mirror of
https://github.com/PerpetualSoftware/pad.git
synced 2026-11-04 10:23:40 +00:00
8ea3c8d5e54e04ecbc04c8a60b0590f49ff447fd
236 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 xarmian
|
fb3609d6c4 | fix(store): an all-lowercase ref-shaped miss falls through to exact slug lookup only (BUG-4119 r1) | ||
|
xarmian
|
6551dfcf8c |
fix(store): a wrong-prefix ref never resolves to another item (BUG-4119)
Require an exact prefix match or an item_collection_moves row for the same item and workspace whose former collection has the requested current prefix. Include deleted collections so deletion and prefix reuse preserve proven moved refs. Share the lookup and SQL predicate across item resolution, relation referents, wiki links and cross-workspace backlinks, retaining caller liveness and wiki scope. Make parsed-ref misses terminal in both resolvers, and let show resolve live moved refs without widening include-deleted lookup. Return additive item_ref on comment creation and replay, and print the server ref in CLI success output with an older-server fallback. Cover write integrity and move history with dual-dialect fixtures, and address ref-shaped integration fixtures through their own refs or UUIDs. |
||
|
xarmian
|
fbabb65869 |
feat(schedule): carry schedules in workspace export/import and migrate-to-pg (TASK-4104 D2) (#2360)
* feat(schedule): carry schedules in workspace export/import and migrate-to-pg (TASK-4104 D2) WorkspaceExport.Schedules (additive, omitempty, no version bump) carries each live item's schedule with its occurrence history and managed reminder state. Import re-compiles every rule, stores canonical timing with rdates/exdates re-marshalled from parsed walls, rebuilds exactly one managed reminder per live schedule, recomputes next_at/remind_at, and remaps history comment ids. A malformed schedule is dropped, counted and reported (dropped_schedules) while the item and the import survive. insertCarriedScheduleTx is the shared helper the cross-workspace copy (D3) will reuse. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * feat(schedule): list the schedule tables in MigratedTables (TASK-4104 D2) The migration now reads item_schedules and schedule_occurrences, so the NUL preflight must refuse on them; the export-coverage guard maps the new section. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): qualify the schedule export ORDER BY for Postgres (TASK-4104 D2) scheduleColumns also selects the managed reminder's id, so a bare ORDER BY id is ambiguous on Postgres (SQLSTATE 42702) and failed every workspace export there. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * test(schedule): every schedule state round-trips through export/import unchanged (TASK-4104 D2-a evidence) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): migrate-to-pg reports dropped schedules; anchor_wall all-day check; comment map guards (TASK-4104 D2 r1-1, r1-2, r1-3) migrate-to-pg prints each refused schedule as it happens and a closing summary naming the SQLite source; print-only, exit 0. An anchor_wall whose all-day form differs from dtstart's is dropped. The import's comment map skips an empty id and binds an occurrence only to a comment of its own item. A schedule is marked seen only after a successful insert. Documents the dropped_schedules reason codes. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(cli): migrate-to-pg's drop summary says how to read the uncarried rows (TASK-4104 D2 r2-2) The summary said dropped schedules "remain in <from>", but the migrate then marks that file as migrated and pad refuses to open it. It now says the rows are still there, that pad won't open the file, and how to read them: sqlite3 on item_schedules and schedule_occurrences, or a `pad db backup` copy taken before the migration. The red row pins the wording. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(cli): quote the source path in migrate-to-pg's sqlite3 hint (TASK-4104 D2 r3-1) The drop summary's "read them with sqlite3 <from>" is a command an operator pastes, and a macOS data path ("Application Support") has a space. The path is now single-quoted for a POSIX shell, with an embedded ' written as '\''. The new row sends a path with a space and a quote through sh -c and gets it back unchanged. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS |
||
|
xarmian
|
7eccac77c9 |
feat(web): explain an empty chat roster and how agents join (TASK-4186 PR B) (#2359)
* feat(web): explain an empty chat roster and how agents join (TASK-4186 PR B) /messages shows a help block when both the conversation list and the sessions read answered and found nothing, replacing the bare "No conversations yet.". A pending, failed or unavailable read is unknown and never renders "No one to message yet". A non-empty roster with no conversations gets a "Start a conversation" heading. Docs and both skill copies say how an agent gets a chat identity and that its DM is @<its-name>. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(web): say why the mobile chat nav spec skips off the phone project (TASK-4186 PR A r2-L1, folded into PR B) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(web): describe how an agent joins chat accurately, and make the copy buttons accessible (TASK-4186 PR B r1) The empty-state, docs/api.md and both SKILL.md files now say the Pad monitor (pad watch --stream --for-session) is what the agent harness runs, from a .pad.toml-linked directory, and state the name order in ResolveAgentName's order. The monitor line loses its Copy button. The remaining Copy button gets a per-command aria-label, a polite live status, a visible failure message and a per-command timer. Tests pin the order (Go chain test + copy phrase) and each accessibility behaviour. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(web): name chat arming in the agent setup copy, keep the detail in docs, re-announce repeat copies (TASK-4186 PR B r2) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(cli): scope the chat-copy guard to the chat-identity text so a dropped arming clause fails (TASK-4186 PR B) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(docs,web): keep the chat reference whole, harden the copy guard, and fix the copy timer (TASK-4186 PR B r3) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(web): a copy failure keeps its message, and nothing writes after unmount (TASK-4186 PR B r4) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(web): only the latest copy attempt updates the status, and every outcome is announced (TASK-4186 PR B r5) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(web): drop the copy button's auto-clear timer so no stale attempt can strand its state (TASK-4186 PR B r6) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v |
||
|
xarmian
|
b721dfb74d |
feat(schedule): workspace agenda endpoint (TASK-4104 D1) (#2357)
* feat(store): date-window item filter and one shared visibility clause (TASK-4104 D1) ItemListParams.FieldDateWindow keeps items where any named date field falls on a day in a window, on both stored date shapes and both dialects. The pending-reminder visibility switch becomes scopeClause so the agenda reads the same predicate. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * feat(schedule): workspace agenda endpoint (TASK-4104 D1) GET /workspaces/{ws}/agenda?from&to&tz lists the schedules' occurrences with their state and the items dated in the window, in the caller's zone, under the dashboard's visibility applied in SQL. A per-schedule cap degrades that schedule to truncated or unavailable instead of failing the read. History rows merge by wall for floating and all-day schedules, by instant for pinned timed ones. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * test(schedule): classify the agenda in the compress census and the lifecycle guard (TASK-4104 D1) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): agenda scan skips ended schedules, one bad schedule is unavailable, empty tz is refused (TASK-4104 D1 r1-1, r1-2, r1-5) - r1-1: the 1000-schedule scan bound no longer counts schedules that ended before from (ended_at IS NULL OR ended_at >= from). - r1-2: a non-cap error from one schedule's expansion is logged by schedule id and error class only and listed under unavailable with code internal; the agenda stays 200. - r1-5: an explicit empty or blank tz is 400 invalid_tz. - Tests: scan starvation, corrupt schedule, empty tz, the 100 and 500 cuts, an app-token ceiling vs the item list, a pinned HOURLY and a floating missed count across New York's 2026-11-01 fall-back, a stronger runaway row. - Docs: date-entry selection and at, the cut before date ordering, accepted deviations. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): agenda lists an early-resolved schedule, store classifies expansion errors (TASK-4104 D1 r2-1, r2-2) r2-1: an ended schedule stays in the agenda scan while a history row can reach [from-36h, to+36h), so a deadline marked done early still lists as done; one whose history is wholly outside the window still spends no bound slot. ORDER BY is qualified: the unnamed reminder subselects also output an "id" column, which Postgres refuses as ambiguous. r2-2: ExpandAgenda reports unparseable stored state as unavailable "internal" with a nil error and returns an error only for a database failure; the handler answers that with a 500 again. The 1.5 s budget is checked between schedules and never reaches that branch. r2-3: the API docs state the three behaviours under a plain label. r2-4: the runaway test proves the runaway's own ref and the healthy refs. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * test(schedule): the agenda's DB-failure row breaks only the history read; the runaway row pins its one outcome (TASK-4104 D1 r4-2, r4-4) TestAgendaDatabaseFailureDuringExpansionIs500 dropped schedule_occurrences, which since r2-1 also fails the list query's EXISTS, so it 500ed before ExpandAgenda and could not catch a handler that swallowed the error. It now renames a column only agendaOccurrences selects. A mutant that swallows the error as unavailable=internal turns it red. TestAgendaOneRunawayScheduleDoesNotTakeItDown accepted either outcome. A MINUTELY rule over the window hits the instance cap with partial occurrences, cut to the per-schedule cap: exactly 100 entries, truncated. It pins that; AgendaMaxPerSchedule 100 -> 99 turns it red. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS |
||
|
xarmian
|
bb29f4f063 |
feat(schedule): resolve an occurrence (done/skip/snooze/move), missed records, the completion anchor (TASK-4103 C2b-ii) (#2355)
* feat(schedule): ResolveOccurrence, the completion anchor and its rule set (TASK-4103 C2b) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * feat(schedule): POST .../schedule/resolve, the schedule_resolved activity and the docs (TASK-4103 C2b) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): an unparseable resolve instant is code format, and the docs name the zone the missed records walk in (TASK-4103 C2b D3, D7) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * docs(schedule): the warn limiter's residue includes a read that re-adds an entry after a DELETE (TASK-4103 C2b-i r2-1) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedules): resolve records the recipient reading, exact fall-back completion, all-day upsert, calendar re-anchor (TASK-4103) r1-1: done/skip record X at the recipient's reading; the caller zone only gates acceptance. r1-2: ResolveInput.View documents that the caller passes its own zone. r1-3: HOURLY/MINUTELY completion floors the search at done+span-1s, exact in a fall-back hour. r1-4: an all-day upsert matches the date first, then the instant, never two rows. Q1: a calendar done/skip re-anchors through the predicate shared with the fire (reanchorCandidate). Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): floor a completion at the resolved occurrence and phase an elapsed grid from an unambiguous start (TASK-4103) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * docs(schedule): an elapsed completion starts at the completion moment, and the next is always after the resolved occurrence (TASK-4103 C2b-ii r2, CONVE-23) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): an elapsed completion starts at an instant that reads back, from a whole-second clock (TASK-4103 C2b-ii r3) resolveOccurrenceAt cuts the clock to the second once. The grid start is the first of done, done+span, done-k*span whose wall reads back exactly; no read-back puts the schedule in its error state. Tests run on a nanosecond clock and cover every 2026-2027 transition of four zones. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * test(schedule): the transition table runs Kathmandu at fixed instants and checks its exact row count (TASK-4103 C2b-ii D-fix3-1) Asia/Kathmandu has no offset transition in 2026-2027, so the table ran 0 rows for it: 600 resolves over three zones, not the four the r3 commit named. Kathmandu is now pinned at exactly 0 transitions and runs at two fixed instants (local 00:00 and 11:45) for its +05:45 offset, and the table asserts its exact population (700) instead of a floor. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): the resolve's error-state write is guarded by the snapshot it read (TASK-4103 C2b-ii r4-1) The errNoExactStart branch rolls back and then records error_code on the pool, outside the transaction. Without a guard, a timing PATCH that repaired the schedule in between was stamped 'unsupported'. The write now matches updated_at as read; when it hits zero rows the resolve still answers ErrScheduleBroken. The branch is unreachable for a real zone and has no end-to-end test (ruled, D-fix3-2), so this is checked by reading. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS |
||
|
xarmian
|
2895fd3591 |
fix(schedule): a frozen floating fire, a persisted fire stamp in the reminder key, one missed-count warning per edit (TASK-4103 C2b-i) (#2353)
* fix(schedule): an overridden floating fire keeps its frozen instant; the reminder dedupe key takes a persisted fire stamp (TASK-4103 C2b-1, C2b-2) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): log the capped missed-count warning once per schedule edit, not per GET (TASK-4103 C2b-4) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * docs(reminders): the fire_stamp payload member and the reminder dedupe key (TASK-4103 C2b-2) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): the missed-count warn limiter is atomic, only moves forward, and drops a schedule on recovery or delete (TASK-4103 C2b-i r1-1, r1-2) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS |
||
|
xarmian
|
09a7ac7a79 |
feat(schedule): a fired floating row reports the instant it fired for; missed count on the view (TASK-4103 C2a) (#2351)
* feat(schedule): a fired floating row reports the instant it fired for; missed count on the view (TASK-4103 C2a) The fire transaction overwrites next_at with the exact instant of a floating occurrence, so reads, the view and the event payload agree after a zone change (replaces the PR2 omit fallback). outstandingInstant is the one reading shared by fillOccurrenceAt and the view. The managed dedupe key gains fired_at so a re-fire of the same occurrence is a new notification. The view carries missed_count, missed_truncated and stale, computed on read from anchor_wall. Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * docs(schedule): an absent missed_count means 0, an absent missed_truncated or stale false (TASK-4103 C2a D2) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * fix(schedule): walk a floating missed count by wall; a broken-rule fire records the exact instant (TASK-4103 C2a r1 H-M1, H-M2) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS * docs(schedule): split the run-on ScheduleMissed comment (TASK-4103 C2a r2 Low) Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS |
||
|
xarmian
|
b13159e4e4 |
feat(cli): per-user time zone in the CLI, pad auth timezone, and the UTC notice (TASK-4101 PR2b) (#2349)
* feat(cli): show and set the viewer time zone (TASK-4101) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(server): retry timezone checks across midnight (TASK-4101) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(server): overdue and standup days with no time zone set are now UTC, not server-local; set yours in the web settings or with pad auth timezone <IANA> (TASK-4101) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(cli): refuse an unsaved time zone, never exit from the zone resolver, and pin the standup day test (TASK-4101) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(cli): the unconfigured-resolver test clears every configuring env var and drops an unwired request count (TASK-4101) PR2b r2 (Codex Low, hunter question). Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(cli): set the machine zone before the stub server starts in the TZ4101 tests (TASK-4101) standup-user-day wrote time.Local after tzCLI had started its httptest server, whose goroutines read time.Local: a data race under -race. tzCLI now delegates to tzCLIWithLocal, which takes the zone and sets it before the server exists. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(cli): a stored zone this machine cannot load gets a UTC notice that names it (TASK-4101) The CLI resolves the zone with its own tzdata. A zone the server accepted but this machine lacks rendered every time in UTC with no notice, since the notice keyed on an unset zone only. Both doors, the /auth/me lookup and the dashboard seed, now record the notice to print. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v |
||
|
xarmian
|
16f05be105 |
feat(auth): bind an app's 2FA challenge to its PKCE verifier on oauth-login (BUG-4136 2a, TASK-4137) (#2350)
* feat(auth): bind an oauth-login 2FA challenge to a PKCE S256 challenge (TASK-4137)
oauth-login takes an optional two_factor_pkce_challenge; the 2FA challenge
token then carries "pkce:<S256>" in place of the caller's address, and
login-verify takes the matching code_verifier. The binding field now names
its kind ("ip:" or "pkce:"); a pkce token without a verifier and an IP token
with one both get the same 401 as an IP mismatch. A bare-address binding from
the previous release still verifies from its IP. A malformed challenge is a
400 before any account lookup.
Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v
* test(auth): pin the legacy binding's ParseIP clause; doc the PKCE binding and a null challenge (TASK-4137)
The legacy-binding rows now arrive from a RemoteAddr that clientIP reads
as the binding itself, so only the ParseIP clause can refuse them.
handleTOTPLoginVerify's doc names both bindings, and docs/api.md says an
absent or null two_factor_pkce_challenge stays IP-bound.
Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v
* test(auth): pin that a JSON null PKCE challenge mints an IP-bound 2FA challenge (TASK-4137)
docs/api.md says absent or null is IP-bound; the IP-bound-with-verifier
test now runs for both, so a null that minted pkce-bound would verify
with the right verifier and fail it.
Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v
* test(auth): show an absent or null PKCE challenge's token verifies from its own IP without a verifier (TASK-4137)
Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v
* test(auth): an IP-bound 2FA challenge without a verifier is refused from another IP (TASK-4137)
The other-IP request now carries no verifier, so its 401 can only be the
IP binding; the minting-IP request keeps the verifier, refused there.
Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v
|
||
|
xarmian
|
e629f6a420 |
feat(schedule): HTTP API for item schedules, 409 on managed reminders (TASK-4102 PR2) (#2347)
* feat(schedule): HTTP API for item schedules, 409 on managed reminders, fired floating occurrence_at guard (TASK-4102 PR2)
GET/POST/PATCH/DELETE /workspaces/{ws}/items/{ref}/schedule over the merged
store CRUD: strict bodies (unknown/repeated member, NUL, wrong type are 400
invalid_body), PATCH null clears dtend/rrule/rdates/exdates and is `required`
elsewhere, creator-zone default with timezone_note, a dedicated view (no
workspace_id/item_id/floating bound; floating next_occurrence is the caller's
reading), schedule_created/updated/deleted activity (names only) and
item_updated SSE. Error vocabulary: the ten schedule codes, cap_scan and
cap_stall as separate 400s, cap_time as 503 schedule_busy, field errors,
exhausted, schedule_exists.
Re-arm, ack and delete of a reminder with a schedule_id answer 409
reminder_managed, after the visibility, archived and edit checks.
H-L2 fallback: a fired floating managed reminder reports no occurrence_at on
reads (the recipient's current zone is not the one it fired in); C2 removes it.
HTTP only: no CLI, no MCP; the MCP golden files are unchanged.
Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS
* test(schedule): an empty PATCH publishes nothing and logs no activity (TASK-4102 PR2)
Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS
* fix(schedule): null on a required POST member is `required`, as on PATCH (TASK-4102 PR2 r1 C-M1)
A JSON null decoded into ScheduleCreate's plain fields left them unset, so
kind:null read as an enum error and dtstart:null as a wall error. POST now
reports both as 400 validation_error {field, code: required}; null on an
optional member stays the member left out. Docs say so, and that an empty
rrule clears on PATCH.
Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS
* fix(schedule): refuse a schedule body that is not a JSON object (TASK-4102 PR2 r2 H-Q1)
A top-level null decoded into the body struct as a no-op, so POST null
read as an empty create (400 wall) and PATCH null as the {} no-op. Both
are now 400 invalid_body, like []. strictBodyBytes, shared with push
devices, is unchanged.
Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS
* test(schedule): pin the non-object body check's whitespace and empty branches (TASK-4102 PR2 r3 H-L1)
Claude-Session: https://claude.ai/code/session_01Pa22hHpfXoZbQkEFvPtNeS
|
||
|
xarmian
|
a4ccfb1e45 |
fix(store): new board items land at the top of their lane; children keep appending in creation order (BUG-4005) (#2348)
* fix(store): create new items at the top of their collection (BUG-4005) Every create wrote sort_order = 0, so on a never-dragged lane the new card sorted last and on a dragged lane it tied the top card's 0 and landed second. Create at COALESCE(MIN(sort_order), 0) - 1 over the collection's live items, in the same INSERT, under the workspace advisory lock already taken for item_number/seq. One edit in insertItemTx covers CreateItem, the cross-workspace copy, app provision and app upgrade; the fenced app insert gets the same subquery. Child lists (sort_order ASC, created_at ASC) now list a new child first too: BUG-3527's one-order principle stays, its direction flips (lead ruling, Dave confirmed). itemSort.ts logic is unchanged, comment only. Dispositions: export.go import keeps the exported sort_order (a restore keeps the order); drag writes are explicit; role_sort_order is out of scope. No migration. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(store): an item moved into a collection lands on top of it (BUG-4005) MoveItem kept the item's old sort_order, a number from another lane's numbering, so the moved card landed at an arbitrary place. Set it to the target collection's MIN(sort_order) - 1 (excluding the item itself) in the same UPDATE, under the workspace seq lock the move already holds. Separate commit so it is easy to drop: this is a change to the move contract. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(server): pin the BUG-3530 tie at 0 explicitly now that a create no longer writes 0 (BUG-4005) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(store): put only parentless items on top; children keep appending (BUG-4005) Dave re-ruled: the MIN-1 create applies to parentless items only, so a new child joins the end of its siblings (ship and decompose work a plan's children in sort_order, created_at order). The MIN covers parentless live items; a child is created at 0. The create handler sets ItemCreate.UnderParent because the parent link is written after the insert. A moved item lands on top only when parentless; a child keeps its sort_order. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(store): space the child fixtures' created_at a second apart so the order holds on Postgres (BUG-4005) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(store): drop the move re-ranking; clamp a top create at the INTEGER floor (BUG-4005) Move keeps its existing contract (the item keeps its sort_order): restores moveItemWithPreCheckOnce and its CLAUDE.md block, and drops the move tests. A parentless create at MIN-1 would overflow Postgres INTEGER when a lane holds -2147483648 (the reorder API accepts it); topSortOrder keeps MIN there. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * Revert "test(store): space the child fixtures' created_at a second apart so the order holds on Postgres (BUG-4005)" This reverts commit 78aca990add09a38011df2807e4308459cd17711. * fix(store): order children by item_number after created_at; same-second siblings keep creation order (BUG-4005) created_at has one-second resolution and ids are random UUIDs, so tasks created back to back (decompose) ordered arbitrarily. item_number is the workspace sequence and monotonic in creation order. Tests force a same-second tie with ids in reverse creation order; adds the fenced floor-clamp test. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(web): manual sort breaks created_at ties by item_number (BUG-4005) One order everywhere, server and web. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(server): children tie-break by item_number in the BUG-3789 paging test (BUG-4005) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(share): a shared collection breaks same-second ties by item number, as the board does (BUG-4005) The board's manual order now breaks a tie on sort_order and created_at by item_number (created_at has one-second resolution and ids are random), but the share link still fell back to the id, so a shared page could list tied rows (template seeds, legacy rows at 0) in a different order from the board. Adds a `_num` sort token (i.item_number, underscore-prefixed like `_id`) and puts it ahead of `_id` in the share link's sort. Only the share link renders the manual order on the server; other `_id`-terminated sorts are caller-chosen and keep the id fallback. docs/api.md's children order now names item_number (fix round 2 made the old text false). r2 H1. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(e2e): expect the newest-on-top order in the j/k and card-menu Move specs (BUG-4005) bug-3492: a parentless create now lands on top, so the list shows d, c, b, old. j/k must walk that order; updated order (d, old, c, b) still differs at the second j, so the spec keeps its regression guard. permission-walk-move, list and table Move entries: with distinct stored sort_orders the reorder plan may lift a neighbour past the control and leave the control's value alone, so the write need not name the control. Assert instead that a sort_order write landed and that, after a reload, the control sits where the entry promised. The board leg's status write still names the control and keeps that check. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(store): end the child orders on id after item_number; move topSortOrder off insertItemTx's doc (BUG-4005) item_number has no unique constraint, so it cannot end a total order for LIMIT/OFFSET paging: id goes after it, as before this PR. topSortOrder had been inserted between insertItemTx's doc block and the function. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(store): template seeds and app artifacts append in the order they were made (BUG-4005) A parentless create lands on top, so a run of creates lists newest first. For bulk, ordered, non-interactive creates that reversed the order they were defined in. ItemCreate.Append keeps them at sort_order 0, the exact pre-BUG-4005 create position, and the board's created_at then item_number order lists them as made. Every non-interactive create caller, with its verdict: - SeedCollectionsFromTemplate (collections.go): APPEND. Template order. - ProvisionAppInstall (app_provision.go): APPEND. Manifest order. - UpgradeAppInstall (app_upgrade.go): APPEND. Same class as provision. - Cross-workspace copy (items_cross_workspace_copy.go): TOP, unchanged. One item; CLAUDE.md says the copy lands on top. - Fenced app create (appstore/items.go -> fenced_items.go): TOP, unchanged. One item per call by the app. - Library activation, artifact import (createItemChecked): TOP, unchanged. One item per user action. - Export import (export.go): N/A, its own INSERT keeps the stored order. - Move: N/A, creates nothing; keeps its sort_order (C3). Also: the child-order comments and the docs/api.md children line say why id ends the order. item_number is unique per workspace but nullable. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v |
||
|
xarmian
|
b8b610812c |
feat: a per-user time zone for calendar days, backend (TASK-4101 PR1) (#2337)
* feat(users): users.timezone column, internal/usertz and the conditional set-if-unset write (TASK-4101) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * feat(auth): timezone on /auth/me and the session user, PATCH with if_unset, tz-mismatch dismissal keys (TASK-4101) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(server): compute overdue, standup and stamped dates in the viewer's zone, UTC when unset (TASK-4101) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(server): regenerate the cloud contract goldens for the additive timezone field (TASK-4101) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(store): add the Postgres twin of the users.timezone migration (TASK-4101) pgmigrations has its own numbering; 160 alone left the column missing on Postgres, and make test-pg failed on 'column "timezone" does not exist'. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * feat(store): NUL invariant triggers for users.timezone (TASK-4101) The census exists so no single validator is the only guard (ruling 1431c980 item 1): protect the column with its own post-160 trigger file instead of excluding it. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(server): decode a dismissal key once, and test the viewer zone through /me/needs (TASK-4101) A double-encoded %252F reached the handler already decoded once (net/url keeps no RawPath for it), and the second PathUnescape read it as a slash. Unescape only when chi routed on RawPath. Adds the unescape cases, the too_many_dismissals code assertion, an HTTP-level test that a zone ahead of UTC makes an item overdue on /me/needs, and the api.md notes for the cap and the additive dashboard/standup fields (ruling 1431c980 items 2-5). Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(server): the standup test expects the UTC day, and the zone note names no PR2 surface (TASK-4101) The standup date is the viewer's zone, UTC when unset; the test still compared against the host's local day and failed on any non-UTC host when the two dates differ. The note pointed at the web settings and `pad auth timezone`, which land with PR2 (ruling 00877b60). Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v |
||
|
xarmian
|
d36f11cf40 |
fix(server): a workspace whose owner no longer resolves never yields a '//' path (BUG-4050) (#2334)
* fix(server): a notification whose workspace owner no longer resolves has no deep link, never a '//' path (BUG-4050) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(needs): a needs row whose workspace owner no longer resolves has an empty path and no link, never '//' (BUG-4050) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * fix(needs): fail the request on an owner lookup error instead of reading it as no owner (BUG-4050) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(needs): an owner lookup error must answer 500, not merely not-200 (BUG-4050) Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v * test(needs): rebind the owner-corruption UPDATEs so they run on Postgres (BUG-4050) The raw ? placeholders were a syntax error under make test-pg, so both postgres subtests failed before reaching the handler. Claude-Session: https://claude.ai/code/session_01Pa22hHHb1atXYf1JmBYE1v |
||
|
xarmian
|
58c53d68eb |
feat(web): agent roster on /messages with Start chat, and a sign-out redirect (TASK-4044) (#2324)
* feat(web): ensureConversation client call, carried from the chat window work (TASK-4044) Claude-Session: https://claude.ai/code/session_017ofcsFmgnoVDPxeHwuxCjg * feat(web): chat roster, ensureDM and a reference-counted presence poll (TASK-4044) Ruling 018faf64: counter clamped at 0, DM keys filtered to kind dm, ensure fenced by identity. Claude-Session: https://claude.ai/code/session_017ofcsFmgnoVDPxeHwuxCjg * feat(web): roster rows with Start chat on /messages, and a sign-out redirect (TASK-4044) Claude-Session: https://claude.ai/code/session_017ofcsFmgnoVDPxeHwuxCjg * test(web): census entry for the roster each (TASK-4044) Claude-Session: https://claude.ai/code/session_017ofcsFmgnoVDPxeHwuxCjg * fix(web): roster keeps DMs by the server's 'direct' kind; presence owners are balanced (TASK-4044) The roster filtered on kind 'dm', which the server never writes (migration 158 allows 'direct' and 'group'), so against a real server every conversation dropped off the roster. Fixtures are corrected to 'direct', the Q3 row now uses a group conversation, and an e2e spec reads the server's real value. The chatInbox afterEach asserts no presence timer is left armed before one safety drain, so a leaked owner fails. Claude-Session: https://claude.ai/code/session_017ofcsFmgnoVDPxeHwuxCjg * fix(web): roster ensure does not navigate after the page is left (TASK-4044) Claude-Session: https://claude.ai/code/session_017ofcsFmgnoVDPxeHwuxCjg |
||
|
xarmian
|
6402eb3055 |
fix(mcp): stdio's item patch gives line_hint remote's rule through one shared helper (BUG-4082) (#2315)
* fix(mcp): stdio's item patch gives line_hint remote's rule through one shared helper (BUG-4082)
stdio's pad_item patch was passThrough, so edits reached the CLI unread:
its JSON decode into bodypatch.Edit.LineHint (an int) refused a string
hint that remote coerces ("5"), and took a JSON number of 2^53 or more,
which mcp-go's float64 decode may already have rounded, as a line number.
Remote has validated each edit's line_hint since BUG-4065, inline in
mapItemPatch.
That loop is now editsWithLineHints, called unchanged by mapItemPatch and
by a new stdio action, actionItemPatch. On stdio:
- a valid hint is forwarded as its int64;
- a refusal is validation_failed with remote's message, naming the edit
("(in edits[1])");
- null is absent, and a non-object edit keeps its path.
Neither transport modifies the caller's map.
Tests (lead ruling 86931478): one table, bug4082Cases, runs every input
through both transports and requires the same forwarded edits or the same
refusal (C1). Remote's BUG-4065 rows stay green unchanged. A row on each
transport pins the caller's map (C2). Red on main: stdio forwards "010",
1.5, 2^53, true and {} raw while every remote half passes.
ToolSurfaceVersion 0.105 -> 0.106 (C3), with the changelog in version.go
and docs/mcp.md; the README and the instructions.md heading follow. The
wire goldens follow in the next commit.
Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV
* test(mcp): stdio's line_hint refusal checked on its own; actionItemPatch's input pinned directly (BUG-4082)
Mutants on
|
||
|
xarmian
|
acc45070f6 |
feat(server): deliver chat inbox refs to the owner's own web stream (TASK-4044) (#2314)
A cookie-session stream that opts in with ?chat_inbox=true now receives kind "chat" notices addressed to its own user, so the global web chat view can refetch through /me/conversations instead of polling. - Pref: honoured only for a non-bearer, non-app session; ignored (not refused) on any bearer/PAT stream. No armed required. - Predicate: a notice with an empty target agent key delivers iff the stream has chat_inbox and the target user is the stream user. The existing agent clause is unchanged; the two cases are disjoint. - Publish: one human-target notice per human member, plus a self-notice for a human author (the store's recipient list leaves the author out), deduplicated on the delete path. Human notices are ref-only: excerpt, reply_to_seq and target agent key are cleared at publish time. Agent notices keep excerpt and reply_to_seq for the monitor. - docs/api.md: the param, the payload, the ignored-on-bearer rule, and the agent-path "never match" sentence scoped accordingly. Claude-Session: https://claude.ai/code/session_017ofcsFmgnoVDPxeHwuxCjg |
||
|
xarmian
|
729ae5f69c |
fix(mcp): stdio applies remote's number rule before a value becomes CLI text (BUG-4070) (#2313)
* fix(mcp): stdio applies remote's number rule before a value becomes CLI text (BUG-4070)
On stdio, a string for a "number" param reached the CLI verbatim. An int
flag parses it base 0 (pflag's ParseInt(s, 0, 64)), so "010" was 8, "0x10"
16, "1_000" 1000 and "+5" 5; pad_chat delete's positional seq parses base
10, so "010" was 10. Remote refuses all of them (decimalIntString,
BUG-4065). A JSON number was formatted and forwarded whatever its size,
where remote refuses one of magnitude 2^53 or more as possibly rounded
(wholeInt64, BUG-4061 /
|
||
|
xarmian
|
cba880ca17 |
fix(config): warn on a relative PAD_DATA_DIR / PAD_DB_PATH; anchor install-refresh's marker and config reads (BUG-4066 phase 1) (#2308)
* fix(config): warn once per process on a relative PAD_DATA_DIR / PAD_DB_PATH; install-refresh anchors its marker and config reads (BUG-4066 phase 1)
config.Load takes PAD_DATA_DIR verbatim, or PAD_DB_PATH's dirname, with no
filepath.Abs, so every process resolves a relative value against its own cwd:
a CLI and a server started in different directories silently use different
data (database, attachments, key). Phase 1 (lead ruling 4b4cb4ff) leaves the
resolution unchanged and makes it loud:
- One helper, envDataDir(), is the only reader of the two variables (Load and
userConfigPath both use it). A relative value warns ONCE per process,
naming the absolute path this process resolved, that a CLI and a server in
different directories will use different data, and that a future release
refuses it (TASK-4072). A literal '~' gets a hint. A CLI prints it to
stderr; `pad server start` logs it through slog; `pad watch --stream
--for-session` (the plugin monitor) suppresses it.
- install-refresh anchors the refresh marker and config_value the way 2a
anchors the log (${SERVER_CWD:-$PWD}), so the marker is written and
cleaned up in one place (it used to leak under the caller's cwd), and warns
before anything is read or stopped.
- docs/deployment.md: both variables must be absolute; relative is
deprecated and warns.
Tests: the warning rule (and Windows, GOOS-guarded), the marker and the
warning-before-stop end to end, config_value at function level, and
child-process tests for the monitor's silence and the server's slog line.
Harness guard (after this unit's draft test stopped the box's shared :7777
server twice): every install-refresh exec in internal/buildtools now passes
requireSafeScriptEnv first, which refuses an environment whose resolved port
is missing (the script would fall back to 7777) or is 7777, whose HOME or
data dir is the real user's or outside a test temp dir, or whose port answers
on a LAN address without this test's random stub token.
Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV
* fix(config,mcp,scripts): the relative data-dir warning names the server's path and stays out of agent-facing errors; harden the test guard (BUG-4066 r1)
r1 rulings (c0ef54e8):
- install-refresh's warning now runs once SERVER_CWD is captured (still
before the marker and the stop) and names the anchored path
(${SERVER_CWD:-$PWD}/<dir>, a leading ./ stripped); when the caller's cwd
differs it also names the caller's reading. It used to name $PWD/<dir>,
which the server does not use.
- `pad mcp serve` checks the data dir once on its own stderr; the stdio
dispatcher's `pad` children get PAD_INTERNAL_NO_DATA_DIR_WARNING=1, so the
warning is not folded into a failed tool call's agent-facing error. The
variable is internal (code-documented only), so users cannot silence the
deprecation. Shell completion no longer prints the warning mid-Tab.
- Test guard: refuses a relative data dir with a config-sourced port (the
script reads that port from the server's cwd, which the guard cannot see);
compares symlink-resolved temp paths (macOS); asks for the stub token on
the LAN address that answered; compares 7777 numerically; and a source-scan
test fails if any install-refresh exec in the package is unguarded.
Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV
* fix(config,mcp,scripts): the relative-dir warning names the data dir; completion and MCP fetchers stay quiet; harden the test guard (BUG-4066 r2)
- PAD_DB_PATH warning names the resolved data dir (Dir of the value), in Go and in install-refresh.sh; the script normalises . and .. in pure shell.
- Shell completion (__complete, __completeNoDesc) sets the silent sink in main.
- MCP resource and bootstrap fetchers exec with dispatchChildEnv; a population scan pins every pad exec in internal/mcp.
- Harness guard: numeric 7777 refusal before any dial (asserted by message), PAD_HOST must be empty or loopback, temp-dir check scoped to this test, hardened and self-tested source scan, marker-presence probe in the restarted stub, child timeout, sink reset.
Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV
* fixup! fix(config,mcp,scripts): the relative-dir warning names the data dir; completion and MCP fetchers stay quiet; harden the test guard (BUG-4066 r2)
test(buildtools): the config-file 7777 row asserts the numeric refusal by message too (BUG-4066 r2 item 12, same class)
* test(buildtools,cmd): close the m15, m24 and m28 survivors (BUG-4066 r2)
m24: a scanner self-test case whose variable never runs in its function,
with a guard in a later function, so the function boundary is what flags it.
m28: insideTestTempDir refuses another test's directory, and admits a
subtest's, which t.TempDir names <Parent><sub...> with no separator.
m15: the --workspace completion func no longer sets its own sink. main()
silences every completion request, which made that line dead code.
Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV
* fix(cli,buildtools): an auto-started server does not inherit the warning silencer; the guard reads the config port like the script (BUG-4066 r3)
Item 2: an MCP tool-call child carries PAD_INTERNAL_NO_DATA_DIR_WARNING=1
and is often the process that auto-starts the server, so that long-lived
server never logged the relative data-dir warning. serverStartCommand drops
that one variable from the spawn env, and keeps every other one. It is the
only `server start` spawn in internal/cli; a source test pins both facts.
Item 7: the harness guard took the leading digits of config.toml's port, so
"8080abc" read as 8080 where install-refresh rejects it and falls back to
7777. It now reads the first port line the way config_value does, and a
non-numeric value is refused as unreadable.
Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV
* fix(scripts): install-refresh's relative-dir warning is one line; the completion tests run main() (BUG-4066 r4)
Item 1: when the server's cwd differs from the caller's, the warning printed
a second "Warning:" line naming the shell's-directory reading, and a third
for a leading ~. Phase 1's contract is one warning per process, as
config.Load prints it, so both now ride in the one line. The test asserts
both paths sit in that line and that it prints once.
Item 6: the completion child cases called silenceWarningsForCompletion
themselves, so deleting main()'s call passed every test. They now set
os.Args and run main().
Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV
|
||
|
xarmian
|
bc2a32895e |
feat(chat): monitor reply quotes and a session-start DM ensure (TASK-4043) (#2309)
* feat(chat): render monitor reply references and excerpts (TASK-4043) * feat(chat): ensure owner-agent DM once per monitor process (TASK-4043) * docs(chat): describe monitor quotes and DM startup (TASK-4043) * test(chat): accept startup DM ensure in recovery fixture (TASK-4043) * fix(chat): wait a default when a 429 has no Retry-After (TASK-4043 r1) * fix(chat): bound Retry-After before it can overflow the wait (TASK-4043 r2) A Retry-After too large for a time.Duration (>= 9223372037s) wrapped negative and made the ensure retry hot. Seconds are now bounded before the multiply; zero, negative, absent and overflowing values all wait the 120s default, and the largest value that fits is honoured. Claude-Session: https://claude.ai/code/session_017ofcsFmgnoVDPxeHwuxCjg * test(chat): keep the Retry-After table portable and hermetic (TASK-4043 r3) The overflow rows are int64 and skip where int cannot hold them; the rows run with a temp HOME. Claude-Session: https://claude.ai/code/session_017ofcsFmgnoVDPxeHwuxCjg |
||
|
xarmian
|
82f81ee828 |
fix(mcp): refuse a non-number for a numeric parameter instead of reading it as absent (BUG-4065) (#2306)
* fix(mcp): refuse a non-number for a numeric parameter instead of reading it as absent (BUG-4065) numericInput read any value outside float64, int, int64 and json.Number as absent, so a string, a bool or an object for limit, offset or days was silently replaced by the default. itemExpectedSeqParam had its own switch with the same fall-through, so a string expected_seq sent the content write out UNGUARDED. Now only null is absent: - A string is admitted only as a plain decimal integer (an optional '-' and digits), parsed exactly and bounded like a JSON number (|x| < 2^53), so "10" is 10 and "123" is a guarded write. That matches what stdio's CLI flags and the buildQuery doors already accept (lead ruling af4bff40, Q1). Every other string, and every other type, is refused with validation_failed naming the parameter. - Every Go integer type is admitted exactly; an unsigned value above MaxInt64 is refused. - itemExpectedSeqParam, pr_number and chatSequence share that one rule (pr_number's bound becomes the exclusive 2^53; chatSequence's float64 gets the 2^53 bound and an exact json.Number). Their messages and hints are unchanged. - item patch validates expected_seq and edits[].line_hint locally, and the collection and role update doors validate sort_order, so each answers validation_failed naming the field rather than the server decode's 400. - buildQuery routes the native integers through the same check; strings are still forwarded verbatim. - The item-list resource's limit flag is refused when malformed, not defaulted. ToolSurfaceVersion 0.103 -> 0.104, with the changelog in version.go and docs/mcp.md; the README, instructions.md heading and wire goldens follow. Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV * fix(mcp): numeric query keys and leading-zero strings are refused, not defaulted or re-read (BUG-4065 r1) r1 found two Mediums (lead ruling 5a06782e): - The buildQuery doors forwarded a bool, an object or a non-integer string for a numeric key (item backlinks, item search, item context's budget, project activity, project standup and changelog). The server Atoi'd it and silently kept its default. Each route now names its numeric query keys (routeSpec.numericQuery, and the explicit lists at the direct buildQuery callers), and those keys go through numericInput. TestBUG4065_NoRouteForwards ANonNumberForANumberParam walks every remote route against every parameter its tool declares "number", so a new numeric key cannot be left off. - "010" was 10 here and 8 on stdio (pflag parses base 0). A plain decimal string is now ^-?(0|[1-9][0-9]*)$, so a leading zero is refused. The stdio side is BUG-4070. Also: an end-to-end row through the pad_item tool handler, value rows at the chat doors, an array value at every door, absent-means-default, the resource flag's negative row, stale expected_seq comments, and the v0.104 changelog corrected in version.go and docs/mcp.md. Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV * test(mcp): the numeric-param population walk cannot pass vacuously; uintptr admitted (BUG-4065 r2) r2 found the r1 population walk could pass on broken code (lead ruling b9025d7c): it looked for the raw bad value under the catalog name only, so a rename, a path segment or a value dropped as absent was invisible, and its "x"-filled inputs tripped unrelated validation, so most routes refused before reading the number. With a route's numericQuery dropped, the walk alone stayed green. The walk now uses a differential oracle from a curated valid base: each (route, number param) is dispatched with the param absent, as "7", and as a bad value. If "7" changes what is forwarded, the route reads the param and a bad value must be refused naming it with no write; otherwise a bad value must forward exactly what the absent case does. An inconclusive case fails. The derived read-set is pinned in bug4065ReadSet, so a route that stops reading a param altogether cannot be reclassified and go green. Also: uintptr is admitted like the other unsigned types; an empty string and false are named as refused in the v0.104 changelog; rows for a missing key, a null expected_seq (still unguarded), "" and a 20-digit string at every door. Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV * test(mcp): false, the catalog limit doors, and the chat null claim (BUG-4065 r3) r3 rulings (9bd7fa2d), all Low: - false is fed to the unit table, the door table and the population walk; the changelog says it is refused, and nothing pinned it. - pad_item.list and pad_item.history read limit through intParam before the dispatcher; TestBUG4065_CatalogLimitNonNumbers refuses "abc", true, false, an object, "010" and "" there naming limit, and uses "7". - The v0.104 changelog says pad_chat's numeric params still refuse a present null, as before, with the same message; "only null is absent" read as if they did not. - A misnamed row; the refused pr_number rows assert no request went out. Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV * docs(mcp): reflow a joined comment; state the population walk's limit (BUG-4065 r4) Comment-only (lead ruling 86de95f1): my r1 edit joined two comment lines in dispatch_http_advanced.go into one; and the walk's doc comment now says conditional reads are outside it, with edits[].line_hint covered by the door table. Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV |
||
|
xarmian
|
ba981cb4f2 |
fix(mcp): refuse a numeric parameter that is not a whole int64 instead of changing it (BUG-4061) (#2303)
* fix(mcp): refuse a numeric parameter that is not a whole int64 instead of changing it (BUG-4061)
numericInput converted a float64 with int64(x), so limit 1.5 read as 1, -2.7
as -2, and a value outside int64 as an implementation-defined number. A
json.Number that did not parse read as absent, so the parameter was dropped.
- numericInput returns an error for a fraction, a value outside int64 (2^63
is out), and an unparseable json.Number. intParam names the parameter.
- All 10 caller-input sites refuse with validation_failed: the route mappers,
item history, attachment list, and the pad_item.list and pad_item.history
catalog actions. pad_item.list's documented truncation of a fractional
limit to the default is reversed by ruling; zero still means the default.
- actionItemGet's read of the server's own seq stays lenient (pinned).
- itemExpectedSeqParam refuses a float64 outside int64 and gets the same
json.Number refusal, rather than dropping the token (an unguarded write).
- Comments note the unreachable float32 paths in formatNumber and
chatSequence.
- ToolSurfaceVersion 0.103: the parameters are declared "number", so the
refused inputs were valid under the advertised shape. Goldens move only by
the version string.
Claude-Session: https://claude.ai/code/session_01Hk4vxsaKDm3E1LvsoHtHeV
* fix(mcp): buildQuery refuses a number that is not a whole int64 (BUG-4061 r1)
Round 1 (Codex Medium, and the hunter's standup/changelog question): the
query-string doors built by buildQuery (item backlinks, item context budget,
project activity, item search, project standup and changelog) forwarded
"1.5", and the server parsers read it as absent and used their default.
buildQuery now refuses with the key named, and its four callers return
validation_failed (lead ruling on Q2, option (a)).
- TestBUG4056BuildQueryNumbersUnchanged: the 2.5 and 1e19 rows are now
refusals, superseded by that ruling. The notation rows stand, and
json.Number "1e6" forwards as "1000000".
- jsonNumberInt64: a whole json.Number in exponent form ("1e6") is
accepted. Int64() alone refused it. Used by numericInput and
itemExpectedSeqParam.
- The v0.103 changelog door list is corrected. The instructions.md and
README version headings follow 0.103, which
|
||
|
xarmian
|
d3f87d205a |
feat(chat): delivery, framing and the accept-instructions opt-in (TASK-4041) (#2305)
* WIP TASK-4041: add ref-only chat delivery and explicit acknowledgements * WIP TASK-4041: implement local consent and fetched monitor delivery * WIP TASK-4041: document chat delivery and session instruction consent * WIP TASK-4041: rename chat arm files (_arm.go is a GOARCH build constraint) * test(chat): fix delivery fixture and strengthen consent guards * test(chat): pin replay publication guard after mutation audit * test(chat): make review guards detect their named regressions * docs(chat): clarify bounded excerpts and defer unwired command guidance * test(chat): cover empty agent pairs and the Redis envelope * fix(chat): seed gap fills and acknowledge contiguous output * test(chat): restore gap regressions for amended ack rule * fix(chat): advance contiguous delivery across own rows and tombstones * test(chat): cover final tombstones, ack retries, and sync recovery * fix(chat): acknowledge final contiguous tombstone events * fix(chat): retry contiguous delivery ack on duplicate events * fix(chat): reseed delivery baselines on sync required * fix(chat): wire session consent commands and reuse chat client Pin arm/disarm execution through the real root tree and restore the deferred skill and monitor guidance. Wiring adds both local consent commands to the cmdhelp Document supplied to MCP. Preserve TestChatArmHasNoMCPPath's failure for the requested ruling; do not change MCP goldens or versions. * test(mcp): pin chat direction dispatch across transports * docs(cli): add chat direction command examples * test(chat): expose delivery memory loss and unsafe acknowledgements * fix(chat): retain process delivery memory independently of fill cursors * docs(chat): describe local delivery memory and failed-summary recovery * test(chat): pin both monitor adapter fetch limits * docs(api): state chat owner-message framing in the present tense (TASK-4041) The TASK-4039 provenance caveat described TASK-4041 behaviour as future work. It is implemented now: say what is true and point at the framing rules under GET /api/v1/events/stream. Claude-Session: https://claude.ai/code/session_01Cc68dt7DDR28fp7cxKYkbt * test(chat): expose failed resync, late retraction and identity collisions * test(chat): keep push delivery when monitor identity is unavailable * fix(chat): preserve closed recovery and retraction ownership per identity * docs(chat): clarify recovery, page cap and identity memory limits * test(chat): recover after a transient monitor identity lookup failure * fix(chat): retry transient identity failures on chat references * test(chat): require deferral until a safe server summary * fix(chat): defer events until a server delivery floor is available * test(chat): pin per-conversation server floors and caller boundaries * feat(chat): expose caller delivery floor on conversation GET * fix(chat): fetch per-conversation floors before monitor delivery * test(chat): require bounded synchronous first-contact delivery and backoff * fix(chat): fetch first-contact floors synchronously with bounded backoff * test(chat): remove redundant break from synchronous stream fixture * test(chat): cover stream deadlines, retry windows and cookie agent isolation * fix(chat): bound stream HTTP calls and back off failed conversations * docs(chat): clarify direction consent and stream delivery limits * test(chat): preserve independent dedupe eviction and retry clocks * fix(chat): require bearer authentication for stream agent addressing * test(chat): cover r10 tombstone, summary and arm-generation regressions * fix(chat): fill tombstone gaps and back off unread summaries * fix(chat): bind direction consent to a random arm generation * test: pin r11 retractions and session direction cleanup * fix: retract owed chat deletions before network backoff * fix: report session action when direction removal fails * docs: clarify chat direction rearming and connect state * test(chat): bound HTTP deadline failures and cover unresolved retractions * docs(chat): clarify immediate retractions and session re-arm direction loss |
||
|
xarmian
|
0ed34ea9f7 |
fix(mcp): integral numbers keep decimal notation on both transports (BUG-4056) (#2300)
* fix(mcp): preserve decimal numeric arguments (BUG-4056) Share numeric formatting across CLI dispatch and HTTP queries, and validate remote chat sequences directly with int64 bounds. Preserve the existing tool surface and wire goldens. Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * fix(mcp): numeric array elements, playbook tokens and buildQuery's default share formatNumber (BUG-4056, r1) Lead ruling on r1 (tier A from here): toStringSlice spelled each JSON number element of an array with fmt.Sprint, so a repeatable flag or variadic positional given 1000000 got '1e+06'; playbook raw_args tokens used %v, so a string- or ref-typed argument would bind '1e+06'; buildQuery's default branch kept fmt.Sprint for float32. All three now use formatNumber. Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd |
||
|
xarmian
|
5308535c02 |
fix(chat): one 64-rune bound for agent keys (BUG-4055) (#2297)
* fix(chat): share the 64-rune agent key bound (BUG-4055) Use the attribution and presence name limit for chat headers and stored keys. Refuse overlong explicit body identifiers while normalizing self-declared headers, and cover Unicode round-trips and presence agreement. Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * test(chat): an agent names itself by the normalised key on ensure and unread (BUG-4055, r1) Lead ruling on r1: the agent-caller equality checks (ensure body agent_key, unread ?agent=) were untested now that headers truncate. A 70-rune header's agent must pass the 64-rune key and be refused the raw name. The shadowed rune-count case in the ensure switch now says it is shadowed and by which gate. Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd |
||
|
xarmian
|
51b0bb4de9 |
feat(cli,mcp): pad chat CLI and pad_chat MCP tool (TASK-4042) (#2295)
* feat(cli): add global pad chat commands (TASK-4042) Add conversation targeting, inbox and message commands with caller-owned idempotency and precise read markers. Preserve API responses for JSON output and use cwd workspace links for reference context. Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * fix(cli): add chat examples and isolate command tests (TASK-4042) Satisfy the CLI help-tree example contract and restore package-level flags after command regression tests. Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * feat(mcp): expose global pad_chat on both transports (TASK-4042) Add six chat actions with shared target parsing, uniform authenticated dispatch, precise read markers and structured unnamed-agent errors. Exclude agent chat from ChatGPT and pin the direction guard. Bump the surface to 0.102, update documentation and goldens, and shorten duplicated prompt prose within the fixed budgets. Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * test(mcp): label global chat scope judgments (TASK-4042) Mark the membership-based global-chat exemption reasons explicitly, as required by the allowlist coverage guard. Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * fix(chat): preserve unread gaps and successful outcomes (TASK-4042, seat r0) Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * fix(chat): restore agent rules within prompt budgets (TASK-4042, seat r0) Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * fix(chat): keep scope fixture contiguous with read marker (TASK-4042, seat r0) Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * fix(chat): guard read boundaries and direction inputs (TASK-4042, r1) Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd * fix(chat): validate MCP bodies and report mark outcomes (TASK-4042, r1) Claude-Session: https://claude.ai/code/session_01KYZ6vrKNro953q9kfdSGFd |
||
|
xarmian
|
f8756a0b5b |
feat(server,cli,plugin): agent presence — agent name, worker id and busy/idle activity (TASK-4040) (#2293)
* test: pin agent presence and worker-scoped session activity * feat: carry agent presence and track activity by user and worker * docs: describe worker presence and session activity states * fix: include hook activity examples in CLI help * fix(cli): keep session activity hooks silent on failures * fix(server): tolerate activity read failures in session lists * docs: place activity keys after presence registry details * fix(plugin): wire silent Claude Code activity hooks * docs: explain session busy-state hook limits * fix: bound the entire session activity command * fix: batch session activity reads across workers * docs: describe detached activity reports and timestamp ordering * fix: order worker activity atomically by client timestamp * fix: detach hook activity reports with captured timestamps * test: reproduce detached activity losing registered identity * fix: capture activity identity before detaching the reporter * test: isolate activity registry home on Windows * docs: clarify activity ordering and hook failure behavior * fix: bound activity reordering to ten seconds * fix: replace activity records with corrupt client timestamps * test: prove activity parent exits while child response is held * fix(session): derive activity reorder window from report bound * fix: replace non-string Redis session activity records * test: cover cleared and expired session activity ordering * test: cover older timestamp after legacy activity * test: cover corrupt activity nanos and malformed JSON * test: verify activity child deadline and process isolation * docs: clarify read-only tokens cannot report hook activity * test: strengthen session activity liveness and timing guarantees * test: pin malformed null session activity timestamps * test: harden session activity detach regression checks * test: skip activity process-group check when ps is unavailable * test: tie activity parent-exit bounds to the HTTP timeout * test: bound activity liveness checks by the child HTTP deadline * test: require ps for process-group checks in Go CI |
||
|
xarmian
|
1c6c9740ab |
feat(server): chat HTTP API and access model (TASK-4039) (#2292)
* feat(server): chat API core: conversations, messages, read marker, unread, limits (TASK-4039, part A) Add membership-gated chat HTTP endpoints, credential-derived authorship, private wire DTOs, replay and read markers, and per-agent/user limits. Document the access and provenance model and pin it with handler guards. Claude-Session: https://claude.ai/code/session_01LL3BV3H4zot6QrMQMsVfVc * feat(server): chat read-time visibility for context workspace and item refs (TASK-4039, part B) Authorize context workspaces on send and at read time, omitting hidden contexts and projecting item refs through the caller's current access. Keep unknown and denied refs indistinguishable, with unresolved overflow past 50 distinct refs per response. Pin the wire behavior and document it. Claude-Session: https://claude.ai/code/session_01LL3BV3H4zot6QrMQMsVfVc * fix(chat): a retry replays after context loss; sentinel for context refusal; source, ref cap and empty body (TASK-4039, r1) F1: Add a read-only replay lookup scoped to the author's current conversation membership, and replay identical HTTP retries after context access loss with the same ChatSend charge as normal replays. F2: Use a context refusal sentinel wrapping ErrInvalidConversationInput while preserving the store error text and HTTP response body. F3: Derive chat source from the actor's bearer signal, preserving in-process remote MCP attribution; assert the router rejects stray Basic authorization. F4: Count only distinct refs with a workspace toward the 50-ref lookup cap. F5: Accept empty conversation-ensure bodies for agents while humans still require agent_key. Document the lookup cap and remaining-token header. Claude-Session: https://claude.ai/code/session_01LL3BV3H4zot6QrMQMsVfVc * fix(chat): refs capped at 200 with refs_truncated; ensure charges only a create (TASK-4039, r2) L1: Cap deduplicated response refs at 200, retain the 50-lookup limit, report refs_truncated on list/send/replay, and stop extraction after a drop. Document plain-text fallback and cover 6,000 refs, duplicates, and false flags. L2: Validate agent keys and check the owner's inbox before charging ChatDM. Reuse is free; only creation attempts spend a token. Document the concurrent create race and cover 40 reuses, invalid keys, and the 30/hour creation cap. Claude-Session: https://claude.ai/code/session_01LL3BV3H4zot6QrMQMsVfVc * fix(chat): a human's agent_key must already be a normalised agent name (TASK-4039, r3) Claude-Session: https://claude.ai/code/session_01LL3BV3H4zot6QrMQMsVfVc |
||
|
xarmian
|
fdbba1a31e |
feat(cli,mcp): pad project catch-up and pad_project action=catch-up, read-only (TASK-4035) (#2290)
* feat(cli,mcp): pad project catch-up and pad_project action=catch-up, read-only (TASK-4035)
Read-only wrappers over GET /workspaces/{ws}/catch-up on the CLI, local and
remote MCP, and the ChatGPT surface (catch_up). Mark caught up (PUT /me/seen)
stays web-only (ruling 380aa793): no verb, flag or client method moves the
cursor. ToolSurfaceVersion 0.100 -> 0.101, additive. Existing tool
descriptions were reworded to fewer bytes (no rule, caveat, refusal or ref
dropped) so tools/list keeps 901 B of headroom under an unchanged ceiling.
Claude-Session: https://claude.ai/code/session_01D6M9onL7HhMovW8DZbs6f5
* test(cli,mcp): ChatGPT catch_up in the wire golden and the leak sweep (TASK-4035)
Claude-Session: https://claude.ai/code/session_01D6M9onL7HhMovW8DZbs6f5
* fix(cli,mcp): catch-up json skips the typed decode; the re-indent claim is corrected (TASK-4035)
--format json prints the server's JSON re-indented without the typed
decode; table and markdown keep it. The MCP description names reopened.
Claude-Session: https://claude.ai/code/session_01D6M9onL7HhMovW8DZbs6f5
|
||
|
xarmian
|
8204f03d25 |
feat(server): push dispatch timings are configurable, and a bad value refuses startup (TASK-3939) (#2288)
* feat(server): push dispatch timings are configurable, and a bad value refuses startup (TASK-3939) Claude-Session: https://claude.ai/code/session_01D6M9onL7HhMovW8DZbs6f5 * docs(deployment): push gateway env vars, dispatch timings and the cleartext warning (TASK-3939) Claude-Session: https://claude.ai/code/session_01D6M9onL7HhMovW8DZbs6f5 * fix(server): the lease refusal names the cause, and an overflowing margin is refused (TASK-3939) SetPushDispatchConfig wraps errPushLeaseTooShort with the resolved lease, send timeout and margin; configurePush names both knobs and appends it. A margin within sendTimeout of MaxInt64 is refused before the sum can wrap. Whitespace-only values stay malformed and are now documented and tested; values are otherwise uncapped. Claude-Session: https://claude.ai/code/session_01D6M9onL7HhMovW8DZbs6f5 |
||
|
xarmian
|
6cfe322461 |
feat(push): GET /me/notifications/{id} enrichment and the real-enqueue mention leg (TASK-3939 part B2b) (#2284)
* feat(push): GET /me/notifications/{id} enrichment and the real-enqueue mention leg (TASK-3939 part B2b)
The endpoint resolves a push's nid through the dispatcher's own
notificationAccess gate; every denial is one byte-identical 404 and the
recipient's notification settings are never consulted. The mention leg
drives a real comment write through the real enqueue into a dispatch tick.
Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU
* fix(push): enrichment refusals are tested through the real router, docs corrected (TASK-3939 B2b codex r1)
A disabled account is refused 403 account_disabled by RequireAuth for every
id, not 404; docs/api.md said otherwise. Tests now go through ServeHTTP: a
disabled user's real and unknown ids are byte-identical, and an installed
app's padapp_ token (401 on this route) answers identically for both. The
direct-handler tests are gone. docs/api.md also states a 500 is an
operational error, not a denial.
Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU
* test(push): an unpinned API token reads its own notification through the router (TASK-3939 B2b codex r2)
Pins the docs/api.md claim that any authenticated person, an API token
included, can resolve their own notification.
Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU
* fix(push): enrichment returns 500 on an owner or actor lookup error (TASK-3939 B2b codex r3)
GetUser errors were ignored, so a store failure could answer a partial 200
with an empty path owner or actor name. A missing user is still (nil, nil)
and an empty field; only a real error is now a 500, as docs/api.md says.
Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU
|
||
|
xarmian
|
d97c528d1c |
fix(store): push token ownership follows a registration sequence, not updated_at (TASK-4031) (#2282)
Two users sharing a push token were ordered by updated_at (second resolution) then id (a random uuid), so a same-second reclaim could go to the previous registrant. Add push_devices.reg_seq (SQLite 157, Postgres 125): unique, advanced by every register (INSERT and the same-user in-place UPDATE), untouched by the password-rotation session rebind. The backfill orders by (updated_at, id) so no current owner changes. LivePushDevices compares reg_seq. Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU |
||
|
xarmian
|
ba3a0ab69b |
fix(store): a same-user push re-register keeps the device's created_at and row (TASK-4027) (#2281)
Ownership of a token shared across users now follows updated_at, so a reclaiming user is not outranked by the previous registrant. Claude-Session: https://claude.ai/code/session_01SSofJ73Kn2s3W4TTnjoAfU |
||
|
xarmian
|
aad3c35bdb |
fix(cli): pad item list --format json pages to completion when --limit is not set (BUG-4024) (#2279)
* fix(cli): pad item list --format json pages to completion when --limit is not set (BUG-4024) `pad item list --format json` stopped at the CLI's own 200 default and said so on stderr only, so a consumer parsing the array saw 200 of 204 rows with no signal in the payload. Ruling: with --format json and no --limit (cobra Changed, not a value compare) the CLI follows X-Pad-Next-Offset to the end, sends no limit and prints no notice. The payload stays a plain array; no API, schema or MCP change. An explicit --limit, including --limit 0, keeps today's behaviour and its stderr notice. --limit 0 has always meant "the default" (clamped to 200), not "no limit"; a test pins that. Table and markdown are untouched. --offset with no --limit pages from that offset to the end. One private pager (listAllPages) now backs ListAllItems and ListAllCollectionItems (the old names stay as wrappers) and new *Report variants taking a start offset and returning the first page's undeclared filter keys, so the BUG-3480 warning still fires. A non-advancing next offset, or more than 1000 pages, is an error and a non-zero exit with a message naming the cap, never a partial array. This also applies to the existing callers (reconcile, github status, project standup), which used to return a short list for the non-advancing case. Claude-Session: https://claude.ai/code/session_013aLLQx2EARjEzmWHbExjtm * fix(cli): the list pager requires has-more pages to be full and contiguous (BUG-4024 R2-F1) listAllPages accepted any next offset greater than the current one, so an empty has-more page, or a next offset that skipped rows never returned, followed by a has-more=false page, ended the loop on a partial list with no error. The server sets has-more only when it trimmed the probe row (handlers_items.go listItemsPage), so such a page holds exactly `limit` rows and next-offset == offset+len(items) with len(items) > 0. The pager now requires exactly that and otherwise returns an error with nil items. The check subsumes the old `NextOffset <= offset` test. Tests: empty page (advancing and non-advancing next offset), a jump, and one short, at the client level; the jump at the `pad item list --format json` level (non-zero exit, empty stdout). Claude-Session: https://claude.ai/code/session_013aLLQx2EARjEzmWHbExjtm * fix(cli): the list pager reads a negative start offset as 0, as the server does (BUG-4024 R3-F1) Claude-Session: https://claude.ai/code/session_01UiMM6MkrYr1nkuaNkSmkeD |
||
|
xarmian
|
ca184cff96 |
feat(needs): sort=importance|simplicity with a score-keyed cursor (TASK-3959, part 2) (#2274)
* feat(needs): sort=importance|simplicity with a score-keyed cursor (TASK-3959, part 2) GET /me/needs takes sort=importance and sort=simplicity: the primary score then the secondary, both highest first, then the item id; a row a scorer left unscored sorts last. The cursor carries the key as score/score2 (absent under age, so an age cursor is unchanged), and a score cursor missing either, or out of -1..100, is invalid_cursor. docs/api.md documents the sorts. Claude-Session: https://claude.ai/code/session_01UghmjfBZb6A8UbRgi4rPaw * fix(needs): r1 — differing-order sort test, degraded-page and missing-score docs, comments (TASK-3959, part 2 r1) Claude-Session: https://claude.ai/code/session_01DQDip8AC96dA71t2UCPLTD * fix(needs): r1 — range-check every cursor field, pin the as_of clamp (TASK-3959, part 2 r1) Claude-Session: https://claude.ai/code/session_01DQDip8AC96dA71t2UCPLTD * fix(needs): a cursor the server minted is always followed; key times clamp to int64 nanoseconds (TASK-3959, part 2 r2) r2 found that r1's key/created_at range check (> 0, before 2200) refused cursors the server itself mints: a pre-1970 date, or a zero time from an unparseable stored created_at, gives a non-positive UnixNano, and paging dead-ended at that row under every sort. A check may refuse only what the server could never mint, so key and created_at are no longer checked. A time outside int64 nanoseconds (a zero time, or past 2262) also did not round-trip: UnixNano wraps, so an age cursor named a different instant from the row's key. KeyFor now clamps both key times to that range, so the sort and the cursor see the same instant. The table drops the key/created_at 400 rows, keeps negative values as followed, and adds the age-cursor-with-a-score rows (r2 L2). A new test pages pre-1970, zero, unparseable and year-3000 boundary rows through every sort at limits 1 and 2. Claude-Session: https://claude.ai/code/session_01DQDip8AC96dA71t2UCPLTD * fix(needs): the cursor docs say only what the server could never mint is refused; the odd-time test runs on Postgres (TASK-3959, part 2 r3) r3 (both reviewers): docs/api.md still listed the key/created_at range check removed in r2. The sentence now lists exactly what is refused, says the key times are positions that any value of follows, and says a key time outside about 1677 to 2262 is clamped, so such rows tie on it (hunter L3). The odd-boundary test wrote created_at through the raw *sql.DB with a ? placeholder, which is not rewritten for Postgres; it now writes literal SQL, as setCreated does, and passes on both backends. It reports each sort with Errorf, and its comment says what each sort proves: every sort that the cursor's key times are followed, and only age that the clamp holds (r3 M2). Claude-Session: https://claude.ai/code/session_01DQDip8AC96dA71t2UCPLTD * fix(needs): the cursor docs list the version check; the real-scorer sort test runs on both backends (TASK-3959, part 2 r4) r4 hunter L1: the sentence listing exactly what a cursor check refuses left out a cursor of another version (v). r4 hunter L2: the test that sorts by the real scorers through the router ran on SQLite only; it now runs under needsBackends, and passes on Postgres. Claude-Session: https://claude.ai/code/session_01DQDip8AC96dA71t2UCPLTD |
||
|
xarmian
|
5aa9e49ab4 |
feat(needs): importance and simplicity scorers on /me/needs (TASK-3959, part 1b) (#2273)
* feat(needs): importance and simplicity scorers on /me/needs (TASK-3959, part 1b)
Registers the two needs scorers in server.New. Each fills needs.Score
{Value, Hint, Why} on every row, reading through the part 1a batch reads
and a request-scoped memo, so one request does each read once.
- Importance: round(100 x (.25P + .20B + .20D + .15S + .10H + .10A)).
B is a breadth-first fan-out over blocks links (visited set, depth 5,
cap 99). It counts and expands only targets visible under the scope and
still open, and returns a count, never refs. S is 0 until the
high_stakes eval (TASK-4011, ruling 440f5c63), so importance is capped
at 85 and not renormalised.
- Simplicity: (3 - effort)/3 x 100. The effort level is the argmax and the
hint comes from a fixed table (cap 40). With no decision runner, effort
is the text heuristic, with no hint.
- needs.Viewer gains Now, set from asOf, as the scorers' clock.
- Why emits only a fixed vocabulary, listed in docs/api.md; a test holds it
to that list.
The PLAN-3535 guard classes the new IsTerminalItem call as "keep".
Rulings 99c2bcfe and 6901f2f5 on the TASK-3959 trail.
Claude-Session: https://claude.ai/code/session_01UghmjfBZb6A8UbRgi4rPaw
* fix(needs): pass the workspace to the scoped decision and job reads (TASK-3959, part 1b)
Follows part 1a's round-1 fix, which scopes LatestDecisionsForItems and OwedDecisionJobs to a workspace. The needs memo passes its own workspace id.
Claude-Session: https://claude.ai/code/session_01UghmjfBZb6A8UbRgi4rPaw
* fix(needs): fail closed on scope and unknown collections, local-day deadline, request ctx (TASK-3959, part 1b r1)
Leak test through the router for a restricted viewer, fail-closed fan-out
pins, isOpen fails closed for an unknown collection, the question-hash read
takes the request ctx, D measures the server-local day like the dashboard,
H is clamped to [0,1], and docs/api.md's degraded prose names the real causes.
Claude-Session: https://claude.ai/code/session_01UghmjfBZb6A8UbRgi4rPaw
* fix(needs): pin every importance input, overdue parity with the dashboard, snapped rounding (TASK-3959, part 1b r2)
Per-input contribution table; overdue decided by itemOverdue; weighted sum
snapped before rounding; injectable location instead of mutating time.Local;
restricted-viewer score compared exactly to the hidden-item-deleted score;
docs: overdue rule and the WorkspaceFlagsForItems degraded path.
Claude-Session: https://claude.ai/code/session_01UghmjfBZb6A8UbRgi4rPaw
* test(needs): pin the deadline key pick, priority case and unreadable effort; scores at as_of (TASK-3959, part 1b r3)
- The importance parts table pins the earlier of due_date and end_date
(either key earlier, end_date alone) and the case-insensitive priority.
- A current effort answer whose level cannot be read falls back to the
text heuristic with no hint; a test now pins it, and docs/api.md says so.
- docs/api.md: scores are computed at the request's as_of, which the
cursor carries to later pages.
Claude-Session: https://claude.ai/code/session_014QJdFAhYDf79NBf2udvfdY
* test(needs): as_of reaches the scorers through the handler; threshold, key and date pins (TASK-3959, part 1b r4)
- A request with a cursor scores at the cursor's as_of, end to end through
ServeHTTP (page 1 at the wall clock is 33; a cursor a week after
waiting_since is 28).
- "judged to need a human" from the attention threshold up, not below.
- Unreadable effort keys -1 and x fall back to the heuristic, like 7.
- A date too short to parse scores D=0.
- blocks() states the lock it runs under.
Claude-Session: https://claude.ai/code/session_014QJdFAhYDf79NBf2udvfdY
* test(needs): the as_of check is its own test, so the binding test stays one claim (TASK-3959, part 1b r4)
Claude-Session: https://claude.ai/code/session_014QJdFAhYDf79NBf2udvfdY
* test(needs): a failed read degrades both real scorers; short-date overdue; effort without a medium (TASK-3959, part 1b r5)
Claude-Session: https://claude.ai/code/session_014QJdFAhYDf79NBf2udvfdY
* docs(needs): every scorer sharing a memo passes the same rows (TASK-3959, part 1b r6)
Claude-Session: https://claude.ai/code/session_014QJdFAhYDf79NBf2udvfdY
* fix(needs): needs-human weighs only an answer the inbox's flag rule holds current (TASK-3959, part 1b r7)
H and "judged to need a human" read needs_human through the flag path
(WorkspaceFlagsForItems at threshold 0 over the rows), so an answer made
stale by an edit, with no refresh owed, no longer weighs or says so while
the router does not flag the item. Effort keeps question-hash currency;
docs/api.md states both rules. EffortMediumMinProb is pinned at exactly .5.
Claude-Session: https://claude.ai/code/session_014QJdFAhYDf79NBf2udvfdY
* test(needs): a needs-human answer held while its refresh is owed; the asked-row exception in the docs (TASK-3959, part 1b r8)
Claude-Session: https://claude.ai/code/session_014QJdFAhYDf79NBf2udvfdY
|
||
|
xarmian
|
d76f06d199 |
feat(server): push device registration and notification settings API (TASK-3938) (#2269)
* feat(store): push device register/delete, SessionInfo.ID, one-tx session rotation (TASK-3938) RegisterPushDevice is one transaction: delete rows on either unique key, evict the oldest at the 20-device cap, insert. RotateUserSessions mints the replacement, rebinds the caller's own devices, deletes the other sessions, and fails closed to revoke-all. Claude-Session: https://claude.ai/code/session_019KLyQQPbv9eCe1d6PT2wHP * feat(server): push device and notification-settings routes, push_available (TASK-3938) Session-only PUT/DELETE /me/push-devices/{connection_id}, GET/PUT /me/notification-settings, push_available on /auth/session, PAD_PUSH_GATEWAY_URL, and all credential-change rotations through RotateUserSessions. docs/api.md updated. Claude-Session: https://claude.ai/code/session_019KLyQQPbv9eCe1d6PT2wHP * test(server): classify GET /me/notification-settings in the compress census (TASK-3938) Claude-Session: https://claude.ai/code/session_019KLyQQPbv9eCe1d6PT2wHP * fix(server): the pinned-token refusal on notification settings takes BUG-3982's shape (TASK-3938 r1) * fix(server): notification settings leave the pinned-token refusal to the BUG-3982 gate (TASK-3938 r1) * test(store): concurrent registers at 19 devices hold the push-device cap (TASK-3938) Claude-Session: https://claude.ai/code/session_019KLyQQPbv9eCe1d6PT2wHP * test(store): make the concurrent-register cap test able to fail on Postgres (TASK-3938) Reuse sessions across rounds and widen the count-to-insert window with a test-owned slow insert trigger, so removing the user-row lock overshoots the cap on every run. Claude-Session: https://claude.ai/code/session_019KLyQQPbv9eCe1d6PT2wHP * docs(server): a workspace-pinned token on /me/push-devices gets the BUG-3982 refusal, not session_required (TASK-3938 r1) * fix(server): push_available goes to a signed-in caller only (TASK-3938 r2) |
||
|
xarmian
|
5035168e5c |
fix(security)!: a workspace-pinned API token is confined to its workspace (BUG-3982) (#2266)
* wip(security): BUG-3982 pinned-PAT enforcement, in progress Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd * fix(security): narrow a pinned token's token doors; MCP global-route test (BUG-3982 r1) r1 rulings (lead, on BUG-3982): - F1: docs/api.md says details.token_workspace is absent for a deleted pin. - F2: for a workspace-pinned PAT, GET /auth/tokens lists only the user's tokens pinned to the same workspace, and DELETE /auth/tokens/{id} revokes only those (DeleteUserAPITokenInWorkspace: id, user and workspace in one statement); any other id is the missing-id 404. - Q1: an MCP tool mapped to a global route (pad_workspace create) is refused for a pinned PAT, tested through wireMCP. Claude-Session: https://claude.ai/code/session_01WTUZBwmpXmsWxJSaKqZGq4 * test(e2e): the suite token is unpinned (BUG-3982 CI) global-setup minted the browser suite's token with a workspace_id on a stale premise (api_tokens once required one). Under BUG-3982 a pinned token is refused the global routes the UI calls on every page, so the E2E jobs failed on 403s for /me/workspace-tabs, /events/stream and /auth/export. task-3415's deliberate pin is kept. Claude-Session: https://claude.ai/code/session_01WTUZBwmpXmsWxJSaKqZGq4 * fix(security): refuse import-status to a pinned token; the route walk checks admitted routes (BUG-3982 r3) GET /api/v1/workspaces/import-status sits outside the /{slug} subrouter, but the token route gate read "import-status" as a slug and admitted a pinned token, which could then read the user's import outcome for any workspace by key. It joins reorder, import and deleted as a refused segment. The route walk skipped every route the gate admits, so it could not catch a route admitted wrongly. Each admitted route must now sit inside the workspace subrouter or be in a hand-written expected list, and the list must match what the gate admits. Claude-Session: https://claude.ai/code/session_01WTUZBwmpXmsWxJSaKqZGq4 * fix(security): pin refusals precede slug resolution; a foreign pin is signed out on public routes (BUG-3982 r4) r4 rulings (lead, on BUG-3982): - On every door that takes a workspace by name (RequireWorkspaceAccess, SSE /events?workspace=, search ?workspace=), a pinned token naming any other workspace is refused before the name is resolved (pinAdmitsWorkspaceRef), so a nonexistent, non-member and member slug get byte-identical refusals. The resolved-ID compares stay behind it. - The email-restricted share link and the invitation preview read the caller through signedInFor: a token pinned to another workspace counts as signed out there. Claude-Session: https://claude.ai/code/session_01WTUZBwmpXmsWxJSaKqZGq4 * test: SSE compares a pinned token by resolved ID behind the by-name check (BUG-3982 r4) The r4 pre-resolution check shadows the SSE ID compare, and the 14-mutant rerun showed that mutant surviving. This direct test, shaped like TestBUG3982_WorkspaceAccessComparesThePinByID, holds it. Claude-Session: https://claude.ai/code/session_01WTUZBwmpXmsWxJSaKqZGq4 * fix(security): copy target and ref resolver refuse a foreign pin before resolving (BUG-3982 r5) r5 rulings (lead, on BUG-3982): - authorizeCrossWorkspace refuses a pinned token naming any other target_workspace before resolving it, so copy and preflight give a missing, non-member and member target the same refusal. The OAuth allow-list check, reported after the role check, is unchanged. - The /-/r/ resolver checks the pin by name before resolving; its answer was already the same 404. - Both join the identical-bytes test; the resolver also gets a by-ID test, since its resolved-ID compare is now behind the by-name one. Claude-Session: https://claude.ai/code/session_01WTUZBwmpXmsWxJSaKqZGq4 * fix(security): cross-workspace authorization compares the pin by resolved ID; collab by-ID test; docs separators (BUG-3982 r6) r6 rulings (lead, on BUG-3982): - authorizeCrossWorkspace compares the pin by resolved ID behind its by-name check, like RequireWorkspaceAccess, SSE, the resolver and collab, with a by-ID test. - Collab's resolved-ID compare gets the by-ID test the others have. - docs/api.md: five BUG-3982 sentences appended without a separator now end the sentence before them. Claude-Session: https://claude.ai/code/session_01WTUZBwmpXmsWxJSaKqZGq4 |
||
|
xarmian
|
dd412a022d |
feat(needs): GET /me/needs, the cross-workspace needs-you inbox and its router (TASK-3920) (#2253)
* feat(store): reads behind the cross-workspace needs inbox (TASK-3920) GuestWorkspaceIDs and GetWorkspacesByIDs for the fan-out; NeedsCandidateItems (visibility scope in SQL), OpenMentionsForItems, NeedsSnoozesForItems and NeedsMarkersForItems as batches, WorkspaceOwnerIDs, LatestAssignmentTimes. Snoozes are joined through items.workspace_id and read only for ids the caller already scoped by visibility (day-19 rulings on TASK-3920). Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd * feat(needs): the routing rule, row types and cursor for the needs inbox (TASK-3920) Resolve applies asked, mentioned, assigned, admin_fallback in strict exclusive order over pure inputs (TestResolve_Order). WaitingSince is the earliest open claim. Score.Value is an int 0-100; Scorer takes the viewer and scope. The cursor carries as_of, view and ws and is position only. Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd * feat(server): GET /me/needs, the cross-workspace needs-you inbox (TASK-3920) Fans out over the caller's member and guest workspaces (token allow-list, and a token bound to one workspace stays in it), reads candidates under the caller's visibility, routes them with needs.Resolve, applies the caller's snoozes (joined through items.workspace_id), and pages a total order. degraded is set only on a provider error. Documented in docs/api.md. Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd * fix(server): classify the needs inbox's route and lifecycle call (TASK-3920) Adds GET /me/needs to the compress census and its IsTerminalItem call to the PLAN-3535 lifecycle classification, and drops an unused helper and test field the linter found. Follows the previous commit; both ride the same PR. Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd * fix(needs): a mentioned row is built from the caller's own mentions; attention flags read only caller-visible items (TASK-3920) The mentioned rule built one routing for every mentioned person, so a caller's row carried the earliest mention of anyone and other people's commenters and comment ids. Resolve now builds each person's view from their own mentions (Routing.For), and the handler takes the caller's. The attention read evaluated the whole workspace before visibility, so an error from an item the caller cannot see set degraded. A new Runner.WorkspaceFlagsForItems filters decision rows to the given ids before any state read; the handler passes the caller-visible ones. Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd * fix(needs): only surfaced needs_human rows set a claim; clamp a forged future as_of (TASK-3920) The needs_human claim time was filled from every latest decision row, so a candidate whose row did not surface (below threshold, a no, stale) got a false needs_human reason whenever the workspace had any truly flagged item. Record and apply it only for flagged items. A cursor as_of later than now is clamped to now so the defer snapshot cannot be forged forward. Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd * test(needs): restricted-scope store test; document the display-name assignee match (TASK-3920) Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd |
||
|
xarmian
|
164768dab8 |
fix(server): an invite with an unknown role answers 400, not 500 (BUG-3861) (#2255)
* fix(server): an invite with an unknown role answers 400, not 500 (BUG-3861)
The invite door passed any role straight to CreateInvitation, so a value
outside owner/editor/viewer reached the invitations CHECK constraint and
answered 500. It now answers the role-change door's 400 ("role must be
owner, editor or viewer") and writes nothing. Both doors that take a
workspace role from the caller call one check, requireKnownWorkspaceRole,
so the answer cannot drift between them.
Population: those two are the only doors that take a workspace role from
request input (non-test Go under internal/ and cmd/); every other writer
passes the literal "owner".
Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd
* fix(server): check the invite role after the door's existing refusals (BUG-3861 r1)
Every answer the invite door gave before is unchanged; the only one that
changes is the old 500. Pinned by a setup-window case with a bad role.
Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd
* fix(server): check the invite role just before CreateInvitation (BUG-3861 r2)
The check ran ahead of the already-member 409, so a bad role turned it
into a 400. It now follows every refusal the handler makes; only the store's
own pre-insert refusals (disabled inviter, workspace deleted mid-request)
lose to it. Pinned by an already-member case with a bad role.
Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd
|
||
|
xarmian
|
393d986ea9 |
fix(auth): a browser-approved CLI token gets its own lifetime (TASK-3975) (#2252)
* fix(auth): a browser-approved CLI token gets its own lifetime (TASK-3975)
The CLI token minted by /auth/cli/sessions/{code}/approve was dated by the
approving web session's created_at, so approving from an 85-day-old session
left the token a 5-day window under the 90-day cap. It is now minted with no
issuedAt: created_at is the approval, 30-day sliding window, 90-day cap from
approval. No TTL lengths change.
The widening is accepted: a stolen near-expiry web session can now mint a CLI
token good for up to 90 days from approval. Step-up-on-approve is filed as its
own idea.
created_at doubled as the sign-in recency anchor for confirm-only account
delete (BUG-3336), so dating the CLI token from approval would have made it
read as a fresh sign-in. CLI-kind sessions can therefore no longer satisfy
confirm-only delete recency (403 reauth_required): approach (b), which keeps
the BUG-3336 property with no migration. Passwordless accounts confirm from
the web. The credential-change rotation keeps the replaced session's
created_at (pinned by a new test); its 7d-vs-30d TTL is BUG-3978, untouched.
Claude-Session: https://claude.ai/code/session_01JRXHP9ZVfEN3YEuzmucxP3
* fix(auth): only a browser session approves a CLI sign-in (TASK-3975 r2)
With the approval now minting the CLI token with its own lifetime, a
CLI-kind session that could approve could mint its own successor: a CLI
bearer creates a pending code with POST /auth/cli/sessions, approves it
with itself, and receives a new token with created_at = now and a fresh
90-day cap. Repeated before each cap, that chain keeps a CLI credential
(or a stolen one) alive forever. Before this PR the approval inherited
the approver's created_at, so the chain stayed bounded by the original
sign-in. Reproduced on the previous head: an 85-day-old CLI bearer got
200 and a session aged 0s.
The accepted widening is ONE hop from a web session; the chain never
was. /approve now refuses any approver that is not a web-kind session
with 403 session_required, before anything is minted. The web client
approves on its cookie and is the only caller. docs/api.md says so.
Claude-Session: https://claude.ai/code/session_01JRXHP9ZVfEN3YEuzmucxP3
* test(auth): the rotation cap pin starts from a 7-day web session (TASK-3975)
#2254 (BUG-3978) makes a credential-change rotation keep the replaced
session's own sliding window. TestTASK3975_RotationKeepsParentCap
rotated the 24-hour session oauthOnlyCloud mints, so after that change
the 24-hour window bound before the 90-day cap it exists to pin, and it
failed on the rebased tree (expiry now+24h, want now+5d). The parent is
now a 7-day web session, so the cap five days away is what binds.
Test-only.
Claude-Session: https://claude.ai/code/session_01JRXHP9ZVfEN3YEuzmucxP3
* docs(api): who may approve a CLI sign-in, by credential (TASK-3975 r4)
A CLI-kind bearer gets 403 session_required, a CLI-kind session sent as
a cookie is no credential (BUG-3350) and gets 401, and an API token gets
403. The sentence said any CLI-kind session got 403, and called the
web-kind check "browser" though a web session sent as a bearer passes.
Claude-Session: https://claude.ai/code/session_01JRXHP9ZVfEN3YEuzmucxP3
|
||
|
xarmian
|
096bde6954 |
feat(apps): admin Apps toggle, paused webhook status, app-name attribution, developer docs (TASK-3980) (#2258)
* feat(apps): admin Apps toggle, paused webhook status, app-name attribution, developer docs (TASK-3980)
Polish from the Connected Apps walkthrough, items 1-6:
1. Console > Admin > Settings gains an Apps section on the existing
GET/PUT /api/v1/admin/apps (draft-then-Save, read-only on Cloud); the
Apps tab's off-state copy now names it.
2. The install preview drops the stale "will activate when this server
supports them" notice: events and item actions are live.
3. An item an app's bot created reads "Created ... by <app name>" instead
of "by agent"; a person acting through an app keeps "by <person> via
<app>". created_by storage is unchanged.
4. An install's webhook status is derived as "paused" while the install
is not active, matching the delivery gate, instead of reading "active".
5. The context-code redeem route is /api/app/v1/context/redeem in both
code comments that named it under /workspaces/{ws}.
6. docs/apps.md: a developer guide to the manifest, install and redeem,
tokens, the app API, webhooks, item actions and lifecycle.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012tVNjc1RAdLdRN1ae77u4U
* docs(apps): r1 FIX-OR-CITE on the four untraced areas (TASK-3980)
Every claim in webhook delivery, install refusals, manifest limits and
comment author_kind is now backed by a file:line or corrected:
- The text limits (title, publisher, description, name, label, path)
are bytes, not characters.
- id and slug say their start and end rules.
- Reserved slugs refuse with 422 invalid_manifest.
- Unknown keys are refused in the manifest and collection schemas, but
not inside the free-form config_schema.
- Confirm documents 409 install_review_mismatch.
- Redeem documents its limits: 10 a minute per address, 5 per install.
- author_kind says when each value occurs.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012tVNjc1RAdLdRN1ae77u4U
* docs(apps): r2 Lows and FIX-OR-CITE on the OAuth paragraphs (TASK-3980)
r2 Lows:
- Apps off: the apps list answers 200 available:false, and every other
app route answers 404.
- Preview failures add invalid_base_url 400, artifact_fetch_failed 502
and artifact_destination_missing 422.
- paused takes precedence over the held notice. Enable restores the
hook's earlier status. Only rotate takes the secret away.
FIX-OR-CITE on delegated consent and OAuth (24 claims):
- Do not discover the token endpoint from the well-known document. It is
gated on MCP OAuth and describes MCP clients.
- Only reads are re-validated before send; writes and downloads re-check
at their own points.
- Name the three OAuth doors that stay open with MCP off.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012tVNjc1RAdLdRN1ae77u4U
---------
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
|
||
|
xarmian
|
07215d4953 |
fix(plugin): session start runs nothing; presence and the arm check wait for the first use of Pad (TASK-3970) (#2249)
* fix(plugin): session start runs nothing; presence and the arm check wait for the first use of Pad (TASK-3970)
Dave: "the plugin should not be doing anything when a session is started."
session.start now only registers /pad-pane and restores the pane. It no
longer runs `pad session register` / `should-arm`, no longer spawns
pad-monitor.sh, and no longer starts the 5s refresh timer, which now runs
only while the pane is open.
wake() runs once per session, on the first pad Bash command, a Pad MCP tool
call, or opening the pane. The first pad command waits for registration
(never for should-arm), because register mints the worker id that leases key
on. A .pad.toml push.auto_arm opt-in is therefore read at first use.
Tests: session start runs no process and asks for no timer; non-pad Bash
wakes nothing; wake runs once; an MCP tool wakes it; registration happens
before the first pad command runs. Prose swept (skill, monitor script,
CLAUDE.md, registry comments); docs/plugin-releases.md gets the stuck-0.3.x
remedy.
Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd
* fix(plugin): a pad command inside a shell string or after an assignment wakes the session (TASK-3970)
Hunter r1 F1: `bash -c "pad ..."`, `sh -c 'pad ...'` and `X=... pad` missed
the first-use match, so that call ran before presence was recorded. The
class now takes quotes and `=`; a false positive only wakes early.
Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd
* fix(plugin): pad as a whole word, checked against a table of shapes (TASK-3970)
Round r2 found two more missed shapes (Codex: `\pad ...`; hunter: a bare
`pad` before a quote, `)` or `;`). Rather than add a third case, the match
is now `pad` as a whole word, not inside a longer name. watch.test.ts
tables 25 shapes that run pad and 8 that do not, and asserts that
registration ran before each matching command reached the tool
(Codex r2 note).
Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd
* fix(plugin): a Pad MCP tool wakes the session whatever the server is called (TASK-3970)
Codex r3: the matcher required "pad" in the server part of the tool name,
so a Pad server registered under another name (work-tracker) was missed.
It now matches any mcp__<server>__pad_* tool. The tests table Pad tools
under four server names and four tools that are not Pad's, and add ./pad
and ../bin/pad to the Bash shapes.
Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd
* fix(plugin): the pane refreshes after a Pad MCP edit under any server name (TASK-3970)
Hunter r4: the pane-refresh matcher still required "pad" in the server
name, so it disagreed with the wake matcher fixed in
|
||
|
xarmian
|
94c6d3cc52 |
fix(brand): the favicon's gaps tighten to match the mark (TASK-3974) (#2248)
pad-mark-small moves from 4px tiles with 2px gaps (gap/tile 0.50) to 4px tiles with 1px gaps and a 1px inset (0.25), the grid pad-favicon-tile already used. It stays pixel-aligned: the master's own 0.19 renders its sub-pixel gaps as smeared half-tones at 16px 1x in Chromium and WebKit, and this grid stays crisp at 1x, 2x and 3x. icon.svg, favicon-16/32 and favicon.ico (16/32/48) are re-exported with export.mjs; the outputs of unchanged masters came out byte-identical, so the export reproduces the committed set. docs/brand.md records the change and why. Claude-Session: https://claude.ai/code/session_012tVNjc1RAdLdRN1ae77u4U Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> |
||
|
xarmian
|
16aaaf5450 |
feat(collections): awaits_human collection setting (TASK-3919) (#2244)
* feat(collections): awaits_human collection setting (TASK-3919) A collection whose items are asks of a person (IDEA-3906): the needs-you router will treat an open, assigned item in it as "asked". Stored as settings.awaits_human like tracks_work: absent means false, a settings write that omits it keeps the stored value, a typed member on create and update sets it alone, and a non-boolean is refused 400. No migration (A3 default). - models: CollectionAwaitsHuman[JSON], Carry/Validate/Set, on shared bool setting helpers that the tracks_work functions now use too - store: create and update apply it; update carries it under the row lock - CLI: pad collection update --awaits-human[=false], checked on the response - web: "Items are asks of a person" toggle on the editor's Display tab - docs/api.md Claude-Session: https://claude.ai/code/session_01EJctmVZwefvYhqSRSJhNKX * fix(collections): read awaits_human per key, not through CollectionSettings (TASK-3919) A plain bool field made a stored non-boolean awaits_human (an import is not validated) fail the whole CollectionSettings unmarshal, so a reference collection read as work. CollectionAwaitsHumanJSON now reads the one key. Also corrects the --awaits-human comment: the flag shape is not MCP-safe. Claude-Session: https://claude.ai/code/session_01EJctmVZwefvYhqSRSJhNKX * test(store): assert the returned settings after turning awaits_human off (TASK-3919) staticcheck SA4006: the UpdateCollection result was assigned and never read. Claude-Session: https://claude.ai/code/session_01Fbkk7f7M5JqZE1Gc4ZSSYj * fix(cli): pad collection create takes --awaits-human (TASK-3919) Codex r2 P2: only `collection update` had the flag, so marking a human-tasks collection took a second call. create now sends the typed member and, like update, refuses to report success when an older server ignored it. Claude-Session: https://claude.ai/code/session_01EZ6hZzQiytCeBxXrtCWcVd |
||
|
xarmian
|
e598bc4f64 |
feat(decision): effort, effort_medium and high_stakes on the attention set, staged; drain-paced backfill (TASK-3921) (#2236)
* feat(decision): effort, effort_medium and high_stakes on the attention set, staged; one-shot backfill (TASK-3921)
- attention set gains effort (Score), effort_medium (Choice) and high_stakes
(Noul) in the same call; needs_human_decision's text is unchanged.
- QuestionSet.Unsurfaced names the staged keys: WorkspaceFlags and
SurfacedDecisions skip them (no flag, no state read, no counter); the
decisions list and endpoint still return every row.
- attention chips only render keys that have a label.
- store: per-set enqueue body extracted (owedDecisionJobTx), OweDecisionJobs
(chunked, under the installed debounce) and ItemsMissingDecisionKey.
- Runner.BackfillEffort owes the attention set once for eligible items with a
needs_human_decision answer and no effort answer, marker
effort_decisions_backfilled written after every chunk; hooked at the end of
reconfigureDecisionsLocked (boot and later admin enable); makes no provider call.
- eval harness: titlebody now sends the live set; RESULTS.md rows pending.
- docs/api.md and tests updated.
Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF
* test(decision-eval): keep titlebody as the day-73 control, add titlebody-live; record the TASK-3957 and TASK-3921 runs
- titlebody again sends the day-73 pair (needs_human_decision + blocked), so it
stays comparable with its 09-22 row as the model-drift control.
- titlebody-live sends the live attention set on the same {title, body} state:
the TASK-3921 gate (needs_human_decision AUC 0.936, within .02 of 0.939).
- Every run prints the question keys it sends, before -dry too, so a row's
call shape is in its own log.
- RESULTS.md: rows for the one-question call (TASK-3957) and the
four-question call (TASK-3921).
Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF
* fix(decision): effort backfill lifecycle, staged keys off item reads, dry-run guard (TASK-3921; #r1 F1-F4)
- F1: startEffortBackfill checks stopped and does bg.Add under one
decisionTick.mu hold; BackfillEffort/EffortBackfillCandidates take a ctx
checked before each candidate read and each chunk; cancel returns ctx.Err()
and never writes the marker. stopDecisionTick cancels the run.
- F2: reconfigure cancels a running backfill; only a non-nil runner starts a
new one. A per-run generation replaces the atomic latch so a cancelled run
cannot clobber its successor.
- F3: item show / --agent / MCP item get use Runner.ItemReadDecisions, which
drops the set's Unsurfaced keys; the decisions endpoint stays raw. docs/api.md
updated.
- F4: the file dry run refuses a path with a -wal/-shm sibling or under
$HOME/.pad (refuseLiveDatabase, tested without the env var).
Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF
* test(decision): a chunk write that fails in the store writes no marker (TASK-3921; mutant M6)
The two failure tests fail the per-chunk test hook, so the path where
OweDecisionJobs itself returns an error was never exercised: a mutant that
ignores that error and marks anyway survived. The new test breaks the
decision_jobs table from the hook so the error comes back through the store,
asserts no marker, then restores the table and re-runs to completion.
Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF
* refactor(decision): drop the pre-marker cancel check; a cancel after the last chunk may mark (TASK-3921; M5, lead ruling)
Mutant M5 (that check removed) survived every test, and could not do
otherwise: a cancel can land there only after every chunk was owed, and the
marker means every candidate was ENQUEUED, not answered, so marking then is
true. The check is removed rather than kept as a guard no instrument can
turn red. The doc comments on BackfillEffort, cancelEffortBackfill and
startEffortBackfill now say a cancel before the last chunk writes no
marker and one after it may.
Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF
* docs(api): a backfill chunk in flight when decisions are disabled may still commit (TASK-3921; r2 L1, lead ruling bdce2116)
docs/api.md said that with no provider "no job row is ever written". That is
false for one window: a disable that lands while the one-shot effort
backfill is inside a chunk's write lets that chunk commit, and its jobs wait
until a provider returns. Ruled docs-only. The disable test's comment now
says it covers a backfill parked before its first chunk, not that window.
Sweep for the claim (CONVE-23): grep of docs, internal, cmd, scripts and
skills (.go, .md) for "no job row", "job row is", "no job is", "no jobs
are written/owed/enqueued" and "never written/owed/enqueued". Two hits are
about this mechanism: api.md:72 (fixed) and the test comment (narrowed).
Unchanged, still true:
- store/decisions.go:27 is about the WRITE DOORS, which still enqueue
nothing without a resolver.
- runner_test.go:238 is about the nil-provider runner, which never starts a
backfill.
- effort_backfill_lifecycle_test.go:128 covers a run parked before its
first chunk.
The other hits are unrelated mechanisms.
Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF
* fix(decision): pace the effort backfill on drain; dry run opens a copy; docs eligibility (TASK-3921; r3 M1, L2, L4)
- M1: the backfill owes one tick pass of items per chunk (20 default, wired
from the tick limit) and owes chunk k+1 only once chunk k's own jobs have
drained: none claimable now, by ClaimDecisionJobs' own predicate
(new Store.CountClaimableDecisionJobs). Debounced jobs do not hold it.
The wait polls at the tick interval, honours ctx, and a cancel writes
no marker; the marker still follows the last chunk being owed.
- L2: TestEffortBackfillDryRunOnFile copies the named file under GOTMPDIR
and opens only the copy.
- L4: docs/api.md states the real eligibility and the drain pacing.
Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF
* docs(decision): the Unsurfaced comment names ItemReadDecisions (TASK-3921; r4 L2)
The field's comment listed WorkspaceFlags and SurfacedDecisions as the
readers that skip staged keys, but not ItemReadDecisions, which item show
(and so --agent and MCP item get) has used since the r1 F3 fix. Comment only.
Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF
* test(decision): break the table before the LAST chunk so the store-failure test pins M6 (TASK-3921; lead ruling)
Since the drain pacing (
|
||
|
xarmian
|
ffc11387e1 |
feat(verify): verification evidence tied to a revision, slice 1 (TASK-3617) (#2228)
* feat(verify): verification evidence tied to a revision, slice 1 (TASK-3617)
Store, REST and the read-time judgment for per-criterion verdicts:
- item_verifications (SQLite 150, PG 120), append-only, with the NUL
census classified and trigger file 151 generated.
- internal/verification: criterion hash (whitespace-collapsed), the
removed / changed / superseded / current state, and the advisory
possibly_stale hint from a linked PR merged after the verdict.
- POST/GET /items/{ref}/verifications: atomic batch, seq-guarded so a
criterion hash is stored against the body it came from, via resolved
in-workspace and visibility-checked, activity "verified", item_updated
SSE.
- github_pr carries merge_sha / merged_at, fetched by pad github link
and reconcile.
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* test(verify): router tests, body-order sort, compress census, CLI merge fields (TASK-3617)
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* test(verify): close mutant holes M5 (re-spacing) and M8 (merged before the verdict); placeholder folds into missing (TASK-3617)
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* docs(api): the verifications endpoint (TASK-3617)
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* fix(verify): r1 findings: the retry re-checks access; a moved item is told from a gone via (TASK-3617)
- F1: when the item moves between the criteria read and the write, the
retry re-runs visibility and edit permission on the fresh item.
- F2: a zero-row insert re-checks the target in the transaction, so a
Postgres seq race retries (or 404s) instead of answering unknown_via.
- F3: verificationBeforeInsertHook test seam; tests for one move, an
item that keeps moving (409), and a grant revoked mid-retry (404).
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* fix(verify): r2 L1, the retry re-resolves via; gate findings (TASK-3617)
- The retry re-runs the via resolution and its visibility check, the same
re-check F1 added for the item; TestTASK3617_RetryRechecksVia.
- The state-history test asserted by row position, and one batch's rows
share a created_at, so their order is by random id: assert by criterion.
- nulscan.go's protected-column count (146: 27 JSON, 119 text).
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* test(store): the scan-cost pin follows the list, 146 columns (TASK-3617)
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* chore(verify): drop the comment resolveVia's doc comment superseded (TASK-3617 r3)
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* fix(verify): r4, verifications travel with a workspace export/import (TASK-3617)
- F1: VerificationExport, exported for the bundle's live items and
imported with the item and via ids remapped, every other value
verbatim. Each bundle row is checked before its insert (a refused
statement on Postgres loses the whole import); a row that fails, or
whose item did not import, is dropped and counted. Tests: a SQLite round
trip, the migrate-to-pg path (SQLite export into a Postgres import with
the slug preserved), and a hostile bundle on both backends.
- F2: docs/api.md says a criterion repeated in one request is
validation_error, as the code answers.
- Q2: gh's mergedAt zero time is read as not merged.
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* fix(store): item_verifications is a migrated table (TASK-3617 r4 gate)
The export now carries verifications, so the three lists that name what
`pad db migrate-to-pg` copies must name it too: MigratedTables (the NUL
preflight scans it), its export-section test map, and
migratedRefusalTables (the post-migration write refusal covers it).
Swept by item_reminders across cmd/, internal/ and docs/: those three
are the population.
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* chore(store): renumber TASK-3617 migrations after #2230 (sqlite 151/152, pg 121)
#2230 took sqlite 150 and pg 120 for decision_jobs.not_before. The
verification table is now sqlite 151 / pg 121, and its NUL trigger file
is 152_nul_invariant_triggers_post151 (regenerated, so the trigger names
carry pad_nul152_). References swept by the old file names and the bare
numbers in this branch's diff.
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
* test(verify): an id that is both a criterion and a placeholder is refused (TASK-3617, lead spot mutant)
Claude-Session: https://claude.ai/code/session_01DYmGZ1nCgxXCX4jPsQu5MW
|
||
|
xarmian
|
eb7f8a200c |
feat(needs): per-user dismiss/defer storage and the needs/snooze routes (TASK-3918) (#2231)
IDEA-3906 half A, unit A2.
- Migrations 153 (SQLite) and 122 (Postgres) add item_needs_snoozes, one
row per (user, item), FKs cascading, indexed on item_id.
- A deferral holds until defer_until (an RFC3339 time after now and within
366 days), whatever changes before then (IDEA-3906 A2). A fractional time
is stored rounded up to the next whole second, never early.
- A dismissal holds until something happens after its marker: a live
comment by anyone else newer than seen_comment_at, another such comment
at that same second (seen_comment_ids), or a later status transition
(MAX(status_transitions.seq); items.seq and updated_at don't move on a
comment). The user's own human comments never break it; an agent's
comments under their credentials do, and so does the user's own status
change. Imported comments are history and never break it.
- The marker comes from the client, clamped to the server's values so it
can only claim less was seen. No marker means the current state.
- PUT|DELETE /api/v1/workspaces/{ws}/items/{slug}/needs/snooze, beside
stars and watches: requireItemVisible (404 when hidden) and no edit
check, so viewers and item-grant guests may snooze. Read-scoped tokens
are refused by tokenScopeAllows. DELETE is idempotent.
- nulcolumns classifies the table's TEXT columns as server-written.
- A migrate-to-pg marked SQLite file refuses snooze writes: the table joins
migratedRefusalTables, since models.WorkspaceExport does not carry it.
TestMigratedDatabaseRefusesNeedsSnoozeWrites drives the store's own verbs
rather than iterating the list, so removing the entry goes red.
- Workspace purge relies on the FK cascade; the purge census
(wsChildTables, seedFullWorkspace) now counts item_needs_snoozes.
- docs/api.md documents the endpoint.
Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF
|
||
|
xarmian
|
e432d0f5bc |
feat(decision): debounce decision re-asks with decision_jobs.not_before (TASK-3916) (#2230)
* feat(decision): debounce decision re-asks with decision_jobs.not_before (TASK-3916) IDEA-3906 half B, unit B2. - Migrations 150 (SQLite) and 120 (Postgres) add decision_jobs.not_before TEXT. A job is claimable only once not_before is NULL or past, in the one decisionJobClaimable predicate both the scan and the claim UPDATE use. - The enqueue sets not_before to the item's latest evaluation for the set plus the set's window, or NULL when there is no window, no prior evaluation (a first evaluation is never delayed), or the window is past. The arithmetic is in Go on decisionTime TEXT, so both backends agree. On conflict COALESCE(old, new) keeps an existing not_before, so a stream of comments cannot push the re-ask back. - A superseded completion RECOMPUTES not_before from the latest evaluation rather than setting now+window (ruling ae2e0a90): the mid-run write read the evaluations before this run's answers landed. A run that stored nothing moves nothing, so it never invents a delay. - Runner.Install wires Store.SetDecisionDebounce: ReaskDebounce (1h) for the item-level sets, none for a PerComment set or an unregistered one. - The dashboard's attention comment says the pending window can now last up to an hour (#2229 r3-D1, ruling ce3e9dc5). - The tick-interval and release comments no longer promise a job is claimable at once: a debounced one waits for its window. - docs/api.md and README updated. Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF * docs: a debounced burst costs at most one call an hour (TASK-3916; #2230 r1 codex Low) * docs: the debounce is per question set (TASK-3916; #2230 r2 codex Low) * fix(store): debounce helpers stay inside the app-fence boundary (TASK-3916; #2230 CI TestAppstoreBoundary) |
||
|
xarmian
|
b1785f8952 |
fix(decision): retire text-derived blocked, waiting_on_external and conventions_comments; keep a pending answer on the dashboard (TASK-3915, TASK-3924) (#2229)
* fix(decision): retire text-derived blocked, waiting_on_external and conventions_comments; keep a pending answer on the dashboard (TASK-3915, TASK-3924) IDEA-3906 half B, units 1 and 3. - The attention set asks one question, needs_human_decision. The text-derived blocked Noul is gone: blocked is the dependency graph's alone, and the dashboard no longer appends a "its text says it is blocked" entry. waiting_on_external flagged nothing on 10-17 and goes too. - conventions_comments is no longer registered in production. It took 42% of provider calls on 10-17 for 7 chip-level answers. The set definition and the PerComment machinery stay, since tests and the conventions eval gates use them. The web drops the comment-card chips and their store. - Stored answers to the retired keys and set need no migration: no registered question carries their keys, so they read current=false and the brief counts them as stale questions. - WorkspaceFlags pending tolerance: an above-threshold answer whose item has moved on is kept while a job is owed for it with no recorded failure and the set still applies. Without that, the dashboard entry vanishes for the whole wait for the re-ask, which TASK-3916's debounce will stretch to an hour. - The day-73 titlebody eval control keeps the retired blocked question text locally, so it still re-runs that shape. - docs/api.md and README updated. Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF * test(decision): a claimed re-ask still counts as pending; rewording one question keeps the others (TASK-3915 r1) r1 hunter Lows, all FIXED: the per-key rewording rule had lost its coverage with the one-question set, so a two-question test set keeps it; a claimed-but-in-flight job leg is added to the pending test; the ProductionRegistry comment's run-on join is split. Claude-Session: https://claude.ai/code/session_018oQ5EErQKHtBJK8yLpcDNF |