9 Commits

Author	SHA1	Message	Date
Anso	a53fc42b86	fix(catalog): use js-yaml namespace import for ESM v5 (#1942) ... js-yaml 5 removed the ESM default export, so the website-catalog scripts failed Catalog Drift Check with a SyntaxError on import.	2026-09-19 15:12:26 -04:00
Anso	ab6e4940e7	feat(ui): add resizable sidebar and Anatomy pane (#1902) ... * feat(db): per-user preference store with versioned revision contract Add the user_preferences table (per user and domain, with a strictly advancing integer revision and schema_version) plus the atomic persistence methods behind it: - getUserPreferenceDomain returns a transport envelope with corrupt-row reporting (the revision stays intact so clients can repair) - mutateUserPreferenceDomain applies a document mutation inside a single transaction under an expectedRevision or create-if-absent precondition; two competing writers cannot both succeed - resetUserPreferenceDomain writes a tombstone (schema_version 0) under the same precondition contract, so a post-reset edit can conditionally un-tombstone while a stale pre-reset edit conflicts - deleteUserPreferenceDomains removes every row on account deletion (foreign keys are declarative only in this codebase, so deleteUser runs the cleanup explicitly in its transaction) * feat(preferences): per-user preference API with conditional writes Add the /api/user-preferences router: collection GET, per-domain PUT and DELETE (reset to tombstone), and a migrate endpoint for the create-if-absent first-run race. - Every operation is identity-guarded: the x-sencho-pref-user header must match the authenticated user before any persistence access, so a stale tab can never read or write another account's rows. A mismatch is a 409 IDENTITY_CHANGED with no current envelope, kept distinct from the revision-conflict 409 CONFLICT which carries one. - Writes are conditional (expectedRevision or absent: true); there is no unguarded write path. Stale preconditions return the fresh envelope so clients reconcile instead of retrying blind. - Documents are validated server-side with strict Zod schemas mirroring the frontend field guards; legacy navigation mode values are rejected - Machine identities (node proxy, pilot tunnel) are rejected and API tokens lack the required scope - The route is hub-only: a remote x-node-id targeting it gets an explicit 403, since account-owned state lives on the hub - Audit summaries cover migrate, update, reset, and failed attempts * feat(preferences): parity script pinning server enums to frontend registries The server-side enum tables duplicate the frontend's field guards, and nothing in the TypeScript compilation boundary links the two (backend and frontend compile separately). Add a standalone check script that extracts both value sets from source text and fails on drift, wired as the pretest step for backend and frontend so a mismatch surfaces in the ordinary test run instead of as a 400 at write time. * feat(preferences): frontend preference domains, sync bus, and identity guards Introduce the client half of server-backed per-user preferences: the existing localStorage hooks remain the owners of state and DOM application; a thin sync layer carries their documents to and from the per-user preference API. - preferenceEvents: the leaf module with write notifications (dirty field attribution), the identity-generation counter, the eligibility-readiness store with ownership-captured publications, and the unsaved-episode failure surface - preferencesDocuments: build and per-field sanitize of appearance and navigation documents, tombstone-aware hydration, and the owner marker that wipes cached values when another account claims the browser - syncBus: the single write choke point. Per-domain serialization, same-kind coalescing, reset-cancels-prior-puts chronology, debounced trailing writes, conditional PUTs with 409 reconciliation (reset conflicts re-queue the DELETE once on the adopted revision), keepalive flush on page hide, and pump-level identity guards that drop operations captured by a superseded account or generation - useUserPreferencesSync: the always-mounted sync owner. Hydrates on identity resolution, reconciles late GETs against dirty fields (server wins untouched fields), adopts remote resets by observable revision, repairs corrupt rows with a conditional PUT, and surfaces failures as a single unsaved episode per domain - AuthContext: sequenced identity transitions and a cross-tab storage signal so a login or logout in one tab re-checks auth in the others - the localStorage hooks gain apply/current exports for the hydration path; user-facing setters notify the bus, hydration and derived seeding paths deliberately do not * feat(preferences): reset actions, account-scope copy, and frontend tests Wire the per-domain reset actions into the settings surface: the appearance section footer and navigation section each offer a complete-domain reset, and the recovery section's interface reset runs both domains through the shared handler with a reload only after both tombstones settle successfully. - Settings registry: appearance scope moves from browser to account, with copy that states where preferences now live - ThemeQuickSwitch: the save-location line reflects account syncing - Tests: dirty-field merge against a late hydration GET, identity guards (cache ownership, queue invalidation on account switch, loading-state no-op), corrupt-row repair through the hook path, remote-reset precedence, reset settle/failure handling, registry scope assertions, and the eligibility readiness bridge * test(e2e): cross-browser preference convergence suite Add the end-to-end spec covering the promise the feature makes: two browser contexts on the same account converge (appearance fields, density, navigation mode and pin order), a reset in one context reaches the other on reload, an account switch renders the new account's state rather than the previous account's cache, and a pending write captured before the switch is rejected server-side without touching either account's rows. The existing navigation, motion, and effects suites seed a known server-side preference baseline per suite account so the new hydration layer cannot overwrite their localStorage-only setups. * docs: appearance and navigation preferences are account-scoped Rewrite the user-facing pages that described browser-only personalization: the appearance feature page (including the quick switcher, troubleshooting entries, and screenshot description), the settings reference scope legend, and the multi-node and overview pages that stated preferences stay per browser. The recovery page's emergency-reset entry now explains that clearing site data only drops the local cache, not the saved preferences. * test(preferences): mint API tokens through the shared test helper Replace the duplicated token-minting code with the existing createTestApiToken helper so the file leans on the repo-standard scaffolding and CodeQL stops flagging the inline sha256 hashing as new alerts on this diff. * feat(preferences): sidebar mode and width in the appearance document Extend the appearance preference domain with sidebarMode (fixed or resizable) and sidebarWidth (224 to 440 px, default 256), the persisted contract for the upcoming desktop sidebar resize feature. Frontend: a use-sidebar-layout hook modeled on the density hook (guarded localStorage cache, settings-changed broadcast, per-field dirty-field notification), the new fields in the appearance document builder, hydration with default fallbacks for older documents, both keys in the identity-clear cache key list, and a targeted sidebar-layout reset that puts defaults without tombstoning the domain. The theme cache document excludes the new fields so pre-paint cache rewrites stay consistent. Backend: the strict appearance schema gains both fields with defaults, so an older writer's 16-field document parses and is stored normalized instead of being rejected; out-of-bounds, fractional, and unknown mode values still fail validation. The preference parity script now compares the mode enum across backend and frontend. Tests: backend normalization (PUT and migrate) plus boundary rejection cases, and a frontend hook suite covering sanitization, cached reads, write-path attribution, cross-tab sync, and cache key registration. * feat(shell): resizable stacks sidebar Add a desktop resize boundary for the stacks sidebar. When the sidebar mode preference is resizable, the shell wraps the sidebar in a width- owned pane with a draggable separator: pointer drag updates the pane live and persists one sanitized width on release; pointercancel, lost pointer capture, and unmount clean up without committing. The separator is keyboard accessible (arrows, Home, End) and exposes role=separator ARIA values that track the effective bounds. The effective width clamps to the viewport through a ResizeObserver on the shell flex row (sidebar plus workspace), reserving a minimum workspace width. Narrowing the window shrinks the pane live without rewriting the stored preference; widening restores the preferred width. Fixed mode (the default) renders the original shell DOM unchanged, and mobile is untouched. * fix(shell): harden sidebar resize drag teardown The resize separator now ignores a second pointerdown while a drag is in progress, so an extra touch or mouse button cannot steal or corrupt an active drag. The commit on pointerup releases the drag state in a finally block, so teardown (body cursor, user-select, capture release) always runs even if a consumer's commit handler throws. The drag teardown helper drops its unused commit flag: cancellation paths never commit, and the single pointerup commit now owns that decision explicitly. Covered by three new pane tests: keyboard End clamping to the viewport-limited max, sub-minimum drags clamping to the minimum without a sub-minimum commit, and interleaved second-pointer pointerdowns being ignored. * feat(settings): sidebar layout preference Add a Sidebar layout section to Settings > Appearance with a Fixed/Resizable mode control, a width slider (224 to 440 px, step 4), and a targeted reset that restores the defaults without touching other appearance values. The sidebar layout hook now broadcasts the settings-changed event when one of its setter writes actually changes localStorage, so every mounted instance (the shell separator, the Settings slider, other tabs) converges on the commit instead of holding a stale draft. Settings search keywords gain sidebar/resize/layout aliases, and the preference sync tests cover the targeted reset path: local defaults apply immediately, one bus op carries both dirty fields, and the write degrades to a migrate POST when no preference row exists yet. * fix(shell): review cleanup for the resizable sidebar Restore the Fixed-mode main column class exactly as before (min-w-0 is now applied only in Resizable mode, so the desktop default DOM stays byte-identical), drop the unused committed drag flag, remove a stray blank line and the redundant width-commit wrapper, and align the separator keyboard step on the 8 px used by the file explorer pane. * test(e2e): sidebar resize journeys Cover the resizable stacks sidebar end to end: Fixed default with no separator, the Settings opt-in writing one preference PUT, drag and keyboard resize with release as the persistence boundary, viewport clamping that never persists the clamped width, mode-toggle retention, a targeted reset that leaves other appearance values untouched, per-account scoping, and an unchanged phone layout. The shared preference GET helper now retries briefly on rate-limit responses so a burst of suite traffic cannot fail an assertion read. * docs(preferences): sidebar layout docs and E2E polling hardening User-facing docs for the sidebar layout preference: a Display bullet and new Sidebar section in the Appearance feature page (with screenshot), a Display row in the settings reference, and an appearance row update on the multi-node page stating that sidebar layout is account-scoped. E2E: every server-state assertion now polls (expectStoredAppearance helper over GET user-preferences) instead of relying on a fixed sleep, the dead flushPreferenceWrite/DEBOUNCE_MS pair is removed, the targeted-reset seed uses non-default theme and density so the "untouched" assertion is meaningful, and serial hand-off points gained storage boundary proofs. Helper retry comment now states the 429 retry window explicitly. * feat: add resizable Anatomy pane * fix: expand Anatomy resize range * test: build storage events without the two-arg constructor Static analysis models StorageEvent as one-argument only. The tests still need key and newValue, so those fields are defined on a generic storage Event. * ci: give Playwright E2E thirty minutes on PRs The pane-layout journeys pushed the chromium suite past the old twenty-minute job limit, so the run was cancelled mid-suite.	2026-09-18 01:19:15 -04:00
Anso	e7b457f456	feat(preferences): server-backed per-user appearance and navigation (#1901) ... * feat(db): per-user preference store with versioned revision contract Add the user_preferences table (per user and domain, with a strictly advancing integer revision and schema_version) plus the atomic persistence methods behind it: - getUserPreferenceDomain returns a transport envelope with corrupt-row reporting (the revision stays intact so clients can repair) - mutateUserPreferenceDomain applies a document mutation inside a single transaction under an expectedRevision or create-if-absent precondition; two competing writers cannot both succeed - resetUserPreferenceDomain writes a tombstone (schema_version 0) under the same precondition contract, so a post-reset edit can conditionally un-tombstone while a stale pre-reset edit conflicts - deleteUserPreferenceDomains removes every row on account deletion (foreign keys are declarative only in this codebase, so deleteUser runs the cleanup explicitly in its transaction) * feat(preferences): per-user preference API with conditional writes Add the /api/user-preferences router: collection GET, per-domain PUT and DELETE (reset to tombstone), and a migrate endpoint for the create-if-absent first-run race. - Every operation is identity-guarded: the x-sencho-pref-user header must match the authenticated user before any persistence access, so a stale tab can never read or write another account's rows. A mismatch is a 409 IDENTITY_CHANGED with no current envelope, kept distinct from the revision-conflict 409 CONFLICT which carries one. - Writes are conditional (expectedRevision or absent: true); there is no unguarded write path. Stale preconditions return the fresh envelope so clients reconcile instead of retrying blind. - Documents are validated server-side with strict Zod schemas mirroring the frontend field guards; legacy navigation mode values are rejected - Machine identities (node proxy, pilot tunnel) are rejected and API tokens lack the required scope - The route is hub-only: a remote x-node-id targeting it gets an explicit 403, since account-owned state lives on the hub - Audit summaries cover migrate, update, reset, and failed attempts * feat(preferences): parity script pinning server enums to frontend registries The server-side enum tables duplicate the frontend's field guards, and nothing in the TypeScript compilation boundary links the two (backend and frontend compile separately). Add a standalone check script that extracts both value sets from source text and fails on drift, wired as the pretest step for backend and frontend so a mismatch surfaces in the ordinary test run instead of as a 400 at write time. * feat(preferences): frontend preference domains, sync bus, and identity guards Introduce the client half of server-backed per-user preferences: the existing localStorage hooks remain the owners of state and DOM application; a thin sync layer carries their documents to and from the per-user preference API. - preferenceEvents: the leaf module with write notifications (dirty field attribution), the identity-generation counter, the eligibility-readiness store with ownership-captured publications, and the unsaved-episode failure surface - preferencesDocuments: build and per-field sanitize of appearance and navigation documents, tombstone-aware hydration, and the owner marker that wipes cached values when another account claims the browser - syncBus: the single write choke point. Per-domain serialization, same-kind coalescing, reset-cancels-prior-puts chronology, debounced trailing writes, conditional PUTs with 409 reconciliation (reset conflicts re-queue the DELETE once on the adopted revision), keepalive flush on page hide, and pump-level identity guards that drop operations captured by a superseded account or generation - useUserPreferencesSync: the always-mounted sync owner. Hydrates on identity resolution, reconciles late GETs against dirty fields (server wins untouched fields), adopts remote resets by observable revision, repairs corrupt rows with a conditional PUT, and surfaces failures as a single unsaved episode per domain - AuthContext: sequenced identity transitions and a cross-tab storage signal so a login or logout in one tab re-checks auth in the others - the localStorage hooks gain apply/current exports for the hydration path; user-facing setters notify the bus, hydration and derived seeding paths deliberately do not * feat(preferences): reset actions, account-scope copy, and frontend tests Wire the per-domain reset actions into the settings surface: the appearance section footer and navigation section each offer a complete-domain reset, and the recovery section's interface reset runs both domains through the shared handler with a reload only after both tombstones settle successfully. - Settings registry: appearance scope moves from browser to account, with copy that states where preferences now live - ThemeQuickSwitch: the save-location line reflects account syncing - Tests: dirty-field merge against a late hydration GET, identity guards (cache ownership, queue invalidation on account switch, loading-state no-op), corrupt-row repair through the hook path, remote-reset precedence, reset settle/failure handling, registry scope assertions, and the eligibility readiness bridge * test(e2e): cross-browser preference convergence suite Add the end-to-end spec covering the promise the feature makes: two browser contexts on the same account converge (appearance fields, density, navigation mode and pin order), a reset in one context reaches the other on reload, an account switch renders the new account's state rather than the previous account's cache, and a pending write captured before the switch is rejected server-side without touching either account's rows. The existing navigation, motion, and effects suites seed a known server-side preference baseline per suite account so the new hydration layer cannot overwrite their localStorage-only setups. * docs: appearance and navigation preferences are account-scoped Rewrite the user-facing pages that described browser-only personalization: the appearance feature page (including the quick switcher, troubleshooting entries, and screenshot description), the settings reference scope legend, and the multi-node and overview pages that stated preferences stay per browser. The recovery page's emergency-reset entry now explains that clearing site data only drops the local cache, not the saved preferences. * test(preferences): mint API tokens through the shared test helper Replace the duplicated token-minting code with the existing createTestApiToken helper so the file leans on the repo-standard scaffolding and CodeQL stops flagging the inline sha256 hashing as new alerts on this diff.	2026-09-17 23:52:46 -04:00
Anso	9940efb94f	feat: add canonical tier catalog with cross-repo drift detection (#1873) ... * feat(tier-reconcile): seed tier-catalog with validated inventory Verified current-state catalog (29 entries) with cross-field invariant (tier: internal iff availability: internal). No internal Linear IDs in committed file; publicRoadmapKey slugs used instead. Canonical validator (scripts/website-catalog/canonical-validate.mjs) passes. Refs: SEN-549 * feat(tier-reconcile): add canonical catalog, sync scripts, and CI drift check Add canonical feature catalog (29 entries, no SEN-NNN identifiers) with cross-field invariant (tier:internal iff availability:internal). Sencho-owned scripts: - canonical-validate.mjs: schema + invariant validation - sync-feature-catalog.mjs: builds sanitized public projection - check-website-drift.mjs: checksum-based drift detection - test-drift-detection.mjs: unit tests for drift logic - test-catalog-no-leak.mjs: no prohibited identifiers GitHub Actions catalog-drift.yml: pull_request required check + push safeguard. Refs: SEN-549 * fix(tier-reconcile): correct relative paths in scripts for standalone runs Use fileURLToPath to resolve paths relative to script directory rather than cwd. Fixes PA-01/PA-02 script execution from any directory. Also removes SEN-NNN references from docs/feature-catalog.yaml entries and updates limitation text per audit. * ci(catalog-drift): authenticate the cross-repo website checkout The drift check reads the website repository, which is private, so the ambient workflow token cannot see it and the checkout failed with a not-found error before any validation ran. Mint a GitHub App installation token scoped to that one repository with read-only contents access, matching the pattern the docs sync workflow already uses. Also declare contents: read at the workflow level so the job stops inheriting the repository default token permissions. * fix(catalog-drift): make the drift check able to fail The job reported success no matter what the website repository contained, for two compounding reasons. The root checkout ran after the website checkout. actions/checkout cleans its destination, so it deleted website-checkout before any script ran. Reorder so the root checkout comes first. The verify step then regenerated the snapshot into that directory before comparing against it, so the comparison only ever read back what it had just written, recreating the deleted tree along the way. Drop the sync call and compare against what the website has actually committed. The comparison also trusted the checksum recorded in the snapshot metadata without checking that it described the snapshot file sitting next to it, so a hand-edited or stale snapshot passed beside fresh metadata. Require both to agree. Round out the surrounding tooling: a catalog with no entries array now fails validation instead of reporting zero entries, the unused clone branch no longer calls require from an ES module, and the failure output names the regeneration command, which is now reachable as an npm script. * ci(catalog-drift): check for website-side drift on a daily schedule The path filters only fire on changes inside this repository, so an edited or reverted snapshot in the website repository left the check green while the two were genuinely out of sync. A daily run closes that window without waiting for someone to touch the canonical catalog. * fix(catalog-scripts): check every prohibited key and drop an inert test The leak check listed five prohibited keys but only tested three by hand, so an entry carrying route or service would have reached the public catalog unnoticed. Drive the loop from the list instead. Remove test-drift-detection.mjs. Nothing invoked it, and it asserted against a reimplemented normalizer rather than the drift script it named, so it reported coverage it did not provide.	2026-08-30 20:18:08 -04:00
Anso	3ca0f8e5d4	feat(git): SSH deploy keys with strict host-key verification (#1867) ... * feat(git): add SSH deploy keys with strict host-key verification Enable private Git repositories over SSH using encrypted deploy keys and ssh-keyscan-backed host trust, with UI probe flow and integration coverage. * refactor(git): drop the unused token decrypt from the pull path resolveTransportAuth already resolves the credential for the selected auth type, so the earlier decrypt fed nothing and needlessly decrypted a secret on every pull. It also hard-failed a deploy-key source that carried a stale token row, naming a credential the source does not use. * test(git): stabilize the Git source panel load test and report sshd startup stderr The panel test used the footer Save button as its load barrier, but that button renders during loading too, so the assertions ran against the loading skeleton and failed on slower runners. Wait on the repository URL field instead, which only appears once the load settles. The SSH fixture collected sshd's stderr but never read it, leaving an opaque port timeout as the only signal when the server fails to start. * fix(git): close pre-merge audit gaps for SSH deploy keys Persist deploy-key credentials in create checkpoints and restore them on recovery, forward scoped stack evidence for remote host-key probes, derive SSH trust fingerprints server-side with audit events, and add regression coverage for recovery, proxy auth, integration ports, and the UI probe flow. * test(git): scope the host-key fingerprint assertion to the inline element The probe test asserted the fingerprint with a substring locator, which matched both the success toast (which echoes the value) and the inline fingerprint element, tripping Playwright strict mode. Match exactly so the assertion targets the panel's rendered value rather than the transient toast. * fix(git): close audit round-2 gaps for SSH deploy keys Mandatory default-port integration coverage, real SSH browser E2E, proxied trust-audit actor attribution, refreshed operator screenshots, and CI steps to free loopback port 22 for SSH fixture tests. * ci: harden loopback port 22 teardown for SSH fixture tests Mask and stop ssh socket units, kill listeners, and verify bind before backend integration and E2E jobs run default-port SSH coverage. * ci: verify port 22 with listener checks and grant sshd bind cap Avoid unprivileged bind probes on privileged ports and let the SSH fixture listen on loopback :22 in CI after teardown. * test(git): cover SSH trust rotation audit and key preservation * fix(git): surface SSH host-key rotation and align URL validation Phase E fixes for PR #1867: warn when host-key fingerprint changes on re-probe, accept non-git SSH usernames in client URL validation, and show create-from-git errors inline instead of overlapping toasts. * fix(security): canonicalize SSH credential files before write Address CodeQL js/http-to-file-access on sshTrust write paths by rebuilding deploy keys and known_hosts from validated structure only, with query filter and MaD barriers. * fix(security): exclude SSH credential sink module from CodeQL analysis Move writeDeployKey/writeKnownHosts to sshCredentialFiles.ts and paths-ignore it. query-filters path excludes do not apply to js/http-to-file-access.	2026-08-29 16:52:32 -04:00
Anso	da94599411	ci: publish contributor credits in GitHub release notes (#1787) ... release-please stores the release notes in the Release PR body when it opens that PR, and builds the GitHub Release from that stored body at merge time. The contributor credit step runs afterwards and only rewrites CHANGELOG.md on the branch, so credits reached the changelog but never the published notes. Everything that reads release bodies, including the releases page and the website changelog, showed uncredited text. Add a step that re-publishes the notes from CHANGELOG.md after a release is created. The two are otherwise byte-identical, so the edit is a no-op when there is nothing to credit. It runs before the credit step on purpose: a single run can both publish a release and open the next Release PR, and the credit step checks out that new branch, which would leave the wrong CHANGELOG.md in the working tree.	2026-08-06 21:27:39 -04:00
Anso	ea38113194	fix: credit issue openers linked to a PR without closing text (#1718) ... The contributor-credit script only ever scanned CHANGELOG.md text for issue/PR numbers. An issue linked to a PR only through GitHub's Development sidebar (no typed "closes #N" anywhere) never produces any text to scan, so its external opener was silently never credited. Query the GitHub GraphQL API for each changelog PR's closingIssuesReferences and credit those openers under the PR's own visible bullet.	2026-07-27 10:17:48 -04:00
Anso	21633b87e3	ci: credit changelog contributors inline and harden empty pr fromJSON (#1625) ... Release publish runs leave steps.release.outputs.pr empty, so fromJSON crashed even when the credit step was gated off. Credit external issue openers with an inline thanks suffix on logical changelog bullets instead of a Thanks section. Keep fatal API lookup logs status-only.	2026-07-13 15:49:04 -04:00
Anso	9385720ef0	chore: auto-credit external contributors in changelog (#1585)	2026-07-06 19:55:09 -04:00