Make install links survive the login screen, and speed up CI

[jhd3197]

Four separate things in this branch turned out to be doing nothing at all, which is its own strange kind of relief. Install links from serverkit.ai — the entire point of the README badges — were discarded the moment login intervened, because PrivateRoute bounced to /login without recording where the visitor was going and every post-auth path then navigated to /; the /extensions?install=<slug> handler those links aim at had simply never been written, even though Templates.jsx has had its counterpart for a while. Meanwhile the default template repository pointed at a GitHub org that does not exist, so it has 404'd for its entire existence and no panel has ever fetched a template remotely, and npm run lint — defined in package.json, documented in CLAUDE.md — was invoked by no workflow, silently unenforcing three project-specific checkers including the raw-HTML sink audit. The redirect is parked in sessionStorage rather than react-router location state because the SSO flow leaves the origin entirely and comes back through /login/callback/<provider>, which router state cannot survive — one mechanism covering all four post-auth exits beats two each covering half — and it is validated on write and on read, since login is exactly where an open redirect hurts. The install deep link deliberately opens the extension's detail card instead of installing: a URL arriving from another site must not be able to install anything on its own, so the operator still presses Install and every trust gate behind it still fires. The CI half is separate housekeeping — five workflows were validating the same commit up to three times, and Backend CI's 21m50s was the pipeline wait while everything else finished inside a minute — so the suite now shards across four runners, chosen over pytest-xdist because each shard is its own VM and the process-shared state that makes in-process parallelism unsafe here simply isn't shared.

Highlights

• Signing in now returns you to the page you originally asked for, instead of dumping you on the dashboard with no explanation of why the thing you clicked did not happen. This covers all four sign-in paths: password, two-factor, magic link, and SSO.
• Install links from serverkit.ai finally land on the extension they name. The link opens that extension's detail card so you can review it and press Install yourself — a link from another site can never install anything on its own.
• An install link naming an extension this panel does not know about now says so, rather than quietly doing nothing.
• The panel can fetch templates from the registry for the first time. Every install to date has only ever seen the 118 templates bundled with the panel. This needs serverkit.ai's own fix deployed first; until then, syncing finds nothing, exactly as it does today.
• Templates downloaded from a repository are checked against the checksum the registry pins for them, and a mismatched file is refused before it ever reaches disk.
• Pipeline feedback arrives in roughly a quarter of the time, and pushes no longer burn three duplicate validation runs per change.

Technical changes

Post-login redirect

• New frontend/src/utils/redirectAfterLogin.js exporting rememberRedirect(location), consumeRedirect(), and the pure sanitizeRedirect(path).
• PrivateRoute in App.jsx calls rememberRedirect(location) before <Navigate to="/login" replace />; Login.jsx (link redemption, password, 2FA) and SSOCallback.jsx all navigate to consumeRedirect() instead of '/'.
• Storage is sessionStorage under serverkit.redirectAfterLogin, holding {path, at}. Chosen over router state because the SSO round trip leaves the origin; a single mechanism then covers every post-auth exit.
• sanitizeRedirect enforces same-origin by shape — one absolute path and nothing else. //evil.com and /\evil.com are rejected explicitly, since browsers read both as protocol-relative and either would turn login into an open redirect.
• Control characters (newline, tab, NUL, DEL) are rejected: they can smuggle a value past the shape checks once something downstream re-parses it.
• Dot segments are refused outright, plain and percent-encoded, in any position. /..//evil.com normalizes to //evil.com, which is only same-origin while resolved against a base — assigned to window.location.href it leaves the site. Refusing the gadget beats auditing every present and future consumer of the stored value. A dot inside a segment name (/files/.env) is untouched.
• Auth-route rejection moved from exact-string to a case-insensitive prefix match on a / boundary, so /login/ and /login/callback/<provider> are caught — the latter would re-run the SSO callback with no code and land the user on an error page immediately after a successful login. /logins and /login-help stay valid.
• Parked destinations expire after 30 minutes, sized for a password manager, a TOTP prompt, or an SSO round trip that includes signing up at the provider. Without it, a destination abandoned early in a tab session fired on any later login in that tab.
• consumeRedirect treats a missing, non-numeric, or future at as expired rather than trusting it — rememberRedirect is the only writer, so anything else did not come from this module. Also a 2048-char path cap, single-use semantics (read clears), re-validation on read, and a try/catch fallback to / when storage is unavailable.

Extension install deep link

• Marketplace.jsx reads ?install=<slug> and sets detailEntry to the matching catalog entry, searching builtins and registryExtensions by installKey so featured/sort ordering is irrelevant.
• Opens the modal rather than installing, keeping the unreviewed / unverified-checksum / untrusted-publisher-key gates on the operator's click path exactly as a card click does. An unmatched slug raises a toast naming the slug.
• The param is stripped via setSearchParams(next, {replace: true}) either way, so a refresh does not reopen it.
• Reads on /extensions, not /marketplace — the latter resolves through a <Navigate>, which drops the query string.

Template repository

• TemplateService.DEFAULT_REPOS moves from raw.githubusercontent.com/serverkit/templates/main (nonexistent org; the registry is jhd3197/serverkit-templates, default branch master) to https://serverkit.ai/templates, which proxies the registry, serves the <repo_url>/index.json and <repo_url>/templates/<id>.yaml paths this class derives, and caches with last-good fallback. The product domain also means an upstream branch rename cannot silently empty every panel's catalog — the exact failure being fixed.
• New DEAD_REPO_URLS set plus _heal_dead_repos(), applied in get_config(). Fixing the default alone would only help fresh installs, since get_config returns whatever a saved templates.json holds. Not written back — a getter should not have a disk side effect — so the repair re-applies each read until the config is saved normally.
• sync_templates() now verifies each download against the sha256 the index pins, comparing against response.content. Mismatch appends a truncated-hash error and continues without writing; a missing hash is permitted and counted in a new unverified field on the return value, mirroring the unsigned-vs-invalid split used for extensions.
• Files are written in binary mode so what lands on disk is byte-identical to what was hashed — text mode would rewrite line endings on Windows and break the comparison.
• Verification is in this commit rather than a follow-up because the URL fix activates a download path that has never once run; shipping an unverified fetch days after the panel learned to verify ed25519 signatures on extensions would be a known downgrade.
• get_template's in-memory remote read (parses without saving) is not covered — it has no index entry on hand and would need an extra fetch.
• Deploy ordering: serverkit.ai must ship its master-branch fix before this helps. Until then the proxy 502s and sync finds nothing, same as today.

CI

• backend-ci.yml splits pytest into a 4-way matrix using pytest-split (--splits 4 --group ${{ matrix.group }}), roughly 794 tests per shard. Sharding over pytest-xdist because each shard is its own VM, so templates.json / APPS_DIR and the per-PID DB dance in tests/conftest.py are not shared and no test code changes.
• fail-fast: false on the matrix, so all four shards report in one pass instead of hiding shards 2-4 behind the first failure.
• The test-count ratchet becomes its own job — a shard only collects its quarter, so it cannot see the whole suite. It runs alongside the shards and costs no wall-clock.
• Shard command is scoped to pytest tests rather than a bare pytest. Identical in CI (backend/dev-data/ is gitignored and absent), but a bare pytest on a dev box tries to collect locally deployed apps and dies during collection — the line is now copy-pasteable for debugging a red shard.
• Known limitation, documented inline: with no .test_durations file, pytest-split balances by test count, not time, and these tests range from 0.1s to 10s+. If one shard becomes the new critical path, run once with --store-durations and commit the file.
• New frontend-ci.yml running npm run lint (eslint plus check-settings-index, check-theme-tokens, check-html-sinks). Currently 926 warnings / 0 errors, and eslint exits 0 on warnings, so the gate is on errors only; --max-warnings=<N> is the documented lever if the warning count ever needs its own ratchet. backend/app/** is in the trigger paths because check-html-sinks scans it for |safe, Markup(, and render_template_string. Lint only — the frontend is already compiled by Release Build Smoke Test's scripts/build-release.sh.
• Five workflows (backend-ci, extensions-ci, release-smoke, scripts-ci, security-scan) narrow from push: [dev, main] + pull_request: [dev, main] to push: [dev] + pull_request: [main]. pull_request: [dev] was dead config — every PR in this repo targets main, checked back through Test Sandbox, resumable LocalKit sync, and installer hardening #77 including dependabot's. push: [main] was redundant: release.yml gates itself on Backend CI via ci-gate and its build-release job runs scripts/build-release.sh for real moments later.
• test-system-utils.yml drops its unit-tests job, which ran pytest tests/test_utils_system.py (44 tests) that Backend CI's collection already includes — there is no pytest.ini, addopts, or collect_ignore narrowing it. The real-distro integration matrix and the raw-subprocess audit stay; those are what Backend CI genuinely cannot do.
• Coverage of main is unchanged: a pull_request run tests the merge result, and release.yml still gates on the full backend suite.
• backend/tests/BASELINE_COUNT ratchets 3138 → 3173.

[Copilot]

Pull request overview

This PR improves deep-link usability and operational safety by preserving intended destinations across authentication (including SSO), adding an /extensions?install=<slug> deep link handler, fixing the default template repo URL (with on-read healing for existing installs), and speeding up CI via sharded backend tests plus an explicit frontend lint workflow.

Changes:

• Preserve and safely restore post-login navigation targets via sessionStorage (covers password, 2FA, magic link, and SSO).
• Support extension install deep links by opening the matching extension detail modal from /extensions?install=<slug>.
• Fix template repo defaults + add checksum verification for synced templates; accelerate CI by sharding backend pytest and adding frontend lint enforcement.

Reviewed changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
VERSION	Bumps panel version to 1.7.83.
frontend/src/utils/redirectAfterLogin.js	New sessionStorage-based redirect capture/consume with sanitization to prevent open redirects/loops.
frontend/src/pages/SSOCallback.jsx	Redirects to the stored destination after successful SSO login.
frontend/src/pages/Login.jsx	Redirects to the stored destination after login/magic-link redemption/2FA completion.
frontend/src/App.jsx	Updates PrivateRoute to remember the intended destination before redirecting to /login.
frontend/src/pages/Marketplace.jsx	Handles /extensions?install=<slug> by opening the matching extension detail modal and then stripping the query param.
backend/app/services/template_service.py	Fixes default template repo URL, heals dead URLs on read, and adds sha256 verification + unverified count during sync.
backend/tests/test_template_repo_sync.py	Adds coverage for default repo URL, healing behavior, and checksum verification semantics.
backend/tests/BASELINE_COUNT	Raises the test-count floor to 3173.
.github/workflows/backend-ci.yml	Shards backend pytest into a 4-way matrix and moves the test-count ratchet into its own job.
.github/workflows/frontend-ci.yml	Adds a dedicated lint workflow to enforce npm run lint (eslint + project checkers).
.github/workflows/extensions-ci.yml	Adjusts triggers to reduce duplicate runs (push dev / PR main).
.github/workflows/release-smoke.yml	Adjusts triggers and documents avoiding duplicate main-branch builds.
.github/workflows/scripts-ci.yml	Adjusts triggers to reduce duplicate runs (push dev / PR main).
.github/workflows/security-scan.yml	Adjusts PR triggers to main only.
.github/workflows/test-system-utils.yml	Removes redundant mocked unit-tests job; retains real-distro integration matrix + audit job.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.