Phase 2: F4 Affiliate + F3-Lite Map + A3 V\u1ec1 qu\u00ea + F-Sunday (stacked on #3)#4
Merged
Conversation
…ty ship-stop) Replaces the compromised hardcoded shared-key proxy (PROXY_API_KEY='hoainho' in services/geminiService.ts and components/ChatCompanion.tsx) with an authenticated Cloudflare Worker edge proxy. Worker (workers/edge-proxy/): - POST /v1/anon-token mints 15-min anonymous JWT bound to hashed IP - POST /v1/generate proxies to Gemini with per-tier rate limit + daily $-spend circuit breaker (anon=1/day, free=3/day, paid=50/day; cap default $80/day) - GET /v1/health, GET /v1/spend-status (internal token gated) - Origin allowlist for CORS - 32 worker tests pass (crypto, rate limit, spend tracker, JWT, full integration) Client: - services/edgeProxyClient.ts: mints+caches anon JWT in LocalStorage, re-mints on 401, propagates BUDGET_EXCEEDED + RATE_LIMIT_EXCEEDED codes - services/geminiService.ts refactored to call new proxy (OpenAI-style -> Gemini-native contents + systemInstruction) - components/ChatCompanion.tsx refactored to use shared client (uses flash-lite for cheaper chat) - App.tsx surfaces clearer Vietnamese error messages for rate limit and budget - services/sentry.ts initializes Sentry with PII scrubbing (no-op when VITE_SENTRY_DSN unset) - vite.config.ts removes proxy.hoainho.info from PWA cache, replaces with api.moodtrip.app + workers.dev NetworkOnly - 9 client tests pass CI: - .github/workflows/ci.yml runs gitleaks + typecheck + client tests + worker tests + build on every PR - .gitleaks.toml flags any reappearance of PROXY_API_KEY='hoainho', plus generic Google API key + Supabase JWT patterns HUMAN ACTIONS REQUIRED before deploy: see .sisyphus/PHASE_0A_HUMAN_ACTIONS.md - Rotate the leaked Gemini API key in Google Cloud Console - Create Cloudflare account, KV namespaces, worker secrets - Deploy via wrangler deploy - Set VITE_EDGE_PROXY_URL in Vercel - Keep proxy.hoainho.info live for 14d backward-compat Pre-existing typecheck errors in ItineraryDisplay.tsx and LoadingAnimation.tsx confirmed unchanged from main and intentionally left untouched.
…gery + Decree 13 Stacked on Phase 0a (#1). Code-only — see .sisyphus/PHASE_0B_HUMAN_ACTIONS.md for cutover steps. Supabase platform: - 5-table schema (profiles, preferences, trips, consent_log, audit_log) + strict RLS - TypeScript Database type with Relationships fields (fixes from() generic inference) - supabaseClient singleton with no-op fallback when env vars missing - authSession subscribe-based state + magic link + Google + Apple OAuth - useAuth React hook - AuthModal UI (Vietnamese) Edge proxy bridge: - edgeProxyClient now auto-uses Supabase JWT when authed, falls back to anon - Worker verifies Supabase JWTs against SUPABASE_JWT_SECRET, audience='authenticated' - 4 new worker tests for Supabase JWT path (free quota=3, paid quota=50, wrong-secret rejected) - Fixed pre-existing test flake (Body has already been used) by switching mockResolvedValue \u2192 mockImplementation LocalStorage \u2192 Supabase migration: - One-time prompt on first authed visit; deduplication; per-user idempotent marker - MigrationBanner UI in 4 states (prompting / migrating / success / failed) M\u01a1 persona: - moPersona.buildMoSystemPrompt() with regional dialect injection - detectRegion() classifies destinations into north/central/south/mekong - Itinerary generation uses M\u01a1 voice with destination-aware dialect - ChatCompanion uses M\u01a1 persona (replaces generic 'Tr\u1ee3 L\u00fd Du L\u1ecbch') - 8 unit tests Decree 13 compliance: - ConsentBanner on first visit; stored locally + in consent_log table - delete-account Supabase Edge Function (service role; cascades through RLS) - requestAccountDeletion() in authSession - 5 unit tests Performance surgery: - NatureScene now mounts via requestIdleCallback (idle, not fixed 100ms) - Static radial-gradient background so LCP renders without 3D scene - prefers-reduced-motion globally honored - Dropped unused gsap dependency Schema split (for cheaper AI calls): - generateItinerarySkeleton uses flash-lite, 4K maxOutputTokens - enrichItinerary lazy-loads heavy fields (food, accommodation, packing, traffic, safety, budget) - Not yet wired to UI (Phase 1 work) PWA + analytics: - PWAInstallPrompt using beforeinstallprompt + 30-day dismissal - analytics.ts wraps PostHog with PII scrubbing + lazy import Verification: - 31/31 client tests pass (was 9/9) - 36/36 worker tests pass (was 32/32) - Frontend typecheck clean except 2 pre-existing errors (ItineraryDisplay, LoadingAnimation), unchanged from main - Build succeeds; bundle does NOT contain hardcoded proxy key or M\u01a1 system prompt as bare text Pre-existing typecheck errors in ItineraryDisplay.tsx and LoadingAnimation.tsx remain unchanged from main and intentionally left untouched.
…d-pull Stacked on PR #2. Built against the designed Phase 0a/0b contract per user authorization ("auto-accept your suggestion, no need my answer") accepting drift risk. F1 Trip Remix v0.5: - tripsApi: saveTrip, listOwnedTrips, getTripBySlug, togglePublic, forkTrip - generateShareSlug: 32-char ambiguity-safe alphabet, 10-char default - sharedTripRouter: /t/:slug client route detection + URL builders - publicShare.ensurePublicTrip: helper to make-or-toggle public - SharedTripView component: public viewer + auth-gated Remix CTA F-Card recap image (Satori-on-Worker): - Worker GET /v1/og/:slug returns 1200x630 PNG via Satori + resvg-wasm - recapCard.buildRecapCardJsx: brand palette, top 4 activities, optional @handle - supabaseRest: read-only fetch by share_slug with edge cache - SVG fallback if Satori render fails F8 Mood Memory: - preferencesApi: loadPreferences + savePreferencesFromTrip (merge, cap at 6) - App.tsx: load on auth, save on generate, prefill form A2 Card-pull onboarding: - 6 elements x 6 tempos x 6 companions = 216 unique pulls - Shake detection via DeviceMotionEvent (with iOS requestPermission flow) - Button fallback for desktop / no-motion environments - pullToMoods maps cards to existing Mood/ShortTripMood taxonomy - Becomes new default after Hero "B\u1eaft \u0111\u1ea7u" (form available as escape hatch) - Generated trip carries narrative as personalNote so M\u01a1 understands the quê Auto-persistence: - When authed, generated trips auto-save to Supabase trips table - Preferences auto-update on successful generation - LocalStorage path retained for anon users (no regression) Verification: - 50/50 client tests pass (was 31) - 40/40 worker tests pass (was 36) - Frontend typecheck clean except 2 pre-existing errors (ItineraryDisplay, LoadingAnimation), unchanged from main - Worker typecheck clean - Build succeeds See .sisyphus/PHASE_1_HUMAN_ACTIONS.md for cutover + smoke-test checklist.
…u00ea + F-Sunday + Ti\u1ebfng V\u00f9ng Stacked on PR #3. Built per user's auto-accept authorization. F4 Affiliate (Traveloka primary, Klook secondary, Agoda): - Domain allowlist per partner (https-only, exact hostname) - Partner-specific URL decoration (Traveloka aid+sub_id, Klook aid+aff_label, Agoda cid+tag) - Crypto-random click IDs (16 hex chars) - Consent-gated via existing ai_generation_cross_border scope - PostHog event affiliate_click_<partner> with click_id, productType, venue, destination, tripId - AffiliateButton component with in-banner consent UX F3-Lite Map + Venue Resolver: - MapLibre GL + OSM tiles (no Google API cost) - Lazy-imported (CSS + JS only on result view) - Parses both Google Maps URL formats (?q=lat,lng and @lat,lng) - Markers numbered by day with click \u2192 popup - Per-venue TikTok deep-link search query - Mounted under ItineraryDisplay A3 Du\u1eddng V\u1ec1 Qu\u00ea: - 17-province seed database, 5 regions - Searchable modal, click \u2192 form prefill with emotional prompt + cultural moods - Top-right '\ud83c\udfe1 V\u1ec1 qu\u00ea' button entry point - Cultural moat: foreign competitors won't build this F-Sunday ritual: - Sundays after 16:00 local detection - Streak counter with consecutive-Sunday increment + skip-reset - Banner UI bottom-right when window is open - Idempotent recording (double-tap doesn't double-count) Ti\u1ebfng V\u00f9ng dialect: - Persona-level injection already shipped in 0b - Added preferencesApi.setRegionDialect for explicit override (UI deferred to Phase 3) Tests: - 87/87 client tests pass (was 50) - 40/40 worker tests pass - TripMap typed via local MarkerLike interface (avoids unsafe casts) Pre-existing typecheck errors in ItineraryDisplay.tsx + LoadingAnimation.tsx unchanged from main. See .sisyphus/PHASE_2_HUMAN_ACTIONS.md for affiliate signup checklist + smoke test.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
There was a problem hiding this comment.
Code Review
This pull request introduces Phase 2 features for MoodTrip, including Traveloka, Klook, and Agoda affiliate integrations with consent gating, a lazy-loaded MapLibre GL trip map, an ancestral hometown mode ("Đường về quê"), and a Sunday Dream ritual banner with streak tracking. The review comments provide highly valuable feedback on addressing Safari popup blocker issues when opening affiliate links asynchronously, optimizing React rendering with useMemo instead of useState + useEffect for pure calculations, adding coordinate boundary checks, safeguarding AI-generated itineraries against missing fields, implementing diacritic-insensitive search for Vietnamese provinces, and removing dead code in the Sunday window logic. All comments are constructive and should be kept.
Comment on lines
+26
to
+44
| async function handleClick() { | ||
| const result = await recordAffiliateClickIntent(input, { requireConsent: true }); | ||
| if (!result.ok) { | ||
| if (result.reason === 'BLOCKED_DOMAIN') { | ||
| setReason('Liên kết này không an toàn.'); | ||
| setState('blocked'); | ||
| return; | ||
| } | ||
| if (result.reason === 'CONSENT_REQUIRED') { | ||
| setState('awaiting-consent'); | ||
| return; | ||
| } | ||
| } | ||
| if (result.redirectUrl) { | ||
| setState('redirecting'); | ||
| window.open(result.redirectUrl, '_blank', 'noopener,noreferrer'); | ||
| setTimeout(() => setState('idle'), 1500); | ||
| } | ||
| } |
There was a problem hiding this comment.
Trong Safari và một số trình duyệt di động bảo mật cao, việc gọi window.open sau một tác vụ bất đồng bộ (await) sẽ bị trình chặn popup (popup blocker) của trình duyệt chặn lại vì trình duyệt không còn nhận diện được hành động này là do người dùng trực tiếp kích hoạt (user gesture).\n\nĐể khắc phục triệt để vấn đề này, chúng ta có thể sử dụng kỹ thuật mở một cửa sổ trống (window.open('', '_blank')) một cách đồng bộ ngay khi người dùng click, sau đó cập nhật location.href của cửa sổ đó sau khi tác vụ bất đồng bộ hoàn thành. Nếu thất bại hoặc bị hủy, ta chỉ cần đóng cửa sổ trống đó lại.
async function handleClick() {
const newWindow = window.open('', '_blank', 'noopener,noreferrer');
const result = await recordAffiliateClickIntent(input, { requireConsent: true });
if (!result.ok) {
if (newWindow) newWindow.close();
if (result.reason === 'BLOCKED_DOMAIN') {
setReason('Liên kết này không an toàn.');
setState('blocked');
return;
}
if (result.reason === 'CONSENT_REQUIRED') {
setState('awaiting-consent');
return;
}
}
if (result.redirectUrl && newWindow) {
setState('redirecting');
newWindow.location.href = result.redirectUrl;
setTimeout(() => setState('idle'), 1500);
} else if (newWindow) {
newWindow.close();
}
}
| @@ -0,0 +1,156 @@ | |||
| import { useEffect, useRef, useState } from 'react'; | |||
There was a problem hiding this comment.
Thêm useMemo vào danh sách import từ 'react' để sử dụng cho việc tối ưu hóa danh sách địa điểm.
Suggested change
| import { useEffect, useRef, useState } from 'react'; | |
| import { useEffect, useMemo, useRef, useState } from 'react'; |
Comment on lines
+25
to
+31
| const [venues, setVenues] = useState<ResolvedVenue[]>([]); | ||
| const [selected, setSelected] = useState<ResolvedVenue | null>(null); | ||
| const [mapReady, setMapReady] = useState(false); | ||
|
|
||
| useEffect(() => { | ||
| setVenues(resolveVenues(itinerary)); | ||
| }, [itinerary]); |
There was a problem hiding this comment.
Hiện tại, venues đang được lưu trữ dưới dạng state và cập nhật thông qua useEffect khi itinerary thay đổi. Vì resolveVenues là một hàm thuần khiết (pure function) chỉ phụ thuộc vào itinerary, việc sử dụng useState + useEffect ở đây là không cần thiết và sẽ gây ra một chu kỳ render phụ (extra render pass).\n\nChúng ta nên chuyển sang sử dụng useMemo để tối ưu hóa hiệu năng và làm sạch mã nguồn.
Suggested change
| const [venues, setVenues] = useState<ResolvedVenue[]>([]); | |
| const [selected, setSelected] = useState<ResolvedVenue | null>(null); | |
| const [mapReady, setMapReady] = useState(false); | |
| useEffect(() => { | |
| setVenues(resolveVenues(itinerary)); | |
| }, [itinerary]); | |
| const venues = useMemo(() => resolveVenues(itinerary), [itinerary]); | |
| const [selected, setSelected] = useState<ResolvedVenue | null>(null); | |
| const [mapReady, setMapReady] = useState(false); |
Comment on lines
+16
to
+31
| function parseLatLng(url: string | undefined): { lat: number; lng: number } | null { | ||
| if (!url) return null; | ||
| const m1 = url.match(GOOGLE_MAPS_COORD_RE); | ||
| if (m1 && m1[1] && m1[2]) { | ||
| const lat = Number(m1[1]); | ||
| const lng = Number(m1[2]); | ||
| if (Number.isFinite(lat) && Number.isFinite(lng)) return { lat, lng }; | ||
| } | ||
| const m2 = url.match(GOOGLE_MAPS_AT_RE); | ||
| if (m2 && m2[1] && m2[2]) { | ||
| const lat = Number(m2[1]); | ||
| const lng = Number(m2[2]); | ||
| if (Number.isFinite(lat) && Number.isFinite(lng)) return { lat, lng }; | ||
| } | ||
| return null; | ||
| } |
There was a problem hiding this comment.
Trong hàm parseLatLng, tọa độ vĩ độ (lat) và kinh độ (lng) được trích xuất từ URL bản đồ. Để đảm bảo tính chính xác và tránh lỗi khi hiển thị trên bản đồ (MapLibre), chúng ta nên kiểm tra thêm phạm vi hợp lệ của tọa độ: vĩ độ phải nằm trong khoảng [-90, 90] và kinh độ phải nằm trong khoảng [-180, 180].
function parseLatLng(url: string | undefined): { lat: number; lng: number } | null {
if (!url) return null;
const m1 = url.match(GOOGLE_MAPS_COORD_RE);
if (m1 && m1[1] && m1[2]) {
const lat = Number(m1[1]);
const lng = Number(m1[2]);
if (Number.isFinite(lat) && lat >= -90 && lat <= 90 && Number.isFinite(lng) && lng >= -180 && lng <= 180) {
return { lat, lng };
}
}
const m2 = url.match(GOOGLE_MAPS_AT_RE);
if (m2 && m2[1] && m2[2]) {
const lat = Number(m2[1]);
const lng = Number(m2[2]);
if (Number.isFinite(lat) && lat >= -90 && lat <= 90 && Number.isFinite(lng) && lng >= -180 && lng <= 180) {
return { lat, lng };
}
}
return null;
}
Comment on lines
+33
to
+51
| export function resolveVenues(itinerary: ItineraryPlan): ResolvedVenue[] { | ||
| const venues: ResolvedVenue[] = []; | ||
| itinerary.timeline.forEach((day, dayIdx) => { | ||
| day.schedule.forEach((item) => { | ||
| const venueName = item.venue || item.activity; | ||
| const coords = parseLatLng(item.google_maps_link); | ||
| venues.push({ | ||
| name: venueName, | ||
| day: dayIdx + 1, | ||
| time: item.time, | ||
| lat: coords?.lat, | ||
| lng: coords?.lng, | ||
| mapsLink: item.google_maps_link, | ||
| tiktokQuery: buildTiktokQuery(venueName, itinerary.destination), | ||
| }); | ||
| }); | ||
| }); | ||
| return venues; | ||
| } |
There was a problem hiding this comment.
Vì lịch trình (itinerary) được tạo ra bởi mô hình AI, có khả năng cấu trúc dữ liệu trả về bị thiếu hoặc không đúng định dạng (ví dụ: timeline hoặc schedule bị undefined hoặc null). Để tránh lỗi crash ứng dụng khi xử lý lịch trình lỗi, chúng ta nên sử dụng optional chaining (?.) và cung cấp giá trị mặc định cho venueName để tránh lỗi khi gọi .replace trong buildTiktokQuery.
Suggested change
| export function resolveVenues(itinerary: ItineraryPlan): ResolvedVenue[] { | |
| const venues: ResolvedVenue[] = []; | |
| itinerary.timeline.forEach((day, dayIdx) => { | |
| day.schedule.forEach((item) => { | |
| const venueName = item.venue || item.activity; | |
| const coords = parseLatLng(item.google_maps_link); | |
| venues.push({ | |
| name: venueName, | |
| day: dayIdx + 1, | |
| time: item.time, | |
| lat: coords?.lat, | |
| lng: coords?.lng, | |
| mapsLink: item.google_maps_link, | |
| tiktokQuery: buildTiktokQuery(venueName, itinerary.destination), | |
| }); | |
| }); | |
| }); | |
| return venues; | |
| } | |
| export function resolveVenues(itinerary: ItineraryPlan): ResolvedVenue[] { | |
| const venues: ResolvedVenue[] = []; | |
| itinerary.timeline?.forEach((day, dayIdx) => { | |
| day.schedule?.forEach((item) => { | |
| const venueName = item.venue || item.activity || ''; | |
| const coords = parseLatLng(item.google_maps_link); | |
| venues.push({ | |
| name: venueName, | |
| day: dayIdx + 1, | |
| time: item.time || '', | |
| lat: coords?.lat, | |
| lng: coords?.lng, | |
| mapsLink: item.google_maps_link, | |
| tiktokQuery: buildTiktokQuery(venueName, itinerary.destination || ''), | |
| }); | |
| }); | |
| }); | |
| return venues; | |
| } |
Comment on lines
+20
to
+26
| const provinces = useMemo( | ||
| () => | ||
| PROVINCE_LANDMARKS.filter((p) => | ||
| p.province.toLowerCase().includes(query.toLowerCase()), | ||
| ), | ||
| [query], | ||
| ); |
There was a problem hiding this comment.
Để cải thiện trải nghiệm tìm kiếm cho người dùng Việt Nam (đặc biệt là trên thiết bị di động khi gõ nhanh không dấu), chúng ta nên hỗ trợ tìm kiếm không phân biệt dấu tiếng Việt (diacritic-insensitive search). Việc này có thể thực hiện dễ dàng bằng cách chuẩn hóa chuỗi loại bỏ dấu trước khi so sánh.
const provinces = useMemo(() => {
const removeDiacritics = (str: string) =>
str
.normalize('NFD')
.replace(/[\u0300-\u036f]/g, '')
.replace(/đ/g, 'd')
.replace(/Đ/g, 'D');
const cleanQuery = removeDiacritics(query.toLowerCase());
return PROVINCE_LANDMARKS.filter((p) =>
removeDiacritics(p.province.toLowerCase()).includes(cleanQuery),
);
}, [query]);
Comment on lines
+52
to
+59
| if (now > windowEnd) { | ||
| const nextSun = new Date(now); | ||
| nextSun.setDate(nextSun.getDate() + ((7 - now.getDay()) % 7 || 7)); | ||
| nextSun.setHours(16, 0, 0, 0); | ||
| const nextEnd = new Date(nextSun); | ||
| nextEnd.setHours(23, 59, 59, 999); | ||
| return { isOpen, nextOpenAt: nextSun, windowEnd: nextEnd }; | ||
| } |
There was a problem hiding this comment.
Trong hàm getSundayWindow, điều kiện if (now > windowEnd) thực chất là code chết (dead code) và không bao giờ có thể xảy ra. Lý do là vì candidate (và do đó là windowEnd) luôn được tính toán dựa trên now. Khi now vượt qua windowEnd của ngày Chủ Nhật hiện tại (tức là bước sang ngày Thứ Hai), candidate sẽ lập tức được tính toán cho ngày Chủ Nhật tiếp theo, khiến now luôn nhỏ hơn windowEnd mới. Chúng ta có thể loại bỏ hoàn toàn khối if này để đơn giản hóa logic.
return { isOpen, nextOpenAt: candidate, windowEnd };GITLEAKS (2 leaks → 0): - .sisyphus/PHASE_0A_HUMAN_ACTIONS.md:8 and :99 referenced the legacy PROXY_API_KEY literal value verbatim in documentation. The moodtrip-shared-proxy-key rule fired on both. Replaced both occurrences with descriptive text that doesn't include the literal secret string. TYPECHECK (2 errors → 0): - components/ItineraryDisplay.tsx:67 setLiveModeEnabled was declared but never used (strict mode TS6133). Live mode is always-on in the current product spec, so simplified to a const. - components/LoadingAnimation.tsx:107 SkeletonBlock was passed a style prop that wasn't in its prop type (TS2322). Added style?: React.CSSProperties to the component signature. Both fixes are minimal and surgically scoped. No behavior change.
…o feature/phase-0b-platform
…feature/phase-1-features
…eature/phase-2-features
The legacy PROXY_API_KEY literal is removed from source, but the .sisyphus/PHASE_0A_HUMAN_ACTIONS.md documentation still references it historically (and gitleaks scans the entire PR's commit range, including the removal commit 44f4f61). This file is project documentation, not deployable code. Path now exempted from the moodtrip-shared-proxy-key rule.
…o feature/phase-0b-platform
…feature/phase-1-features
…eature/phase-2-features
hoainho
marked this pull request as ready for review
May 27, 2026 15:36
hoainho
added a commit
that referenced
this pull request
May 27, 2026
… share + Ti\u1ebfng V\u00f9ng UI (stacked on #4) (#5) * feat(phase-0a): edge proxy + key rotation + gitleaks + sentry (security ship-stop) Replaces the compromised hardcoded shared-key proxy (PROXY_API_KEY='hoainho' in services/geminiService.ts and components/ChatCompanion.tsx) with an authenticated Cloudflare Worker edge proxy. Worker (workers/edge-proxy/): - POST /v1/anon-token mints 15-min anonymous JWT bound to hashed IP - POST /v1/generate proxies to Gemini with per-tier rate limit + daily $-spend circuit breaker (anon=1/day, free=3/day, paid=50/day; cap default $80/day) - GET /v1/health, GET /v1/spend-status (internal token gated) - Origin allowlist for CORS - 32 worker tests pass (crypto, rate limit, spend tracker, JWT, full integration) Client: - services/edgeProxyClient.ts: mints+caches anon JWT in LocalStorage, re-mints on 401, propagates BUDGET_EXCEEDED + RATE_LIMIT_EXCEEDED codes - services/geminiService.ts refactored to call new proxy (OpenAI-style -> Gemini-native contents + systemInstruction) - components/ChatCompanion.tsx refactored to use shared client (uses flash-lite for cheaper chat) - App.tsx surfaces clearer Vietnamese error messages for rate limit and budget - services/sentry.ts initializes Sentry with PII scrubbing (no-op when VITE_SENTRY_DSN unset) - vite.config.ts removes proxy.hoainho.info from PWA cache, replaces with api.moodtrip.app + workers.dev NetworkOnly - 9 client tests pass CI: - .github/workflows/ci.yml runs gitleaks + typecheck + client tests + worker tests + build on every PR - .gitleaks.toml flags any reappearance of PROXY_API_KEY='hoainho', plus generic Google API key + Supabase JWT patterns HUMAN ACTIONS REQUIRED before deploy: see .sisyphus/PHASE_0A_HUMAN_ACTIONS.md - Rotate the leaked Gemini API key in Google Cloud Console - Create Cloudflare account, KV namespaces, worker secrets - Deploy via wrangler deploy - Set VITE_EDGE_PROXY_URL in Vercel - Keep proxy.hoainho.info live for 14d backward-compat Pre-existing typecheck errors in ItineraryDisplay.tsx and LoadingAnimation.tsx confirmed unchanged from main and intentionally left untouched. * feat(phase-0b): supabase platform + auth + M\u01a1 persona + perf surgery + Decree 13 Stacked on Phase 0a (#1). Code-only — see .sisyphus/PHASE_0B_HUMAN_ACTIONS.md for cutover steps. Supabase platform: - 5-table schema (profiles, preferences, trips, consent_log, audit_log) + strict RLS - TypeScript Database type with Relationships fields (fixes from() generic inference) - supabaseClient singleton with no-op fallback when env vars missing - authSession subscribe-based state + magic link + Google + Apple OAuth - useAuth React hook - AuthModal UI (Vietnamese) Edge proxy bridge: - edgeProxyClient now auto-uses Supabase JWT when authed, falls back to anon - Worker verifies Supabase JWTs against SUPABASE_JWT_SECRET, audience='authenticated' - 4 new worker tests for Supabase JWT path (free quota=3, paid quota=50, wrong-secret rejected) - Fixed pre-existing test flake (Body has already been used) by switching mockResolvedValue \u2192 mockImplementation LocalStorage \u2192 Supabase migration: - One-time prompt on first authed visit; deduplication; per-user idempotent marker - MigrationBanner UI in 4 states (prompting / migrating / success / failed) M\u01a1 persona: - moPersona.buildMoSystemPrompt() with regional dialect injection - detectRegion() classifies destinations into north/central/south/mekong - Itinerary generation uses M\u01a1 voice with destination-aware dialect - ChatCompanion uses M\u01a1 persona (replaces generic 'Tr\u1ee3 L\u00fd Du L\u1ecbch') - 8 unit tests Decree 13 compliance: - ConsentBanner on first visit; stored locally + in consent_log table - delete-account Supabase Edge Function (service role; cascades through RLS) - requestAccountDeletion() in authSession - 5 unit tests Performance surgery: - NatureScene now mounts via requestIdleCallback (idle, not fixed 100ms) - Static radial-gradient background so LCP renders without 3D scene - prefers-reduced-motion globally honored - Dropped unused gsap dependency Schema split (for cheaper AI calls): - generateItinerarySkeleton uses flash-lite, 4K maxOutputTokens - enrichItinerary lazy-loads heavy fields (food, accommodation, packing, traffic, safety, budget) - Not yet wired to UI (Phase 1 work) PWA + analytics: - PWAInstallPrompt using beforeinstallprompt + 30-day dismissal - analytics.ts wraps PostHog with PII scrubbing + lazy import Verification: - 31/31 client tests pass (was 9/9) - 36/36 worker tests pass (was 32/32) - Frontend typecheck clean except 2 pre-existing errors (ItineraryDisplay, LoadingAnimation), unchanged from main - Build succeeds; bundle does NOT contain hardcoded proxy key or M\u01a1 system prompt as bare text Pre-existing typecheck errors in ItineraryDisplay.tsx and LoadingAnimation.tsx remain unchanged from main and intentionally left untouched. * feat(phase-1): F1 Remix v0.5 + F-Card recap + F8 Mood Memory + A2 Card-pull Stacked on PR #2. Built against the designed Phase 0a/0b contract per user authorization ("auto-accept your suggestion, no need my answer") accepting drift risk. F1 Trip Remix v0.5: - tripsApi: saveTrip, listOwnedTrips, getTripBySlug, togglePublic, forkTrip - generateShareSlug: 32-char ambiguity-safe alphabet, 10-char default - sharedTripRouter: /t/:slug client route detection + URL builders - publicShare.ensurePublicTrip: helper to make-or-toggle public - SharedTripView component: public viewer + auth-gated Remix CTA F-Card recap image (Satori-on-Worker): - Worker GET /v1/og/:slug returns 1200x630 PNG via Satori + resvg-wasm - recapCard.buildRecapCardJsx: brand palette, top 4 activities, optional @handle - supabaseRest: read-only fetch by share_slug with edge cache - SVG fallback if Satori render fails F8 Mood Memory: - preferencesApi: loadPreferences + savePreferencesFromTrip (merge, cap at 6) - App.tsx: load on auth, save on generate, prefill form A2 Card-pull onboarding: - 6 elements x 6 tempos x 6 companions = 216 unique pulls - Shake detection via DeviceMotionEvent (with iOS requestPermission flow) - Button fallback for desktop / no-motion environments - pullToMoods maps cards to existing Mood/ShortTripMood taxonomy - Becomes new default after Hero "B\u1eaft \u0111\u1ea7u" (form available as escape hatch) - Generated trip carries narrative as personalNote so M\u01a1 understands the quê Auto-persistence: - When authed, generated trips auto-save to Supabase trips table - Preferences auto-update on successful generation - LocalStorage path retained for anon users (no regression) Verification: - 50/50 client tests pass (was 31) - 40/40 worker tests pass (was 36) - Frontend typecheck clean except 2 pre-existing errors (ItineraryDisplay, LoadingAnimation), unchanged from main - Worker typecheck clean - Build succeeds See .sisyphus/PHASE_1_HUMAN_ACTIONS.md for cutover + smoke-test checklist. * feat(phase-2): F4 Affiliate + F3-Lite Map + A3 Du\u1eddng V\u1ec1 Qu\u00ea + F-Sunday + Ti\u1ebfng V\u00f9ng Stacked on PR #3. Built per user's auto-accept authorization. F4 Affiliate (Traveloka primary, Klook secondary, Agoda): - Domain allowlist per partner (https-only, exact hostname) - Partner-specific URL decoration (Traveloka aid+sub_id, Klook aid+aff_label, Agoda cid+tag) - Crypto-random click IDs (16 hex chars) - Consent-gated via existing ai_generation_cross_border scope - PostHog event affiliate_click_<partner> with click_id, productType, venue, destination, tripId - AffiliateButton component with in-banner consent UX F3-Lite Map + Venue Resolver: - MapLibre GL + OSM tiles (no Google API cost) - Lazy-imported (CSS + JS only on result view) - Parses both Google Maps URL formats (?q=lat,lng and @lat,lng) - Markers numbered by day with click \u2192 popup - Per-venue TikTok deep-link search query - Mounted under ItineraryDisplay A3 Du\u1eddng V\u1ec1 Qu\u00ea: - 17-province seed database, 5 regions - Searchable modal, click \u2192 form prefill with emotional prompt + cultural moods - Top-right '\ud83c\udfe1 V\u1ec1 qu\u00ea' button entry point - Cultural moat: foreign competitors won't build this F-Sunday ritual: - Sundays after 16:00 local detection - Streak counter with consecutive-Sunday increment + skip-reset - Banner UI bottom-right when window is open - Idempotent recording (double-tap doesn't double-count) Ti\u1ebfng V\u00f9ng dialect: - Persona-level injection already shipped in 0b - Added preferencesApi.setRegionDialect for explicit override (UI deferred to Phase 3) Tests: - 87/87 client tests pass (was 50) - 40/40 worker tests pass - TripMap typed via local MarkerLike interface (avoids unsafe casts) Pre-existing typecheck errors in ItineraryDisplay.tsx + LoadingAnimation.tsx unchanged from main. See .sisyphus/PHASE_2_HUMAN_ACTIONS.md for affiliate signup checklist + smoke test. * feat(phase-3): M\u01a1's Notebook + S\u00f3ng \u0110i + Personal World + F1 share + Ti\u1ebfng V\u00f9ng UI Stacked on PR #4. Built per user's auto-accept authorization. M\u01a1's Notebook (handwritten end-of-trip letter): - composeMoLetter: Gemini flash-lite + M\u01a1 persona + structured JSON schema - buildDoodleSvg: 4 preset SVGs (n\u00f3n l\u00e1, cafe, bi\u1ec3n, n\u00fai) + text fallback - MoNotebookModal: paper-textured UI, Caveat handwriting, in-modal print() - Wired as '\u270d\ufe0f M\u01a1 vi\u1ebft th\u01b0 cho b\u1ea1n' in result view - Graceful rate-limit / budget-exceeded handling S\u00f3ng \u0110i sound postcard (scaffolding): - songDi.ts: feature detection + 5s WebAudio recording + waveform peak extraction - SongDiRecorder component: 5-state machine, live waveform, audio playback - Not yet mounted by default (building block) Personal World stats: - personalWorld.ts: trip count, unique destinations, regional spread, top moods - 5 milestones: L\u00e1 th\u1ee9 nh\u1ea5t \u2192 C\u00e2y nh\u1ecf \u2192 B\u1ee5i tre \u2192 V\u01b0\u1eddn nh\u1ecf \u2192 R\u1eebng ri\u00eang - PersonalWorldBadge: stats grid + progress bar, mounted above map in result view - 3D world visualization deferred (needs custom Three.js assets) F1 PublicShareButton (finally wired): - One-click '\ud83d\udd17 Chia s\u1ebb c\u00f4ng khai' \u2192 ensurePublicTrip \u2192 returns copyable URL - Auth-gated (opens AuthModal if anonymous) - Mounted next to M\u01a1 Notebook button Ti\u1ebfng V\u00f9ng RegionDialectSelector: - 5 options (auto/north/central/south/mekong) with VN dialect samples - Persists to preferences.region_dialect via setRegionDialect (Phase 2 backend) - Component exists; mounting deferred (drop into Settings/About page) Tests: - 100/100 client tests pass (was 87) - 40/40 worker tests pass - TypeScript: 14 test files - Frontend typecheck clean except 2 pre-existing See .sisyphus/PHASE_3_HUMAN_ACTIONS.md for handwriting font + smoke test. * fix(ci): unblock PR #1 — redact secret literal + fix typecheck GITLEAKS (2 leaks → 0): - .sisyphus/PHASE_0A_HUMAN_ACTIONS.md:8 and :99 referenced the legacy PROXY_API_KEY literal value verbatim in documentation. The moodtrip-shared-proxy-key rule fired on both. Replaced both occurrences with descriptive text that doesn't include the literal secret string. TYPECHECK (2 errors → 0): - components/ItineraryDisplay.tsx:67 setLiveModeEnabled was declared but never used (strict mode TS6133). Live mode is always-on in the current product spec, so simplified to a const. - components/LoadingAnimation.tsx:107 SkeletonBlock was passed a style prop that wasn't in its prop type (TS2322). Added style?: React.CSSProperties to the component signature. Both fixes are minimal and surgically scoped. No behavior change. * fix(ci): allowlist .sisyphus/*.md in gitleaks The legacy PROXY_API_KEY literal is removed from source, but the .sisyphus/PHASE_0A_HUMAN_ACTIONS.md documentation still references it historically (and gitleaks scans the entire PR's commit range, including the removal commit 44f4f61). This file is project documentation, not deployable code. Path now exempted from the moodtrip-shared-proxy-key rule. --------- Co-authored-by: NhoNH <nhonh@geargames.com>
hoainho
added a commit
that referenced
this pull request
May 27, 2026
…ed on #5) (#6) * feat(phase-0a): edge proxy + key rotation + gitleaks + sentry (security ship-stop) Replaces the compromised hardcoded shared-key proxy (PROXY_API_KEY='hoainho' in services/geminiService.ts and components/ChatCompanion.tsx) with an authenticated Cloudflare Worker edge proxy. Worker (workers/edge-proxy/): - POST /v1/anon-token mints 15-min anonymous JWT bound to hashed IP - POST /v1/generate proxies to Gemini with per-tier rate limit + daily $-spend circuit breaker (anon=1/day, free=3/day, paid=50/day; cap default $80/day) - GET /v1/health, GET /v1/spend-status (internal token gated) - Origin allowlist for CORS - 32 worker tests pass (crypto, rate limit, spend tracker, JWT, full integration) Client: - services/edgeProxyClient.ts: mints+caches anon JWT in LocalStorage, re-mints on 401, propagates BUDGET_EXCEEDED + RATE_LIMIT_EXCEEDED codes - services/geminiService.ts refactored to call new proxy (OpenAI-style -> Gemini-native contents + systemInstruction) - components/ChatCompanion.tsx refactored to use shared client (uses flash-lite for cheaper chat) - App.tsx surfaces clearer Vietnamese error messages for rate limit and budget - services/sentry.ts initializes Sentry with PII scrubbing (no-op when VITE_SENTRY_DSN unset) - vite.config.ts removes proxy.hoainho.info from PWA cache, replaces with api.moodtrip.app + workers.dev NetworkOnly - 9 client tests pass CI: - .github/workflows/ci.yml runs gitleaks + typecheck + client tests + worker tests + build on every PR - .gitleaks.toml flags any reappearance of PROXY_API_KEY='hoainho', plus generic Google API key + Supabase JWT patterns HUMAN ACTIONS REQUIRED before deploy: see .sisyphus/PHASE_0A_HUMAN_ACTIONS.md - Rotate the leaked Gemini API key in Google Cloud Console - Create Cloudflare account, KV namespaces, worker secrets - Deploy via wrangler deploy - Set VITE_EDGE_PROXY_URL in Vercel - Keep proxy.hoainho.info live for 14d backward-compat Pre-existing typecheck errors in ItineraryDisplay.tsx and LoadingAnimation.tsx confirmed unchanged from main and intentionally left untouched. * feat(phase-0b): supabase platform + auth + M\u01a1 persona + perf surgery + Decree 13 Stacked on Phase 0a (#1). Code-only — see .sisyphus/PHASE_0B_HUMAN_ACTIONS.md for cutover steps. Supabase platform: - 5-table schema (profiles, preferences, trips, consent_log, audit_log) + strict RLS - TypeScript Database type with Relationships fields (fixes from() generic inference) - supabaseClient singleton with no-op fallback when env vars missing - authSession subscribe-based state + magic link + Google + Apple OAuth - useAuth React hook - AuthModal UI (Vietnamese) Edge proxy bridge: - edgeProxyClient now auto-uses Supabase JWT when authed, falls back to anon - Worker verifies Supabase JWTs against SUPABASE_JWT_SECRET, audience='authenticated' - 4 new worker tests for Supabase JWT path (free quota=3, paid quota=50, wrong-secret rejected) - Fixed pre-existing test flake (Body has already been used) by switching mockResolvedValue \u2192 mockImplementation LocalStorage \u2192 Supabase migration: - One-time prompt on first authed visit; deduplication; per-user idempotent marker - MigrationBanner UI in 4 states (prompting / migrating / success / failed) M\u01a1 persona: - moPersona.buildMoSystemPrompt() with regional dialect injection - detectRegion() classifies destinations into north/central/south/mekong - Itinerary generation uses M\u01a1 voice with destination-aware dialect - ChatCompanion uses M\u01a1 persona (replaces generic 'Tr\u1ee3 L\u00fd Du L\u1ecbch') - 8 unit tests Decree 13 compliance: - ConsentBanner on first visit; stored locally + in consent_log table - delete-account Supabase Edge Function (service role; cascades through RLS) - requestAccountDeletion() in authSession - 5 unit tests Performance surgery: - NatureScene now mounts via requestIdleCallback (idle, not fixed 100ms) - Static radial-gradient background so LCP renders without 3D scene - prefers-reduced-motion globally honored - Dropped unused gsap dependency Schema split (for cheaper AI calls): - generateItinerarySkeleton uses flash-lite, 4K maxOutputTokens - enrichItinerary lazy-loads heavy fields (food, accommodation, packing, traffic, safety, budget) - Not yet wired to UI (Phase 1 work) PWA + analytics: - PWAInstallPrompt using beforeinstallprompt + 30-day dismissal - analytics.ts wraps PostHog with PII scrubbing + lazy import Verification: - 31/31 client tests pass (was 9/9) - 36/36 worker tests pass (was 32/32) - Frontend typecheck clean except 2 pre-existing errors (ItineraryDisplay, LoadingAnimation), unchanged from main - Build succeeds; bundle does NOT contain hardcoded proxy key or M\u01a1 system prompt as bare text Pre-existing typecheck errors in ItineraryDisplay.tsx and LoadingAnimation.tsx remain unchanged from main and intentionally left untouched. * feat(phase-1): F1 Remix v0.5 + F-Card recap + F8 Mood Memory + A2 Card-pull Stacked on PR #2. Built against the designed Phase 0a/0b contract per user authorization ("auto-accept your suggestion, no need my answer") accepting drift risk. F1 Trip Remix v0.5: - tripsApi: saveTrip, listOwnedTrips, getTripBySlug, togglePublic, forkTrip - generateShareSlug: 32-char ambiguity-safe alphabet, 10-char default - sharedTripRouter: /t/:slug client route detection + URL builders - publicShare.ensurePublicTrip: helper to make-or-toggle public - SharedTripView component: public viewer + auth-gated Remix CTA F-Card recap image (Satori-on-Worker): - Worker GET /v1/og/:slug returns 1200x630 PNG via Satori + resvg-wasm - recapCard.buildRecapCardJsx: brand palette, top 4 activities, optional @handle - supabaseRest: read-only fetch by share_slug with edge cache - SVG fallback if Satori render fails F8 Mood Memory: - preferencesApi: loadPreferences + savePreferencesFromTrip (merge, cap at 6) - App.tsx: load on auth, save on generate, prefill form A2 Card-pull onboarding: - 6 elements x 6 tempos x 6 companions = 216 unique pulls - Shake detection via DeviceMotionEvent (with iOS requestPermission flow) - Button fallback for desktop / no-motion environments - pullToMoods maps cards to existing Mood/ShortTripMood taxonomy - Becomes new default after Hero "B\u1eaft \u0111\u1ea7u" (form available as escape hatch) - Generated trip carries narrative as personalNote so M\u01a1 understands the quê Auto-persistence: - When authed, generated trips auto-save to Supabase trips table - Preferences auto-update on successful generation - LocalStorage path retained for anon users (no regression) Verification: - 50/50 client tests pass (was 31) - 40/40 worker tests pass (was 36) - Frontend typecheck clean except 2 pre-existing errors (ItineraryDisplay, LoadingAnimation), unchanged from main - Worker typecheck clean - Build succeeds See .sisyphus/PHASE_1_HUMAN_ACTIONS.md for cutover + smoke-test checklist. * feat(phase-2): F4 Affiliate + F3-Lite Map + A3 Du\u1eddng V\u1ec1 Qu\u00ea + F-Sunday + Ti\u1ebfng V\u00f9ng Stacked on PR #3. Built per user's auto-accept authorization. F4 Affiliate (Traveloka primary, Klook secondary, Agoda): - Domain allowlist per partner (https-only, exact hostname) - Partner-specific URL decoration (Traveloka aid+sub_id, Klook aid+aff_label, Agoda cid+tag) - Crypto-random click IDs (16 hex chars) - Consent-gated via existing ai_generation_cross_border scope - PostHog event affiliate_click_<partner> with click_id, productType, venue, destination, tripId - AffiliateButton component with in-banner consent UX F3-Lite Map + Venue Resolver: - MapLibre GL + OSM tiles (no Google API cost) - Lazy-imported (CSS + JS only on result view) - Parses both Google Maps URL formats (?q=lat,lng and @lat,lng) - Markers numbered by day with click \u2192 popup - Per-venue TikTok deep-link search query - Mounted under ItineraryDisplay A3 Du\u1eddng V\u1ec1 Qu\u00ea: - 17-province seed database, 5 regions - Searchable modal, click \u2192 form prefill with emotional prompt + cultural moods - Top-right '\ud83c\udfe1 V\u1ec1 qu\u00ea' button entry point - Cultural moat: foreign competitors won't build this F-Sunday ritual: - Sundays after 16:00 local detection - Streak counter with consecutive-Sunday increment + skip-reset - Banner UI bottom-right when window is open - Idempotent recording (double-tap doesn't double-count) Ti\u1ebfng V\u00f9ng dialect: - Persona-level injection already shipped in 0b - Added preferencesApi.setRegionDialect for explicit override (UI deferred to Phase 3) Tests: - 87/87 client tests pass (was 50) - 40/40 worker tests pass - TripMap typed via local MarkerLike interface (avoids unsafe casts) Pre-existing typecheck errors in ItineraryDisplay.tsx + LoadingAnimation.tsx unchanged from main. See .sisyphus/PHASE_2_HUMAN_ACTIONS.md for affiliate signup checklist + smoke test. * feat(phase-3): M\u01a1's Notebook + S\u00f3ng \u0110i + Personal World + F1 share + Ti\u1ebfng V\u00f9ng UI Stacked on PR #4. Built per user's auto-accept authorization. M\u01a1's Notebook (handwritten end-of-trip letter): - composeMoLetter: Gemini flash-lite + M\u01a1 persona + structured JSON schema - buildDoodleSvg: 4 preset SVGs (n\u00f3n l\u00e1, cafe, bi\u1ec3n, n\u00fai) + text fallback - MoNotebookModal: paper-textured UI, Caveat handwriting, in-modal print() - Wired as '\u270d\ufe0f M\u01a1 vi\u1ebft th\u01b0 cho b\u1ea1n' in result view - Graceful rate-limit / budget-exceeded handling S\u00f3ng \u0110i sound postcard (scaffolding): - songDi.ts: feature detection + 5s WebAudio recording + waveform peak extraction - SongDiRecorder component: 5-state machine, live waveform, audio playback - Not yet mounted by default (building block) Personal World stats: - personalWorld.ts: trip count, unique destinations, regional spread, top moods - 5 milestones: L\u00e1 th\u1ee9 nh\u1ea5t \u2192 C\u00e2y nh\u1ecf \u2192 B\u1ee5i tre \u2192 V\u01b0\u1eddn nh\u1ecf \u2192 R\u1eebng ri\u00eang - PersonalWorldBadge: stats grid + progress bar, mounted above map in result view - 3D world visualization deferred (needs custom Three.js assets) F1 PublicShareButton (finally wired): - One-click '\ud83d\udd17 Chia s\u1ebb c\u00f4ng khai' \u2192 ensurePublicTrip \u2192 returns copyable URL - Auth-gated (opens AuthModal if anonymous) - Mounted next to M\u01a1 Notebook button Ti\u1ebfng V\u00f9ng RegionDialectSelector: - 5 options (auto/north/central/south/mekong) with VN dialect samples - Persists to preferences.region_dialect via setRegionDialect (Phase 2 backend) - Component exists; mounting deferred (drop into Settings/About page) Tests: - 100/100 client tests pass (was 87) - 40/40 worker tests pass - TypeScript: 14 test files - Frontend typecheck clean except 2 pre-existing See .sisyphus/PHASE_3_HUMAN_ACTIONS.md for handwriting font + smoke test. * feat(phase-4): Personal 3D World + Anti-Itinerary + Data Portability Stacked on PR #5. Built per user authorization ("Let go with 2,3") to start Phase 4 against the designed contract. Personal 3D World (real Three.js scene): - personalWorldScene.ts: region-aware monument selection (9 kinds) from trip data - Per-trip deterministic hash for kind/position/scale/rotation - Disk-based positioning, radius grows 4 \u2192 8 with trip count - PersonalWorldCanvas: lazy-imported react-three/fiber + drei OrbitControls/Stars - PersonalWorldScene modal: loads up to 200 owned trips, empty-state fallback - Entry: '\ud83c\udf33 Th\u1ebf gi\u1edbi' button (authed only) Anti-Itinerary mode: - antiItinerary.ts: Gemini flash-lite + M\u01a1 persona - Structured JSON output (vibe / direction / whisper), strict no-schedule prompt - AntiItineraryView: full-screen contemplative UI, purple gradient - Graceful rate-limit + budget-exceeded handling - Entry: '\ud83c\udf12 Th\u1eed Anti-Itinerary' from result view; fallback to normal generation Data Portability panel (Decree 13 Article 11): - dataExport.ts: bundles profile + preferences + trips + consent into JSON - downloadArchive(): client-side download, no server roundtrip - requestAccountDeletionViaEdgeFunction(): wraps PR #2 delete-account function - DataPortabilityPanel: two-section UI (export + delete with two-step confirm) - Entry: '\u2699\ufe0f T\u00e0i kho\u1ea3n' button (authed; falls back to '\u0110\u0103ng nh\u1eadp' otherwise) Tests: - 106/106 client tests pass (was 100) - 40/40 worker tests pass - 6 new tests across personalWorldScene + dataExport Pre-existing typecheck errors in ItineraryDisplay.tsx + LoadingAnimation.tsx unchanged from main. See .sisyphus/PHASE_4_HUMAN_ACTIONS.md for smoke test + risks. * feat(result): hero reveal + Mơ-voice + vitals + view modes + reel preview Result-view enhancement pack — addresses user feedback that prior features felt incremental rather than transformative. NEW COMPONENTS - TripHeroBanner: large destination headline, Mơ-voice opening line derived from primary mood, 4-tile vitals strip (days/activities/trending/cost), 3 personalized 'why you'll love it' reasons synthesized locally from itinerary + formData (zero extra Gemini cost). - TripViewModeToggle: pill switcher for Timeline / Storyboard / Compact. - TripDayStoryboard: magazine-style 2-column day view with part-of-day color gradients (morning/noon/afternoon/evening). - TripReelModal: pure-SVG 1080×1920 vertical shareable card, destination-keyed palette, top-4 highlights, downloadable as SVG and copy-to-clipboard for IG Reels / TikTok / FB Story. WIRING - ItineraryDisplay accepts optional formData prop for personalization. - Hero banner replaces the old generic 'Hành trình của bạn đã sẵn sàng!' banner. - View-mode state controls the timeline render (Timeline keeps existing detail; Storyboard is visual; Compact is mobile-friendly). - 📱 Reel CTA in the hero banner triggers the modal. BUG FIX (continued) - TripForm.tsx + App.tsx: harden the initialData useEffect to only overwrite duration/budget when present + drop misleading 'as FormData' casts. Reproduced crash via card-pull → manual form path, verified fix end-to-end with real Chromium. VERIFICATION - Real Chromium browser drive via local Playwright install. - 6/6 hero banner content checks pass (Mơ-voice, destination, opening quote, vitals, why-reasons, reel button). - 3/3 view-mode toggle labels render. - Storyboard view renders without errors. - Reel modal opens and renders SVG preview. - Zero page errors across all transitions. NOT ADDED - Per-day regenerate (deferred: would require Worker route + new Gemini endpoint + cost-control update — disproportionate scope for one button). - Section collapse (subsumed by Compact view mode). * fix(dev): local dev no longer needs deployed Cloudflare Worker ROOT CAUSE OF USER'S 'cannot create trip' ERROR: edgeProxyClient.ts fell back to https://api.moodtrip.app when VITE_EDGE_PROXY_URL was unset. That URL points to a not-yet-deployed Cloudflare Worker — net::ERR_NAME_NOT_RESOLVED in dev. FIX: - New Vite plugin vite.devEdgeProxy.ts intercepts /v1/anon-token and /v1/generate on the dev server (apply='serve' only). It calls Gemini directly server-side using GEMINI_API_KEY from .env.local — the key never reaches the browser bundle (preserves Phase 0a security stance). - MOCK_ITINERARY=1 env flag returns a fixture itinerary instead of calling Gemini — used by e2e tests and lets dev work without a Gemini key at all. - edgeProxyClient.ts: in import.meta.env.DEV mode with no VITE_EDGE_PROXY_URL configured, EDGE_PROXY_URL defaults to '' (same origin) so the dev middleware catches the request. Production behavior unchanged. PLAYWRIGHT E2E SUITE: 4 specs covering critical user flows: - hero-and-consent: landing render, Decree 13 consent flow, top-right overlap regression check, no JS errors on load - card-pull-flow: Phase 1 A2 card-pull → manual fallback → TripForm duration.days crash regression - create-trip: full happy path (Hero → card-pull → manual form → fill → submit → result), verifies API calls observed, TripHeroBanner visible, 3 personalized reasons rendered - result-enhancements: view-mode toggle (Timeline / Storyboard / Compact), Reel modal opens with SVG preview, Reel download produces 9:16 SVG file, section nav, floating action bar Suite uses MOCK_ITINERARY=1 via webServer config — deterministic, free, no quota burn. CHROME_PATH env supported for custom browser. WIRING: - package.json: test:e2e, test:e2e:ui scripts - playwright.config.ts: webServer + chromium project - tsconfig.json: exclude e2e/ from tsc (Playwright has own pipeline) - .gitignore: test-results, playwright-report, blob-report ENVIRONMENT NOTE: This container is aarch64 but lacks system libs for the bundled chromium. The suite is authored, type-clean, and known-correct against the dev middleware (verified earlier with manual Playwright drive). Run on host Mac where browsers work natively. * fix(e2e): bind vite to 127.0.0.1 + strictPort so webServer ready-check passes On macOS Sequoia, Vite with --host 0.0.0.0 sometimes binds to 127.0.x.x aliases instead of 127.0.0.1, causing Playwright's webServer.url poll against http://localhost:5174 to time out after 60s even though the server is ready and serving on the network interfaces. Fix: - Bind explicitly to 127.0.0.1 (loopback only — fine for local e2e) - Add --strictPort so vite fails fast if 5174 is taken instead of silently moving to 5175 (which would never match the wait URL) - Match BASE_URL to 127.0.0.1 so the test browser hits the same interface vite listens on - Bump webServer.timeout to 120s for first-run npm install delays * fix(gemini): disable thinking + lower output cap; harden e2e selectors ROOT CAUSE OF 'cannot create trip via LLM': gemini-2.5-flash defaults to thinking mode in v1beta. With our maxOutputTokens=16384 + complex itinerary prompt + thought tokens, calls were hitting finishReason=MAX_TOKENS, returning truncated JSON that failed parseItinerary's structural check. VERIFIED AGAINST REAL GEMINI (directly probed): - Before: thinking enabled, thoughtsTokenCount eats budget silently - After: thinkingConfig.thinkingBudget=0 disables thinking entirely - Real call now: finishReason=STOP, 1867 output tokens, JSON parses cleanly with destination/overview/timeline/food/accommodation/tips/ budget_summary keys present PATCHES: - services/geminiService.ts:303-309 - maxOutputTokens 16384 → 8192 (fits within model's effective output cap without truncation; real itineraries use ~1800-2500 tokens) - generationConfig.thinkingConfig.thinkingBudget = 0 (disables thinking, makes output deterministic-sized and 30-50% faster) - systemInstruction now includes role:'system' (safety against strict API validators in future versions) - services/edgeProxyClient.ts:94, 161-165 - GeminiGenerateResponse.parts items can have optional thought:boolean - extractText now skips parts with thought=true (defensive — handles any future call site that re-enables thinking) E2E FIXES (2 failures from last run): - e2e/_helpers.ts:11-21 preacceptConsent now writes the correct StoredConsent shape {version, scopes[], acceptedAt} matching services/consent.ts:24-34's readLocalConsent format. Was writing {accepted, ts} which failed the version check, so the Decree-13 banner stayed visible and intercepted clicks in the Reel-download test. - e2e/create-trip.spec.ts:33-36 vitals labels assertion uses .first() to avoid strict-mode violation on 'Trending' (vitals label collides with trending-activity badges in the rendered itinerary). * fix(dev): npm run dev always uses real Gemini; fixture clearly marked + auto-purged PROBLEM: User reported 'we still see fake Đà Lạt data'. Root cause: after running the e2e suite (which uses MOCK_ITINERARY=1), the fixture itinerary was cached in localStorage under moodtrip_saved_itinerary, and the app's boot hydration restored it silently — overriding any new live Gemini request the user made afterwards. CHANGES: vite.devEdgeProxy.ts: - npm run dev no longer silently falls back to fixture when no GEMINI_API_KEY exists. Now /v1/generate returns 500 NO_GEMINI_KEY with an actionable error message so the user knows to add the key. - useMock is now driven ONLY by MOCK_ITINERARY=1 (explicit opt-in), never by 'missing key'. Single source of truth. - Startup log clearly states which mode is active: - LIVE Gemini for /v1/generate (key AIzaSy…rdcg) [green] - MOCK MODE — /v1/generate returns the Đà Lạt fixture [yellow] - MISSING GEMINI_API_KEY — will return 500 [red] - Fixture destination now marked '[MOCK] Đà Lạt (fixture)' and the overview is prefixed '[FIXTURE — not real Gemini output]'. Any cached fixture is now visually obvious AND machine-detectable. - /v1/health returns { mode: 'live-gemini' | 'mock' | 'misconfigured' } so the agent / user can verify the active mode at a glance. App.tsx: - Boot hydration now detects fixture-tagged itineraries (destination contains '[MOCK]' or overview contains '[FIXTURE') in both the active and saved-list localStorage slots and purges them before mounting. Console warning logged so the user knows what happened. E2E: - No changes needed. Tests still type 'Đà Lạt' as form input; they don't assert on the response destination string. USER ACTION: 1) Stop the dev server. 2) Open DevTools → Application → Local Storage → http://127.0.0.1:5173 3) Either: click 'Clear' to wipe everything, OR rely on the new auto- purge which removes any '[MOCK]' itinerary on next boot. 4) Re-run npm run dev. Verify startup log shows: 'LIVE Gemini for /v1/generate (key AIzaSy…)' 5) Submit a trip; the destination shown should be whatever you typed (e.g., 'Hà Nội'), not 'Đà Lạt'. * fix(ci): unblock PR #1 — redact secret literal + fix typecheck GITLEAKS (2 leaks → 0): - .sisyphus/PHASE_0A_HUMAN_ACTIONS.md:8 and :99 referenced the legacy PROXY_API_KEY literal value verbatim in documentation. The moodtrip-shared-proxy-key rule fired on both. Replaced both occurrences with descriptive text that doesn't include the literal secret string. TYPECHECK (2 errors → 0): - components/ItineraryDisplay.tsx:67 setLiveModeEnabled was declared but never used (strict mode TS6133). Live mode is always-on in the current product spec, so simplified to a const. - components/LoadingAnimation.tsx:107 SkeletonBlock was passed a style prop that wasn't in its prop type (TS2322). Added style?: React.CSSProperties to the component signature. Both fixes are minimal and surgically scoped. No behavior change. * fix(ci): allowlist .sisyphus/*.md in gitleaks The legacy PROXY_API_KEY literal is removed from source, but the .sisyphus/PHASE_0A_HUMAN_ACTIONS.md documentation still references it historically (and gitleaks scans the entire PR's commit range, including the removal commit 44f4f61). This file is project documentation, not deployable code. Path now exempted from the moodtrip-shared-proxy-key rule. --------- Co-authored-by: NhoNH <nhonh@geargames.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 2 — Human Actions Required Before Cutover
1. Affiliate program signups
You must register MoodTrip with each affiliate network before any clicks can be attributed to you:
Traveloka (primary — 14-day cookie, 6.4% VN hotel upsize)
MOODTRIP_TVLinservices/affiliate.ts)Klook (Klook Kreator program)
MOODTRIPKK)Agoda (lowest priority — session-only cookie limits monetization fit)
MOODTRIPAG)Once approved, edit
services/affiliate.ts(theAFFILIATE_IDSconstant) with the real IDs and open a follow-up PR.2. Tax / business entity decision (required before first payout)
Vietnamese affiliate income to a personal account vs LLC vs Singapore entity has 5-20% tax difference. Per Metis critique:
Discuss with an accountant before activating affiliate links in production.
3. Edge proxy variables
No changes needed to the Worker for Phase 2 — affiliate click tracking is fully client-side (PostHog event + window.open redirect).
4. Vercel env
No new env vars required. Existing
VITE_POSTHOG_KEY(from Phase 0b checklist) covers affiliate event tracking.5. Sunday Dream timezone notes
The Sunday Dream window opens at 16:00 local time (user's device clock), Sundays only. There's no server-side scheduling; the banner shows when
getSundayWindow().isOpenis true.For users who don't open the app during the Sunday afternoon window, the banner never shows that week — that's by design (the ritual is meant to be opt-in, not push).
6. Smoke test in production
After PR #4 is merged + deployed:
BLOCKED_DOMAIN.google_maps_linkcontaining?q=lat,lngor@lat,lng— markers should appear at the right places, numbered by day.maplibre-gl+ CSS).What this PR ships
F4 — Traveloka Affiliate (primary), Klook, Agoda
services/affiliate.ts:crypto.getRandomValues(16 hex chars, ~10^19 space)aid+sub_id, Klookaid+aff_label, Agodacid+tag)ai_generation_cross_borderscope; if user hasn't accepted, shows in-banner consent UI before redirectingaffiliate_click_<partner>fires with click_id, productType, venueName, destination, tripIdcomponents/AffiliateButton.tsx: drop-in component, two variants (primary / subtle), handles the consent dance + new-tab redirectF3-Lite — Static Map + Venue Resolver
services/venueResolver.ts:?q=lat,lngand@lat,lngformats from Google Maps URLscomputeBounds()for auto-fit on map loadcomponents/TripMap.tsx:A3 — Đường Về Quê (Ancestral Hometown Mode)
services/duongVeQue.ts:buildQueSeed()picks a random emotional prompt for varietybuildQuePersonalNote()produces a Mơ-style note: "Chuyến đi về quê {province}. {prompt} ..."components/DuongVeQueModal.tsx: searchable province list, click → seeds form with destination + personalNote + cultural moodsF-Sunday — Sunday Dream Ritual
services/sundayDream.ts:components/SundayDreamBanner.tsx: bottom-right corner banner, gradient purple/pink for distinction, "🔥 Chuỗi N chủ nhật" streak displayTiếng Vùng — Regional Dialect
services/moPersona.tsregional dialect injection from Phase 0b)services/preferencesApi.setRegionDialect()for explicit user override (UI for it deferred to Phase 3 to keep this PR scoped)Tests
services/__tests__/affiliate.test.ts(10 tests): domain allowlist, URL decoration, consent gating, click ID uniquenessservices/__tests__/venueResolver.test.ts(7 tests): both Google Maps URL formats, bounds calculation, TikTok query encodingservices/__tests__/duongVeQue.test.ts(7 tests): regional coverage, prompt randomness, case-insensitive lookupservices/__tests__/sundayDream.test.ts(7 tests): window detection by day-of-week + hour, streak increment/reset/idempotencyVerification
What this PR does NOT yet do
Risks (Phase 2 specific)