residual fixes

src/lib/components/AddRepositoryModal.svelte

@@ -67,6 +67,7 @@
 		<div class="mb-5 flex items-center justify-between">
 			<h2 class="text-lg font-semibold text-gray-900">Add Repository</h2>
 			<button
+				type="button"
 				onclick={onClose}
 				class="rounded-lg p-1 text-gray-400 hover:bg-gray-100 hover:text-gray-600"
 				aria-label="Close"
@@ -81,6 +82,7 @@
 
 		<div class="mb-5 flex gap-2">
 			<button
+				type="button"
 				class="flex-1 rounded-lg py-2 text-sm transition-colors {source === 'github'
 					? 'bg-blue-600 text-white'
 					: 'border border-gray-200 text-gray-700 hover:bg-gray-50'}"
@@ -89,6 +91,7 @@
 				GitHub
 			</button>
 			<button
+				type="button"
 				class="flex-1 rounded-lg py-2 text-sm transition-colors {source === 'local'
 					? 'bg-blue-600 text-white'
 					: 'border border-gray-200 text-gray-700 hover:bg-gray-50'}"
@@ -151,12 +154,14 @@
 
 		<div class="mt-6 flex justify-end gap-3">
 			<button
+				type="button"
 				onclick={onClose}
 				class="rounded-lg border border-gray-200 px-4 py-2 text-sm text-gray-700 hover:bg-gray-50"
 			>
 				Cancel
 			</button>
 			<button
+				type="button"
 				onclick={handleSubmit}
 				disabled={loading || !sourceUrl.trim()}
 				class="rounded-lg bg-blue-600 px-4 py-2 text-sm text-white hover:bg-blue-700 disabled:cursor-not-allowed disabled:opacity-50"

src/lib/components/RepositoryCard.svelte

@@ -67,6 +67,7 @@
 
 	<div class="mt-4 flex flex-wrap gap-2">
 		<button
+			type="button"
 			onclick={() => onReindex(repo.id)}
 			class="rounded-lg bg-blue-600 px-3 py-1.5 text-sm text-white hover:bg-blue-700 disabled:cursor-not-allowed disabled:opacity-50"
 			disabled={repo.state === 'indexing'}
@@ -80,6 +81,7 @@
 			Details
 		</a>
 		<button
+			type="button"
 			onclick={() => onDelete(repo.id)}
 			class="ml-auto rounded-lg px-3 py-1.5 text-sm text-red-600 hover:bg-red-50"
 		>

src/routes/+page.svelte

@@ -100,6 +100,7 @@
 		</p>
 	</div>
 	<button
+		type="button"
 		onclick={() => (showAddModal = true)}
 		class="flex items-center gap-1.5 rounded-lg bg-blue-600 px-4 py-2 text-sm font-medium text-white hover:bg-blue-700"
 	>
@@ -139,6 +140,7 @@
 			retrieval.
 		</p>
 		<button
+			type="button"
 			onclick={() => (showAddModal = true)}
 			class="mt-6 flex items-center gap-1.5 rounded-lg bg-blue-600 px-5 py-2.5 text-sm font-medium text-white hover:bg-blue-700"
 		>

src/routes/api/v1/libs/+server.ts

@@ -28,8 +28,8 @@ export const GET: RequestHandler = ({ url }) => {
 		const libraries = service.list({ state: state ?? undefined, limit, offset });
 		const total = service.count(state ?? undefined);
 
-		// Augment each library with its versions array
+		// Augment each library with its versions array; strip sensitive fields.
-		const enriched = libraries.map((repo) => ({
+		const enriched = libraries.map(({ githubToken: _token, ...repo }) => ({
 			...repo,
 			versions: service.getVersions(repo.id)
 		}));
@@ -63,8 +63,9 @@ export const POST: RequestHandler = async ({ request }) => {
 			jobResponse = { id: job.id, status: job.status };
 		}
 
+		const { githubToken: _token, ...safeRepo } = repo;
 		return json(
-			{ library: repo, ...(jobResponse ? { job: jobResponse } : {}) },
+			{ library: safeRepo, ...(jobResponse ? { job: jobResponse } : {}) },
 			{ status: 201 }
 		);
 	} catch (err) {

src/routes/api/v1/libs/[id]/+server.ts

@@ -22,7 +22,8 @@ export const GET: RequestHandler = ({ params }) => {
 			return json({ error: 'Repository not found', code: 'NOT_FOUND' }, { status: 404 });
 		}
 		const versions = service.getVersions(id);
-		return json({ ...repo, versions });
+		const { githubToken: _token, ...safeRepo } = repo;
+		return json({ ...safeRepo, versions });
 	} catch (err) {
 		return handleServiceError(err);
 	}
@@ -39,7 +40,8 @@ export const PATCH: RequestHandler = async ({ params, request }) => {
 			branch: body.branch,
 			githubToken: body.githubToken
 		});
-		return json(updated);
+		const { githubToken: _token, ...safeUpdated } = updated;
+		return json(safeUpdated);
 	} catch (err) {
 		return handleServiceError(err);
 	}