* feat: email-based password reset flow (IDEA-81)
Add full password reset flow: forgot password request, time-limited
reset tokens (1hr, single-use, SHA-256 hashed), new password form,
and automatic session creation after reset.
* fix: use all: prefix in go:embed to include _-prefixed files
Go's embed package excludes files starting with _ or . when recursing
directories. SvelteKit/Vite occasionally generates chunk filenames with
_ prefixes (e.g. _VLZtjCJ.js), causing them to be silently dropped
from the embedded filesystem and served as HTML by the SPA fallback.
The all: prefix includes everything regardless of filename prefix.
Fixed in both embed.go and the Makefile which regenerates it.
* fix: address PR review — atomic token consumption, error handling, log reset URL
- Replace ValidatePasswordReset + MarkPasswordResetUsed with atomic
ConsumePasswordReset using UPDATE ... WHERE ... RETURNING to prevent
race conditions where two concurrent requests consume the same token
- Handle DeleteUserSessions errors (log instead of silently ignoring)
- Log the full reset URL when email is not configured so the admin
CLI fallback is actually usable
The meta area (timestamps + action buttons) was a single flex row that
wrapped chaotically on narrow screens. Split it into a `.meta-info` row
for timestamps/save status and a separate `.meta-actions` row for buttons,
both with flex-wrap. Renamed `.history-btn` to `.action-btn` with
consistent sizing (min-width, white-space: nowrap).
Closes IDEA-71
Replace conditional {#if} rendering of save status with always-present
span using opacity transitions. Element stays in the DOM flow so the
flex row never reflows when state changes.
Rapid saves to the same item by the same user within 5 minutes now
coalesce into a single activity entry instead of creating one per save.
SSE events still fire every time for real-time UI updates.
Agents were using verbose slugs because:
1. The skill file (SKILL.md) taught them to use `<slug>` in every example
2. CLI output showed slugs in parentheses rather than issue IDs
3. CLI usage strings said `<slug>` not `<ref>`
4. JSON output lacked a `ref` field, so agents parsing JSON only saw slugs
Changes:
- Add computed `ref` field to Item model (e.g. "TASK-5") in JSON output
- CLI create/update/delete/edit output now prominently shows issue IDs
- All CLI usage strings changed from `<slug>` to `<ref>`
- Issue IDs displayed in bold cyan (not dim) in list/show/grouped views
- Skill file rewritten to use issue IDs in all examples and instructions
- Dashboard API includes `item_ref`/`ref` in attention, suggestions, phases
- Search results now include item_number and collection_prefix for refs
- CLAUDE.md updated to document issue ID usage
The agent registered webhooksCmd() and bulkUpdateCmd() but hasn't
written the implementations yet. Remove the registrations to fix
the build. They'll be re-added when the implementations are complete.
- pad standup: Auto-generate daily standup from recent activity
(completed/in-progress/blockers, --days flag, JSON output)
- pad changelog: Generate release notes grouped by collection
(--days, --since, --phase flags, markdown output for GitHub releases)
- pad watch: Real-time terminal activity stream via SSE
(colored output, graceful Ctrl+C shutdown)
- pad blocks/blocked-by/deps/unblock: Task dependency management
- Colorized pad init, pad onboard, pad show, and pad status output
with Active Work section showing in-progress items
Full-stack feature: move items between collections (e.g., idea → task)
with automatic field migration.
Backend:
- Field migration engine (items/migrate.go) maps matching fields,
handles type conversions, drops incompatible fields, applies defaults
- Store method updates collection_id and assigns new item_number
- POST /api/v1/workspaces/{ws}/items/{slug}/move endpoint
- Activity logging with "moved" action and from/to metadata
- 6 migration unit tests covering type matching, conversion, and edge cases
CLI:
- pad move <slug> <target-collection> [--field key=value ...]
- Accepts singular collection names (task, idea, bug, etc.)
Web UI:
- "Move to..." dropdown on item detail page
- Shows all collections except current with icons
- Redirects to the item's new URL after move
Field migration rules:
- Same type: transfer directly (validate select options)
- Compatible types (text↔url, number→text, select→text): auto-convert
- Incompatible types: drop silently
- Missing required target fields: apply defaults or error
Dashboard improvements:
- New "In Progress" section at the top showing clickable chips for
collections with in-progress items — jump straight to what you're
working on
- Agent activity gets a purple left-border and "AGENT" badge in the
activity feed, making AI contributions visually distinct
- CLI activity gets a blue "CLI" badge
- Removed redundant "by you via web" text — the badges are cleaner
The dashboard now clearly shows the human-agent collaboration story:
you can see at a glance what the AI has been doing alongside you.
j/k or arrow keys to move between items, Enter to open, Esc to clear
focus. Works in both list and board views. Focused item gets a blue
outline ring and auto-scrolls into view.
Skips keyboard handling when typing in inputs or when the quick-create
bar is open. Doesn't conflict with existing Cmd+K, Cmd+N, etc. global
shortcuts since those all use modifier keys.
This is the kind of keyboard-first navigation that makes developer
tools feel fast — no mouse needed to browse your task board.
The demo workspace now showcases conventions AND playbooks (both key
differentiators), references multi-agent support in the architecture doc,
and has a better description. This is what people see when they run
pad init --template demo to try Pad for the first time.
When the CLI or an agent creates items, the web UI now shows a subtle
toast notification like "Agent created: Fix OAuth redirect" or
"CLI created: New task". Only fires for non-web sources — changes you
make in the browser don't trigger redundant notifications.
This makes the agent collaboration feel alive — you can see items
appearing in real-time as your AI works alongside you.
Click "+ New Task" to open a title input right in the page header.
Type a title, press Enter — item is created instantly without navigating
to a separate form. Press Esc to cancel. The item appears in the current
view immediately via local state update.
This is how Linear/Todoist handle creation — no page navigation, no forms,
just type and go. Much faster for rapid item creation during planning or
when an agent is working alongside you.
- Fix SQL injection in sort parameter: validate field names against
alphanumeric regex before interpolating into json_extract queries
- Restrict CORS to localhost origins only (remove http://* wildcard)
- Change Makefile HOST default from 0.0.0.0 to 127.0.0.1
- Add Apache-2.0 license field to web/package.json
- Opens http://localhost:7777 (or configured URL) in the default browser
- Auto-starts the server if not running
- Navigates directly to the active workspace if detected
- Works on macOS (open), Linux (xdg-open), and Windows (rundll32)
- Update skills command description to reference pad install
New top-level `pad install` command that auto-detects AI coding tools and
installs the /pad skill with tool-appropriate frontmatter:
- Claude Code (.claude/skills/) — full frontmatter
- Codex/Cursor/Windsurf (.agents/skills/) — name+description only
- GitHub Copilot (.github/instructions/) — applyTo frontmatter
- Amazon Q (.amazonq/rules/) — no frontmatter
- JetBrains Junie (.junie/guidelines/) — no frontmatter
Supports: pad install, pad install <tool>, pad install --all, --list, --update.
Updates pad init to detect and offer multi-tool installation.
- Board view: move empty column text inside .column-cards so it aligns at top instead of bottom
- List/Board views: capture reorder data before awaiting status change to prevent reactive overwrite of drop position
- Onboarding: add dismiss button with localStorage persistence and re-show option, copyable prompts using shared clipboard utility, clearer setup instructions, and proper spacing below the checklist
Export/Import:
- `pad export -o file.json` exports workspace (collections, items,
comments, links, versions) to portable JSON
- `pad import file.json --name X` creates new workspace with
regenerated UUIDs and remapped relations
- GET /workspaces/{slug}/export and POST /workspaces/import endpoints
- "Download JSON" button in workspace settings
- Import tab with drag-and-drop in the create workspace modal
- Full transaction wrapping for atomic imports
Create Workspace Modal:
- Extracted from sidebar dropdown into a proper centered modal
(sidebar's CSS transform was trapping fixed-position elements)
- Rendered at root layout level via uiStore flag
- Create and Import tabs with template picker and file drop zone
Spreadsheet-style third view option alongside list and board. Sortable
columns for all schema fields, clickable status cycling, inline progress
bars, resolved relation labels, sticky header, and horizontal scroll.
Persisted per-collection in localStorage, configurable as default view.
Quick wins:
- IDEA-31: URL autolink + link popover in editor (SafeLink with data-href
prevents mobile navigation, popover shows open/edit/remove actions)
- IDEA-36: Focus title on new item creation, Enter moves to editor
- IDEA-38: Add `pad link` CLI command to link directory to existing workspace
- IDEA-34: Show checklist progress bar on item cards (parses markdown checkboxes)
- IDEA-28: Workspace rename (already existed in settings)
Medium effort:
- IDEA-33: Drag-and-drop task reordering in Phase documents via svelte-dnd-action
- IDEA-26: Archive collections (frontend wiring — backend already supported soft delete)
- IDEA-29: Archive workspaces with danger zone confirmation in settings
- IDEA-37: Raw markdown editor toggle + inline Mermaid diagram rendering
(NodeView with ignoreMutation to prevent ProseMirror re-parse loops)
- Print suggested /pad prompts after `pad init` creates a new workspace
- Add `pad onboard` command that detects project tooling (language, build system,
test runner, CI, linter) and suggests matching conventions from the library
- Replace empty workspace welcome box with OnboardingChecklist component showing
a 4-step guided setup with progress bar and /pad prompt hints
- Add contextual tips with /pad prompts to empty collection states
- Add onboarding workflow to /pad skill for agent-driven codebase analysis
- Fix relation fields storing slugs instead of UUIDs: server now resolves
slugs/refs to UUIDs for relation-type fields on both create and update
Status change and sort order updates were firing concurrently, causing
SQLITE_BUSY errors. Now handleFinalize awaits the status change before
sending reorder updates. Switched all frontend API calls from item.slug
to item.id (UUID). Added UUID support to ResolveItem in the store layer.
New QuickAction type in collection settings lets users define prompt templates
with variables ({ref}, {title}, {status}, etc.) that resolve at click time.
Lightning bolt menu appears on item detail and collection pages. Includes
default actions for Tasks, Ideas, Phases, and Docs collections. Fully
customizable via new Quick Actions tab in EditCollectionModal.
Show field summary after create/update CLI commands. Make svelte-check
blocking in CI. Improve editor block handling, field editor layout,
conventions page, and minor UI consistency fixes across pages.
Pad — project management for developers and AI agents.
Single Go binary with embedded SvelteKit web UI, SQLite storage,
CLI, and Claude Code /pad skill integration.
https://getpad.dev
xarmian