Fix auth deploy: env after pull, sidebar without asChild.

AUTH_JWT_SECRET was never written because upsert ran before git pull;
sidebar used Button asChild which Base UI does not support.

Co-authored-by: Cursor <cursoragent@cursor.com>

frontend/src/components/layout/sidebar-auth.tsx

@@ -6,7 +6,8 @@
 import Link from "next/link";
 import { useOptionalAuth, useOptionalUser } from "@/hooks/use-optional-auth";
 import { authEnabled, localAuthEnabled } from "@/lib/auth";
-import { Button } from "@/components/ui/button";
+import { buttonVariants } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
 
 export function SidebarCredits() {
   return null;
@@ -27,12 +28,18 @@ export function SidebarUserButton() {
   if (!isSignedIn || !user) {
     return (
       <div className="flex flex-col gap-1 px-1">
-        <Button asChild size="sm" variant="outline" className="w-full justify-start">
-          <Link href="/sign-in">Sign in</Link>
-        </Button>
-        <Button asChild size="sm" variant="ghost" className="w-full justify-start">
-          <Link href="/sign-up">Create account</Link>
-        </Button>
+        <Link
+          href="/sign-in"
+          className={cn(buttonVariants({ size: "sm", variant: "outline" }), "w-full justify-start")}
+        >
+          Sign in
+        </Link>
+        <Link
+          href="/sign-up"
+          className={cn(buttonVariants({ size: "sm", variant: "ghost" }), "w-full justify-start")}
+        >
+          Create account
+        </Link>
       </div>
     );
   }
@@ -43,17 +50,19 @@ export function SidebarUserButton() {
       {user.email && user.name ? (
         <div className="truncate text-[11px] text-muted-foreground">{user.email}</div>
       ) : null}
-      <Button
-        size="sm"
-        variant="ghost"
-        className="h-7 justify-start px-0 text-xs text-muted-foreground"
+      <button
+        type="button"
+        className={cn(
+          buttonVariants({ size: "sm", variant: "ghost" }),
+          "h-7 justify-start px-0 text-xs text-muted-foreground",
+        )}
         onClick={() => {
           signOut?.();
           window.location.href = "/sign-in";
         }}
       >
         Sign out
-      </Button>
+      </button>
     </div>
   );
 }

scripts/update-pinscope.sh

@@ -118,13 +118,6 @@ upsert_env NEXT_PUBLIC_API_URL "$SITE" .env
 # JSON list — keep it a single line so docker compose / pydantic-settings parse it.
 upsert_env CORS_ORIGINS "[\"$SITE\"]" .env
 
-# Self-host multi-user auth (Pinscope accounts). Generate a secret once if missing.
-if [[ -z "$(read_env AUTH_JWT_SECRET .env || true)" ]]; then
-  log "Generating AUTH_JWT_SECRET for local multi-user auth"
-  upsert_env AUTH_JWT_SECRET "$(openssl rand -hex 32)" .env
-fi
-upsert_env NEXT_PUBLIC_AUTH_MODE "local" .env
-
 KEY="$(read_env DEEPSEEK_API_KEY .env || true)"
 if [[ -z "$KEY" || "$KEY" == "sk-..." ]]; then
   die "Set a real DEEPSEEK_API_KEY in $ROOT/.env before updating."
@@ -144,6 +137,13 @@ else
   log "Skipping git pull (--no-pull)"
 fi
 
+# Self-host multi-user auth — after pull so this script's upsert logic is current.
+if [[ -z "$(read_env AUTH_JWT_SECRET .env || true)" ]]; then
+  log "Generating AUTH_JWT_SECRET for local multi-user auth"
+  upsert_env AUTH_JWT_SECRET "$(openssl rand -hex 32)" .env
+fi
+upsert_env NEXT_PUBLIC_AUTH_MODE "local" .env
+
 log "docker compose up -d --build (data/ is kept)"
 compose up -d --build