fix: address greptile authz follow-ups

server/src/__tests__/app-private-hostname-gate.test.ts

@@ -2,13 +2,20 @@ import { describe, expect, it } from "vitest";
 import { shouldEnablePrivateHostnameGuard } from "../app.ts";
 
 describe("shouldEnablePrivateHostnameGuard", () => {
-  it("enables the hostname guard for local_trusted mode", () => {
+  it("enables the hostname guard for local_trusted private deployments", () => {
     expect(shouldEnablePrivateHostnameGuard({
       deploymentMode: "local_trusted",
       deploymentExposure: "private",
     })).toBe(true);
   });
 
+  it("does not enable the hostname guard for local_trusted public deployments", () => {
+    expect(shouldEnablePrivateHostnameGuard({
+      deploymentMode: "local_trusted",
+      deploymentExposure: "public",
+    })).toBe(false);
+  });
+
   it("enables the hostname guard for authenticated private deployments", () => {
     expect(shouldEnablePrivateHostnameGuard({
       deploymentMode: "authenticated",

server/src/__tests__/health.test.ts

@@ -102,6 +102,40 @@ describe("GET /health", () => {
     });
   });
 
+  it("redacts detailed metadata when authenticated mode is reached without auth middleware", async () => {
+    const devServerStatus = await import("../dev-server-status.js");
+    vi.spyOn(devServerStatus, "readPersistedDevServerStatus").mockReturnValue(undefined);
+    const { healthRoutes } = await import("../routes/health.js");
+    const db = {
+      execute: vi.fn().mockResolvedValue([{ "?column?": 1 }]),
+      select: vi.fn(() => ({
+        from: vi.fn(() => ({
+          where: vi.fn().mockResolvedValue([{ count: 1 }]),
+        })),
+      })),
+    } as unknown as Db;
+    const app = express();
+    app.use(
+      "/health",
+      healthRoutes(db, {
+        deploymentMode: "authenticated",
+        deploymentExposure: "public",
+        authReady: true,
+        companyDeletionEnabled: false,
+      }),
+    );
+
+    const res = await request(app).get("/health");
+
+    expect(res.status).toBe(200);
+    expect(res.body).toEqual({
+      status: "ok",
+      deploymentMode: "authenticated",
+      bootstrapStatus: "ready",
+      bootstrapInviteActive: false,
+    });
+  });
+
   it("keeps detailed metadata for authenticated requests in authenticated mode", async () => {
     const devServerStatus = await import("../dev-server-status.js");
     vi.spyOn(devServerStatus, "readPersistedDevServerStatus").mockReturnValue(undefined);

server/src/app.ts

@@ -90,8 +90,10 @@ export function shouldEnablePrivateHostnameGuard(opts: {
   deploymentMode: DeploymentMode;
   deploymentExposure: DeploymentExposure;
 }): boolean {
-  return opts.deploymentMode === "local_trusted" ||
-    (opts.deploymentMode === "authenticated" && opts.deploymentExposure === "private");
+  return (
+    opts.deploymentExposure === "private" &&
+    (opts.deploymentMode === "local_trusted" || opts.deploymentMode === "authenticated")
+  );
 }
 
 export async function createApp(

server/src/routes/health.ts

@@ -12,8 +12,7 @@ function shouldExposeFullHealthDetails(
   deploymentMode: DeploymentMode,
 ) {
   if (deploymentMode !== "authenticated") return true;
-  if (!actorType) return true;
-  return actorType !== "none";
+  return actorType === "board" || actorType === "agent";
 }
 
 export function healthRoutes(

server/src/services/company-portability.ts

@@ -3948,7 +3948,11 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
     const warnings = [...plan.preview.warnings];
     const include = plan.include;
 
-    let targetCompany: { id: string; name: string } | null = null;
+    let targetCompany: {
+      id: string;
+      name: string;
+      requireBoardApprovalForNewAgents?: boolean | null;
+    } | null = null;
     let companyAction: "created" | "updated" | "unchanged" = "unchanged";
 
     if (input.target.mode === "new_company") {
@@ -4206,8 +4210,8 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
         }
 
         const requiresApproval =
-          typeof (targetCompany as { requireBoardApprovalForNewAgents?: unknown }).requireBoardApprovalForNewAgents === "boolean"
-            ? Boolean((targetCompany as { requireBoardApprovalForNewAgents?: boolean }).requireBoardApprovalForNewAgents)
+          typeof targetCompany.requireBoardApprovalForNewAgents === "boolean"
+            ? targetCompany.requireBoardApprovalForNewAgents
             : include.company
               ? (sourceManifest.company?.requireBoardApprovalForNewAgents ?? true)
               : true;