xarmian e43bd7b858 feat: the console MCP section; Connected Apps follows OAuth (TASK-3303, PLAN-2310 U5) (#1666) ...

* feat: the console MCP section, and Connected Apps follows OAuth (TASK-3303, PLAN-2310 U5)

The admin Settings page gains "MCP for agents": the toggle (saved on
click; disabled with "set by environment (PAD_MCP_ENABLED)" or "managed
by the operator" when locked) and the GET /api/v1/admin/mcp readout:
state (on, off, or blocked with the reason), public origin and where it
came from, MCP URL, https, how agents sign in, and while off, what would
resume (nothing was revoked).

The session, setup and admin stats payloads carry mcp_available and
oauth_available (per request). Connected Apps keys on oauthAvailable
instead of cloud mode, and the admin MCP Audit tab is always shown to
admins, with "No MCP activity recorded" as its empty state.

Claude-Session: https://claude.ai/code/session_01NidgPePY7UvHcEJCMkD2Qz

* fix(web): the MCP Off state no longer overstates what the routes answer (TASK-3303, codex r1)

Claude-Session: https://claude.ai/code/session_01NidgPePY7UvHcEJCMkD2Qz

* feat(web): the MCP toggle saves with an explicit Save, like the page's other sections (TASK-3303, lead ruling)

Claude-Session: https://claude.ai/code/session_01NidgPePY7UvHcEJCMkD2Qz

* fix(web): 'off by default' is a self-host fact (TASK-3303, codex r3 nit)

Claude-Session: https://claude.ai/code/session_01NidgPePY7UvHcEJCMkD2Qz

2026-09-29 16:41:24 -04:00

..

render

fix(attachments): a HEIC embed is decided by what can be served and painted, not by an image/ prefix (BUG-2964)

2026-09-08 19:40:37 -04:00

testdata

test(server): the body-reader accounting asks the type checker, so a request reached through a struct field, context value, alias or embedding is counted (BUG-2820) (#1546)

2026-09-25 14:22:55 -04:00

access_epoch_test.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

access_epoch.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

activity_cursor_test.go

fix(activity): feeds page by a (created_at, id) keyset and break timestamp ties by id (BUG-2781) (#1459)

2026-09-23 09:05:05 -04:00

activity_cursor.go

fix(activity): feeds page by a (created_at, id) keyset and break timestamp ties by id (BUG-2781) (#1459)

2026-09-23 09:05:05 -04:00

artifact_import.go

fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) (#1550)

2026-09-25 21:48:30 -04:00

attachments_authz.go

fix(store): route cross-workspace copy's lock-held reads through the copy transaction (BUG-2409) (#1136)

2026-08-17 08:16:02 -04:00

authz_cross_workspace_test.go

feat(server): add cross-workspace copy dry-run preflight endpoint (TASK-2364)

2026-07-30 20:15:00 +00:00

authz_cross_workspace.go

docs(server): correct the cross-workspace authz re-check contract per final review

2026-07-31 02:35:53 +00:00

body_reader_census_test.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

bootstrap_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

bootstrap.go

feat(auth): PAD_BYPASS_SETUP_TOKEN open-bootstrap escape hatch (#429)

2026-05-06 13:27:12 -04:00

bug1791_archived_visibility_test.go

fix(items): surface archived items instead of masking them as missing (BUG-1791) (#733)

2026-06-15 14:44:58 -04:00

bug2367_close_state_test.go

fix(BUG-2367): a move or copy that would reopen, close or un-abandon an item must name the status instead of inheriting whatever survived migration (#1516)

2026-09-24 15:53:06 -04:00

bug2367_migrate_doors_test.go

fix(BUG-2367): moves and copies never carry into a computed field, and a carried unique-field collision is dropped and named instead of 500ing or storing a duplicate (#1514)

2026-09-24 13:12:32 -04:00

bug2639_guest_grant_terminal_test.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

bug2640_done_field_display_test.go

fix(project): standup and changelog rows show the value of the item's own done field, not a blank read from a literal status (BUG-2640) (#1477)

2026-09-23 19:37:58 -04:00

bug2683_bulk_move_dropped_test.go

test(BUG-2683): pin that a bulk move records an ordinary dropped field in its activity row, the case the bug was filed for (#1531)

2026-09-25 02:03:55 -04:00

bug2684_preflight_origin_test.go

test(BUG-2684): pin that the copy preflight labels a dropped-then-defaulted key from=default, the case the bug was filed for (#1533)

2026-09-25 01:36:38 -04:00

bug2685_grandfathered_reserved_key_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

bug2788_entry_id_stability_test.go

fix(timeline): structured entries get a persisted id instead of a positional one that renumbers when a sibling moves (BUG-2788) (#1540)

2026-09-25 07:10:26 -04:00

bug2812_scan_bench_test.go

fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) (#1550)

2026-09-25 21:48:30 -04:00

bug2817_metrics_label_bound_test.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

bug2819_audit_source_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

bug2819_filename_source_wiring_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

bug2896_collection_traits_duplicate_keys_test.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

bug3028_relation_blank_test.go

fix: a relation's "no target" has one stored form, and required means it names one (BUG-3028) (#1427)

2026-09-22 08:08:15 -04:00

bug3035_applier_seq_test.go

fix(cli): item edit refuses a stale body, guards its save with expected_seq, and keeps a recovery file on failure (BUG-3035) (#1418)

2026-09-21 21:03:05 -04:00

bug3037_expected_seq_test.go

feat(items): expected_seq — an OCC token that can tell two same-second writes apart (BUG-3037) (#1351)

2026-09-13 22:38:15 -04:00

bug3049_bulk_field_patch_test.go

fix(items): twelve item-field writers send a patch instead of replacing the blob (BUG-3049 / BUG-3055) (#1349)

2026-09-13 21:14:57 -04:00

bug3069_workspace_not_found_test.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

bug3079_default_drop_test.go

fix(items): an injected schema default takes the same type check a supplied value takes (BUG-3079) (#1362)

2026-09-14 09:03:24 -04:00

bug3080_client_write_test.go

fix: a tab's older content write can no longer land over its newer one (BUG-3080) (#1435)

2026-09-22 13:54:24 -04:00

bug3099_account_delete_owned_test.go

fix(store): account deletion reads the owned workspaces inside its transaction under the owner lock, so a workspace minted or unjoined in the window no longer survives its deleted owner (BUG-3099) (#1567)

2026-09-26 09:47:46 -04:00

bug3124_watermark_stamp_test.go

feat: a caught-up tab stamps the flush watermark, so viewing an item no longer leaves it pending (BUG-3124 unit B) (#1420)

2026-09-21 22:50:56 -04:00

bug3154_bulk_undeclared_key_test.go

fix(server): a bulk status or priority change refuses an item whose collection has no such field (BUG-3154) (#1450)

2026-09-23 03:09:25 -04:00

bug3163_reserved_write_doors_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

bug3167_query_or_contract_test.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

bug3202_field_number_precision_test.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

bug3202_semantic_compare_test.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

bug3219_repeated_member_test.go

fix(server): a request that repeats fields_patch or field_overrides is refused, where it silently dropped the first copy (BUG-3219) (#1548)

2026-09-25 18:23:31 -04:00

bug3244_rebuild_seed_grant_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3244_schema_rebuild_set_aside_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3244_set_aside_guard_test.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

bug3254_guest_workspace_get_test.go

fix(workspaces): GET /workspaces/{ws} marks a guest, so a guest who arrives by URL gets the guest sidebar, not member chrome (BUG-3254) (#1616)

2026-09-27 13:08:42 -04:00

bug3257_role_board_counts_test.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

bug3273_stream_soft_delete_test.go

fix(server): an open workspace event stream closes when its workspace is soft-deleted (BUG-3273) (#1638)

2026-09-28 11:04:51 -04:00

claim_codes_test.go

feat(mcp): workspace.create + workspace.claim actions + claim-code mechanics (TASK-1521) (#582)

2026-05-18 00:43:46 -04:00

claim_codes.go

feat(mcp): workspace.create + workspace.claim actions + claim-code mechanics (TASK-1521) (#582)

2026-05-18 00:43:46 -04:00

client_write_marks.go

fix: a tab's older content write can no longer land over its newer one (BUG-3080) (#1435)

2026-09-22 13:54:24 -04:00

cloud_admin_gate_test.go

fix(server): gate RequireAuth's cloud-secret bypass on validated session (BUG-1944) (#1112)

2026-08-15 19:18:55 -04:00

collection_resolve_test.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

collection_resolve.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

content_disposition_test.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

content_disposition.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

content_state_population_test.go

fix(web): a body the server marks as behind its live document says so wherever it is rendered — share pages, the read-only pane, the diff, and a dot on marked rows in lists, backlinks and the palette (BUG-3050 U3) (#1577)

2026-09-26 13:37:34 -04:00

context.go

fix(items): note and decide append server-side under the write lock, so they no longer revert a concurrent field write (BUG-3056) (#1458)

2026-09-23 07:46:45 -04:00

copy_preflight_drop_reason_parity_test.go

IDEA-2893 + IDEA-2894: record the accepted carry disclosure, and make the drop-reason mapper testable (#1254)

2026-09-05 19:01:57 -04:00

dashboard_attention_decisions_test.go

feat(decision): content-aware attention on the dashboard and item page (TASK-3118) (#1421)

2026-09-21 23:55:54 -04:00

decision_settings_test.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

decision_settings.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

decision_tick.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

decode_json_nul_test.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

decode_json_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

document_lock_contention_test.go

fix(store): serialize document renames and stop reading the pool inside transactions (BUG-2778) (#1208)

2026-08-25 22:40:58 -04:00

events_publish_test.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

events_publish.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

events_surface_test.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

events_surface.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

handlers_2fa_recovery_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

handlers_2fa_totp_step_test.go

fix(security): make TOTP login codes single-use (BUG-2054) (#914)

2026-07-10 23:56:59 -04:00

handlers_2fa.go

fix(security): make TOTP login codes single-use (BUG-2054) (#914)

2026-07-10 23:56:59 -04:00

handlers_account_export_contract_test.go

test: cover account delete + export contracts and Danger Zone e2e (TASK-1963) (#824)

2026-07-05 20:47:30 -04:00

handlers_account_export_gate_test.go

fix(server): deny account export to restricted owners (BUG-1945) (#814)

2026-07-04 14:38:01 -04:00

handlers_account_test.go

test: cover account delete + export contracts and Danger Zone e2e (TASK-1963) (#824)

2026-07-05 20:47:30 -04:00

handlers_account.go

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00

handlers_activity_debounce_actor_test.go

fix(store): activity debounce must not merge across writers (BUG-2763) (#1201)

2026-08-25 14:28:29 -04:00

handlers_activity.go

fix(activity): feeds page by a (created_at, id) keyset and break timestamp ties by id (BUG-2781) (#1459)

2026-09-23 09:05:05 -04:00

handlers_admin_bearer_gate_test.go

fix(security): gate collab WebSocket writes on editor role (TASK-265) (#938)

2026-07-15 01:30:12 -04:00

handlers_admin_billing_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_admin_billing.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_admin_invitations.go

fix(store,server): an invitation to a soft-deleted workspace reads as unknown (BUG-3104) (#1413)

2026-09-21 17:58:27 -04:00

handlers_admin_mcp_test.go

feat(mcp): MCP addressing from config; mcp_enabled setting with an env lock (TASK-3302, PLAN-2310 U1) (#1662)

2026-09-29 12:46:03 -04:00

handlers_admin_mcp.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_admin_settings_test.go

fix(admin): stop leaking 2FA secret via GET /admin/settings (BUG-1909) (#779)

2026-07-01 17:44:43 -04:00

handlers_admin_users_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_admin_users.go

feat: the console MCP section; Connected Apps follows OAuth (TASK-3303, PLAN-2310 U5) (#1666)

2026-09-29 16:41:24 -04:00

handlers_admin.go

feat(decision): instance-admin settings for the decision provider (TASK-3121) (#1426)

2026-09-22 07:34:33 -04:00

handlers_agent_roles.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

handlers_artifact_export_device_test.go

fix(BUG-3185): an item export's file name whose stem is a Windows device gets a "_" prefix, on the server and in the CLI (#1495)

2026-09-24 03:44:11 -04:00

handlers_artifact_export.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

handlers_artifact_import_relation_carry_test.go

fix: a relation's "no target" has one stored form, and required means it names one (BUG-3028) (#1427)

2026-09-22 08:08:15 -04:00

handlers_artifact_import_warnings_test.go

WIP feat(server,store): referent validation for relation values — 6 of 8 doors (TASK-2878) (#1246)

2026-09-05 10:07:44 -04:00

handlers_artifact_import.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_artifact_test.go

fix(cli): refuse a blank --stdin body on item create/update; add --clear-content (BUG-3100) (#1415)

2026-09-21 18:52:28 -04:00

handlers_attachments_attach_test.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_attachments_attach.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_attachments_bug2818_test.go

fix(attachments): the blocklist judges the same filename the download header serves (BUG-2818) (#1445)

2026-09-22 20:54:46 -04:00

handlers_attachments_bug2822_test.go

fix(attachments): a stored name Windows would open as a device gets a "_" prefix (BUG-2822) (#1493)

2026-09-24 02:37:59 -04:00

handlers_attachments_bug3153_test.go

fix(attachments): drop Bidi_Control characters from attachment names and rewrite legacy rows (BUG-3153) (#1452)

2026-09-23 04:35:58 -04:00

handlers_attachments_download_authz_test.go

refactor(attachments): centralize parent resolution, close orphan-read and delete-denial gaps

2026-08-02 00:55:20 +00:00

handlers_attachments_download_mime_test.go

fix(server): force-download unknown and disallowed stored MIME (BUG-2413)

2026-08-08 20:37:39 +00:00

handlers_attachments_download_test.go

fix(ci): gofmt + bump race-detector timeout to 30m (#299)

2026-04-29 15:41:12 -04:00

handlers_attachments_isobmff_test.go

fix(attachments): HEIC, HEIF and AVIF are recognised from their bytes, not refused (BUG-2961) (#1291)

2026-09-08 13:30:42 -04:00

handlers_attachments_test.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_attachments_thumbnails_parent_test.go

fix(attachments): skip derivation for an archived parent (TASK-2404)

2026-08-01 23:27:34 +00:00

handlers_attachments_thumbnails_test.go

fix(cli,mcp): send raw collection slug so an alias can't shadow a real collection (BUG-2630) (#1162)

2026-08-19 08:13:29 -04:00

handlers_attachments_thumbnails.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_attachments_transform_authz_test.go

fix(attachments): gate transform on item visibility (TASK-2402)

2026-08-01 23:05:26 +00:00

handlers_attachments_transform_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_attachments_transform.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_attachments_upload_live_item_test.go

refactor(attachments): centralize parent resolution, close orphan-read and delete-denial gaps

2026-08-02 00:55:20 +00:00

handlers_attachments_variant_headers_test.go

fix(attachments): a HEIC embed is decided by what can be served and painted, not by an image/ prefix (BUG-2964)

2026-09-08 19:40:37 -04:00

handlers_attachments.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

handlers_audit.go

fix(activity): feeds page by a (created_at, id) keyset and break timestamp ties by id (BUG-2781) (#1459)

2026-09-23 09:05:05 -04:00

handlers_auth_admin_register_test.go

fix(auth): an admin-created registration mints no session, so creating an account no longer hands the admin a live credential for the new user (BUG-3232) (#1581)

2026-09-26 15:27:50 -04:00

handlers_auth_bootstrap_bypass_test.go

feat(auth): PAD_BYPASS_SETUP_TOKEN open-bootstrap escape hatch (#429)

2026-05-06 13:27:12 -04:00

handlers_auth_bootstrap_token_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

handlers_auth_local_reset_test.go

feat(auth): localhost password recovery for locked-out self-host admins (#760)

2026-06-22 20:58:50 -04:00

handlers_auth_loopback_test.go

fix(server): read raw TCP peer for loopback check (TASK-662) (#175)

2026-04-21 19:33:47 -04:00

handlers_auth_ratelimit_test.go

feat(auth): per-email login rate limiter (TASK-651) (#178)

2026-04-21 20:52:03 -04:00

handlers_auth_replaced_session_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_auth_session_rotation_test.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

handlers_auth_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_auth.go

feat: the console MCP section; Connected Apps follows OAuth (TASK-3303, PLAN-2310 U5) (#1666)

2026-09-29 16:41:24 -04:00

handlers_backlinks_admin_bearer_test.go

fix(backlinks): scope cross-workspace admin enumeration to membership for bearer auth (BUG-1617) (#633)

2026-05-27 10:37:30 -04:00

handlers_backlinks.go

fix(server): consistent soft-delete handling across item sub-resources (#771)

2026-06-27 21:42:52 -05:00

handlers_bootstrap_test.go

fix(server): guard degraded/degraded_sections in bootstrap dashboard (BUG-2072) (#869)

2026-07-08 13:09:26 -04:00

handlers_bootstrap.go

fix(store): a collection gated by ID is queried by ID, so a slug freed and re-taken in between cannot answer for another collection (BUG-2631) (#1535)

2026-09-25 04:25:42 -04:00

handlers_capabilities.go

feat(attachments): attach binds an unattached upload to an item, so its share renders it (TASK-2247) (#1652)

2026-09-28 19:25:55 -04:00

handlers_changelog_abandoned_test.go

fix(project): a collection's own abandoned_options decide what the changelog, standup and reports count as shipped (BUG-2347) (#1464)

2026-09-23 12:52:46 -04:00

handlers_changes.go

chore: clear staticcheck SA + U1000 findings on main (TASK-764) (#249)

2026-04-25 11:53:31 -04:00

handlers_claim_code_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_claim_code.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_cli_auth_test.go

fix(server): derive CLI auth URL scheme from r.TLS, gate X-Forwarded-Proto on trusted proxies (TASK-665) (#190)

2026-04-22 09:27:45 -04:00

handlers_cli_auth.go

fix(auth): unify first-run setup into one browser handoff (BUG-1843) (#739)

2026-06-20 23:51:43 -04:00

handlers_cloud_autocreate_husk_test.go

fix(cloud): auto-create removes a workspace it cannot seed or administer, and leaves no restorable husk (BUG-3087) (#1383)

2026-09-15 12:50:53 -04:00

handlers_cloud_autocreate_workspace_test.go

fix(cloud): auto-create removes a workspace it cannot seed or administer, and leaves no restorable husk (BUG-3087) (#1383)

2026-09-15 12:50:53 -04:00

handlers_cloud_member_ack_test.go

fix(cloud): reconcile before destroying a workspace whose owner-add lost its ack (BUG-3026) (#1341)

2026-09-11 19:34:44 -04:00

handlers_cloud.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_collab_applier_refusal_test.go

fix(server): a successful applier-path PATCH stops answering with the previous content (BUG-2995) (#1320)

2026-09-10 12:37:49 -04:00

handlers_collab_bug1308_test.go

fix(collab): WebSocket dials get their own per-user bucket and a per-user socket cap, and the editor jitters its reconnects (BUG-1308) (#1499)

2026-09-24 04:51:57 -04:00

handlers_collab_prune_atomicity_test.go

fix(server): the op-log prune rides inside the write it justifies (BUG-2840 half B) (#1295)

2026-09-08 16:46:28 -04:00

handlers_collab_set_aside.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

handlers_collab_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_collab_watermark.go

fix(editor): opening an item without typing no longer rewrites a body the editor does not reproduce byte for byte (BUG-3197) (#1515)

2026-09-24 16:42:14 -04:00

handlers_collab.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

handlers_collection_crud_visibility_test.go

fix(server): gate collection update/delete on visibility (BUG-1921) (#795)

2026-07-03 18:12:35 -04:00

handlers_collection_traits_rename_test.go

feat(store,server,web): collection kernel traits — de-hardcode conventions/playbooks slugs (TASK-2657, BUG-2702) (#1171)

2026-08-20 13:26:05 -04:00

handlers_collection_traits_test.go

feat(store,server): make collection trait uniqueness a database invariant — de-dup pass + partial unique indexes (TASK-2710) (#1257)

2026-09-05 20:43:43 -04:00

handlers_collections_concurrency_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_collections_refusal_status_test.go

fix(server): a refused collection prefix reaches the caller as a 400 naming the rule (BUG-2951) (#1293)

2026-09-08 14:51:21 -04:00

handlers_collections_reserved_keys_test.go

fix(server): reserve parent/plan schema field keys (TASK-1912) (#786)

2026-07-03 03:27:04 -04:00

handlers_collections.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

handlers_comments_atomic_test.go

fix(comments): the "commented" activity and the comment commit in one transaction (BUG-2716) (#1388)

2026-09-15 16:36:26 -04:00

handlers_comments_bearer_gate_test.go

fix(server): bearer-gate canEditComment's admin bypass (BUG-1919) (#796)

2026-07-03 18:24:36 -04:00

handlers_comments_edit_test.go

feat(comments): comment editing backend — user_id, UpdateComment, PATCH, SSE (TASK-1663) (#665)

2026-05-30 12:38:57 -04:00

handlers_comments_item_scoped_test.go

fix(comments): deleting a comment that has replies answers 409 comment_has_replies instead of 500 (BUG-3252) (#1608)

2026-09-27 09:11:48 -04:00

handlers_comments.go

fix(comments): deleting a comment that has replies answers 409 comment_has_replies instead of 500 (BUG-3252) (#1608)

2026-09-27 09:11:48 -04:00

handlers_connected_apps_mutations_test.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

handlers_connected_apps_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_connected_apps.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_content_state_doors_test.go

fix(items): eleven hand-built doors carry the stale-body marker (BUG-3033) (#1344)

2026-09-13 18:34:16 -04:00

handlers_convention_library.go

feat(server): library endpoints gain ?category, ?summary, /library/entry (TASK-1561) (#612)

2026-05-21 13:08:02 -04:00

handlers_dashboard_test.go

test(server): adopt t.Parallel() in heaviest handler tests (TASK-2059) (#918)

2026-07-11 09:38:14 -04:00

handlers_dashboard.go

fix(progress): an abandoned child leaves both the done count and the total, and 0/0 renders as no progress (BUG-3195) (#1510)

2026-09-24 11:24:33 -04:00

handlers_decisions_test.go

feat(decision): typed-decision storage and async runner (TASK-3117) (#1417)

2026-09-21 20:46:41 -04:00

handlers_decisions.go

feat(decision): typed-decision storage and async runner (TASK-3117) (#1417)

2026-09-21 20:46:41 -04:00

handlers_documents_test.go

fix(fields,activity): debounce typed-input field saves + collapse same-field activity runs (BUG-1466) (#549)

2026-05-14 22:10:12 -04:00

handlers_documents_title_test.go

fix(documents): bound the rename cascade at the title and at the projected total (BUG-2798, BUG-2796) (#1218)

2026-08-27 22:45:27 -04:00

handlers_documents.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

handlers_events_access_epoch_stream_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_access_epoch_test.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

handlers_events_cancel_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_failed_test.go

fix(events): a closed MemoryBus refuses a late subscribe instead of handing out a channel nothing will close (BUG-2737) (#1483)

2026-09-23 21:52:18 -04:00

handlers_events_filter_test.go

fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989)

2026-07-21 09:43:05 -04:00

handlers_events_membership_test.go

fix(security): require workspace membership on SSE subscriptions (TASK-264) (#937)

2026-07-14 23:43:19 -04:00

handlers_events_resume_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events_revalidation_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_events_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_events.go

fix(server): an open workspace event stream closes when its workspace is soft-deleted (BUG-3273) (#1638)

2026-09-28 11:04:51 -04:00

handlers_export_bundle_test.go

feat(attachments): bundle attachments + manifest in workspace export (TASK-884) (#305)

2026-04-29 18:30:43 -04:00

handlers_export_bundle.go

fix(server): Content-Disposition carries a non-ASCII or unquotable filename in filename* with an ASCII fallback, so NBSP and zero-width names no longer reach clients as Go escape text (BUG-3190) (#1569)

2026-09-26 09:47:51 -04:00

handlers_export_gate_test.go

fix(server): deny workspace export to restricted owners (BUG-1922) (#813)

2026-07-04 13:54:08 -04:00

handlers_grant_visibility_test.go

fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989)

2026-07-21 09:43:05 -04:00

handlers_grants.go

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00

handlers_graph_test.go

fix(server): bearer-gate visibleCollectionIDs to close BUG-1917 (#792)

2026-07-03 14:40:54 -04:00

handlers_graph.go

feat(server): focused neighborhood mode on workspace graph endpoint (TASK-1781) (#718)

2026-06-08 18:13:10 -04:00

handlers_import_bundle_bug3184_test.go

fix(import): a failed bundle import always reports its workspace, and the body is read under a per-Read deadline (BUG-3184) (#1497)

2026-09-24 03:44:26 -04:00

handlers_import_bundle_bug3191_test.go

fix(import): a panic after a bundle import creates its workspace takes the keep door, then re-panics (BUG-3191) (#1501)

2026-09-24 05:49:44 -04:00

handlers_import_bundle_comment_refs_test.go

fix(store): cover documents and comment bodies in the attachment reference walks (BUG-2614, BUG-2615) (#1145)

2026-08-17 14:26:09 -04:00

handlers_import_bundle_husk_test.go

fix(import): a rejected bundle import leaves no restorable husk, and the shared removal reclaims blobs before it purges (BUG-3094) (#1385)

2026-09-15 14:12:20 -04:00

handlers_import_bundle_partial_test.go

fix(import): a kept partial bundle import is attached to its importer instead of left ownerless (BUG-2709) (#1386)

2026-09-15 15:40:13 -04:00

handlers_import_bundle_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_import_bundle.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_import_stale_bodies_test.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

handlers_import_test.go

feat(server): POST /api/v1/import/url endpoint + integration tests (TASK-1472) (#556)

2026-05-15 00:36:41 -04:00

handlers_import.go

feat(server): POST /api/v1/import/url endpoint + integration tests (TASK-1472) (#556)

2026-05-15 00:36:41 -04:00

handlers_invitation_accept_limit_test.go

fix(invitations): accepting as an existing member is idempotent (BUG-3281) (#1645)

2026-09-28 15:46:57 -04:00

handlers_invitation_deleted_workspace_test.go

fix(store,server): an invitation to a soft-deleted workspace reads as unknown (BUG-3104) (#1413)

2026-09-21 17:58:27 -04:00

handlers_invitation_email_test.go

fix(auth): exact invitation email match, no Unicode folding (BUG-3282) (#1644)

2026-09-28 15:01:24 -04:00

handlers_invitation_preview_test.go

fix(server): invitation-preview endpoint + read-only email prefill on /join (BUG-1934) (#803)

2026-07-03 23:47:06 -04:00

handlers_item_lease_test.go

feat(items): execution lease — atomic claim/checkout with expiry (#1238)

2026-09-18 12:25:38 -04:00

handlers_item_lease.go

feat(items): execution lease — atomic claim/checkout with expiry (#1238)

2026-09-18 12:25:38 -04:00

handlers_item_links_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_item_links.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

handlers_item_versions_bounds_test.go

fix: bound item history and stop resolving bodies nobody reads (BUG-2608) (#1147)

2026-08-17 19:02:53 -04:00

handlers_item_versions_bug3031_pg_test.go

fix(versions): a restore over unsaved collaborative edits is refused unless the caller consents to discarding them (BUG-3031) (#1573)

2026-09-26 12:57:38 -04:00

handlers_item_versions_bug3031_test.go

fix: an overwrite, including a confirmed version restore, that deleted another tab's unsaved edits says how many (BUG-3230 U2) (#1595)

2026-09-26 23:25:18 -04:00

handlers_item_versions_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_item_versions.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

handlers_items_access_epoch_test.go

feat(server,web): detect a revocation that writes no item, and evict the cache it left stale (IDEA-2898) (#1261)

2026-09-06 13:36:22 -04:00

handlers_items_ack_loss_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_append_test.go

fix(items): note and decide append server-side under the write lock, so they no longer revert a concurrent field write (BUG-3056) (#1458)

2026-09-23 07:46:45 -04:00

handlers_items_attribution_test.go

fix(cli,server): make agent attribution actually happen (BUG-2542) (#1088)

2026-08-13 16:21:10 -04:00

handlers_items_bug3133_pending_guard_test.go

fix: refuse a token-guarded content write over unflushed tab edits (BUG-3133) (#1423)

2026-09-22 00:42:02 -04:00

handlers_items_bug3230_refuse_pending_test.go

fix(web): the item pane's raw-markdown saves are refused, not applied, over another tab's unstored edits; an unload save keeps its text for recovery (BUG-3230 U0) (#1590)

2026-09-26 21:28:37 -04:00

handlers_items_bulk_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_bulk.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_items_collab_versions_test.go

fix(versions): a restore over unsaved collaborative edits is refused unless the caller consents to discarding them (BUG-3031) (#1573)

2026-09-26 12:57:38 -04:00

handlers_items_content_echo_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_content_route_test.go

fix(server): write first, apply second on the collab applier path (TASK-2989 / BUG-2840 half A) (#1318)

2026-09-10 08:54:41 -04:00

handlers_items_content_route.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

handlers_items_content_state_test.go

feat(items): content_state marks a body the server knows is stale (BUG-3000) (#1343)

2026-09-13 10:51:03 -04:00

handlers_items_copy_attachment_authz_test.go

fix(copy): authorize attachment references in cross-workspace copy (TASK-2408)

2026-08-02 04:54:31 +00:00

handlers_items_copy_content_state_test.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

handlers_items_copy_parity_test.go

refactor(server): extract resolveAuthorizedCopy shared by preflight and copy (TASK-2370)

2026-07-31 14:43:40 +00:00

handlers_items_copy_preflight_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_copy_preflight.go

fix(server): a request that repeats fields_patch or field_overrides is refused, where it silently dropped the first copy (BUG-3219) (#1548)

2026-09-25 18:23:31 -04:00

handlers_items_copy_relation_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

handlers_items_copy_resolve.go

fix(server): a request that repeats fields_patch or field_overrides is refused, where it silently dropped the first copy (BUG-3219) (#1548)

2026-09-25 18:23:31 -04:00

handlers_items_copy_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_items_copy.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_items_field_coercion_test.go

test(server): pin the last three coercion call sites (BUG-2850)

2026-09-03 12:49:33 +00:00

handlers_items_fieldpatch_test.go

feat(items): field-level PATCH + conflict envelope + read-only version history (TASK-2022) (#876)

2026-07-08 16:47:34 -04:00

handlers_items_github_pr_test.go

fix(items): github_pr is written only through a typed, validated update member; the field-setter door refuses it (BUG-2696, ToolSurfaceVersion 0.47) (#1469)

2026-09-23 14:35:41 -04:00

handlers_items_jsonb_inner_shape_test.go

feat(store): JSONB NOT NULL hardening on items/views + handler shape validation (IDEA-1486+1488) (#566)

2026-05-16 10:15:59 -04:00

handlers_items_move_overrides_test.go

fix(server): a move refuses a field override the destination does not declare, as the copy does (BUG-2379) (#1448)

2026-09-23 00:02:43 -04:00

handlers_items_moved_out_test.go

fix(sync): moved-out tombstones for cross-visibility collection moves (BUG-1675) (#670)

2026-05-30 19:57:45 -04:00

handlers_items_open_children_guard_test.go

fix(deps): bump go-jose/v3 to v3.0.5 to clear GO-2026-4945 (BUG-1619) (#634)

2026-05-27 13:21:57 -04:00

handlers_items_open_children_guard.go

fix(collab): a schema-version rebuild sets unflushed edits aside instead of deleting them (BUG-3244 A) (#1598)

2026-09-27 05:40:55 -04:00

handlers_items_parent_ambiguity_test.go

fix(server): refuse a PATCH carrying both a fields hierarchy key and top-level parent_id (BUG-2594) (#1133)

2026-08-17 03:42:08 -04:00

handlers_items_preimage_test.go

fix(server): diff the activity change list against the store's pre-image (BUG-2776) (#1206)

2026-08-25 20:16:18 -04:00

handlers_items_refuse_undeclared_test.go

fix(mcp): bulk-update refuses an undeclared status/priority per item on stdio and remote too (BUG-3156, ToolSurfaceVersion 0.46) (#1463)

2026-09-23 10:48:28 -04:00

handlers_items_rename_cascade_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items_reserved_fieldpatch_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_items_reserved_write.go

fix(fields): field writes keep every number's literal, so an integer above 2^53 is no longer rounded by a write that never named it (BUG-3202) (#1545)

2026-09-25 14:22:09 -04:00

handlers_items_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_items_title_test.go

fix(items): a lost commit ack no longer writes the item twice (BUG-2994) (#1340)

2026-09-11 18:03:09 -04:00

handlers_items.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_library_entry.go

feat(cli): pad library get + list --full + server-side category filter (TASK-1562) (#613)

2026-05-21 16:59:57 -04:00

handlers_library_test.go

feat(cli): pad library get + list --full + server-side category filter (TASK-1562) (#613)

2026-05-21 16:59:57 -04:00

handlers_mcp_audit_test.go

feat(mcp): persistent audit log for /mcp tool calls (TASK-960) (#389)

2026-05-02 22:56:10 -04:00

handlers_mcp_audit.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

handlers_mcp_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_mcp_tool_surface_test.go

feat(server): expose MCP tool-surface over authed REST endpoint (#764)

2026-06-24 22:45:32 -04:00

handlers_mcp.go

feat(mcp): off-cloud Host allowlist on the non-API MCP paths (TASK-2319, PLAN-2310 U3) (#1665)

2026-09-29 15:25:44 -04:00

handlers_me_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_me.go

feat(workspace): expose currentRole + resource-scoped permission helpers (TASK-1101) (#415)

2026-05-05 08:52:05 -04:00

handlers_member_collection_access_escalation_test.go

fix(server): deny restricted owners from escalating collection access (BUG-1925) (#815)

2026-07-04 14:39:33 -04:00

handlers_members.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_my_invitations.go

fix(invitations): accepting as an existing member is idempotent (BUG-3281) (#1645)

2026-09-28 15:46:57 -04:00

handlers_oauth_claim_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_claim.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_clients.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth_provider_test.go

fix(server): auth-perimeter hardening — B6–B9 from the IDEA-1927 audit (TASK-1932) (#811)

2026-07-04 11:33:18 -04:00

handlers_oauth_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_oauth.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_plan_limit_race_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_plan_source_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_playbook_library.go

feat(server): library endpoints gain ?category, ?summary, /library/entry (TASK-1561) (#612)

2026-05-21 13:08:02 -04:00

handlers_playbook_match_ratelimit_test.go

feat(server): a dedicated rate limit for synchronous decision-provider calls (TASK-3141) (#1436)

2026-09-22 13:42:37 -04:00

handlers_playbook_match_test.go

feat(playbook): match free text to an active playbook via the decision provider (TASK-3120) (#1429)

2026-09-22 11:28:57 -04:00

handlers_playbooks_test.go

fix(playbooks): enforce draft gate server-side + expose status (BUG-2020) (#874)

2026-07-08 15:28:21 -04:00

handlers_playbooks.go

fix(store): a collection gated by ID is queried by ID, so a slug freed and re-taken in between cannot answer for another collection (BUG-2631) (#1535)

2026-09-25 04:25:42 -04:00

handlers_project_intel_test.go

fix(server): stop counting disabled conventions as completed work (#1152)

2026-08-18 10:44:50 -04:00

handlers_project_intel.go

fix(store): item field filters match exactly; the comma OR is explicit and lives only in the list endpoint's query parse (BUG-3167) (#1478)

2026-09-23 20:24:40 -04:00

handlers_push_cross_instance_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_delivery_symmetry_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_presence_unreadable_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_publish_result_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_push_store_error_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_push_test.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_push_visibility_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_push.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_rbac_test.go

fix(auth): an admin-created registration mints no session, so creating an account no longer hands the admin a live credential for the new user (BUG-3232) (#1581)

2026-09-26 15:27:50 -04:00

handlers_ref_resolver_test.go

fix(server): bearer-gate checkItemVisible's admin bypass (BUG-1918) (#793)

2026-07-03 15:31:17 -04:00

handlers_ref_resolver.go

fix: one prefix grammar, and the ref parser widens to it (BUG-2943) (#1286)

2026-09-07 17:32:36 -04:00

handlers_relation_backlinks.go

feat(relations): materialised reverse index and Referenced-by (PLAN-2857 U5 / TASK-2997) (#1328)

2026-09-11 00:57:47 -04:00

handlers_reminders_test.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

handlers_reminders.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

handlers_reports_test.go

feat(report): windowed project report endpoint + DateBucket dialect (TASK-1630) (#638)

2026-05-29 08:24:05 -04:00

handlers_reports.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_restore_plan_limit_test.go

test(server): RED legs for item restore past items_per_workspace (BUG-3101)

2026-09-17 11:02:02 -04:00

handlers_role_board.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

handlers_search_collection_bug2659_test.go

fix(search): the collection filter resolves exact-first per workspace in scope, so a collection named task is no longer shadowed by tasks (BUG-2659, BUG-2839) (#1576)

2026-09-26 12:20:58 -04:00

handlers_search.go

fix(search): the collection filter resolves exact-first per workspace in scope, so a collection named task is no longer shadowed by tasks (BUG-2659, BUG-2839) (#1576)

2026-09-26 12:20:58 -04:00

handlers_sessions_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_sessions.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_share_attachments_derive_test.go

feat(web,server): render embedded image attachments on share pages via a variants-only byte endpoint (BUG-2389 2b, TASK-2637) (#1153)

2026-08-18 12:26:00 -04:00

handlers_share_attachments_test.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_share_attachments.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_share_links_bruteforce_test.go

fix(security): rate-limit share-link password verification (TASK-2055) (#913)

2026-07-10 23:48:59 -04:00

handlers_share_links_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_share_links.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_stars_test.go

fix(mcp): bundle BUG-1081 + BUG-1082 + TASK-1076 — three small MCP-UX fixes from dogfooding (#387)

2026-05-02 21:31:48 -04:00

handlers_stars.go

fix(events): Publish reports its outcome, and a failed activity publish is counted and logged (BUG-2732) (#1457)

2026-09-23 07:03:36 -04:00

handlers_storage_delete_authz_test.go

fix(attachments): classify derived rows after authorization on delete

2026-08-02 01:50:34 +00:00

handlers_storage_test.go

feat(attachments): Settings → Storage tab with attachment list (TASK-882) (#303)

2026-04-29 17:44:12 -04:00

handlers_storage.go

fix(attachments): classify derived rows after authorization on delete

2026-08-02 01:50:34 +00:00

handlers_stream_gap_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_stream_session_liveness_test.go

fix(server): a stream ends when the credential that opened it stops being valid (BUG-3007) (#1323)

2026-09-10 16:47:31 -04:00

handlers_tags_test.go

feat(tags): workspace tag enumeration endpoint + cross-collection filter (TASK-1653) (#658)

2026-05-29 23:43:02 -04:00

handlers_timeline_collapse_test.go

fix(timeline): resolve collab-snapshot diffs + collapse autosave bursts (BUG-1612) (#691)

2026-06-01 21:25:42 -04:00

handlers_timeline_comment_agent_test.go

feat(server): timeline comment rows carry the agent name (TASK-2760) (#1196)

2026-08-24 18:09:02 -04:00

handlers_timeline_cursor_test.go

fix: timeline can answer has_more=true with zero entries, and the client cannot page past it (BUG-2765) (#1202)

2026-08-25 16:11:47 -04:00

handlers_timeline_cursor_validation_test.go

feat(store): make the NUL invariant a property of the DATABASE (DOC-2823 S2)

2026-09-01 21:16:17 +00:00

handlers_timeline_id_collision_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_timeline_structured_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

handlers_timeline.go

fix(timeline): structured entries get a persisted id instead of a positional one that renumbers when a sibling moves (BUG-2788) (#1540)

2026-09-25 07:10:26 -04:00

handlers_tokens_session_auth_test.go

fix(server): minting or rotating an API token requires an interactive session (BUG-2890) (#1267)

2026-09-06 22:02:05 -04:00

handlers_tokens.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_unparented_test.go

fix(events): release SSE admission slots when a client leaves mid-establishment (BUG-2749) (#1186)

2026-08-24 08:24:34 -04:00

handlers_unsubscribe_test.go

fix(server): escape unsubscribe page via html/template + add strict CSP (TASK-657) (#185)

2026-04-21 22:53:27 -04:00

handlers_unsubscribe.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_verify_email_test.go

fix: registering from an invitation link lands in the joined workspace on an ephemeral tab (BUG-3284) (#1647)

2026-09-28 16:37:02 -04:00

handlers_versions.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

handlers_views_collections_jsonb_test.go

feat(store): JSONB NOT NULL hardening on items/views + handler shape validation (IDEA-1486+1488) (#566)

2026-05-16 10:15:59 -04:00

handlers_views_unparented_test.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_views.go

feat(items): add unparented filtering contract (#926)

2026-07-13 22:46:55 -04:00

handlers_watch_access_test.go

feat(server,cli): watches, user-scoped event stream, plugin monitor command — PLAN-2469 Phase 1 (TASK-2533) (#1082)

2026-08-12 15:50:41 -04:00

handlers_watch_access.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_watch_events_cancel_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_watch_events_oauth_scope_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

handlers_watch_events_refused_test.go

fix(watchevents, server): the watch stream refuses a subscriber when the instance has no watch subscription, as the activity stream does (BUG-2800) (#1451)

2026-09-23 01:37:54 -04:00

handlers_watch_events_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

handlers_watch_events.go

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00

handlers_watch_notify.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

handlers_watch_vis_cache_test.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

handlers_watches_test.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_watches.go

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) (#1220)

2026-08-30 21:30:19 -04:00

handlers_webhook_token_idor_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_webhooks_secret_test.go

test(webhooks): use a literal IP instead of example.com in two more spots

2026-07-26 23:56:34 +00:00

handlers_webhooks.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

handlers_webmcp_setting_test.go

feat(server): add webmcp_enabled platform setting + session flag (#763)

2026-06-24 22:28:34 -04:00

handlers_well_known.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

handlers_workspace_autoadd_race_test.go

test(store): SQLite interleaving for the auto-add statement (BUG-2792 review r2 P2)

2026-09-16 15:36:49 -04:00

handlers_workspace_cap_test.go

feat(billing): record plan_source; a lowering applies only from the source that set the plan (TASK-3295) (#1657)

2026-09-29 10:14:38 -04:00

handlers_workspace_create_consent_test.go

feat(server): refuse workspace creation without may_create_workspaces consent (IDEA-2756) (#1212)

2026-08-26 13:23:56 -04:00

handlers_workspace_import_autoadd_test.go

fix(workspaces): workspace import adds the new workspace to the importing OAuth connection, as create does (BUG-2794) (#1491)

2026-09-24 01:02:00 -04:00

handlers_workspace_import_nul_test.go

fix(store,server,cli): three defects from codex round 1 (BUG-2810)

2026-09-02 15:15:11 +00:00

handlers_workspace_import_plan_limit_test.go

fix(server): charge workspace imports against the plan limit (BUG-2793) (#1219)

2026-08-27 23:56:55 -04:00

handlers_workspace_import_refusal_status_test.go

fix(server): a refused collection prefix reaches the caller as a 400 naming the rule (BUG-2951) (#1293)

2026-09-08 14:51:21 -04:00

handlers_workspace_mint_parity_test.go

fix(server,store): both workspace mint doors enforce their preconditions from one place (BUG-2809) (#1268)

2026-09-06 23:36:58 -04:00

handlers_workspace_tabs_test.go

fix(tabs): order workspace-tab lists by a per-user server revision (BUG-3285) (#1649)

2026-09-28 18:33:09 -04:00

handlers_workspace_tabs.go

fix(tabs): order workspace-tab lists by a per-user server revision (BUG-3285) (#1649)

2026-09-28 18:33:09 -04:00

handlers_workspaces_test.go

fix(auth): a web sign-in destroys the session row its cookie replaces, so a sign-in as someone else no longer leaves the previous user's session alive (BUG-3011) (#1579)

2026-09-26 14:25:10 -04:00

handlers_workspaces.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

import_nul_repair.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

import_plan_limit_message_test.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

import_read_deadline.go

fix(import): a failed bundle import always reports its workspace, and the body is read under a per-Read deadline (BUG-3184) (#1497)

2026-09-24 03:44:26 -04:00

import_stale_bodies.go

fix(export): mark bundle bodies that were stale when written, and refuse the migration that would abandon them (BUG-3032) (#1356)

2026-09-14 01:45:30 -04:00

isolated_client_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

item_lineage.go

feat(relations): exact-title resolution and hydrated reads for relation fields (PLAN-2857 U6 / TASK-2996) (#1326)

2026-09-10 21:06:40 -04:00

item_moved_to_test.go

feat(relations): exact-title resolution and hydrated reads for relation fields (PLAN-2857 U6 / TASK-2996) (#1326)

2026-09-10 21:06:40 -04:00

item_moved_to.go

feat(server): expose ACL-gated moved-to pointer on item GET (TASK-2359)

2026-07-30 12:20:38 +00:00

listen_serve_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

main_test.go

perf(test): build the SQLite migration chain once per test binary (IDEA-1914) (#788)

2026-07-03 10:15:49 -04:00

mcp_availability_payload_test.go

feat: the console MCP section; Connected Apps follows OAuth (TASK-3303, PLAN-2310 U5) (#1666)

2026-09-29 16:41:24 -04:00

mcp_capability_test.go

feat(mcp): off-cloud Host allowlist on the non-API MCP paths (TASK-2319, PLAN-2310 U3) (#1665)

2026-09-29 15:25:44 -04:00

mcp_security_floor_test.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

metrics_auth_test.go

perf(test): wire remaining store helpers onto storetest fixture (TASK-1915) (#789)

2026-07-03 12:17:03 -04:00

middleware_auth_admin_token_gate_test.go

fix(auth): scope admin platform role to cookie session auth (BUG-1616) (#632)

2026-05-27 10:09:30 -04:00

middleware_auth_public_paths_test.go

fix(auth): TokenAuth falls through invalid Bearer on public API paths (BUG-1227) (#434)

2026-05-07 20:01:34 -04:00

middleware_auth.go

fix(api): a workspace that does not resolve answers 404 not_found marked details.scope=workspace, so a client can tell it from a missing item (BUG-3069) (#1534)

2026-09-25 03:46:16 -04:00

middleware_csrf_test.go

fix(server): auth-perimeter hardening — B6–B9 from the IDEA-1927 audit (TASK-1932) (#811)

2026-07-04 11:33:18 -04:00

middleware_csrf.go

fix(server): auth-perimeter hardening — B6–B9 from the IDEA-1927 audit (TASK-1932) (#811)

2026-07-04 11:33:18 -04:00

middleware_form_body_test.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

middleware_form_body.go

fix(server): OAuth form-encoded bodies take the transport text rule, so a NUL or invalid UTF-8 in connection_name, code or refresh_token answers 400 instead of 500 (BUG-2811) (#1564)

2026-09-26 02:21:40 -04:00

middleware_logging_test.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

middleware_logging.go

feat(auth): first-run logs-token bootstrap flow (TASK-1167) (#424)

2026-05-06 08:40:11 -04:00

middleware_mcp_audit_test.go

fix(attachments,mcp-audit): record where a stored filename or tool name came from, instead of sentinel strings a caller can choose (BUG-2819) (#1537)

2026-09-25 05:13:05 -04:00

middleware_mcp_audit.go

feat(mcp): construct MCP off cloud, mount always, gate per request (TASK-2317, PLAN-2310 U2) (#1663)

2026-09-29 14:13:03 -04:00

middleware_mcp_auth_dual_read_test.go

feat(oauth): per-connection state tables + dual-read introspection gate (TASK-1520) (#581)

2026-05-18 00:03:20 -04:00

middleware_mcp_auth.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_mcp_host_test.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_mcp_host.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_mcp_metrics_test.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

middleware_mcp_session_test.go

feat(metrics): session-id-keyed TTL sweep for mcp_active_sessions (TASK-1120) (#400)

2026-05-03 17:40:18 -04:00

middleware_mcp_session.go

docs(mcp): the reason given for the protocol restriction was false — replace it with the true one (TASK-2977) (#1312)

2026-09-09 20:35:44 -04:00

middleware_metrics_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

middleware_metrics.go

fix(metrics): bound the MCP tool label and the HTTP method label, which callers could fill with invented values (BUG-2817) (#1456)

2026-09-23 06:01:08 -04:00

middleware_query_test.go

fix(server): refuse invalid-UTF-8 and NUL query values at the transport (BUG-2784) (#1217)

2026-08-27 10:35:39 -04:00

middleware_ratelimit_test.go

fix(e2e): disable rate limiting on the E2E server to stop 429 flakes (BUG-2089) (#922)

2026-07-11 14:30:32 -04:00

middleware_ratelimit.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_realip_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

middleware_realip.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

middleware_request_text_test.go

fix(server): refuse invalid-UTF-8 and NUL query values at the transport (BUG-2784) (#1217)

2026-08-27 10:35:39 -04:00

middleware_request_text.go

fix(server): the request-body gate reads tokens with jsontext, so a NUL behind a repeated key or beside 1e999 is refused, and a repeated request member is refused on every body (BUG-2812) (#1550)

2026-09-25 21:48:30 -04:00

middleware_security_test.go

chore: bump Go toolchain to 1.26 (TASK-763) (#247)

2026-04-25 11:35:19 -04:00

middleware_security.go

fix(server): reject CORS wildcard when credentials are on (TASK-664) (#188)

2026-04-21 23:59:54 -04:00

middleware_session_ip_test.go

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00

middleware_session_ua_test.go

feat(security): enforce session UA binding under strict mode (TASK-2056) (#912)

2026-07-10 23:32:22 -04:00

middleware_verified_email_test.go

fix(members): invitation accept enforces members_per_workspace (BUG-3098)

2026-09-17 16:13:36 -04:00

middleware_verified_email.go

feat(server): RequireVerifiedEmail enforcement across all mutation perimeters (TASK-1937) (#807)

2026-07-04 02:06:58 -04:00

migrate_close_state.go

fix(BUG-2367): a move or copy that would reopen, close or un-abandon an item must name the status instead of inheriting whatever survived migration (#1516)

2026-09-24 15:53:06 -04:00

mobile_contract_test.go

test(server): the mobile shells' unversioned contracts fail CI when they move (TASK-2053) (#1294)

2026-09-08 15:49:05 -04:00

my_invitations_test.go

fix(invitations): accepting as an existing member is idempotent (BUG-3281) (#1645)

2026-09-28 15:46:57 -04:00

nul_differential_test.go

feat(server,store): the differential test's three live legs + the 400 mapping

2026-09-01 12:06:08 +00:00

nul_repair_differential_test.go

fix(store): a JSON blob that repeats a member is stored collapsed, so SQLite's json_extract and Go read the same value (BUG-2896) (#1547)

2026-09-25 16:24:50 -04:00

open_children_guard_pool_test.go

fix(store): serialize document renames and stop reading the pool inside transactions (BUG-2778) (#1208)

2026-08-25 22:40:58 -04:00

oplog_gc_test.go

feat(collab): periodic op-log GC sweeper for dormant items (TASK-1309) (#471)

2026-05-09 18:19:33 -04:00

oplog_gc.go

fix(server): add panic recovery to background sweeper goroutines (BUG-2071) (#865)

2026-07-08 11:58:41 -04:00

orphan_gc_test.go

fix(server): rowless-blob GC sweep — reclaim blobs no attachments row references (BUG-2406) (#1137)

2026-08-17 09:03:44 -04:00

orphan_gc.go

fix(store): cover documents and comment bodies in the attachment reference walks (BUG-2614, BUG-2615) (#1145)

2026-08-17 14:26:09 -04:00

outbox_drain_test.go

feat(server): outbox drain — webhooks delivered from the choke point (TASK-2714) (#1173)

2026-08-20 23:33:26 -04:00

outbox_drain.go

docs(store,server): four comments and one log line that had stopped being true (BUG-2827)

2026-09-02 12:33:08 +00:00

outbox_payload_limit_test.go

docs,test(store): correct five comments and strengthen the shrink fixture (BUG-2827)

2026-09-02 12:05:57 +00:00

overdue_surfaces_test.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

overdue.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

password_strength_test.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

password_strength.go

feat(server): zxcvbn password strength check at registration / rotation / reset (TASK-669) (#193)

2026-04-22 12:21:34 -04:00

plan_limit_native_shell_test.go

fix(test): call SetUserPlan with a PlanWrite; main broken since 1ed52bdb (TASK-3293) (#1659)

2026-09-29 11:28:17 -04:00

progress_abandoned_test.go

fix(progress): an abandoned child leaves both the done count and the total, and 0/0 renders as no progress (BUG-3195) (#1510)

2026-09-24 11:24:33 -04:00

publish_sites_ruled_test.go

fix(server,watchevents): shared session presence + honest push acceptance (BUG-2698, BUG-2699) (#1175)

2026-08-21 20:43:20 -04:00

push_message_collapse_test.go

feat(web): push-to-agent composer in the item view (TASK-2561) (#1099)

2026-08-15 08:22:09 -04:00

redis_health_test.go

fix(watchevents,server): four concurrency findings from codex round 9 (BUG-2727, BUG-2726)

2026-08-22 03:43:15 +00:00

redis_health.go

refactor: prune the claim surface, and turn one prose claim into a test

2026-08-22 05:09:29 +00:00

relation_backlinks_test.go

feat(relations): materialised reverse index and Referenced-by (PLAN-2857 U5 / TASK-2997) (#1328)

2026-09-11 00:57:47 -04:00

relation_hydration.go

fix(schema): a grandfathered reserved-key FieldDef never reaches an item-field path (BUG-2685) (#1377)

2026-09-15 00:50:12 -04:00

relation_multi_roundtrip_test.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

relation_ref_prefix_test.go

fix(store): a relation ref falls back to matching by number only when its prefix names no live collection (BUG-3082) (#1369)

2026-09-14 11:49:35 -04:00

relation_referents_doors_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

relation_referents.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

relation_target_availability.go

feat(items): multi_relation — an ordered list of references (TASK-2999 / PLAN-2857 U4) (#1342)

2026-09-13 16:01:12 -04:00

relation_titles_copy_test.go

feat(relations): exact-title resolution and hydrated reads for relation fields (PLAN-2857 U6 / TASK-2996) (#1326)

2026-09-10 21:06:40 -04:00

relation_titles_doors_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

relation_titles_import_test.go

fix(store): a relation ref falls back to matching by number only when its prefix names no live collection (BUG-3082) (#1369)

2026-09-14 11:49:35 -04:00

relation_unjudged_fail_closed_test.go

fix(relations): a wrong_collection reason is judged on the row resolved, never by a second lookup (BUG-3012) (#1490)

2026-09-24 01:01:52 -04:00

reminder_tick.go

feat: item reminders — the fire-at-an-instant primitive, and one overdue rule for all four surfaces (IDEA-2641, closes #1010) (#1244)

2026-09-04 11:36:11 -04:00

reserved_seed_test.go

fix(items): create refuses reserved metadata keys; convention metadata goes through a typed create member; a full fields update may only carry them (BUG-3163, ToolSurfaceVersion 0.48) (#1470)

2026-09-23 16:23:06 -04:00

role_item_counts.go

fix(server): a role's item_count on the roles board counts only items the caller may see (BUG-3257) (#1625)

2026-09-27 18:51:51 -04:00

server_test.go

feat(server): a dedicated rate limit for synchronous decision-provider calls (TASK-3141) (#1436)

2026-09-22 13:42:37 -04:00

server.go

feat(mcp): DR-9 security floor, per-route limits and pre-auth counting (TASK-2320, PLAN-2310 U4) (#1667)

2026-09-29 16:38:00 -04:00

session_identity_test.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

session_identity.go

feat(server): armed-session declaration + push delivery filter (PLAN-2613 S1, TASK-2616) (#1130)

2026-08-17 01:59:02 -04:00

session_presence_keys_test.go

feat(redis): namespace every Redis keyspace from one shared config value (BUG-2724)

2026-08-22 01:41:31 +00:00

session_presence_namespace_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_observer_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_observer.go

refactor: prune the claim surface, and turn one prose claim into a test

2026-08-22 05:09:29 +00:00

session_presence_redis_round2_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_redis_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_redis.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence_test.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

session_presence.go

fix(push): apply delivery's visibility gate to delivered_sessions (BUG-2725) (#1187)

2026-08-24 09:45:48 -04:00

share_item_field_defs_test.go

fix(web,server): a direct item share labels and colours its field chips like a collection share, from defs that disclose only what the item shows (TASK-2248 U3) (#1587)

2026-09-26 20:13:56 -04:00

share_page_collab_isolation_test.go

fix(web): share pages render attachment refs as honest placeholders (BUG-2389) (#1135)

2026-08-17 05:19:25 -04:00

stream_admission_test.go

test: no test request goes through the process-global default transport (BUG-3008, closes BUG-2949) (#1324)

2026-09-10 16:59:58 -04:00

stream_admission.go

fix(collab): WebSocket dials get their own per-user bucket and a per-user socket cap, and the editor jitters its reconnects (BUG-1308) (#1499)

2026-09-24 04:51:57 -04:00

stream_credential_liveness.go

fix(server): a stream ends when the credential that opened it stops being valid (BUG-3007) (#1323)

2026-09-10 16:47:31 -04:00

stream_gap_announcer_test.go

test: close the mutation gaps a coverage audit named (BUG-2730, codex round 18)

2026-08-23 02:32:43 +00:00

stream_gap_announcer.go

revert(sse): remove the ordering barrier; its failure mode is worse than the problem (BUG-2730, codex round 16)

2026-08-23 02:16:35 +00:00

testimageprocessor_libvips_test.go

feat(attachments): ImageProcessor interface + pure-Go impl + thumbnail pipeline (TASK-878) (#295)

2026-04-29 14:35:49 -04:00

testimageprocessor_purego_test.go

feat(attachments): ImageProcessor interface + pure-Go impl + thumbnail pipeline (TASK-878) (#295)

2026-04-29 14:35:49 -04:00

token_reaper_test.go

fix(server): add panic recovery to background sweeper goroutines (BUG-2071) (#865)

2026-07-08 11:58:41 -04:00

token_reaper.go

fix(server): add panic recovery to background sweeper goroutines (BUG-2071) (#865)

2026-07-08 11:58:41 -04:00

token_scopes_test.go

feat(oauth): MCPBearerAuth OAuth integration + public-info (TASK-1027) — closes TASK-951 (#375)

2026-05-02 13:33:53 -04:00

token_workspace_allowlist_test.go

fix(security): scope MCP workspace-global reads by OAuth consent allow-list (BUG-2102) (#935)

2026-07-14 20:37:03 -04:00

token_workspace_consent_scope_test.go

fix(workspaces): reorder skips workspaces outside the OAuth consent allow-list, as the list endpoint does (BUG-3255) (#1614)

2026-09-27 12:01:55 -04:00

twofactor_challenge.go

fix: persist 2FA challenge key and prevent duplicate TOTP verification

2026-04-08 20:30:39 +00:00

username.go

feat: username validation, reserved words, and registration flow

2026-04-10 23:12:59 +00:00

web_build_identity_test.go

feat(ops): health reports which web bundle is served, and install-refresh warns when it is not a clean build of the commit (TASK-3233) (#1583)

2026-09-26 16:54:20 -04:00

web_build_identity.go

feat(ops): health reports which web bundle is served, and install-refresh warns when it is not a clean build of the commit (TASK-3233) (#1583)

2026-09-26 16:54:20 -04:00

workspace_access_notify_test.go

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00

workspace_access_notify.go

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00

workspace_mint.go

fix: no commerce in the mobile apps (TASK-3293, PLAN-3291 U1, BUG-3290) (#1658)

2026-09-29 10:42:26 -04:00

workspace_owner_compensation_test.go

fix(server): a workspace create answers with a usable workspace or with nothing (BUG-2715) (#1376)

2026-09-14 19:43:25 -04:00

workspace_owner_compensation.go

fix(import): a rejected bundle import leaves no restorable husk, and the shared removal reclaims blobs before it purges (BUG-3094) (#1385)

2026-09-15 14:12:20 -04:00

workspace_purge_test.go

feat(store): hard-purge soft-deleted workspaces after 30 days (TASK-1966) (#825)

2026-07-05 22:23:12 -04:00

workspace_purge.go

feat(server): workspace_access_changed on the user stream when an existing account gains or loses a workspace (TASK-3272) (#1636)

2026-09-28 10:05:51 -04:00