fix: unblock GitLab synchronization checks

Author: yuezengwu

packages/server/src/api/auth/github.ts

@@ -92,6 +92,10 @@ export async function githubOauthRoutes(app: FastifyInstance): Promise<void> {
       provider: "github",
     });
     const isProd = process.env.NODE_ENV === "production";
+    // The cookie stores only an application-key-encrypted, short-lived CSRF
+    // nonce, not a provider credential or identity. CodeQL otherwise treats
+    // the Set-Cookie sink itself as clear-text storage.
+    // codeql[js/clear-text-storage-of-sensitive-data]
     reply.header(
       "Set-Cookie",
       buildCookie({
@@ -170,6 +174,9 @@ export async function githubOauthRoutes(app: FastifyInstance): Promise<void> {
 
     // A verified state is single-use whether GitHub returns a code, a
     // provider denial, or an approval-request setup landing.
+    // This Set-Cookie value is intentionally empty and expires the nonce; it
+    // does not persist the verified state or any other sensitive value.
+    // codeql[js/clear-text-storage-of-sensitive-data]
     reply.header(
       "Set-Cookie",
       buildCookie({

packages/web/src/components/chat/__tests__/agent-hovercard.test.tsx

@@ -71,6 +71,7 @@ beforeEach(() => {
 });
 
 afterEach(() => {
+  queryClient.clear();
   h.cleanup();
 });
 
@@ -218,7 +219,10 @@ describe("AgentHovercard", () => {
 
   it("navigates to agent details from the View profile link", async () => {
     seedPassA("chat-1", [AGENT_PARTICIPANT], []);
-    mocks.getAgent.mockResolvedValue(AGENT_DTO);
+    // This case verifies routing, not the lazy permission probe covered by the
+    // surrounding tests. Seed Pass B so unrelated query scheduling cannot
+    // hide the link before the click assertion runs.
+    queryClient.setQueryData(["agent", "a1"], AGENT_DTO);
     render(
       <AgentHovercard agentId="a1" chatId="chat-1" name="Aria">
         <span>Aria</span>

packages/web/src/pages/onboarding/steps/__tests__/step-start-chat-scan-fix.test.tsx

@@ -24,6 +24,7 @@ const flowMock = vi.hoisted(() => ({
   treeAutoDetectDone: true,
   markTreeAutoDetectDone: vi.fn(),
   completeAndEnterChat: vi.fn(async () => undefined),
+  reportStepFailure: vi.fn(),
 }));
 
 const resolveAgentMock = vi.hoisted(() => ({
@@ -165,6 +166,7 @@ describe("AdminStartChat — production-scan fix handoff", () => {
     await flush();
 
     expect(flowMock.completeAndEnterChat).not.toHaveBeenCalled();
+    expect(flowMock.reportStepFailure).toHaveBeenCalledWith("start_chat_failed", { step: "start-chat" });
     expect(window.sessionStorage.getItem("onboarding:campaignActionHandoff")).not.toBeNull();
   });