Fix paid AI action billing and fail-closed build pushes

[cursor]

Bug and impact

• Build This App created public GitHub repos, did not deduct the advertised 500 credits, and emitted done even when file generation or GitHub/GitLab pushes failed. A paid user could get free external builds, leak generated code publicly on GitHub, or see a successful build for an incomplete repo.
• Scaffold and legacy analysis routes trusted/requested body userId for billing, allowing charges to be skipped or applied to another account instead of the authenticated user.
• Credit deductions used a read-modify-write balance update, allowing concurrent paid actions to overspend or lose balance updates.

Root cause

• Paid action routes charged late or not at all and accepted client-controlled billing identities.
• Build push helpers logged non-2xx responses instead of throwing, and generation failures were converted into placeholder files.
• deductCredits computed balances outside the SQL update predicate.

Fix

• Charge authenticated users before scaffold, legacy analysis, and Build This App work; refund on post-charge failures.
• Make GitHub build repos private, dedupe generated paths, and fail SSE streams with error (no done) on generation/empty output/push failures.
• Make credit deduction/refund atomic SQL update+transaction operations.

Validation

• pnpm exec tsc --noEmit
• pnpm exec eslint app/api/build-app/route.ts app/api/generate-scaffold/route.ts app/api/analyses/[id]/analyze/route.ts lib/credits.ts
• git diff --check HEAD~1..HEAD
• Mocked critical-path harness covering private GitHub repo creation, build insufficient-credit short-circuit, push failure refund/no-done behavior, scaffold authenticated-user billing/refund, legacy analysis auth billing, and atomic credit SQL shape.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
repo-app-architect	Ready	Preview, Comment	Jul 6, 2026 11:14am
repofuse	Ready	Preview, Comment, Open in v0	Jul 6, 2026 11:14am
v0-repo-app-architect	Ready	Preview, Comment, Open in v0	Jul 6, 2026 11:14am