mirror of https://github.com/PerpetualSoftware/pad.git synced 2026-09-23 19:06:33 +00:00

Files

T

xarmian b801867053 chore(web): npm audit fix — svelte 5.55.8, devalue 5.8.1, mermaid 11.15.0 (#589 )

* chore(web): npm audit fix — patch-bump svelte, devalue, mermaid

Resolves three advisories surfaced by the Web CI job (and visible on
recent main commits before this):

- svelte:    5.55.5 → 5.55.8 (moderate × 4: SSR XSS via spread,
             hydratable Promise XSS, DOM clobbering, ReDoS in
             <svelte:element>)
- devalue:   5.6.x → 5.8.1   (high: DoS via sparse array deser)
- mermaid:   11.14 → 11.15.0 (moderate × 4: Gantt infinite-loop DoS,
             classDef CSS/HTML injection, config CSS injection)

All three are in-range patch bumps — package.json untouched, only the
lockfile changes. No major bumps, no API churn.

Tiptap deliberately untouched: @tiptap/core, @tiptap/extension-
collaboration, @tiptap/y-tiptap stay at 3.22.5 — the CLAUDE.md
lockstep rule (coordinated bumps + Y.Doc schema-version bump) only
applies when those three move together, and nothing here does.

Verified:
- npm audit: 0 vulnerabilities
- npm run check: 0 errors (existing 6 warnings unchanged)
- make build + make install: clean, server boots and serves the new
  bundle.

* test(oauth): TestConsent_ApproveWithSpecificWorkspaces locates connection by shape

The test asserts the persisted oauth_connections row from a specific-
workspaces consent (allowed_workspaces=[alpha,beta]) has
AllCurrentWorkspaces=false and the right slug list. It indexed via
conns[0], which only worked when the approve flow was the most-recent
connection — but the test also calls runAuthCodeFlow above the
assertion to mint a bearer for the introspect call, and that helper
posts allowed_workspaces=["*"] → wildcard connection. With
ListUserOAuthConnections ordered ConnectedAt DESC, conns[0] is now the
wildcard bearer row, not the alpha+beta row this test is verifying.

We can't move the bearer-mint below the assertion (the introspect call
needs the bearer first), and the auth-code response doesn't surface the
request_id we'd need to look up the right connection directly. The
specific-workspaces flow is the only one in this test with
AllCurrentWorkspaces=false, so locate by that shape — surgical fix that
matches the test's actual intent.

Verified with `go test -count=3 -run TestConsent_ApproveWithSpecificWorkspaces`
(deflakes across orderings) and the full ./internal/server suite.

2026-05-18 17:17:42 -04:00

.vscode

Initial release

2026-03-26 01:52:36 +00:00

e2e

refactor(e2e): extract demo data into shared module (TASK-1201) (#431 )

2026-05-07 10:32:52 -04:00

src

fix(web,build): search palette hang on numeric query + graceful SSE shutdown (BUG-1531) (#588 )

2026-05-18 15:25:27 -04:00

static

feat(brand): new tagline — Project Management for the agent era (#351 )

2026-05-01 15:01:08 -04:00

.gitignore

test(e2e): Playwright smoke test infrastructure + 2 dashboard tests (TASK-689) (#225 )

2026-04-22 22:35:08 -04:00

.npmrc

Initial release

2026-03-26 01:52:36 +00:00

package-lock.json

chore(web): npm audit fix — svelte 5.55.8, devalue 5.8.1, mermaid 11.15.0 (#589 )

2026-05-18 17:17:42 -04:00

package.json

feat(web): localSearch MiniSearch store (TASK-1363) (#508 )

2026-05-11 22:35:40 -04:00

playwright.config.ts

test(e2e): Playwright smoke test infrastructure + 2 dashboard tests (TASK-689) (#225 )

2026-04-22 22:35:08 -04:00

README.md

Initial release

2026-03-26 01:52:36 +00:00

svelte.config.js

Initial release

2026-03-26 01:52:36 +00:00

tsconfig.json

Initial release

2026-03-26 01:52:36 +00:00

vite.config.ts

Initial release

2026-03-26 01:52:36 +00:00

README.md

Pad Web UI

SvelteKit 2 + Svelte 5 frontend for Pad, compiled to static files and embedded into the Go binary.

Development

npm install
npm run dev          # Dev server at localhost:5173 (proxies API to localhost:7777)
npm run build        # Production build to build/
npm run check        # Type checking with svelte-check

When developing, run the Go backend separately with make dev from the project root.

Building for Production

Do not build in isolation. Always use make build from the project root — this builds the web frontend, then compiles the Go binary with the build output embedded via //go:embed.

Stack

Svelte 5 with runes ($state, $derived, $effect)
SvelteKit 2 with adapter-static (SPA mode)
Tiptap block editor with markdown round-trip
svelte-dnd-action for drag-and-drop in board/list views
SSE for real-time updates
TypeScript throughout

Structure

src/
  routes/                    SvelteKit pages
    +layout.svelte           App shell (sidebar + main)
    +page.svelte             Landing/redirect
    [workspace]/
      +page.svelte           Dashboard (collections, phases, activity)
      +layout.svelte         SSE connection per workspace
      [collection]/
        +page.svelte         Collection view (board/list)
      [collection]/[item]/
        +page.svelte         Item detail + editor
      conventions/            Purpose-built conventions page
      playbooks/              Purpose-built playbooks page
      settings/               Workspace settings
  lib/
    api/client.ts            HTTP API client
    components/
      layout/                Sidebar, navigation
      editor/                Tiptap editor, raw markdown editor
      fields/                FieldEditor, relation picker
      items/                 ItemCard, ItemDetail
      collections/           BoardView, ListView
      common/                StatusBadge, badges, modals
      search/                CommandPalette
      activity/              ActivityFeed
    stores/                  Svelte 5 reactive stores
      workspace.svelte.ts    Workspace state
      collections.svelte.ts  Collection + item state
      ui.svelte.ts           Sidebar, mobile state
    types/index.ts           TypeScript types and constants
  app.css                    Global styles and design tokens