Development

.github/instructions/*.instructions.md

@@ -1,4 +1,4 @@
-# Copilot Instructions — Tracker Tracker
+# Copilot PR Review Instructions
 
 ## Project
 
@@ -8,12 +8,6 @@ Self-hosted single-user dashboard for monitoring private tracker stats. Next.js
 
 pnpm only. Never use npm or yarn. Node.js >= 22 required.
 
-## Linting and Formatting
-
-- Biome for linting (`pnpm lint` runs `pnpm tsc && biome check .`). No ESLint.
-- Prettier for formatting (`pnpm format`). Biome's formatter is disabled.
-- TypeScript strict mode. Check with `pnpm tsc`.
-
 ## File Conventions
 
 - First line of every JS/TS file: `// relative/path/to/file.tsx`
@@ -79,10 +73,11 @@ Single-user app with master password auth. No third-party providers.
 - **Public routes:** defined in `proxy.ts` as `PUBLIC_EXACT` and `PUBLIC_PREFIX` arrays. All other routes require the cookie.
 
 Route handler pattern:
+
 ```ts
 const auth = await authenticate()
-if (auth instanceof NextResponse) return auth  // 401
-const key = decodeKey(auth)                    // Buffer
+if (auth instanceof NextResponse) return auth // 401
+const key = decodeKey(auth) // Buffer
 // use key to decrypt DB fields
 ```
 
@@ -92,26 +87,8 @@ const key = decodeKey(auth)                    // Buffer
 - Suppress findings with `// security-audit-ignore: <reason>` on the line above. A bare suppression without a reason is itself a critical failure.
 - URL inputs are validated against SSRF via `isUnsafeNetworkHost()` in `src/lib/network.ts`.
 
-## Design System
-
-- Dark neumorphic aesthetic. No hex values in component files — use Tailwind semantic tokens.
-- Depth: `nm-raised`, `nm-raised-sm` for raised elements. `nm-inset`, `nm-inset-sm` for recessed elements.
-- Colors: `text-upload` (cyan), `text-download` (amber), `text-positive` (lime), `text-negative` (red).
-- Per-tracker colors are the only allowed inline `style={{ backgroundColor }}` values.
-- Chart colors come from `CHART_THEME` in `src/components/charts/lib/theme.ts`. Never hardcode hex in chart files.
-- Typography: `font-mono` (JetBrains Mono) for data values. `font-sans` (Archivo) for UI text. Use `tabular-nums` on numeric data for column alignment.
-- Chart axis labels use `textTertiary` (not `textMuted`). Chart tooltip HTML must escape user data with `escHtml()`.
-- Border radius tokens: `rounded-nm-sm` (8px), `rounded-nm-md` (12px), `rounded-nm-lg` (20px), `rounded-nm-pill` (9999px).
-- No shadcn/ui. This project uses a fully custom component library with `cva` (class-variance-authority) for variants and `clsx` for class merging.
-
 ## Component Patterns
 
-- `StatCard` has 3 variants (basic, stacked, ring) — they render different JSX structures, not just different classes.
-- `ProgressBar` in `src/components/ui/ProgressBar.tsx` — reusable neumorphic progress bar matching the Toggle track/knob depth pattern.
-- `MarqueeText` for long torrent/tracker names instead of CSS `truncate`.
-- `Tooltip` accepts `ReactNode` content, not just strings. Use JSX with `flex-col` for multi-line tooltips.
-- Never use native `<input type="checkbox">` — use the `<Checkbox>` component.
-- Never use native `<select>` — use the `<Select>` component.
 - Component anatomy: internal sub-components are unexported functions within the file. Single public export at the bottom. Types exported with `export type { ... }`.
 - Use React 19's ref-as-prop pattern (direct `ref` prop), not `forwardRef`.
 - SVG path calculations with floating-point geometry should round to 2 decimal places for SSR hydration safety.
@@ -125,13 +102,6 @@ All module-level singletons (cron tasks, DB client, qBT SID cache) must be store
 - Framework: Vitest.
 - Test mocks must match real API response shapes. Do not add fields (i.e., `isPrivate: true`) that the real API does not return — this masks bugs.
 - Do not add test-only methods to production classes. Put test utilities in test files.
-- qBittorrent's API returns snake_case fields (`is_private`, `added_on`). The `QbtTorrent` TypeScript type uses camelCase for some fields but there is no automatic mapping — raw API responses have snake_case.
-
-## Commit Messages
-
-- Never mention AI, Claude, or LLMs in commit messages.
-- Use conventional commits: `feat(scope):`, `fix(scope):`, `style(scope):`, `chore(scope):`.
-- One-line commit messages only.
 
 ## Code Organization
 
@@ -142,23 +112,11 @@ All module-level singletons (cron tasks, DB client, qBT SID cache) must be store
 ## SSR / Hydration
 
 - NEVER read `localStorage` in `useState` initializers — causes hydration mismatch. Initialize with a server-safe default, then hydrate in `useEffect`.
-- Page components (`page.tsx`) should be thin wrappers. Business logic, UI sections, and data fetching belong in extracted components and hooks.
-
-## Writing Style
-
-- Always use "i.e." never "e.g." in comments, documentation, and UI text.
-- Do not use em dashes, en dashes, curly quotes, or other non-ASCII punctuation in comments, strings, or error messages. Stick to plain ASCII: commas, periods, hyphens, straight quotes. IDEs and terminals choke on fancy Unicode punctuation.
 
 ## Adapter Pattern
 
 - Tracker platforms use an adapter pattern: `TrackerAdapter` interface with `getAdapter()` factory. UNIT3D, Gazelle, and GGn are implemented. Adding a new platform means adding a new adapter file in `src/lib/adapters/`, not modifying existing ones.
 
-## qBittorrent Integration
-
-- The qBT Web API returns snake_case field names (`is_private`, `added_on`). The `QbtTorrent` TypeScript interface uses camelCase for some fields but `getTorrents()` returns raw JSON with NO field mapping. Do not assume camelCase fields exist on raw API responses.
-- Tag matching must be case-insensitive. The aggregator lowercases map keys. `parseTorrentTags()` lowercases by default.
-- The heartbeat loop (5s) must NOT update `lastPolledAt` — only the deep poll (5min) writes it. Otherwise the deep poll's overdue check never triggers.
-
 ## Precision Concerns
 
 - Daily upload/download deltas are computed as BigInt subtraction. Converting daily deltas to Number for percentage calculations is safe — `Number.MAX_SAFE_INTEGER` (~9 PiB) vastly exceeds any realistic daily transfer. Do not over-engineer BigInt arithmetic for percentage computations on daily deltas.
@@ -191,7 +149,6 @@ All module-level singletons (cron tasks, DB client, qBT SID cache) must be store
 
 ## Things NOT to Do
 
-- Do not use the terms "Production-Ready" or "Enterprise" anywhere.
 - Do not use ESLint. It has been deprecated for this project.
 - Do not use `npm` or `yarn` — `pnpm` only.
 - Do not create raw SQL migration files. Use `drizzle-kit push`.
@@ -204,4 +161,3 @@ All module-level singletons (cron tasks, DB client, qBT SID cache) must be store
 - Do not use `JSON.parse()` without a try/catch wrapper.
 - Do not use `console.log` in API routes — use the `log` instance from `@/lib/logger`.
 - Do not use `db.execute()` in API routes (raw SQL is banned except for the health check `SELECT 1`).
-- Do not use function names like "enhanced", "wrapper", or "util" — be specific and descriptive.

.github/workflows/dependency-review.yml

@@ -16,7 +16,6 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Review dependencies
-        continue-on-error: true
         uses: actions/dependency-review-action@v4
         with:
           fail-on-severity: high

.github/workflows/dev-image.yml

@@ -45,6 +45,7 @@ jobs:
           context: .
           push: true
           platforms: linux/amd64,linux/arm64
+          build-args: NEXT_PUBLIC_RELEASE_CHANNEL=development
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:development
             docker.io/jordyjordy/tracker-tracker:development

.gitignore

@@ -44,6 +44,7 @@ docs/audit/
 docs/superpowers/*
 docs/superpowers/specs/
 .claude/
+CLAUDE.md
 .history/
 .vscode/
 .serena/

.prettierignore

@@ -1 +1,5 @@
-# docs/**/*.md
+docs/**/*.md
+CHANGELOG.md
+LICENSE
+README.md
+pnpm-lock.yaml

.versionrc.json

@@ -1,10 +1,7 @@
 {
   "header": "# Changelog\n",
-  "skip": {
-    "tag": true
-  },
   "writerOpts": {
-    "commitPartial": "- {{#if scope}}**{{scope}}:** {{/if}}{{#if subject}}{{{subject}}}{{else}}{{{header}}}{{/if}}{{~#if hash}} ({{#if @root.linkReferences}}[{{shortHash}}]({{@root.host}}/{{@root.owner}}/{{@root.repository}}/commit/{{hash}}){{else}}{{shortHash}}{{/if}}){{/if}}{{~#each references}}, closes {{#if @root.linkReferences}}[{{prefix}}{{issue}}]({{@root.host}}/{{@root.owner}}/{{@root.repository}}/issues/{{issue}}){{else}}{{prefix}}{{issue}}{{/if}}{{/each}}\n"
+    "commitPartial": "- {{#if scope}}**{{scope}}:** {{/if}}{{#if subject}}{{{subject}}}{{else}}{{{header}}}{{/if}}\n"
   },
   "types": [
     { "type": "feat", "section": "Features" },