Sloth-ninja stops backend errors from trapping users in login limbo

A database-permission failure can now become a clear, retryable error instead of an endless login spinner.

securityworkflow

After an account lookup failed without returning a response, pilot users were left waiting indefinitely at sign-in. Sloth-ninja has tightened the safety net around the service so failures are handled consistently rather than silently stranding a request.

Backend requests now return a standard error response when unexpected failures occur, without exposing sensitive permission details.
Account loading now times out after 15 seconds and gives the user a retry option instead of assuming their account has unlimited access.

The work also preserves the special handling needed for live, streaming responses, avoiding a blunt fix that could interrupt them.

So what Legal teams piloting AI tools should care because an outage now fails visibly and recoverably, rather than looking like a user-access problem.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from Sloth-ninja/JessicaOSS, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date

23ed39e3 Harden async handlers + profile-load error state (login spinner incident) sloth-ninja 2026-07-21 ↗ GitHub

SHA	Subject	Author	Date
`23ed39e3`	Harden async handlers + profile-load error state (login spinner incident)	sloth-ninja	2026-07-21	↗ GitHub
commit body Production Supabase lost the service_role grant on user_api_keys; the unwrapped GET /user/profile handler threw, and after the #22 unhandledRejection guard the request simply never responded - the frontend gate spun on loading forever (infinite login spinner). This is the code-level defence. Backend: audited every async route handler; wrapped 56 unwrapped/partial ones via a new self-contained lib/asyncHandler.ts (fixed generic 500 detail + console.error via safeErrorLog; mirrors workflows.ts asyncRoute). Handlers with whole-body try/catch left untouched. Added user.test.ts covering the GET /user/profile reject path. Frontend: 15s AbortController timeout on the profile load + an honest error+retry state in MfaLoginGate, replacing the silent misleading fallback profile. Docs: DURABLE_LESSONS 2026-07-21 entry + BUILD_LOG entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

commit body

Production Supabase lost the service_role grant on user_api_keys; the unwrapped
GET /user/profile handler threw, and after the #22 unhandledRejection guard the
request simply never responded - the frontend gate spun on loading forever
(infinite login spinner). This is the code-level defence.

Backend: audited every async route handler; wrapped 56 unwrapped/partial ones
via a new self-contained lib/asyncHandler.ts (fixed generic 500 detail +
console.error via safeErrorLog; mirrors workflows.ts asyncRoute). Handlers with
whole-body try/catch left untouched. Added user.test.ts covering the GET
/user/profile reject path.

Frontend: 15s AbortController timeout on the profile load + an honest error+retry
state in MfaLoginGate, replacing the silent misleading fallback profile.

Docs: DURABLE_LESSONS 2026-07-21 entry + BUILD_LOG entry.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1163.md from inside the repo you want the changes in.

⬇ Download capture-thread-1163.md