fix(onboarding): improve account entry, discovery and star imports

[harlan-zw]

🔗 Linked issue

Implements the account and onboarding UX audit and its confirmed review findings.

❓ Type of change

• 📖 Documentation
• 🐞 Bug fix
• 👌 Enhancement
• ✨ New feature
• 🧹 Chore
• ⚠️ Breaking change

📚 Description

Sign-in hid the account benefits, selected likes could disappear, and star imports missed Repositories without “skill” in their names.
Show concrete account benefits and preserve Like intent through sign-in and retry.
Use NuxtSEO’s two-panel login layout with skilld branding.
Place the GitHub action before the benefits on phones.
Use explicit Sign In with GitHub and Sign Up with GitHub headings.
Switch views without losing Like or Watch intent.
Sign-up reveals compact account benefits with NuxtSEO’s panel and content transitions.
Sign-in collapses the benefits into a focused account entry.
Adapt NuxtSEO’s icon-led benefits, type hierarchy, and permission footer.
Use skilld’s editorial atmosphere, a larger logo, and a full-width permission divider.

Collapse recording prompts and expose Run controls on phones.
Guide accounts with watches and no likes toward discovery and Repository coverage.
Stage up to 1,000 GitHub stars before replacing an import, preserve previous coverage after failures, and label partial imports.
Reject malformed GitHub responses with the existing retry message.

Browser imports carry a generation identifier on every continuation.
Each public API request completes its bounded import on the server and returns nextPage: null.
The response fields stay unchanged, and the released CLI stops its import loop after that response.
A delayed legacy continuation also creates its own complete import, so it cannot mix another request’s pages.
Each GitHub page uses one staged SQL insert to stay within the Worker request budget.

Count browser sign-in clicks separately from server OAuth requests.
Click reporting requires a five-minute, single-use proof bound to the page and client.
Preparation and event intake use the existing guest rate limiter.
The browser requests proof only where a sign-in link exists. Reporting failures never block sign-in.
These limited events still do not prove a human conversion.

📝 Migration

The production workflow applies 0154_user_starred_import.sql and 0155_signup_click_proofs.sql before deployment.
For another environment, run pnpm exec wrangler d1 migrations apply DB --remote --config wrangler.jsonc before deploying this Worker.
The migrations add import staging and expiring click-proof tables.
They cannot recover an import overwritten by earlier code.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-12 04:51 UTC.

GitHub merged this pull request.

No material findings were recorded.

Another Agent took this Review.

[harlan-zw]

🤖 Harlan Agent Kit Agent browser evidence for c9a6de63a66ba01bda7f1b02a5e84fbef1578a53.

Ran the built Worker locally with migrated D1 and a synthetic account.
The phone login button fits within 390 × 844. The weekly preview opens its server-rendered page.
A trusted sign-in click posts to the analytics endpoint with HTTP 200. OAuth failure retains the selected Skill and action.
The Skill header Run link starts at y=259. It moves the Run and copy controls into view.
The recording prompt starts closed and opens with Enter. Clipboard contents match the Run prompt.
A watch-only account shows its Repository count. Its coverage link opens the watched Repository.

Live GitHub success and production migration remain unexercised.

Phone login	Skill demo

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: BLOCKED.

Read the Review results

[harlan-github-agent]

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: BLOCKED.

Read the Review results

[harlan-zw]

🤖 Harlan Agent Kit Agent verification of head 17657ce49ab66c363d335265d9883975470b3415.

The reported site / test failure is stale. GitHub reports that check as completed with success on this exact head. The complete Test run also completed successfully. The earlier failure belonged to c9a6de63a66ba01bda7f1b02a5e84fbef1578a53 and was repaired in 17657ce49ab66c363d335265d9883975470b3415.

This verifies the CI finding only. The Service owns its queued Repair and Review publication.

[harlan-zw]

🤖 Harlan Agent Kit Agent desktop preview of the login and sign-up page on head 17657ce49ab66c363d335265d9883975470b3415. The viewport is 1440 × 1000. New accounts and returning users share the GitHub action.

[harlan-zw]

🤖 Harlan Agent Kit Agent verification of the four media findings on head 17657ce49ab66c363d335265d9883975470b3415.

All four published attachments return HTTP 200 after following GitHub's redirect. The PNGs decode and were visually inspected. The SVG also renders through the review service's existing renderer.

• Architecture SVG: image/svg+xml, 19,722 bytes.
• Phone login PNG: image/png, 46,051 bytes, 390 × 964.
• Skill demo PNG: image/png, 94,661 bytes, 390 × 844.
• Watch-only account PNG: image/png, 24,631 bytes, 390 × 844.

The attachment URLs are healthy. The Service's HTTP 400 retrieval failure remains an operational issue. Its exact failing request was unavailable, so no speculative Service change was made.

[harlan-zw]

🤖 Harlan Agent Kit Agent assessment of head 0cef67c55b134147bbddd7fb08bab807b0435919.

The Service review was stopped for this exact head under the PR skill’s capacity fallback.
Seven Review Tasks were queued against two free host slots.
An independent, read-only Agent reviewed the complete diff, surrounding boundaries, tests, and screenshots.
No confirmed finding above 80/100 remains. All current-head GitHub Actions checks passed.
This assessment is separate from Service READY. Human merge decision remains required.

Logged (18/100): cached proof can undercount another click after returning to the same page.
Sign-in remains functional. This repeats the existing Service finding.
Fixed (30/100): restored the architecture image to its healthy GitHub attachment URL.
The published body now contains the attachment URL and preserves its AI disclosure.

Assessment confidence: 90/100. Deducted five for the broad diff and five for limited live coverage.
Successful live OAuth and the production migration were not exercised.

Desktop and phone browser evidence

[harlan-zw]

🤖 Harlan Agent Kit browser check of head a4b466f. Adapted the NuxtSEO layout, benefit icons, hierarchy and permission footer to skilld. Checked the production build at 1440px, 768px and 375px. Both themes show the GitHub action. Phone action is 44px tall, with no horizontal overflow. Existing weekly and digest preview links open their real pages.

[harlan-zw]

🤖 Harlan Agent Kit Agent assessment of head a4b466fa3f4ba2fc7123a16e2ff1cb96c240d1d1.

The Service review stopped for this exact head under the PR skill’s capacity fallback.
Eleven Review or Repair Tasks exceeded two free host slots.
An independent Agent reviewed the complete diff, surrounding boundaries, tests, and original-resolution images.
No confirmed finding above 80/100 remains. All applicable current-head GitHub Actions checks passed, including site / test.
This assessment is separate from Service READY. Human merge decision remains required.

Logged (18/100): returning to the same login page can suppress another click count for four minutes.
Sign-in works. Optional follow-up: reset proof preparation after consumption while preserving single-use intake.

Assessment confidence: 90/100. Deducted five for the broad diff and five for limited live coverage.
Live OAuth success, ten-page provider latency, and production migration were not exercised.

Desktop, light and phone browser evidence

[harlan-zw]

🤖 Harlan Agent Kit browser check of head 02c451c. Sign-up and sign-in use the requested headings and NuxtSEO switch transitions. Sign-up reveals the compact benefits panel; sign-in collapses it. The permission divider spans the card, both preview links are removed, and the logo is 144px wide. Checked the built Worker at 1440px and 375px. The switch and browser Back retain Like intent and the OAuth retry error.

[harlan-zw]

🤖 Harlan Agent Kit Agent assessment of head 02c451c1652508d975b355cbd077433810a4d04d.

The Service review stopped for this exact head under the PR skill’s capacity fallback.
Ten Review or Repair Tasks were queued with no free host slots.
An independent Agent reviewed the complete diff, surrounding boundaries, tests, and original-resolution images.
No confirmed finding above 80/100 remains. All applicable current-head Actions checks passed, including site / test.
This assessment is separate from Service READY. Human merge decision remains required.

Logged (18/100): returning to the same login page can suppress another click count for four minutes.
Sign-in works. Optional follow-up: reset proof preparation after consumption while preserving single-use intake.

Assessment confidence: 90/100. Deducted five for the broad diff and five for limited live coverage.
Live OAuth success, ten-page provider latency, and production migration were not exercised.

Sign-up, sign-in and phone browser evidence

[harlan-zw]

🤖 Agent visual check: aligned desktop cards, compact benefits, clearer account purpose, larger GitHub action, and full-width permission divider. Checked sign-in and sign-up at desktop and phone widths in light and dark themes. Mode switching preserves the requested action and return page.

[harlan-zw]

🤖 Harlan Agent Kit Agent assessment of head 9101576. The exact-head Service review was stopped because ten review or repair tasks exceeded three free host slots. One independent agent reviewed the complete diff, surrounding boundaries, architecture evidence, and final original-resolution screenshots. No confirmed finding exceeds 80/100. Confidence: 90/100. Repeat anonymous click counts can be undercounted after returning within four minutes, Logged 18/100. Authentication remains usable. All applicable CI checks passed for this head. Desktop and phone UI checks passed in both themes. Live OAuth completion, production migrations, and live GitHub import latency were not exercised by this assessment. This is an independent assessment, separate from Service READY.