xarmian d2ee26cccd fix(auth): platform administration refuses an API token (BUG-3361) ...

BREAKING for anyone driving /api/v1/admin/* or admin account creation with
a personal access token: those now answer 403 session_required. Use a
`pad auth login` CLI session, or on self-host set PAD_ADMIN_API_TOKENS=allow.

An admin's PAT carried full platform authority. codex reproduced the chain
during BUG-3336's review: register an account with a chosen password,
promote it to admin, sign in as it, and reset any account's password. A
leaked admin token therefore escalated to interactive sessions for any
account.

- refuseAPITokenForAdmin guards the whole /api/v1/admin route group, so an
  admin route added later is refused by construction.
  TestBUG3361_EveryAdminRouteRefusesAnAdminPAT walks the router to hold it.
- handleRegister refuses admin-create signup with an API token.
- PAD_ADMIN_API_TOKENS=allow is the self-host escape hatch. It is read at
  startup, logs a WARN, and is never honoured in cloud mode. Documented in
  docs/deployment.md, Security.
- A browser session and a CLI session (padsess_) are unaffected. So is the
  Pad Cloud sidecar, which authenticates with the cloud secret, never a
  PAT. /audit-log already refused a PAT (BUG-3334).

Claude-Session: https://claude.ai/code/session_01H63zaWhkb5pAafx2WGjrVC

2026-10-02 21:50:05 +00:00

..

render

fix(attachments): a HEIC embed is decided by what can be served and painted, not by an image/ prefix (BUG-2964)

2026-09-08 19:40:37 -04:00

testdata

feat(materialize): recover unsaved editor sessions into items.content (TASK-2198 U4) (#1683)

2026-09-30 11:03:07 -04:00

access_epoch_test.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

access_epoch.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

activity_cursor_test.go

fix(activity): feeds page by a (created_at, id) keyset and break timestamp ties by id (BUG-2781) (#1459)

2026-09-23 09:05:05 -04:00

activity_cursor.go

fix(activity): feeds page by a (created_at, id) keyset and break timestamp ties by id (BUG-2781) (#1459)

2026-09-23 09:05:05 -04:00

artifact_import.go

fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) (#1550)

2026-09-25 21:48:30 -04:00

attachments_authz.go

fix(store): route cross-workspace copy's lock-held reads through the copy transaction (BUG-2409) (#1136)

2026-08-17 08:16:02 -04:00

authz_cross_workspace_test.go

feat(server): add cross-workspace copy dry-run preflight endpoint (TASK-2364)

2026-07-30 20:15:00 +00:00

authz_cross_workspace.go

docs(server): correct the cross-workspace authz re-check contract per final review

2026-07-31 02:35:53 +00:00

body_reader_census_test.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

bootstrap_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

bootstrap.go

feat(auth): PAD_BYPASS_SETUP_TOKEN open-bootstrap escape hatch (#429)

2026-05-06 13:27:12 -04:00

bug1791_archived_visibility_test.go

fix(items): surface archived items instead of masking them as missing (BUG-1791) (#733)

2026-06-15 14:44:58 -04:00

bug2367_close_state_test.go

fix(BUG-2367): a move or copy that would reopen, close or un-abandon an item must name the status instead of inheriting whatever survived migration (#1516)

2026-09-24 15:53:06 -04:00

bug2367_migrate_doors_test.go

fix(BUG-2367): moves and copies never carry into a computed field, and a carried unique-field collision is dropped and named instead of 500ing or storing a duplicate (#1514)

2026-09-24 13:12:32 -04:00

bug2639_guest_grant_terminal_test.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

bug2640_done_field_display_test.go

fix(project): standup and changelog rows show the value of the item's own done field, not a blank read from a literal status (BUG-2640) (#1477)

2026-09-23 19:37:58 -04:00

bug2683_bulk_move_dropped_test.go

test(BUG-2683): pin that a bulk move records an ordinary dropped field in its activity row, the case the bug was filed for (#1531)

2026-09-25 02:03:55 -04:00

bug2684_preflight_origin_test.go

test(BUG-2684): pin that the copy preflight labels a dropped-then-defaulted key from=default, the case the bug was filed for (#1533)

2026-09-25 01:36:38 -04:00

bug2685_grandfathered_reserved_key_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

bug2788_entry_id_stability_test.go

fix(timeline): structured entries get a persisted id instead of a positional one that renumbers when a sibling moves (BUG-2788) (#1540)

2026-09-25 07:10:26 -04:00

bug2812_scan_bench_test.go

fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) (#1550)

2026-09-25 21:48:30 -04:00

bug2817_metrics_label_bound_test.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

bug2819_audit_source_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

bug2819_filename_source_wiring_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

bug2896_collection_traits_duplicate_keys_test.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

bug3028_relation_blank_test.go

fix: a relation's "no target" has one stored form, and required means it names one (BUG-3028) (#1427)

2026-09-22 08:08:15 -04:00

bug3035_applier_seq_test.go

fix(cli): item edit refuses a stale body, guards its save with expected_seq, and keeps a recovery file on failure (BUG-3035) (#1418)

2026-09-21 21:03:05 -04:00

bug3037_expected_seq_test.go

feat(items): expected_seq — an OCC token that can tell two same-second writes apart (BUG-3037) (#1351)

2026-09-13 22:38:15 -04:00

bug3049_bulk_field_patch_test.go

fix(items): twelve item-field writers send a patch instead of replacing the blob (BUG-3049 / BUG-3055) (#1349)

2026-09-13 21:14:57 -04:00

bug3069_workspace_not_found_test.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

bug3079_default_drop_test.go

fix(items): an injected schema default takes the same type check a supplied value takes (BUG-3079) (#1362)

2026-09-14 09:03:24 -04:00

bug3080_client_write_test.go

fix: a tab's older content write can no longer land over its newer one (BUG-3080) (#1435)

2026-09-22 13:54:24 -04:00

bug3099_account_delete_owned_test.go

fix(store): account deletion reads the owned workspaces inside its transaction under the owner lock, so a workspace minted or unjoined in the window no longer survives its deleted owner (BUG-3099) (#1567)

2026-09-26 09:47:46 -04:00

bug3124_watermark_stamp_test.go

feat: a caught-up tab stamps the flush watermark, so viewing an item no longer leaves it pending (BUG-3124 unit B) (#1420)

2026-09-21 22:50:56 -04:00

bug3154_bulk_undeclared_key_test.go

fix(server): a bulk status or priority change refuses an item whose collection has no such field (BUG-3154) (#1450)

2026-09-23 03:09:25 -04:00

bug3163_reserved_write_doors_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

bug3167_query_or_contract_test.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

bug3202_field_number_precision_test.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

bug3202_semantic_compare_test.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

bug3219_repeated_member_test.go

fix(server): a request that repeats fields_patch or field_overrides is refused, where it silently dropped the first copy (BUG-3219) (#1548)

2026-09-25 18:23:31 -04:00

bug3244_rebuild_seed_grant_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3244_schema_rebuild_set_aside_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3244_set_aside_guard_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3254_guest_workspace_get_test.go

fix(workspaces): GET /workspaces/{ws} marks a guest, so a guest who arrives by URL gets the guest sidebar, not member chrome (BUG-3254) (#1616)

2026-09-27 13:08:42 -04:00

bug3257_role_board_counts_test.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

bug3273_stream_soft_delete_test.go

fix(server): an open workspace event stream closes when its workspace is soft-deleted (BUG-3273) (#1638)

2026-09-28 11:04:51 -04:00

bug3307_workspace_slug_test.go

fix(store): reusing a recently deleted workspace's name no longer 500s, and a create that loses a slug race takes the next one (BUG-3307) (#1689)

2026-09-30 09:10:41 -04:00

bug3314_activity_ip_test.go

fix(store): activity reads a member can reach no longer return ip_address and user_agent (BUG-3314) (#1679)

2026-09-30 02:20:23 -04:00

bug3327_applier_version_test.go

fix(versions): an applier-path body write leaves a version row (BUG-3327) (#1709)

2026-10-01 23:56:37 -04:00

bug3331_search_scope_test.go

fix(search): scope workspace search to visible items (#1723)

2026-10-02 11:18:07 -04:00

bug3333_deleted_collection_grant_test.go

fix(grants): an item grant never opens a deleted collection (BUG-3333) (#1725)

2026-10-02 12:29:03 -04:00

bug3334_fail_closed_test.go

fix(auth): store errors on access decisions fail closed (BUG-3334) (#1730)

2026-10-02 14:06:35 -04:00

bug3335_document_restore_scope_test.go

fix(documents): restore only a document of the URL's workspace (BUG-3335) (#1724)

2026-10-02 13:15:31 -04:00

bug3336_account_delete_test.go

fix(account): account deletion needs an interactive, recently signed-in session (BUG-3336) (#1733)

2026-10-02 15:43:57 -04:00

bug3339_share_link_deleted_workspace_test.go

fix(share-links): a link stops resolving while its workspace is deleted (#1726)

2026-10-02 12:41:02 -04:00

bug3340_webhook_scope_test.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

bug3341_lease_permission_test.go

fix(leases): bind item leases to the claiming account (#1731)

2026-10-02 14:20:58 -04:00

bug3343_sse_empty_collection_test.go

fix(sse): an item event without a collection is not workspace-level (BUG-3343) (#1729)

2026-10-02 13:52:04 -04:00

bug3346_body_ids_test.go

fix(api): body-supplied IDs must name something in the authorized workspace (BUG-3346) (#1728)

2026-10-02 13:34:22 -04:00

bug3348_unverified_email_access_test.go

fix(server): match accounts by email only once the address is verified (#1732)

2026-10-02 14:56:36 -04:00

bug3353_legacy_token_test.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

bug3354_import_bundle_bomb_test.go

fix(import): bound the work a single bundle import can do (#1735)

2026-10-02 16:28:58 -04:00

bug3355_last_owner_test.go

fix(members): keep a workspace's owner and at least one owner member (#1737)

2026-10-02 17:01:54 -04:00

bug3361_admin_pat_test.go

fix(auth): platform administration refuses an API token (BUG-3361)

2026-10-02 21:50:05 +00:00

claim_codes_test.go

feat(mcp): workspace.create + workspace.claim actions + claim-code mechanics (TASK-1521) (#582)

2026-05-18 00:43:46 -04:00

claim_codes.go

feat(mcp): workspace.create + workspace.claim actions + claim-code mechanics (TASK-1521) (#582)

2026-05-18 00:43:46 -04:00

client_write_marks.go

fix: a tab's older content write can no longer land over its newer one (BUG-3080) (#1435)

2026-09-22 13:54:24 -04:00

cloud_admin_gate_test.go

fix(server): gate RequireAuth's cloud-secret bypass on validated session (BUG-1944) (#1112)

2026-08-15 19:18:55 -04:00

collection_resolve_test.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

collection_resolve.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

content_disposition_test.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

content_disposition.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

content_state_population_test.go

fix(web): a body the server marks as behind its live document says so wherever it is rendered — share pages, the read-only pane, the diff, and a dot on marked rows in lists, backlinks and the palette (BUG-3050 U3) (#1577)

2026-09-26 13:37:34 -04:00

context.go

feat(mcp): mount the ChatGPT catalog at /mcp/chatgpt, OAuth-only, off by default (TASK-3321 U2b) (#1719)

2026-10-02 03:34:43 -04:00

copy_preflight_drop_reason_parity_test.go

IDEA-2893 + IDEA-2894: record the accepted carry disclosure, and make the drop-reason mapper testable (#1254)

2026-09-05 19:01:57 -04:00

dashboard_attention_decisions_test.go

feat(decision): content-aware attention on the dashboard and item page (TASK-3118) (#1421)

2026-09-21 23:55:54 -04:00

decision_settings_test.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

decision_settings.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

decision_tick.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

decode_json_nul_test.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

decode_json_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

document_lock_contention_test.go

fix(store): serialize document renames and stop reading the pool inside transactions (BUG-2778) (#1208)

2026-08-25 22:40:58 -04:00

events_publish_test.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

events_publish.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

events_surface_test.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

events_surface.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

handlers_2fa_recovery_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

handlers_2fa_totp_step_test.go

fix(security): make TOTP login codes single-use (BUG-2054) (#914)

2026-07-10 23:56:59 -04:00

handlers_2fa.go

fix(server): bound the per-key rate limiter maps and key IPv6 on the /64 (BUG-3308) (#1670)

2026-09-29 19:22:17 -04:00

handlers_account_export_contract_test.go

test: cover account delete + export contracts and Danger Zone e2e (TASK-1963) (#824)

2026-07-05 20:47:30 -04:00

handlers_account_export_gate_test.go

fix(server): deny account export to restricted owners (BUG-1945) (#814)

2026-07-04 14:38:01 -04:00

handlers_account_test.go

test: cover account delete + export contracts and Danger Zone e2e (TASK-1963) (#824)

2026-07-05 20:47:30 -04:00

handlers_account.go

fix(account): account deletion needs an interactive, recently signed-in session (BUG-3336) (#1733)

2026-10-02 15:43:57 -04:00

handlers_activity_debounce_actor_test.go

fix(store): activity debounce must not merge across writers (BUG-2763) (#1201)

2026-08-25 14:28:29 -04:00

handlers_activity.go

fix(activity): feeds page by a (created_at, id) keyset and break timestamp ties by id (BUG-2781) (#1459)

2026-09-23 09:05:05 -04:00

handlers_admin_bearer_gate_test.go

fix(security): gate collab WebSocket writes on editor role (TASK-265) (#938)

2026-07-15 01:30:12 -04:00

handlers_admin_billing_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_admin_billing.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_admin_invitations.go

fix(store,server): an invitation to a soft-deleted workspace reads as unknown (BUG-3104) (#1413)

2026-09-21 17:58:27 -04:00

handlers_admin_mcp_test.go

feat(mcp): MCP addressing from config; mcp_enabled setting with an env lock (TASK-3302, PLAN-2310 U1) (#1662)

2026-09-29 12:46:03 -04:00

handlers_admin_mcp.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

handlers_admin_settings_test.go

fix(admin): stop leaking 2FA secret via GET /admin/settings (BUG-1909) (#779)

2026-07-01 17:44:43 -04:00

handlers_admin_users_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_admin_users.go

fix(account): account deletion needs an interactive, recently signed-in session (BUG-3336) (#1733)

2026-10-02 15:43:57 -04:00

handlers_admin.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

handlers_agent_roles.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

handlers_artifact_export_device_test.go

fix(BUG-3185): an item export's file name whose stem is a Windows device gets a "_" prefix, on the server and in the CLI (#1495)

2026-09-24 03:44:11 -04:00

handlers_artifact_export.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

handlers_artifact_import_relation_carry_test.go

fix: a relation's "no target" has one stored form, and required means it names one (BUG-3028) (#1427)

2026-09-22 08:08:15 -04:00

handlers_artifact_import_warnings_test.go

WIP feat(server,store): referent validation for relation values — 6 of 8 doors (TASK-2878) (#1246)

2026-09-05 10:07:44 -04:00

handlers_artifact_import.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_artifact_test.go

fix(cli): refuse a blank --stdin body on item create/update; add --clear-content (BUG-3100) (#1415)

2026-09-21 18:52:28 -04:00

handlers_attachments_attach_test.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_attachments_attach.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_attachments_bug2818_test.go

fix(attachments): the blocklist judges the same filename the download header serves (BUG-2818) (#1445)

2026-09-22 20:54:46 -04:00

handlers_attachments_bug2822_test.go

fix(attachments): a stored name Windows would open as a device gets a "_" prefix (BUG-2822) (#1493)

2026-09-24 02:37:59 -04:00

handlers_attachments_bug3153_test.go

fix(attachments): drop Bidi_Control characters from attachment names and rewrite legacy rows (BUG-3153) (#1452)

2026-09-23 04:35:58 -04:00

handlers_attachments_download_authz_test.go

refactor(attachments): centralize parent resolution, close orphan-read and delete-denial gaps

2026-08-02 00:55:20 +00:00

handlers_attachments_download_mime_test.go

fix(server): force-download unknown and disallowed stored MIME (BUG-2413)

2026-08-08 20:37:39 +00:00

handlers_attachments_download_test.go

fix(ci): gofmt + bump race-detector timeout to 30m (#299)

2026-04-29 15:41:12 -04:00

handlers_attachments_isobmff_test.go

fix(attachments): HEIC, HEIF and AVIF are recognised from their bytes, not refused (BUG-2961) (#1291)

2026-09-08 13:30:42 -04:00

handlers_attachments_test.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_attachments_thumbnails_parent_test.go

fix(attachments): skip derivation for an archived parent (TASK-2404)

2026-08-01 23:27:34 +00:00

handlers_attachments_thumbnails_test.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

handlers_attachments_thumbnails.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_attachments_transform_authz_test.go

fix(attachments): gate transform on item visibility (TASK-2402)

2026-08-01 23:05:26 +00:00

handlers_attachments_transform_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_attachments_transform.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_attachments_upload_live_item_test.go

refactor(attachments): centralize parent resolution, close orphan-read and delete-denial gaps

2026-08-02 00:55:20 +00:00

handlers_attachments_variant_headers_test.go

fix(attachments): a HEIC embed is decided by what can be served and painted, not by an image/ prefix (BUG-2964)

2026-09-08 19:40:37 -04:00

handlers_attachments.go

feat(attachments): the viewer says when a file was uploaded, and by whom (TASK-3319) (#1697)

2026-09-30 16:49:25 -04:00

handlers_audit.go

fix(auth): store errors on access decisions fail closed (BUG-3334) (#1730)

2026-10-02 14:06:35 -04:00

handlers_auth_admin_register_test.go

fix(auth): an admin-created registration mints no session, so creating an account no longer hands the admin a live credential for the new user (BUG-3232) (#1581)

2026-09-26 15:27:50 -04:00

handlers_auth_bootstrap_bypass_test.go

feat(auth): PAD_BYPASS_SETUP_TOKEN open-bootstrap escape hatch (#429)

2026-05-06 13:27:12 -04:00

handlers_auth_bootstrap_token_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

handlers_auth_local_reset_test.go

feat(auth): localhost password recovery for locked-out self-host admins (#760)

2026-06-22 20:58:50 -04:00

handlers_auth_loopback_test.go

fix(server): read raw TCP peer for loopback check (TASK-662) (#175)

2026-04-21 19:33:47 -04:00

handlers_auth_ratelimit_test.go

feat(auth): per-email login rate limiter (TASK-651) (#178)

2026-04-21 20:52:03 -04:00

handlers_auth_replaced_session_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_auth_session_rotation_test.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

handlers_auth_test.go

feat(web): the connect modal serves the token path (TASK-2321, PLAN-2310 U6) (#1668)

2026-09-29 18:15:34 -04:00

handlers_auth.go

fix(auth): platform administration refuses an API token (BUG-3361)

2026-10-02 21:50:05 +00:00

handlers_backlinks_admin_bearer_test.go

fix(backlinks): scope cross-workspace admin enumeration to membership for bearer auth (BUG-1617) (#633)

2026-05-27 10:37:30 -04:00

handlers_backlinks.go

fix(server): consistent soft-delete handling across item sub-resources (#771)

2026-06-27 21:42:52 -05:00

handlers_bootstrap_test.go

fix(server): guard degraded/degraded_sections in bootstrap dashboard (BUG-2072) (#869)

2026-07-08 13:09:26 -04:00

handlers_bootstrap.go

fix(store): a collection gated by ID is queried by ID, so a slug freed and re-taken in between cannot answer for another collection (BUG-2631) (#1535)

2026-09-25 04:25:42 -04:00

handlers_bug3322_totp_doors_test.go

fix(auth): OAuth login and password reset no longer mint a session past TOTP (BUG-3322) (#1699)

2026-09-30 22:50:45 -04:00

handlers_capabilities.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_changelog_abandoned_test.go

fix(project): a collection's own abandoned_options decide what the changelog, standup and reports count as shipped (BUG-2347) (#1464)

2026-09-23 12:52:46 -04:00

handlers_changes.go

chore: clear staticcheck SA + U1000 findings on main (TASK-764) (#249)

2026-04-25 11:53:31 -04:00

handlers_chatgpt_mcp.go

feat(mcp): mount the ChatGPT catalog at /mcp/chatgpt, OAuth-only, off by default (TASK-3321 U2b) (#1719)

2026-10-02 03:34:43 -04:00

handlers_claim_code_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_claim_code.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_cli_auth_test.go

fix(server): derive CLI auth URL scheme from r.TLS, gate X-Forwarded-Proto on trusted proxies (TASK-665) (#190)

2026-04-22 09:27:45 -04:00

handlers_cli_auth.go

fix(account): account deletion needs an interactive, recently signed-in session (BUG-3336) (#1733)

2026-10-02 15:43:57 -04:00

handlers_cloud_autocreate_husk_test.go

fix(cloud): auto-create removes a workspace it cannot seed or administer, and leaves no restorable husk (BUG-3087) (#1383)

2026-09-15 12:50:53 -04:00

handlers_cloud_autocreate_workspace_test.go

fix(cloud): auto-create removes a workspace it cannot seed or administer, and leaves no restorable husk (BUG-3087) (#1383)

2026-09-15 12:50:53 -04:00

handlers_cloud_member_ack_test.go

fix(cloud): reconcile before destroying a workspace whose owner-add lost its ack (BUG-3026) (#1341)

2026-09-11 19:34:44 -04:00

handlers_cloud.go

fix(account): account deletion needs an interactive, recently signed-in session (BUG-3336) (#1733)

2026-10-02 15:43:57 -04:00

handlers_collab_applier_refusal_test.go

fix(server): a successful applier-path PATCH stops answering with the previous content (BUG-2995) (#1320)

2026-09-10 12:37:49 -04:00

handlers_collab_bug1308_test.go

fix(collab): WebSocket dials get their own per-user bucket and a per-user socket cap, and the editor jitters its reconnects (BUG-1308) (#1499)

2026-09-24 04:51:57 -04:00

handlers_collab_prune_atomicity_test.go

fix(server): the op-log prune rides inside the write it justifies (BUG-2840 half B) (#1295)

2026-09-08 16:46:28 -04:00

handlers_collab_set_aside.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

handlers_collab_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_collab_watermark.go

fix(editor): opening an item without typing no longer rewrites a body the editor does not reproduce byte for byte (BUG-3197) (#1515)

2026-09-24 16:42:14 -04:00

handlers_collab.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

handlers_collection_crud_visibility_test.go

fix(server): gate collection update/delete on visibility (BUG-1921) (#795)

2026-07-03 18:12:35 -04:00

handlers_collection_traits_rename_test.go

feat(store,server,web): collection kernel traits — de-hardcode conventions/playbooks slugs (TASK-2657, BUG-2702) (#1171)

2026-08-20 13:26:05 -04:00

handlers_collection_traits_test.go

feat(store,server): make collection trait uniqueness a database invariant — de-dup pass + partial unique indexes (TASK-2710) (#1257)

2026-09-05 20:43:43 -04:00

handlers_collections_concurrency_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_collections_refusal_status_test.go

fix(server): a refused collection prefix reaches the caller as a 400 naming the rule (BUG-2951) (#1293)

2026-09-08 14:51:21 -04:00

handlers_collections_reserved_keys_test.go

fix(server): reserve parent/plan schema field keys (TASK-1912) (#786)

2026-07-03 03:27:04 -04:00

handlers_collections.go

fix(search): scope workspace search to visible items (#1723)

2026-10-02 11:18:07 -04:00

handlers_comments_atomic_test.go

fix(comments): the "commented" activity and the comment commit in one transaction (BUG-2716) (#1388)

2026-09-15 16:36:26 -04:00

handlers_comments_bearer_gate_test.go

fix(server): bearer-gate canEditComment's admin bypass (BUG-1919) (#796)

2026-07-03 18:24:36 -04:00

handlers_comments_edit_test.go

feat(comments): comment editing backend — user_id, UpdateComment, PATCH, SSE (TASK-1663) (#665)

2026-05-30 12:38:57 -04:00

handlers_comments_item_scoped_test.go

fix(comments): a deleted comment with replies leaves a tombstone (BUG-3252) (#1675)

2026-09-30 00:41:20 -04:00

handlers_comments.go

fix(sse): an item event without a collection is not workspace-level (BUG-3343) (#1729)

2026-10-02 13:52:04 -04:00

handlers_connected_apps_mutations_test.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

handlers_connected_apps_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_connected_apps.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_content_state_doors_test.go

fix(items): eleven hand-built doors carry the stale-body marker (BUG-3033) (#1344)

2026-09-13 18:34:16 -04:00

handlers_convention_library.go

feat(server): library endpoints gain ?category, ?summary, /library/entry (TASK-1561) (#612)

2026-05-21 13:08:02 -04:00

handlers_dashboard_test.go

test(server): adopt t.Parallel() in heaviest handler tests (TASK-2059) (#918)

2026-07-11 09:38:14 -04:00

handlers_dashboard.go

fix(progress): an abandoned child leaves both the done count and the total, and 0/0 renders as no progress (BUG-3195) (#1510)

2026-09-24 11:24:33 -04:00

handlers_decisions_test.go

feat(decision): typed-decision storage and async runner (TASK-3117) (#1417)

2026-09-21 20:46:41 -04:00

handlers_decisions.go

feat(decision): typed-decision storage and async runner (TASK-3117) (#1417)

2026-09-21 20:46:41 -04:00

handlers_documents_test.go

fix(fields,activity): debounce typed-input field saves + collapse same-field activity runs (BUG-1466) (#549)

2026-05-14 22:10:12 -04:00

handlers_documents_title_test.go

fix(documents): bound the rename cascade at the title and at the projected total (BUG-2798, BUG-2796) (#1218)

2026-08-27 22:45:27 -04:00

handlers_documents.go

fix(documents): restore only a document of the URL's workspace (BUG-3335) (#1724)

2026-10-02 13:15:31 -04:00

handlers_events_access_epoch_stream_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_access_epoch_test.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

handlers_events_cancel_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_failed_test.go

fix(events): a closed MemoryBus refuses a late subscribe instead of handing out a channel nothing will close (BUG-2737) (#1483)

2026-09-23 21:52:18 -04:00

handlers_events_filter_test.go

fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989)

2026-07-21 09:43:05 -04:00

handlers_events_membership_test.go

fix(security): require workspace membership on SSE subscriptions (TASK-264) (#937)

2026-07-14 23:43:19 -04:00

handlers_events_resume_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_revalidation_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_events_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

handlers_export_bundle_test.go

feat(attachments): bundle attachments + manifest in workspace export (TASK-884) (#305)

2026-04-29 18:30:43 -04:00

handlers_export_bundle.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

handlers_export_gate_test.go

fix(server): deny workspace export to restricted owners (BUG-1922) (#813)

2026-07-04 13:54:08 -04:00

handlers_grant_visibility_test.go

fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989)

2026-07-21 09:43:05 -04:00

handlers_grants.go

fix(server): match accounts by email only once the address is verified (#1732)

2026-10-02 14:56:36 -04:00

handlers_graph_test.go

fix(server): bearer-gate visibleCollectionIDs to close BUG-1917 (#792)

2026-07-03 14:40:54 -04:00

handlers_graph.go

feat(server): focused neighborhood mode on workspace graph endpoint (TASK-1781) (#718)

2026-06-08 18:13:10 -04:00

handlers_import_bundle_bug3184_test.go

fix(import): a failed bundle import always reports its workspace, and the body is read under a per-Read deadline (BUG-3184) (#1497)

2026-09-24 03:44:26 -04:00

handlers_import_bundle_bug3191_test.go

fix(import): a panic after a bundle import creates its workspace takes the keep door, then re-panics (BUG-3191) (#1501)

2026-09-24 05:49:44 -04:00

handlers_import_bundle_comment_refs_test.go

fix(store): cover documents and comment bodies in the attachment reference walks (BUG-2614, BUG-2615) (#1145)

2026-08-17 14:26:09 -04:00

handlers_import_bundle_husk_test.go

fix(import): a rejected bundle import leaves no restorable husk, and the shared removal reclaims blobs before it purges (BUG-3094) (#1385)

2026-09-15 14:12:20 -04:00

handlers_import_bundle_partial_test.go

fix(import): a kept partial bundle import is attached to its importer instead of left ownerless (BUG-2709) (#1386)

2026-09-15 15:40:13 -04:00

handlers_import_bundle_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_import_bundle.go

fix(import): bound the work a single bundle import can do (#1735)

2026-10-02 16:28:58 -04:00

handlers_import_stale_bodies_test.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

handlers_import_test.go

feat(server): POST /api/v1/import/url endpoint + integration tests (TASK-1472) (#556)

2026-05-15 00:36:41 -04:00

handlers_import.go

feat(server): POST /api/v1/import/url endpoint + integration tests (TASK-1472) (#556)

2026-05-15 00:36:41 -04:00

handlers_invitation_accept_limit_test.go

fix(invitations): accepting as an existing member is idempotent (BUG-3281) (#1645)

2026-09-28 15:46:57 -04:00

handlers_invitation_deleted_workspace_test.go

fix(store,server): an invitation to a soft-deleted workspace reads as unknown (BUG-3104) (#1413)

2026-09-21 17:58:27 -04:00

handlers_invitation_email_test.go

fix(auth): exact invitation email match, no Unicode folding (BUG-3282) (#1644)

2026-09-28 15:01:24 -04:00

handlers_invitation_preview_test.go

fix(server): invitation-preview endpoint + read-only email prefill on /join (BUG-1934) (#803)

2026-07-03 23:47:06 -04:00

handlers_item_lease_test.go

fix(leases): bind item leases to the claiming account (#1731)

2026-10-02 14:20:58 -04:00

handlers_item_lease.go

fix(leases): bind item leases to the claiming account (#1731)

2026-10-02 14:20:58 -04:00

handlers_item_links_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_item_links.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

handlers_item_versions_bounds_test.go

fix: bound item history and stop resolving bodies nobody reads (BUG-2608) (#1147)

2026-08-17 19:02:53 -04:00

handlers_item_versions_bug3031_pg_test.go

fix(versions): a restore over unsaved collaborative edits is refused unless the caller consents to discarding them (BUG-3031) (#1573)

2026-09-26 12:57:38 -04:00

handlers_item_versions_bug3031_test.go

fix: an overwrite, including a confirmed version restore, that deleted another tab's unsaved edits says how many (BUG-3230 U2) (#1595)

2026-09-26 23:25:18 -04:00

handlers_item_versions_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_item_versions.go

feat(history): version rows carry their writer, line counts and create marker, plus a per-version diff endpoint (PLAN-2348 U2) (#1691)

2026-09-30 10:02:41 -04:00

handlers_items_access_epoch_test.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

handlers_items_ack_loss_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_append_test.go

fix(items): note and decide append server-side under the write lock, so they no longer revert a concurrent field write (BUG-3056) (#1458)

2026-09-23 07:46:45 -04:00

handlers_items_attribution_test.go

fix(cli,server): make agent attribution actually happen (BUG-2542) (#1088)

2026-08-13 16:21:10 -04:00

handlers_items_bug3133_pending_guard_test.go

fix: refuse a token-guarded content write over unflushed tab edits (BUG-3133) (#1423)

2026-09-22 00:42:02 -04:00

handlers_items_bug3230_refuse_pending_test.go

fix(web): the item pane's raw-markdown saves are refused, not applied, over another tab's unstored edits; an unload save keeps its text for recovery (BUG-3230 U0) (#1590)

2026-09-26 21:28:37 -04:00

handlers_items_bulk_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_bulk.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_items_collab_versions_test.go

fix(versions): a restore over unsaved collaborative edits is refused unless the caller consents to discarding them (BUG-3031) (#1573)

2026-09-26 12:57:38 -04:00

handlers_items_content_echo_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_content_route_test.go

fix(server): write first, apply second on the collab applier path (TASK-2989 / BUG-2840 half A) (#1318)

2026-09-10 08:54:41 -04:00

handlers_items_content_route.go

feat: every content change through the ChatGPT door is versioned first (TASK-3321 U1b) (#1711)

2026-10-02 01:01:15 -04:00

handlers_items_content_state_test.go

feat(items): content_state marks a body the server knows is stale (BUG-3000) (#1343)

2026-09-13 10:51:03 -04:00

handlers_items_copy_attachment_authz_test.go

fix(copy): authorize attachment references in cross-workspace copy (TASK-2408)

2026-08-02 04:54:31 +00:00

handlers_items_copy_content_state_test.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

handlers_items_copy_parity_test.go

refactor(server): extract resolveAuthorizedCopy shared by preflight and copy (TASK-2370)

2026-07-31 14:43:40 +00:00

handlers_items_copy_preflight_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_copy_preflight.go

fix(server): a request that repeats fields_patch or field_overrides is refused, where it silently dropped the first copy (BUG-3219) (#1548)

2026-09-25 18:23:31 -04:00

handlers_items_copy_relation_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

handlers_items_copy_resolve.go

fix(server): a request that repeats fields_patch or field_overrides is refused, where it silently dropped the first copy (BUG-3219) (#1548)

2026-09-25 18:23:31 -04:00

handlers_items_copy_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_copy.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_items_field_coercion_test.go

test(server): pin the last three coercion call sites (BUG-2850)

2026-09-03 12:49:33 +00:00

handlers_items_fieldpatch_test.go

feat(items): field-level PATCH + conflict envelope + read-only version history (TASK-2022) (#876)

2026-07-08 16:47:34 -04:00

handlers_items_github_pr_test.go

fix(items): github_pr is written only through a typed, validated update member; the field-setter door refuses it (BUG-2696, ToolSurfaceVersion 0.47) (#1469)

2026-09-23 14:35:41 -04:00

handlers_items_jsonb_inner_shape_test.go

feat(store): JSONB NOT NULL hardening on items/views + handler shape validation (IDEA-1486+1488) (#566)

2026-05-16 10:15:59 -04:00

handlers_items_move_overrides_test.go

fix(server): a move refuses a field override the destination does not declare, as the copy does (BUG-2379) (#1448)

2026-09-23 00:02:43 -04:00

handlers_items_moved_out_test.go

fix(sync): moved-out tombstones for cross-visibility collection moves (BUG-1675) (#670)

2026-05-30 19:57:45 -04:00

handlers_items_open_children_guard_test.go

fix(deps): bump go-jose/v3 to v3.0.5 to clear GO-2026-4945 (BUG-1619) (#634)

2026-05-27 13:21:57 -04:00

handlers_items_open_children_guard.go

feat: every content change through the ChatGPT door is versioned first (TASK-3321 U1b) (#1711)

2026-10-02 01:01:15 -04:00

handlers_items_parent_ambiguity_test.go

fix(server): refuse a PATCH carrying both a fields hierarchy key and top-level parent_id (BUG-2594) (#1133)

2026-08-17 03:42:08 -04:00

handlers_items_preimage_test.go

fix(server): diff the activity change list against the store's pre-image (BUG-2776) (#1206)

2026-08-25 20:16:18 -04:00

handlers_items_refuse_undeclared_test.go

fix(mcp): bulk-update refuses an undeclared status/priority per item on stdio and remote too (BUG-3156, ToolSurfaceVersion 0.46) (#1463)

2026-09-23 10:48:28 -04:00

handlers_items_rename_cascade_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_reserved_fieldpatch_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_items_reserved_write.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

handlers_items_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_items_title_test.go

feat: every content change through the ChatGPT door is versioned first (TASK-3321 U1b) (#1711)

2026-10-02 01:01:15 -04:00

handlers_items.go

fix(auth): store errors on access decisions fail closed (BUG-3334) (#1730)

2026-10-02 14:06:35 -04:00

handlers_library_entry.go

feat(cli): pad library get + list --full + server-side category filter (TASK-1562) (#613)

2026-05-21 16:59:57 -04:00

handlers_library_test.go

feat(cli): pad library get + list --full + server-side category filter (TASK-1562) (#613)

2026-05-21 16:59:57 -04:00

handlers_mcp_audit_test.go

feat(mcp): persistent audit log for /mcp tool calls (TASK-960) (#389)

2026-05-02 22:56:10 -04:00

handlers_mcp_audit.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_mcp_test.go

fix(members): keep a workspace's owner and at least one owner member (#1737)

2026-10-02 17:01:54 -04:00

handlers_mcp_tool_surface_test.go

feat(server): expose MCP tool-surface over authed REST endpoint (#764)

2026-06-24 22:45:32 -04:00

handlers_mcp.go

feat(chatgpt): serve OpenAI's domain challenge at /.well-known/openai-apps-challenge (TASK-3321 G4) (#1717)

2026-10-02 04:08:52 -04:00

handlers_me_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_me.go

feat(workspace): expose currentRole + resource-scoped permission helpers (TASK-1101) (#415)

2026-05-05 08:52:05 -04:00

handlers_member_collection_access_escalation_test.go

fix(server): deny restricted owners from escalating collection access (BUG-1925) (#815)

2026-07-04 14:39:33 -04:00

handlers_members.go

fix(members): keep a workspace's owner and at least one owner member (#1737)

2026-10-02 17:01:54 -04:00

handlers_my_invitations.go

fix(invitations): accepting as an existing member is idempotent (BUG-3281) (#1645)

2026-09-28 15:46:57 -04:00

handlers_oauth_claim_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_claim.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_clients.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_provider_test.go

fix(server): auth-perimeter hardening — B6–B9 from the IDEA-1927 audit (TASK-1932) (#811)

2026-07-04 11:33:18 -04:00

handlers_oauth_test.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

handlers_oauth.go

feat(mcp): mount the ChatGPT catalog at /mcp/chatgpt, OAuth-only, off by default (TASK-3321 U2b) (#1719)

2026-10-02 03:34:43 -04:00

handlers_openai_challenge.go

feat(chatgpt): serve OpenAI's domain challenge at /.well-known/openai-apps-challenge (TASK-3321 G4) (#1717)

2026-10-02 04:08:52 -04:00

handlers_plan_limit_race_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_plan_source_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_playbook_library.go

feat(server): library endpoints gain ?category, ?summary, /library/entry (TASK-1561) (#612)

2026-05-21 13:08:02 -04:00

handlers_playbook_match_ratelimit_test.go

feat(server): a dedicated rate limit for synchronous decision-provider calls (TASK-3141) (#1436)

2026-09-22 13:42:37 -04:00

handlers_playbook_match_test.go

feat(playbook): match free text to an active playbook via the decision provider (TASK-3120) (#1429)

2026-09-22 11:28:57 -04:00

handlers_playbooks_test.go

fix(playbooks): enforce draft gate server-side + expose status (BUG-2020) (#874)

2026-07-08 15:28:21 -04:00

handlers_playbooks.go

fix(store): a collection gated by ID is queried by ID, so a slug freed and re-taken in between cannot answer for another collection (BUG-2631) (#1535)

2026-09-25 04:25:42 -04:00

handlers_project_intel_test.go

fix(server): stop counting disabled conventions as completed work (#1152)

2026-08-18 10:44:50 -04:00

handlers_project_intel.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

handlers_push_cross_instance_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_delivery_symmetry_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_presence_unreadable_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_publish_result_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_push_store_error_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_test.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_push_visibility_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_push.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_rbac_test.go

fix(auth): an admin-created registration mints no session, so creating an account no longer hands the admin a live credential for the new user (BUG-3232) (#1581)

2026-09-26 15:27:50 -04:00

handlers_ref_resolver_test.go

fix(server): bearer-gate checkItemVisible's admin bypass (BUG-1918) (#793)

2026-07-03 15:31:17 -04:00

handlers_ref_resolver.go

fix: one prefix grammar, and the ref parser widens to it (BUG-2943) (#1286)

2026-09-07 17:32:36 -04:00

handlers_relation_backlinks.go

feat(relations): materialised reverse index and Referenced-by (PLAN-2857 U5 / TASK-2997) (#1328)

2026-09-11 00:57:47 -04:00

handlers_reminders_test.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

handlers_reminders.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

handlers_reports_test.go

feat(report): windowed project report endpoint + DateBucket dialect (TASK-1630) (#638)

2026-05-29 08:24:05 -04:00

handlers_reports.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_restore_plan_limit_test.go

test(server): RED legs for item restore past items_per_workspace (BUG-3101)

2026-09-17 11:02:02 -04:00

handlers_role_board.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

handlers_search_collection_bug2659_test.go

fix(search): the collection filter resolves exact-first per workspace in scope, so a collection named task is no longer shadowed by tasks (BUG-2659, BUG-2839) (#1576)

2026-09-26 12:20:58 -04:00

handlers_search.go

fix(search): scope workspace search to visible items (#1723)

2026-10-02 11:18:07 -04:00

handlers_sessions_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_sessions.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_share_attachments_derive_test.go

feat(web,server): render embedded image attachments on share pages via a variants-only byte endpoint (BUG-2389 2b, TASK-2637) (#1153)

2026-08-18 12:26:00 -04:00

handlers_share_attachments_test.go

fix(server): sign protected share-page images on every install (BUG-3305) (#1673)

2026-09-29 20:35:28 -04:00

handlers_share_attachments.go

fix(server): sign protected share-page images on every install (BUG-3305) (#1673)

2026-09-29 20:35:28 -04:00

handlers_share_links_bruteforce_test.go

fix(security): rate-limit share-link password verification (TASK-2055) (#913)

2026-07-10 23:48:59 -04:00

handlers_share_links_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_share_links.go

fix(server): match accounts by email only once the address is verified (#1732)

2026-10-02 14:56:36 -04:00

handlers_stars_test.go

fix(mcp): bundle BUG-1081 + BUG-1082 + TASK-1076 — three small MCP-UX fixes from dogfooding (#387)

2026-05-02 21:31:48 -04:00

handlers_stars.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

handlers_storage_delete_authz_test.go

fix(attachments): classify derived rows after authorization on delete

2026-08-02 01:50:34 +00:00

handlers_storage_test.go

feat(attachments): Settings → Storage tab with attachment list (TASK-882) (#303)

2026-04-29 17:44:12 -04:00

handlers_storage.go

fix(attachments): classify derived rows after authorization on delete

2026-08-02 01:50:34 +00:00

handlers_stream_gap_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_stream_session_liveness_test.go

fix(server): a stream ends when the credential that opened it stops being valid (BUG-3007) (#1323)

2026-09-10 16:47:31 -04:00

handlers_tags_test.go

feat(tags): workspace tag enumeration endpoint + cross-collection filter (TASK-1653) (#658)

2026-05-29 23:43:02 -04:00

handlers_timeline_collapse_test.go

feat(history): one History tab replaces Activity and Versions (PLAN-2348 U3) (#1692)

2026-09-30 14:58:39 -04:00

handlers_timeline_comment_agent_test.go

feat(server): timeline comment rows carry the agent name (TASK-2760) (#1196)

2026-08-24 18:09:02 -04:00

handlers_timeline_cursor_test.go

fix: timeline can answer has_more=true with zero entries, and the client cannot page past it (BUG-2765) (#1202)

2026-08-25 16:11:47 -04:00

handlers_timeline_cursor_validation_test.go

feat(store): make the NUL invariant a property of the DATABASE (DOC-2823 S2)

2026-09-01 21:16:17 +00:00

handlers_timeline_id_collision_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_timeline_structured_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_timeline.go

feat(history): one History tab replaces Activity and Versions (PLAN-2348 U3) (#1692)

2026-09-30 14:58:39 -04:00

handlers_tokens_session_auth_test.go

fix(server): minting or rotating an API token requires an interactive session (BUG-2890) (#1267)

2026-09-06 22:02:05 -04:00

handlers_tokens.go

fix(api): body-supplied IDs must name something in the authorized workspace (BUG-3346) (#1728)

2026-10-02 13:34:22 -04:00

handlers_unparented_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_unsubscribe_test.go

fix(server): escape unsubscribe page via html/template + add strict CSP (TASK-657) (#185)

2026-04-21 22:53:27 -04:00

handlers_unsubscribe.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_verify_email_test.go

fix(server): match accounts by email only once the address is verified (#1732)

2026-10-02 14:56:36 -04:00

handlers_versions.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_views_collections_jsonb_test.go

feat(store): JSONB NOT NULL hardening on items/views + handler shape validation (IDEA-1486+1488) (#566)

2026-05-16 10:15:59 -04:00

handlers_views_unparented_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_views.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_watch_access_test.go

fix(members): keep a workspace's owner and at least one owner member (#1737)

2026-10-02 17:01:54 -04:00

handlers_watch_access.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_watch_events_cancel_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_watch_events_oauth_scope_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_watch_events_refused_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_watch_events_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_watch_events.go

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00

handlers_watch_notify.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_watch_vis_cache_test.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

handlers_watches_test.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_watches.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_webhook_token_idor_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_webhooks_secret_test.go

test(webhooks): use a literal IP instead of example.com in two more spots

2026-07-26 23:56:34 +00:00

handlers_webhooks.go

fix(webhooks): whole-workspace access to manage; no delivery for a deleted workspace (#1727)

2026-10-02 13:20:09 -04:00

handlers_webmcp_setting_test.go

feat(server): add webmcp_enabled platform setting + session flag (#763)

2026-06-24 22:28:34 -04:00

handlers_well_known.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

handlers_workspace_autoadd_race_test.go

test(store): SQLite interleaving for the auto-add statement (BUG-2792 review r2 P2)

2026-09-16 15:36:49 -04:00

handlers_workspace_cap_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_workspace_create_consent_test.go

feat(server): refuse workspace creation without may_create_workspaces consent (IDEA-2756) (#1212)

2026-08-26 13:23:56 -04:00

handlers_workspace_import_autoadd_test.go

fix(workspaces): workspace import adds the new workspace to the importing OAuth connection, as create does (BUG-2794) (#1491)

2026-09-24 01:02:00 -04:00

handlers_workspace_import_nul_test.go

fix(store,server,cli): three defects from codex round 1 (BUG-2810)

2026-09-02 15:15:11 +00:00

handlers_workspace_import_plan_limit_test.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

handlers_workspace_import_refusal_status_test.go

fix(server): a refused collection prefix reaches the caller as a 400 naming the rule (BUG-2951) (#1293)

2026-09-08 14:51:21 -04:00

handlers_workspace_mint_parity_test.go

fix(server,store): both workspace mint doors enforce their preconditions from one place (BUG-2809) (#1268)

2026-09-06 23:36:58 -04:00

handlers_workspace_tabs_test.go

fix(tabs): order workspace-tab lists by a per-user server revision (BUG-3285) (#1649)

2026-09-28 18:33:09 -04:00

handlers_workspace_tabs.go

fix(tabs): order workspace-tab lists by a per-user server revision (BUG-3285) (#1649)

2026-09-28 18:33:09 -04:00

handlers_workspaces_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_workspaces.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

import_nul_repair.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

import_plan_limit_message_test.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

import_read_deadline.go

fix(import): a failed bundle import always reports its workspace, and the body is read under a per-Read deadline (BUG-3184) (#1497)

2026-09-24 03:44:26 -04:00

import_stale_bodies.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

isolated_client_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

item_lineage.go

fix(auth): store errors on access decisions fail closed (BUG-3334) (#1730)

2026-10-02 14:06:35 -04:00

item_moved_to_test.go

feat(relations): exact-title resolution and hydrated reads for relation fields (PLAN-2857 U6 / TASK-2996) (#1326)

2026-09-10 21:06:40 -04:00

item_moved_to.go

feat(server): expose ACL-gated moved-to pointer on item GET (TASK-2359)

2026-07-30 12:20:38 +00:00

listen_serve_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

main_test.go

perf(test): build the SQLite migration chain once per test binary (IDEA-1914) (#788)

2026-07-03 10:15:49 -04:00

materialize_recovery_links_test.go

feat(materialize): recover unsaved editor sessions into items.content (TASK-2198 U4) (#1683)

2026-09-30 11:03:07 -04:00

materialize_recovery_test.go

fix(materialize): the recovery sweep stops re-queuing an exhausted item every tick (BUG-3325) (#1704)

2026-10-01 20:49:44 -04:00

materialize_recovery.go

fix(materialize): the recovery sweep stops re-queuing an exhausted item every tick (BUG-3325) (#1704)

2026-10-01 20:49:44 -04:00

mcp_availability_payload_test.go

feat: the console MCP section; Connected Apps follows OAuth (TASK-3303, PLAN-2310 U5) (#1666)

2026-09-29 16:41:24 -04:00

mcp_capability_test.go

feat(mcp): off-cloud Host allowlist on the non-API MCP paths (TASK-2319, PLAN-2310 U3) (#1665)

2026-09-29 15:25:44 -04:00

mcp_security_floor_test.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

metrics_auth_test.go

perf(test): wire remaining store helpers onto storetest fixture (TASK-1915) (#789)

2026-07-03 12:17:03 -04:00

middleware_auth_admin_token_gate_test.go

fix(auth): scope admin platform role to cookie session auth (BUG-1616) (#632)

2026-05-27 10:09:30 -04:00

middleware_auth_public_paths_test.go

fix(auth): TokenAuth falls through invalid Bearer on public API paths (BUG-1227) (#434)

2026-05-07 20:01:34 -04:00

middleware_auth.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

middleware_csrf_test.go

fix(server): auth-perimeter hardening — B6–B9 from the IDEA-1927 audit (TASK-1932) (#811)

2026-07-04 11:33:18 -04:00

middleware_csrf.go

fix(auth): store errors on access decisions fail closed (BUG-3334) (#1730)

2026-10-02 14:06:35 -04:00

middleware_form_body_test.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

middleware_form_body.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

middleware_logging_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

middleware_logging.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

middleware_mcp_audit_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

middleware_mcp_audit.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

middleware_mcp_auth_dual_read_test.go

feat(oauth): per-connection state tables + dual-read introspection gate (TASK-1520) (#581)

2026-05-18 00:03:20 -04:00

middleware_mcp_auth.go

feat(mcp): ChatGPT tools declare their OAuth scope; a missing scope answers the sign-in challenge (TASK-3321 U2c) (#1720)

2026-10-02 04:37:12 -04:00

middleware_mcp_host_test.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_mcp_host.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_mcp_metrics_test.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

middleware_mcp_session_test.go

feat(metrics): session-id-keyed TTL sweep for mcp_active_sessions (TASK-1120) (#400)

2026-05-03 17:40:18 -04:00

middleware_mcp_session.go

docs(mcp): the reason given for the protocol restriction was false — replace it with the true one (TASK-2977) (#1312)

2026-09-09 20:35:44 -04:00

middleware_metrics_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

middleware_metrics.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

middleware_query_test.go

fix(server): refuse invalid-UTF-8 and NUL query values at the transport (BUG-2784) (#1217)

2026-08-27 10:35:39 -04:00

middleware_ratelimit_bug3308_test.go

fix(server): bound the per-key rate limiter maps and key IPv6 on the /64 (BUG-3308) (#1670)

2026-09-29 19:22:17 -04:00

middleware_ratelimit_bug3310_test.go

fix(server): one general API bucket per caller across both middleware arms (BUG-3310) (#1672)

2026-09-29 20:15:52 -04:00

middleware_ratelimit_test.go

fix(e2e): disable rate limiting on the E2E server to stop 429 flakes (BUG-2089) (#922)

2026-07-11 14:30:32 -04:00

middleware_ratelimit.go

fix(server): one general API bucket per caller across both middleware arms (BUG-3310) (#1672)

2026-09-29 20:15:52 -04:00

middleware_realip_test.go

fix(server): resolve the client from the right-most untrusted X-Forwarded-For hop (BUG-3323) (#1700)

2026-09-30 23:19:41 -04:00

middleware_realip.go

fix(server): resolve the client from the right-most untrusted X-Forwarded-For hop (BUG-3323) (#1700)

2026-09-30 23:19:41 -04:00

middleware_request_text_test.go

fix(server): refuse invalid-UTF-8 and NUL query values at the transport (BUG-2784) (#1217)

2026-08-27 10:35:39 -04:00

middleware_request_text.go

fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) (#1550)

2026-09-25 21:48:30 -04:00

middleware_security_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

middleware_security.go

fix(server): reject CORS wildcard when credentials are on (TASK-664) (#188)

2026-04-21 23:59:54 -04:00

middleware_session_ip_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

middleware_session_ua_test.go

feat(security): enforce session UA binding under strict mode (TASK-2056) (#912)

2026-07-10 23:32:22 -04:00

middleware_verified_email_test.go

fix(members): invitation accept enforces members_per_workspace (BUG-3098)

2026-09-17 16:13:36 -04:00

middleware_verified_email.go

feat(server): RequireVerifiedEmail enforcement across all mutation perimeters (TASK-1937) (#807)

2026-07-04 02:06:58 -04:00

migrate_close_state.go

fix(BUG-2367): a move or copy that would reopen, close or un-abandon an item must name the status instead of inheriting whatever survived migration (#1516)

2026-09-24 15:53:06 -04:00

mobile_contract_test.go

test(server): the mobile shells' unversioned contracts fail CI when they move (TASK-2053) (#1294)

2026-09-08 15:49:05 -04:00

my_invitations_test.go

fix(invitations): accepting as an existing member is idempotent (BUG-3281) (#1645)

2026-09-28 15:46:57 -04:00

nul_differential_test.go

feat(server,store): the differential test's three live legs + the 400 mapping

2026-09-01 12:06:08 +00:00

nul_repair_differential_test.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

oauth_iss_test.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

oauth_iss.go

feat(oauth): RFC 9207 iss on every authorize redirect; JSON 404 for unowned /.well-known (TASK-3321 U0a) (#1706)

2026-10-01 22:25:50 -04:00

oauth_sweep_test.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

oauth_sweep.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

open_children_guard_pool_test.go

fix(store): serialize document renames and stop reading the pool inside transactions (BUG-2778) (#1208)

2026-08-25 22:40:58 -04:00

oplog_gc_test.go

feat(collab): periodic op-log GC sweeper for dormant items (TASK-1309) (#471)

2026-05-09 18:19:33 -04:00

oplog_gc.go

fix(server): add panic recovery to background sweeper goroutines (BUG-2071) (#865)

2026-07-08 11:58:41 -04:00

orphan_gc_test.go

fix(server): rowless-blob GC sweep — reclaim blobs no attachments row references (BUG-2406) (#1137)

2026-08-17 09:03:44 -04:00

orphan_gc.go

fix(store): cover documents and comment bodies in the attachment reference walks (BUG-2614, BUG-2615) (#1145)

2026-08-17 14:26:09 -04:00

outbox_drain_test.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

outbox_drain.go

docs(store,server): four comments and one log line that had stopped being true (BUG-2827)

2026-09-02 12:33:08 +00:00

outbox_payload_limit_test.go

docs,test(store): correct five comments and strengthen the shrink fixture (BUG-2827)

2026-09-02 12:05:57 +00:00

overdue_surfaces_test.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

overdue.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

password_strength_test.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

password_strength.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

plan2348_timeline_drops_test.go

fix(history): split activity runs by source, stamp version source, stop dropping field changes (PLAN-2348 U1) (#1685)

2026-09-30 06:50:13 -04:00

plan2348_timeline_kinds_test.go

feat(history): one History tab replaces Activity and Versions (PLAN-2348 U3) (#1692)

2026-09-30 14:58:39 -04:00

plan2348_u2_versions_test.go

feat(history): one History tab replaces Activity and Versions (PLAN-2348 U3) (#1692)

2026-09-30 14:58:39 -04:00

plan2348_version_source_test.go

fix(history): split activity runs by source, stamp version source, stop dropping field changes (PLAN-2348 U1) (#1685)

2026-09-30 06:50:13 -04:00

plan_limit_native_shell_test.go

fix(test): call SetUserPlan with a PlanWrite; main broken since 1ed52bdb (TASK-3293) (#1659)

2026-09-29 11:28:17 -04:00

progress_abandoned_test.go

fix(progress): an abandoned child leaves both the done count and the total, and 0/0 renders as no progress (BUG-3195) (#1510)

2026-09-24 11:24:33 -04:00

publish_sites_ruled_test.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

push_message_collapse_test.go

feat(web): push-to-agent composer in the item view (TASK-2561) (#1099)

2026-08-15 08:22:09 -04:00

redis_health_test.go

fix(watchevents,server): four concurrency findings from codex round 9 (BUG-2727, BUG-2726)

2026-08-22 03:43:15 +00:00

redis_health.go

refactor: prune the claim surface, and turn one prose claim into a test

2026-08-22 05:09:29 +00:00

relation_backlinks_test.go

feat(relations): materialised reverse index and Referenced-by (PLAN-2857 U5 / TASK-2997) (#1328)

2026-09-11 00:57:47 -04:00

relation_hydration.go

fix(schema): a grandfathered reserved-key FieldDef never reaches an item-field path (BUG-2685) (#1377)

2026-09-15 00:50:12 -04:00

relation_multi_roundtrip_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

relation_ref_prefix_test.go

fix(store): a relation ref falls back to matching by number only when its prefix names no live collection (BUG-3082) (#1369)

2026-09-14 11:49:35 -04:00

relation_referents_doors_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

relation_referents.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

relation_target_availability.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

relation_titles_copy_test.go

feat(relations): exact-title resolution and hydrated reads for relation fields (PLAN-2857 U6 / TASK-2996) (#1326)

2026-09-10 21:06:40 -04:00

relation_titles_doors_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

relation_titles_import_test.go

fix(store): a relation ref falls back to matching by number only when its prefix names no live collection (BUG-3082) (#1369)

2026-09-14 11:49:35 -04:00

relation_unjudged_fail_closed_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

reminder_tick.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

reserved_seed_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

role_item_counts.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

server_test.go

feat(server): a dedicated rate limit for synchronous decision-provider calls (TASK-3141) (#1436)

2026-09-22 13:42:37 -04:00

server.go

fix(auth): platform administration refuses an API token (BUG-3361)

2026-10-02 21:50:05 +00:00

session_identity_test.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

session_identity.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

session_presence_keys_test.go

feat(redis): namespace every Redis keyspace from one shared config value (BUG-2724)

2026-08-22 01:41:31 +00:00

session_presence_namespace_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_observer_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_observer.go

refactor: prune the claim surface, and turn one prose claim into a test

2026-08-22 05:09:29 +00:00

session_presence_redis_round2_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_redis_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_redis.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

share_item_field_defs_test.go

fix(web,server): a direct item share labels and colours its field chips like a collection share, from defs that disclose only what the item shows (TASK-2248 U3) (#1587)

2026-09-26 20:13:56 -04:00

share_page_collab_isolation_test.go

fix(web): share pages render attachment refs as honest placeholders (BUG-2389) (#1135)

2026-08-17 05:19:25 -04:00

stream_admission_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

stream_admission.go

fix(collab): WebSocket dials get their own per-user bucket and a per-user socket cap, and the editor jitters its reconnects (BUG-1308) (#1499)

2026-09-24 04:51:57 -04:00

stream_credential_liveness.go

fix(server): a stream ends when the credential that opened it stops being valid (BUG-3007) (#1323)

2026-09-10 16:47:31 -04:00

stream_gap_announcer_test.go

test: close the mutation gaps a coverage audit named (BUG-2730, codex round 18)

2026-08-23 02:32:43 +00:00

stream_gap_announcer.go

revert(sse): remove the ordering barrier; its failure mode is worse than the problem (BUG-2730, codex round 16)

2026-08-23 02:16:35 +00:00

task3319_attachment_uploaded_test.go

feat(attachments): the viewer says when a file was uploaded, and by whom (TASK-3319) (#1697)

2026-09-30 16:49:25 -04:00

task3321_u1b_chatgpt_versions_test.go

feat: every content change through the ChatGPT door is versioned first (TASK-3321 U1b) (#1711)

2026-10-02 01:01:15 -04:00

task3321_u2a_audience_test.go

feat(oauth): a second canonical resource, with every token bound to one (TASK-3321 U2a) (#1715)

2026-10-02 02:06:09 -04:00

task3321_u2b_mount_test.go

feat(mcp): mount the ChatGPT catalog at /mcp/chatgpt, OAuth-only, off by default (TASK-3321 U2b) (#1719)

2026-10-02 03:34:43 -04:00

testimageprocessor_libvips_test.go

feat(attachments): ImageProcessor interface + pure-Go impl + thumbnail pipeline (TASK-878) (#295)

2026-04-29 14:35:49 -04:00

testimageprocessor_purego_test.go

feat(attachments): ImageProcessor interface + pure-Go impl + thumbnail pipeline (TASK-878) (#295)

2026-04-29 14:35:49 -04:00

token_reaper_test.go

fix(server): add panic recovery to background sweeper goroutines (BUG-2071) (#865)

2026-07-08 11:58:41 -04:00

token_reaper.go

fix(oauth): sweep expired token, code and PKCE rows (BUG-3301) (#1671)

2026-09-29 19:29:17 -04:00

token_scopes_test.go

feat(oauth): MCPBearerAuth OAuth integration + public-info (TASK-1027) — closes TASK-951 (#375)

2026-05-02 13:33:53 -04:00

token_workspace_allowlist_test.go

fix(security): scope MCP workspace-global reads by OAuth consent allow-list (BUG-2102) (#935)

2026-07-14 20:37:03 -04:00

token_workspace_consent_scope_test.go

fix(workspaces): reorder skips workspaces outside the OAuth consent allow-list, as the list endpoint does (BUG-3255) (#1614)

2026-09-27 12:01:55 -04:00

twofactor_challenge.go

fix: persist 2FA challenge key and prevent duplicate TOTP verification

2026-04-08 20:30:39 +00:00

username.go

feat: username validation, reserved words, and registration flow

2026-04-10 23:12:59 +00:00

web_build_identity_test.go

feat(ops): health reports which web bundle is served, and install-refresh warns when it is not a clean build of the commit (TASK-3233) (#1583)

2026-09-26 16:54:20 -04:00

web_build_identity.go

feat(ops): health reports which web bundle is served, and install-refresh warns when it is not a clean build of the commit (TASK-3233) (#1583)

2026-09-26 16:54:20 -04:00

workspace_access_notify_test.go

fix(account): account deletion needs an interactive, recently signed-in session (BUG-3336) (#1733)

2026-10-02 15:43:57 -04:00

workspace_access_notify.go

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00

workspace_mint.go

fix(auth): a user-less legacy workspace token reaches only its own workspace (BUG-3353) (#1734)

2026-10-02 16:06:11 -04:00

workspace_owner_compensation_test.go

fix(store): reusing a recently deleted workspace's name no longer 500s, and a create that loses a slug race takes the next one (BUG-3307) (#1689)

2026-09-30 09:10:41 -04:00

workspace_owner_compensation.go

fix(store): reusing a recently deleted workspace's name no longer 500s, and a create that loses a slug race takes the next one (BUG-3307) (#1689)

2026-09-30 09:10:41 -04:00

workspace_purge_test.go

feat(store): hard-purge soft-deleted workspaces after 30 days (TASK-1966) (#825)

2026-07-05 22:23:12 -04:00

workspace_purge.go

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00