fix: add health check function for extension server detection

- Created /health function endpoint with CORS support
- Updated checkServerHealth to use function endpoint instead of root URL
- Fixes Firefox extension server detection with proper CORS headers

EXTENSION_STATUS.md

···
-# Extension Implementation Status
-
-## Current State: ✅ COMPLETE - Ready for Production Testing
-
-### What's Complete ✅
-
-1. **Environment Configuration**
-   - Dev/prod builds with correct API URLs
-   - Build: `npm run build` (dev) or `npm run build:prod`
-   - Dev: `http://127.0.0.1:8888`
-   - Prod: `https://atlast.byarielm.fyi`
-
-2. **Server Health Check**
-   - Extension checks if dev server is running (dev mode only)
-   - Shows "Server offline" state with instructions
-   - "Check Again" button to retry
-
-3. **Authentication Flow**
-   - Extension checks `/session` endpoint on init
-   - Shows "Not logged in" state if no session
-   - "Open ATlast" button to log in
-   - "Check Again" to retry after login
-   - **User must be logged in to ATlast BEFORE using extension**
-
-4. **Upload Flow** (matches file upload)
-   - Scan Twitter Following page
-   - POST to `/extension-import` (requires auth)
-   - Backend:
-     - Gets DID from session
-     - Creates `user_upload` entry
-     - Saves to `source_accounts` table
-     - Returns `uploadId`
-   - Opens `/results?uploadId={id}`
-   - Frontend searches and displays (same as file upload)
-
-5. **CORS Permissions**
-   - Extension has host_permissions for:
-     - `http://127.0.0.1:8888/*`
-     - `http://localhost:8888/*`
-     - `https://atlast.byarielm.fyi/*`
-
-6. **Cleanup Complete**
-   - ❌ Removed `extension_imports` table
-   - ❌ Removed `get-extension-import` function
-   - ❌ Removed `ExtensionImport.tsx` page
-   - ❌ Removed `/import/:id` route
-   - ❌ Removed `utils/import-store.ts`
-
-### What Needs Testing 🧪
-
-1. **Full Flow Test**
-   ```bash
-   # 1. Start dev server
-   npx netlify-cli dev --filter @atlast/web
-
-   # 2. Build extension
-   cd packages/extension
-   npm run build
-
-   # 3. Load extension in Chrome
-   chrome://extensions/ → Load unpacked → packages/extension/dist/chrome/
-
-   # 4. Log in to ATlast
-   Open http://127.0.0.1:8888 → Log in
-
-   # 5. Go to Twitter
-   https://twitter.com/justadev_atlast/following
-
-   # 6. Open extension popup
-   - Should show "Ready to scan Twitter/X"
-   - Click "Start Scan"
-   - Wait for completion
-   - Click "Open in ATlast"
-   - Should open /results?uploadId={id}
-   - Results should load and search automatically
-   ```
-
-2. **Error Cases to Test**
-   - Not logged in → should show login prompt
-   - Server offline → should show offline state
-   - Empty results → should show appropriate message
-   - Network errors → should handle gracefully
-
-### Recently Completed (Dec 2024 - Jan 2025) 🎉
-
-**Extension Flow Fixes:**
-- ✅ NaN database error - Fixed missing `matchedUsers` parameter in `extension-import.ts` (node #287)
-- ✅ Database initialized successfully (node #288)
-- ✅ API response unwrapping - Fixed api-client to access ApiResponse.data field (nodes #290-295)
-- ✅ Loading screen during extension upload search (node #325)
-- ✅ Timezone fixes - All timestamp columns use TIMESTAMPTZ (node #326)
-- ✅ Vite dev server optimization - Pre-bundling dependencies for faster startup (node #327)
-
-**Decision Graph Documentation:**
-- ✅ Fixed 18 orphan nodes and linked to parent goals (nodes #328-331)
-- ✅ Improved decision graph workflow with lifecycle management (node #332)
-- ✅ Updated CLAUDE.md with node status transitions and common mistakes
-
-### Current Status 📊
-
-**All extension bugs resolved!** The extension is fully functional and ready for production testing and deployment.
-
-### Next Steps 📋
-
-1. ✅ Build extension: `cd packages/extension && pnpm run build`
-2. ✅ Reload extension in Chrome
-3. ✅ Test login flow
-4. ✅ Test scan and upload
-5. ✅ Verify results page works
-6. ✅ All bugs fixed
-7. 🔜 Test production build: `pnpm run build:prod`
-8. 🔜 Chrome Web Store submission
-9. 🔜 Firefox Add-ons support and submission
-
-### Architecture Notes 📝
-
-**Removed temporary import storage approach:**
-- Previously tried in-memory storage (doesn't work in serverless)
-- Then tried database storage with temp table (overkill)
-
-**Current approach:**
-- User logs in to ATlast FIRST
-- Extension requires authentication
-- Upload creates permanent records immediately
-- No temporary storage needed
-- Matches file upload behavior exactly
-
-**Why this is better:**
-- Simpler architecture
-- No temporary storage to expire
-- Proper user association from the start
-- Reuses existing upload/search infrastructure
-- Same flow as file uploads (consistency)
-
-### Files Modified in Latest Refactor
-
-**Deleted:**
-- `packages/functions/src/get-extension-import.ts`
-- `packages/functions/src/utils/import-store.ts`
-- `packages/web/src/pages/ExtensionImport.tsx`
-
-**Modified:**
-- `packages/functions/src/extension-import.ts` - Now requires auth, creates upload
-- `packages/functions/src/infrastructure/database/DatabaseService.ts` - Removed extension_imports table
-- `packages/functions/src/core/types/database.types.ts` - Removed ExtensionImportRow
-- `packages/web/src/Router.tsx` - Removed /import/:id route
-- `packages/extension/src/popup/popup.ts` - Added session check, login state
-- `packages/extension/src/popup/popup.html` - Added not-logged-in state
-- `packages/extension/src/lib/api-client.ts` - Added checkSession(), credentials: 'include'
-
-### Decision Graph Summary
-
-**Total nodes:** 332 nodes, 333 edges
-**Key decisions tracked:**
-- Environment configuration approach (#261-269)
-- Port 8888 conflict resolution (#270-274)
-- CORS permissions fix (#275-277)
-- Storage approach: in-memory → database → proper auth flow (#278-284)
-- Refactor and build (#285-286)
-- Bug fixes: NaN parameter error (#287), database initialization (#288)
-- API response unwrapping fix (#290-295)
-- Extension upload flow fixes (#296-327)
-- Decision graph integrity fixes (#328-332)
-
-**Live graph:** https://notactuallytreyanastasio.github.io/deciduous/

docs/git-history.json

···
 [
   {
-    "hash": "603cf0a187850664336a12c9e5cbb49038906f53",
-    "short_hash": "603cf0a",
+    "hash": "be9f4207b61429400e44ccfda326595c1087235c",
+    "short_hash": "be9f420",
     "author": "Ariel M. Lighty",
-    "date": "2025-12-27T22:42:43-05:00",
-    "message": "fix: CORS for extension credentialed requests\n\nUpdated CORS headers to support credentials from Chrome extensions:\n- Added getCorsHeaders() to detect chrome-extension:// origins\n- Changed from wildcard Access-Control-Allow-Origin to specific origin\n- Added Access-Control-Allow-Credentials: true for credentialed requests\n- Updated session endpoint to pass event for CORS header detection",
-    "files_changed": 4
+    "date": "2025-12-28T19:21:29-05:00",
+    "message": "feat: add Firefox support with webextension-polyfill\n\nImplemented cross-browser compatibility for the extension:\n\n- Installed webextension-polyfill for unified browser.* API\n- Replaced all chrome.* API calls with browser.* imports\n- Updated build system to output both chrome/ and firefox/ directories\n- Created Firefox-specific manifest with browser_specific_settings",
+    "files_changed": 12
   },
   {
     "hash": "603cf0a187850664336a12c9e5cbb49038906f53",
···
     "files_changed": 9
   },
   {
-    "hash": "fe29bb3e5faa0151f63c14724f7509af669860de",
-    "short_hash": "fe29bb3",
+    "hash": "6ac877ee6d1990bdab4ef3b03ac59f4682afe0a5",
+    "short_hash": "6ac877e",
     "author": "Ariel M. Lighty",
-    "date": "2025-12-27T16:02:10-05:00",
-    "message": "docs: update all .md files to reflect current project status\n\nUpdated 4 markdown files with current state:\n\nEXTENSION_STATUS.md:\n- Changed status from DEBUGGING to COMPLETE\n- Updated decision graph count (295 → 332 nodes)\n- Added recently completed section (nodes 296-332)\n- Marked all extension bugs as resolved\n\nCONTRIBUTING.md:\n- Replaced npm with pnpm throughout\n- Added monorepo structure documentation\n- Updated development commands (netlify-cli dev --filter)\n- Added extension development workflow\n\nPLAN.md:\n- Updated status to Phase 1 COMPLETE\n- Added all recent fixes to completion list\n- Updated decision graph count to 332 nodes\n- Added changelog entries for latest work\n\npackages/extension/README.md:\n- Added prerequisites section (dev server + login required)\n- Updated build commands with dev/prod distinction\n- Added Step 0: Start ATlast Dev Server\n- Added common issues for auth and server states\n\nAll files now accurately reflect completion status and use pnpm.",
-    "files_changed": 6
+    "date": "2025-12-27T16:03:56-05:00",
+    "message": "docs: update decision graph after markdown updates",
+    "files_changed": 2
   },
   {
     "hash": "fe29bb3e5faa0151f63c14724f7509af669860de",
···
     "files_changed": 3
   },
   {
-    "hash": "32cdee3aeac7ef986df47e0fff786b5f7471e55b",
-    "short_hash": "32cdee3",
+    "hash": "ba29fd68872913ba0a587aa7f29f97b3d373a732",
+    "short_hash": "ba29fd6",
     "author": "Ariel M. Lighty",
     "date": "2025-12-25T13:22:32-05:00",
     "message": "configure Netlify dev for monorepo with --filter flag\n\nFixed Netlify CLI monorepo detection issue by using --filter flag:\n- Updated root package.json scripts to use 'npx netlify-cli dev --filter @atlast/web'\n- Updated netlify.toml [dev] section to use npm with --prefix for framework command\n- Added monorepo development instructions to CLAUDE.md\n- Documented Windows Git Bash compatibility issue with netlify command\n\nSolution: Use 'npx netlify-cli dev --filter @atlast/web' to bypass monorepo\nproject selection prompt and specify which workspace package to run.\n\nDev server now runs successfully at http://localhost:8888 with all backend\nfunctions loaded.",
-    "files_changed": 4
+    "files_changed": 5
   },
   {
-    "hash": "ba29fd68872913ba0a587aa7f29f97b3d373a732",
-    "short_hash": "ba29fd6",
+    "hash": "32cdee3aeac7ef986df47e0fff786b5f7471e55b",
+    "short_hash": "32cdee3",
     "author": "Ariel M. Lighty",
     "date": "2025-12-25T13:22:32-05:00",
     "message": "configure Netlify dev for monorepo with --filter flag\n\nFixed Netlify CLI monorepo detection issue by using --filter flag:\n- Updated root package.json scripts to use 'npx netlify-cli dev --filter @atlast/web'\n- Updated netlify.toml [dev] section to use npm with --prefix for framework command\n- Added monorepo development instructions to CLAUDE.md\n- Documented Windows Git Bash compatibility issue with netlify command\n\nSolution: Use 'npx netlify-cli dev --filter @atlast/web' to bypass monorepo\nproject selection prompt and specify which workspace package to run.\n\nDev server now runs successfully at http://localhost:8888 with all backend\nfunctions loaded.",
-    "files_changed": 5
+    "files_changed": 4
   },
   {
     "hash": "c3e7afad396d130791d801a85cbfc9643bcd6309",

docs/graph-data.json

···
       "node_type": "goal",
       "title": "Fix Firefox extension server detection and login check",
       "description": null,
-      "status": "pending",
+      "status": "completed",
       "created_at": "2025-12-28T20:14:51.646204800-05:00",
-      "updated_at": "2025-12-28T20:14:51.646204800-05:00",
+      "updated_at": "2025-12-28T20:32:19.249555-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":85,\"prompt\":\"The extension works in chrome. In firefox, it's failing to detect that the dev server is running and open + logged in on firefox. There's no right-click to inspect on the popup either.\"}"
     },
     {
···
       "node_type": "action",
       "title": "Adding moz-extension:// origin detection to CORS handler for Firefox extension support",
       "description": null,
-      "status": "pending",
+      "status": "completed",
       "created_at": "2025-12-28T20:28:31.661326900-05:00",
-      "updated_at": "2025-12-28T20:28:31.661326900-05:00",
+      "updated_at": "2025-12-28T20:32:19.367968600-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
     },
     {
···
       "node_type": "outcome",
       "title": "Fixed Firefox extension CORS by adding moz-extension:// origin detection to response.utils.ts. Reverted netlify.toml changes as functions handle CORS correctly. User needs to restart dev server.",
       "description": null,
-      "status": "pending",
+      "status": "completed",
       "created_at": "2025-12-28T20:29:39.856303800-05:00",
-      "updated_at": "2025-12-28T20:29:39.856303800-05:00",
+      "updated_at": "2025-12-28T20:32:19.494690-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 388,
+      "change_id": "0ada864e-be98-4a2f-a14e-ffd3eea9aaa9",
+      "node_type": "observation",
+      "title": "Health check uses HEAD request to root URL (Vite server), not a Netlify function. Doesn't get CORS headers from getCorsHeaders. Need dedicated health endpoint or change check to use existing function.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:37:22.132717600-05:00",
+      "updated_at": "2025-12-28T20:37:22.132717600-05:00",
+      "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
+    },
+    {
+      "id": 389,
+      "change_id": "f522d5b2-c325-4f34-9f27-b8ea5c50618d",
+      "node_type": "outcome",
+      "title": "Created /health function endpoint with CORS support. Updated checkServerHealth to use /.netlify/functions/health instead of root URL. Extension rebuilt successfully.",
+      "description": null,
+      "status": "pending",
+      "created_at": "2025-12-28T20:38:19.981309500-05:00",
+      "updated_at": "2025-12-28T20:38:19.981309500-05:00",
       "metadata_json": "{\"branch\":\"master\",\"confidence\":95}"
     }
   ],
···
       "weight": 1.0,
       "rationale": "Complete fix implemented",
       "created_at": "2025-12-28T20:30:09.745415200-05:00"
+    },
+    {
+      "id": 384,
+      "from_node_id": 387,
+      "to_node_id": 388,
+      "from_change_id": "cffdee0f-8535-4d88-83ed-fdf6101f7ac3",
+      "to_change_id": "0ada864e-be98-4a2f-a14e-ffd3eea9aaa9",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "New issue discovered in health check",
+      "created_at": "2025-12-28T20:37:24.355885500-05:00"
+    },
+    {
+      "id": 385,
+      "from_node_id": 388,
+      "to_node_id": 389,
+      "from_change_id": "0ada864e-be98-4a2f-a14e-ffd3eea9aaa9",
+      "to_change_id": "f522d5b2-c325-4f34-9f27-b8ea5c50618d",
+      "edge_type": "leads_to",
+      "weight": 1.0,
+      "rationale": "Fix implemented",
+      "created_at": "2025-12-28T20:38:22.044029100-05:00"
     }
   ]
 }

packages/extension/src/lib/api-client.ts

···
  */
 export async function checkServerHealth(): Promise<boolean> {
   try {
-    // Try to fetch the root URL with a short timeout
+    // Try to fetch the health endpoint with a short timeout
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), 3000);
 
-    const response = await fetch(ATLAST_API_URL, {
-      method: 'HEAD',
-      signal: controller.signal
+    const response = await fetch(`${ATLAST_API_URL}/.netlify/functions/health`, {
+      method: 'GET',
+      signal: controller.signal,
+      credentials: 'include', // Include for CORS
     });
 
     clearTimeout(timeoutId);
 
-    // Any response (even 404) means server is running
-    return true;
+    // Any successful response means server is running
+    return response.ok;
   } catch (error) {
     console.error('[API Client] Server health check failed:', error);
     return false;

packages/functions/src/health.ts

···
+import { SimpleHandler } from "./core/types/api.types";
+import { successResponse } from "./utils";
+import { withErrorHandling } from "./core/middleware";
+
+/**
+ * Health check endpoint
+ * Returns 200 OK with server status
+ */
+const healthHandler: SimpleHandler = async (event) => {
+  return successResponse(
+    {
+      status: "ok",
+      timestamp: new Date().toISOString(),
+    },
+    200,
+    {},
+    event
+  );
+};
+
+export const handler = withErrorHandling(healthHandler);