Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@CLAUDE.md`:
- Line 125: Narrow the scope of the inline examples on the "views/" line by
removing the deferred full-feature page names (Dashboard, TaskBoard,
AgentProfiles, BudgetPanel) and replace them with only the view components
actually added in this PR or a neutral phrase like "Page-level components
(current PR views only)"; edit the comment on the line that contains "views/" to
either list the specific in-repo view names introduced by this PR or remove the
example list altogether so it no longer claims pages that are deferred to PR 2.

In `@web/nginx.conf`:
- Around line 33-45: The X-Forwarded-Proto header is being overwritten with
$scheme (which is always "http" here) — change this to preserve an incoming
header with an http-scope fallback by introducing a map (e.g. map
$http_x_forwarded_proto $x_forwarded_proto { default $http_x_forwarded_proto; ''
$scheme; }) and then set proxy_set_header X-Forwarded-Proto $x_forwarded_proto
in both the location /api/v1/ws and location /api/ blocks so the original client
protocol is preserved when present and $scheme is used only as a fallback.

In `@web/package.json`:
- Around line 7-13: The package.json scripts ("dev", "build", "preview") call
the Vite CLI but Vite is not declared in devDependencies; add an explicit
devDependency entry for "vite" (e.g., by running the package manager command to
install it as a devDependency or by adding "vite": "<compatible-version>" under
devDependencies) so the CLI is guaranteed to be available; ensure the version
you choose is compatible with existing dev tools like "vitest" and
"@vitejs/plugin-vue" to avoid resolution conflicts.

In `@web/src/__tests__/api/client.test.ts`:
- Around line 28-33: The test currently guards the interceptor call with "if
(interceptor)" which can silently skip assertions; instead assert the
interceptor exists and is a function before invoking it: add an explicit
expect(typeof interceptor).toBe('function') (or similar) targeting the
interceptor variable extracted from apiClient.interceptors.request.handlers so
the test fails if the request interceptor is not registered; apply this change
to both test cases that extract "handlers" / "interceptor" (the blocks around
apiClient.interceptors.request and the subsequent config invocation).

In `@web/src/__tests__/components/EmptyState.test.ts`:
- Around line 49-55: Rename the existing test in EmptyState.test.ts to "does not
render action container when slot is not provided" to match its behavior, and
add a new test that mounts the EmptyState component with an explicitly provided
but empty action slot (e.g., pass slots: { action: '' } or a slot function that
returns null) to assert the '.mt-4' action container is not rendered; reference
the EmptyState component and the test file's existing
expect(wrapper.findAll('.mt-4')).toHaveLength(0) assertion to validate both
scenarios.

In `@web/src/__tests__/components/PageHeader.test.ts`:
- Around line 5-27: Add a test to PageHeader.test.ts that mounts PageHeader with
an actions slot and asserts the slot content is rendered; specifically, in the
describe('PageHeader') block add an it('renders actions slot', ...) that mounts
PageHeader (using mount(PageHeader, { props: {...}, slots: { actions:
'<button>Action</button>' } })) and then checks wrapper.find('button') or
wrapper.text() contains 'Action' to ensure the actions slot contract in
PageHeader is preserved.

In `@web/src/__tests__/components/StatusBadge.test.ts`:
- Around line 31-52: Add an explicit assertion that the element exists before
checking its classes to make failures clearer: in the test cases that call
wrapper.find('.p-tag') (the variable named tag in the StatusBadge tests), add an
existence assertion (e.g., expect(tag.exists())) immediately after finding the
element and before the expect(tag.classes()) assertions so structural rendering
changes fail with a clear message rather than class mismatches.

In `@web/src/__tests__/composables/useOptimisticUpdate.test.ts`:
- Around line 64-76: The test creates a console.error spy (consoleSpy) but only
calls consoleSpy.mockRestore() on the happy path, risking leaked mocks if
assertions fail; update the test around execute(...) / assertions to ensure
consoleSpy.mockRestore() always runs by moving restoration into a finally block
or using an afterEach that restores console.error, referencing the existing
consoleSpy and the execute / error.value assertions so the spy is always removed
even on failures.

In `@web/src/__tests__/stores/agents.test.ts`:
- Around line 61-100: Tests for useAgentStore.handleWsEvent are missing edge
cases for agent.hired: deduplication and malformed payloads; add two tests
referencing useAgentStore and handleWsEvent that: 1) send a second agent.hired
WS event with the same unique identifier as mockAgent (e.g., name or id in
mockAgent) and assert agents length and total do not increase (still 1), and 2)
send an agent.hired event with a malformed payload (e.g., missing name/id or
required fields) and assert the store does not add the agent or change total,
ensuring handleWsEvent validates payload before inserting.

In `@web/src/__tests__/stores/approvals.test.ts`:
- Around line 212-224: The test for preventing duplicate approvals only asserts
approvals array length but misses verifying that the store.total counter also
doesn't increment; update the test that uses useApprovalStore and calls
store.handleWsEvent(event) to also assert store.total remains 1 (and optionally
unchanged from its pre-event value) after the event to catch regressions in the
total counter handling for duplicate approval.submitted events involving
mockApproval.

In `@web/src/__tests__/stores/budget.test.ts`:
- Around line 45-46: The test fixtures are untyped and use incorrect field names
so they can drift from the real contract; change the mocked responses to be
typed against the shared BudgetConfig and spending interfaces (import
BudgetConfig and the spending type from web/src/api/types.ts) and construct mock
objects that match those types — e.g., replace daily_limit/total_budget with the
actual BudgetConfig fields and replace total_cost with total_cost_usd in the
spending fixture used by mockGetBudgetConfig and the spending mock (e.g.,
mockGetBudgetSpending or whatever mock is used on lines ~93-99) so the mocks
fail at compile time if the API types change.

In `@web/src/api/endpoints/agents.ts`:
- Around line 23-24: The post call in agents.ts doesn't supply the generic type
so unwrap loses the ApiResponse envelope and compile-time guarantees for
AutonomyLevelResponse; update the apiClient.post invocation used in the function
that calls `/agents/${encodeURIComponent(agentId)}/autonomy` to use the generic
ApiResponse<AutonomyLevelResponse> (e.g.,
apiClient.post<ApiResponse<AutonomyLevelResponse>>(...)) so the response retains
the envelope type expected by unwrap and preserves type safety across agents.ts
consistent with auth.ts.

In `@web/src/api/endpoints/providers.ts`:
- Around line 13-16: The provider map construction writes untrusted keys into a
plain object and can be poisoned (e.g., "__proto__"); change the map to a safe
dictionary and skip dangerous keys: create result with Object.create(null)
instead of {}, and in the loop that iterates over Object.entries(raw) (the block
that calls stripSecrets(provider) and assigns to result[key]) skip keys like
"__proto__", "constructor", and "prototype" (or otherwise validate keys) before
assigning. This keeps using stripSecrets(provider) and the same variable names
(result, raw, key, provider) but prevents prototype pollution.

In `@web/src/components/common/EmptyState.vue`:
- Around line 18-20: The proposed change wrongly invokes the slot function in
setup (e.g., calling slots.action?.()), which violates Vue 3 render-phase rules
and can trigger warnings; revert to the idiomatic pattern used now (keep the
template check v-if="$slots.action" in EmptyState.vue and do not call
$slots.action or slots.action() outside the render function), and if you truly
need to detect empty slot content perform that invocation only during render (or
mirror the existing approach used in PageHeader.vue) rather than computing it in
setup.

In `@web/src/components/common/ErrorBoundary.vue`:
- Around line 1-11: The component exported as ErrorBoundary does not implement
Vue's error capture lifecycle (onErrorCaptured) and only displays an error
passed via props, so either rename the component/file to a more accurate name
like ErrorDisplay or ErrorState and update all imports/usages, or keep the name
but add a top-of-file doc comment clarifying it expects an external error prop
and does not capture child errors; update references to the component
accordingly and consider implementing onErrorCaptured inside the <script setup>
(using onErrorCaptured to set local state and emit retry) if you intend true
boundary behavior (see defineProps and defineEmits for where to wire this).

In `@web/src/components/layout/ConnectionStatus.vue`:
- Around line 27-56: The status dots in ConnectionStatus.vue are purely visual
and need accessible labels; update the API and WS indicator elements (the span
with classes using healthError/health?.status and the span using
wsStore.connected) to include appropriate ARIA attributes and hidden descriptive
text: add role="status" or aria-live="polite" on a wrapper, provide aria-label
or aria-describedby that reflects the current state (e.g., "API:
ok/degraded/error" derived from health and healthError, and "WebSocket:
connected/disconnected" from wsStore.connected), and include visually-hidden
text nodes for screen readers so the indicators convey the same semantic state
as the color dots.

In `@web/src/components/layout/Sidebar.vue`:
- Around line 2-3: The component is hardcoding the app name "SynthOrg" instead
of using the shared constant; import APP_NAME from '@/utils/constants' alongside
NAV_ITEMS in Sidebar.vue and replace all inline "SynthOrg" string occurrences
(including the other instances around where NAV_ITEMS is used) with the APP_NAME
symbol so the brand comes from the single source-of-truth constant.

In `@web/src/components/layout/Topbar.vue`:
- Around line 47-67: Add accessible names for the icon-only sidebar toggle and
the user-menu button: update the <Button> for the sidebar toggle (the one with
icon="pi pi-bars" and `@click`="$emit('toggleSidebar')") to include an aria-label
(e.g., aria-label="Toggle sidebar" or a localized equivalent), and update the
user button (the <Button> with :label="auth.user?.username ?? ''", icon="pi
pi-user" and `@click`="toggleUserMenu") to bind a fallback accessible name when
auth.user is null (e.g., :aria-label="auth.user?.username ?? 'Open user menu'"),
ensuring the Menu ref="userMenu" and toggleUserMenu logic continue to work
unchanged.

In `@web/src/composables/useAuth.ts`:
- Around line 14-16: The permission check widens WRITE_ROLES to string[] which
loses the role union and disables compiler checks; remove the cast in canWrite
and call includes against the properly typed constant (e.g.,
WRITE_ROLES.includes(role)), and ensure WRITE_ROLES is declared with the correct
readonly union type (for example as readonly Role[] or `const WRITE_ROLES = [
... ] as const` so its element type matches userRole) so the lookup preserves
the role union and lets TypeScript catch typos/drift; update either the
WRITE_ROLES declaration or its exported type rather than casting inside useAuth
(references: canWrite, userRole, WRITE_ROLES).

In `@web/src/composables/useOptimisticUpdate.ts`:
- Around line 22-33: The current execute() calls applyOptimistic() which both
builds the rollback and performs mutations, so if it throws after mutating we
lose rollback; refactor so rollback is captured before any mutation: change the
optimistic contract into two steps (e.g., prepareOptimistic/commitOptimistic or
have applyOptimistic return a pure rollback-builder that you call before
applying mutations), then in execute() first obtain and store the rollback
callback synchronously, then perform the actual optimistic mutation, keeping
references to rollback and ensuring the catch block can always call it; update
call sites to the new two-step API and adjust types for
applyOptimistic/prepareOptimistic accordingly.

In `@web/src/router/index.ts`:
- Line 6: The router currently calls createWebHistory() with a hardcoded root;
update the router to pass Vite's base URL so it respects subpath deployments by
calling createWebHistory with the Vite base (import.meta.env.BASE_URL). Locate
the createWebHistory invocation in web/src/router/index.ts and replace the
no-arg call so the router uses import.meta.env.BASE_URL (or the app's equivalent
env constant) as the base argument to createWebHistory, ensuring routes and
refreshes work when Vite's base is set.

In `@web/src/stores/agents.ts`:
- Around line 28-34: The fetchAgent function can leave a stale error visible
after a subsequent successful call; clear the reactive error state before
attempting the request and also ensure it's cleared on success. Specifically, in
fetchAgent (which calls agentsApi.getAgent and sets error.value =
getErrorMessage(err) on catch), set error.value = '' at the start of the
function and clear it again after a successful await to guarantee no old error
message remains.
- Around line 38-49: The handler for event.event_type 'agent.hired' currently
casts a partial payload to AgentConfig and pushes it into agents.value, which
can insert incomplete objects; instead add a runtime validation/type guard
(e.g., isValidAgentPayload) that checks all required top-level and nested fields
of AgentConfig (id, name, role, department, and any nested required properties),
and only when it returns true construct a concrete AgentConfig object (populate
required fields explicitly, fill optional fields with safe defaults if needed)
and push that into agents.value and increment total.value; remove the direct
cast (payload as AgentConfig) and return early for invalid payloads to avoid
storing malformed agents.

In `@web/src/stores/approvals.ts`:
- Around line 15-21: fetchApprovals currently doesn't record the active query,
so subsequent local mutations (approve, reject) and handleWsEvent mutate
approvals/total as if unfiltered and can leave non-matching rows; add a
store-scoped activeQuery (e.g., activeFilters/offset/limit) and set it inside
fetchApprovals before mutating approvals, then update approve, reject, and
handleWsEvent to either refetch via approvalsApi.listApprovals(activeQuery) or
reapply the stored filter and correctly adjust total so mutations/events only
affect the currently active view (reference fetchApprovals, approve, reject,
handleWsEvent, approvals, total, approvalsApi.listApprovals).
- Around line 54-65: The code casts a partial WebSocket payload to ApprovalItem
and pushes it into approvals.value on 'approval.submitted', which can produce
malformed records because only id, action_type, and title are checked; instead,
implement a runtime guard or hydrate before inserting: validate that payload
contains all required ApprovalItem fields (description, requested_by,
risk_level, status, metadata, created_at, etc.) or fetch the full approval by id
and only then push a complete ApprovalItem into approvals.value and increment
total.value; update the logic around event.event_type === 'approval.submitted',
payload, and approvals.value so you never insert payload as ApprovalItem without
full validation/hydration.

In `@web/src/stores/auth.ts`:
- Around line 126-127: The console.error call in the auth flow is logging the
full error object (the line with "Failed to fetch user profile:"), which may
include sensitive metadata; update the logging inside the function that fetches
the user profile (e.g., fetchUserProfile / the handler around that
console.error) to log a sanitized error instead—construct a minimal object with
only safe fields like { message: err?.message, code: err?.code } or call a small
sanitizeError(err) helper that strips stack/headers/body, use that in place of
the raw err in the log, and keep rethrowing the original error (throw err)
unchanged so behavior is preserved.

In `@web/src/stores/budget.ts`:
- Around line 35-41: The fetchRecords call currently doesn't preserve its params
so the budget.record_added WS handler prepends/unconditionally increments
records; store the last used params (e.g., lastFetchParams) when
fetchRecords(params) runs, and update the budget.record_added handler to (1)
ignore events whose agent_id or task_id don't match lastFetchParams (if
present), (2) when prepending a new record update records.value and
totalRecords.value but enforce the lastFetchParams.limit by trimming
records.value to that limit, and (3) when incrementing counts use
lastFetchParams to decide whether to apply the change; update references to
records.value and totalRecords.value and the budget.record_added handler
accordingly.
- Around line 10-13: isCostRecord currently only checks agent_id and cost_usd
which allows partial objects to be treated as full CostRecord and then stored
into records; update isCostRecord to validate every required CostRecord property
(e.g. agent_id: string, cost_usd: number, task_id: string, provider: string,
call_category: string, and timestamp as a number or valid ISO string) so it
reliably narrows unknown to CostRecord before insertion into records; adjust the
predicate implementation (isCostRecord) to cast payload to Record<string,
unknown> and explicitly check each field's existence and type/format, returning
false if any are missing or invalid.

In `@web/src/stores/company.ts`:
- Around line 44-47: fetchDepartments currently assigns only the first page from
companyApi.listDepartments, losing items when total > limit; change it to
repeatedly request pages (using MAX_PAGE_SIZE) until you've retrieved
result.meta.total items, concatenating each result.data into departments.value.
In each loop iteration call companyApi.listDepartments with the appropriate
pagination param (offset or page number / cursor) to fetch the next page, check
gen === departmentsGen before merging to avoid races, and break early if gen
changes; ensure the final departments.value contains all fetched pages.

In `@web/src/stores/messages.ts`:
- Around line 31-43: The fetchMessages function can be overwritten by
out-of-order responses; add a per-call request token (e.g. incrementing
currentRequestId stored outside the function) or use an AbortController to
cancel previous calls before calling messagesApi.listMessages, capture the
token/abort signal locally, and only assign messages.value, total.value, and
error.value (and clear loading.value) if the token matches the latestRequestId
(or the request was not aborted); ensure the token is set before awaiting
messagesApi.listMessages and checked in both the try and finally blocks so stale
responses do not commit state.

In `@web/src/stores/tasks.ts`:
- Around line 112-130: The handleWsEvent function currently casts event.payload
to Partial<Task> and may merge malformed payloads into tasks.value; add a
runtime guard that validates required Task fields (at minimum id plus other
non-nullable fields your UI expects) and types before appending or merging: in
the 'task.created' case validate payload is a complete Task object (or bail/log)
before pushing to tasks.value and incrementing total, and in the
'task.updated'/'task.status_changed'/'task.assigned' cases validate payload.id
and any fields you will merge (e.g., status, assignee) to avoid overwriting with
invalid values; use the existing WsEvent, Task, handleWsEvent, hasActiveFilters
and tasks.value symbols to locate where to perform these checks and return early
or log and ignore the event when validation fails.
- Around line 57-65: When creating a task in createTask, don’t unconditionally
append to tasks.value and bump total.value; first check currentFilters and
pagination context to ensure the new task would actually appear in the current
view. Implement a match check (e.g., reuse or add a helper like
matchesFilters(task, currentFilters) or reuse existing filter logic) and only
push into tasks.value and increment total.value when the created task satisfies
currentFilters (and fits current page criteria, e.g., on first page when
paginated); otherwise skip mutating tasks.value/total.value so the local
collection remains consistent with filtered/paginated views.
- Around line 42-47: In fetchTasks(), currentFilters.value is only replaced when
a filters argument is provided, so calling fetchTasks() without args reuses
previous filters; update fetchTasks (the async function fetchTasks(filters?:
TaskFilters)) to set currentFilters.value = { } (or an empty TaskFilters object)
when filters is undefined so callers that omit filters clear previously applied
filters and allow hasActiveFilters() to reflect no active filters.

In `@web/src/stores/websocket.ts`:
- Around line 50-53: The code currently embeds the JWT into the WebSocket URL
(getWsUrl() and token used to construct new WebSocket(url)) which leaks secrets;
change the flow to not send token as a query param—either implement the TODO
ticket handshake (request a one-time WS ticket from the server via XHR/fetch and
use that short-lived ticket instead of the JWT) or switch to a non-URL auth
mechanism (e.g., pass a one-time ticket via the Sec-WebSocket-Protocol or
upgrade over an authenticated HTTP handshake), update the socket creation to use
the ticket or protocol instead of `?token=...`, and remove or sanitize the raw
error logging for the WebSocket error handler (the code that logs the error
event) to avoid echoing secrets. Ensure references to getWsUrl(), token, new
WebSocket(...), and the socket error logging are updated accordingly.
- Around line 178-190: The unsubscribe() implementation currently checks
whole-subscription equality using channels.every(), which prevents removing
subscriptions that partially overlap (e.g., ['tasks','agents'] vs ['tasks']),
causing removed channels to be re-subscribed after reconnect; update
unsubscribe() to iterate activeSubscriptions and pendingSubscriptions and for
each subscription remove only the channels present in the unsubscribe set
(modify the subscription's channels array to filter out channelSet members) and
if a subscription's channels becomes empty, remove that subscription entry
entirely; ensure you use the existing variables activeSubscriptions,
pendingSubscriptions, and channelSet to perform in-place updates so reconnect
logic respects partial unsubscriptions.
- Around line 7-8: The regex in sanitizeLogValue is triggering the
noControlCharactersInRegex lint rule; instead of using a control-character range
in the regex, change sanitizeLogValue to filter characters by their code points
(e.g., iterate over the string or use Array.from and keep only chars with
charCodeAt >= 0x20 and != 0x7f) and then truncate to max, or alternatively add a
localized lint suppression comment above sanitizeLogValue if you intentionally
want the regex—prefer the refactor to a charCode-based filter to avoid the lint
rule and preserve behavior.

In `@web/src/utils/constants.ts`:
- Around line 55-66: NAV_ITEMS currently exposes links for routes the router
doesn't register yet (only /login, /setup and / exist), causing clicks to be
caught by the catch-all redirect; either remove or comment out the unreleased
entries in NAV_ITEMS (Org Chart, Tasks, Messages, Approvals, Agents, Budget,
Meetings, Artifacts, Settings) until the router supports them, or alternatively
add temporary placeholder routes for each path in your router setup so those
paths resolve instead of redirecting—update NAV_ITEMS or the router consistently
so navigation items only point to registered routes.

In `@web/src/utils/errors.ts`:
- Around line 55-61: The current check allows any plain Error through (error
instanceof Error) which lets backend messages leak; change the logic to only
pass through messages when the error is an explicit frontend-safe type (e.g.
FrontendError or SafeFrontendError) and reject plain Error instances. Update the
condition around error instanceof Error to instead check for the safe class
(e.g. error instanceof FrontendError) and keep the existing msg length/format
guards; for all other Error instances return the generic sanitized message. If
FrontendError doesn't exist yet, add a simple exported class (or type guard)
used by client code when throwing safe errors, and use that class name in the
check within the function.

In `@web/src/utils/format.ts`:
- Around line 60-68: formatUptime currently allows NaN and negative inputs which
produce invalid output like "NaNm" or "-1m"; update the formatUptime function to
validate and clamp its input by first checking Number.isFinite(seconds) and
seconds >= 0 (or coerce any invalid value to 0) before computing
days/hours/mins, then proceed with the existing breakdown and return; this
ensures the output is never negative or contains "NaN" and will produce a safe
fallback like "0m" for bad inputs.

In `@web/src/views/LoginPage.vue`:
- Around line 21-58: Extract the lockout logic into a shared composable (e.g.,
useLockout) that centralizes now/clockTimer, locked (computed from lockedUntil
and now), checkAndClearLockout, attempts and lockedUntil and exposes functions:
isLocked(), recordCredentialFailure(), and clearFailures(); update handleLogin
to only call recordCredentialFailure() when auth.login fails with a credential
error (not on network/5xx — detect via getErrorMessage or error type), and
derive the visible error text from isLocked()/lockedUntil+now rather than
setting error.value directly on lock creation; replace duplicated blocks in
LoginPage.vue and SetupPage.vue to call the composable APIs (use isLocked() to
short-circuit and to render the lockout message, and recordCredentialFailure()
on confirmed bad-credentials).

In `@web/src/views/PlaceholderHome.vue`:
- Around line 2-3: The loading placeholder div in PlaceholderHome.vue currently
renders passive text; add ARIA live-region semantics by updating the same div
(the element with class "flex items-center justify-center h-full
text-slate-400") to include live-region attributes such as role="status" and
aria-live="polite" (optionally aria-busy="true" while loading) so screen readers
announce the "Dashboard loading…" message during route loads.