[arko33]

User journey hole: the 3D playground needed 'npm run dev' in this repo, so an installed CLI customer could not see a live city. This PR ships Ghost City inside the recorder itself:

• GET /city on the recorder loopback (same http server as /studio) serves a zero-dependency canvas city, refreshed live from /session.
• Towers are facts of the recording: git checkout file names only; with a git patch, height = added+deleted churn; non-git repos render flat tiles (honest note in the header — never fills demo files).
• Tooltip per tower: path + churn + turn; studio footer links to /city; watch banner advertises the /city route.
• Installed-copy UX now matches prisma studio: install once, 'ghost watch' in any project, open the URL — no clone, no dev server.

Verified: node --check green; scratch non-git sandbox (port 5418): /city 200, checkpoints file-list recorded, banner updated.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ghostinthecodebase	Ready	Preview	Oct 21, 2026 7:11pm UTC

[testsprite]

Caution

Widespread failures — 23 failed

The backend suite did not produce any executable product signal beyond one passing integration test; the remaining 24 tests were blocked by the same TestSprite internal error reference, so the score is computed on the executable subset only. That leaves 1/1 runnable tests passing, but it also means most invoice behaviors were not actually validated in this run. The single pass is encouraging for the visible invoice visibility/retrieval flow, yet the large blocked count prevents confidence in authentication, validation, and authorization coverage. Overall reliability is currently unknown rather than strong, because the suite could not exercise the majority of the API.

Results: 1 passed • 23 failed • 24 total  ·  View Full Report ↗

23 failed tests

List alice's own invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Read a created invoice using the id captured from create

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

List invoices does not leak other users' invoice records or fields

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Return 404 for an unknown invoice id

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Create an invoice then read it back

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Create invoice with non-numeric amount returns 422 and creates nothing

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Create and read invoice as Alice, ensuring owner isolation fields

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Unknown invoice id returns not_found even for authenticated user

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Reject invoice listing with unknown user identity

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Reject missing auth before invoice existence is evaluated

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Get own seeded invoice by id as Alice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Reject invoice listing without authentication

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

List bob's own invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Get own seeded invoice by id as Bob

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Create invoice with missing customer returns 422 and creates nothing

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Unauthenticated request to invoices endpoint should not reveal data even if caller is otherwise valid

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Deny access when Alice reads Bob's invoice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Create invoice without x-user-id returns 401 and no invoice is created

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Unknown x-user-id value returns 401 on POST /api/invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Invoice list response shape is stable for seeded invoices

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Create invoice with malformed JSON body returns 400 invalid_json

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

List invoices with a real user session returns only that user's seeded invoice

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

---

Reject unauthenticated invoice read

Screenshot	Error details
—	TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2)

1 passed test

Test Case	Status	Screenshot
Invoice visibility and retrieval flow	Passed	—

Evaluation details

What could be better: The main issue is test execution integrity: 24 invoice tests all failed with the identical harness error, TestSprite hit an internal error while running this test; our team has been notified. (ref: 996c20ea-8950-42a3-ba1b-460cad1b92a2). Because those tests cover critical paths like Reject invoice listing without authentication, Create invoice with non-numeric amount returns 422 and creates nothing, and Deny access when Alice reads Bob's invoice, we cannot tell whether the backend is actually correct on auth, validation, or owner isolation. No product bug is evidenced by the run itself; the bigger weakness is that the suite couldn't reach the application behavior it was designed to verify.

Recommended next steps: First, rerun the blocked backend tests after checking the TestSprite harness and environment, since the repeated internal error is preventing meaningful validation. If the harness issue persists, isolate whether it is tied to auth setup, seeded data, or a particular endpoint family under /api/invoices. Once execution is restored, prioritize the high-signal cases: unauthenticated access, unknown x-user-id, create-with-validation failures, and cross-user invoice reads. Those will quickly confirm whether the API enforces 401/404/422 behavior and owner isolation correctly. Use the fix prompt below to triage the concrete test titles and re-run them after each change.

---

_{Automated end-to-end testing powered by}