- Add Section 3.5 to AGENTS.md for agent orchestration and tool autonomy
- Add Section E to tasks/GUIDELINES.md with pre-review summary gate
- Update tasks/do.md dispatch template with DRY positive acceptance criteria
- Align task lifecycle state machine to keep in-flight work in tasks/new/
- Extracted `PasskeyTable` and `WebAuthnScript` into `ui/components/auth/`.
- Refactored `PasskeysPage.tsx` and `RegisterPage.tsx` to use the new components instead of inline scripts and HTML.
- Deleted the duplicate `ui/public/ui/utils/bip39_wordlist.ts` and `ui/public/ui/utils/bip39.ts`.
- Updated all import references to use `ui/utils/bip39_wordlist.ts` and `/public/utils/bip39.ts`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Creates `tasks/new/2026-0825.01.jul.story.arch.ui-decomposition-roadmap-2300.md` containing the architectural analysis and phased execution plan for modularizing `ui/` monoliths into pure SSR JSX components while maintaining testability.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Extracted the 1,577-line monolithic `server/main.test.ts` into five isolated, domain-specific files under `server/tests/`:
- `forward_auth.test.ts`: ForwardAuth bypass, cookie scoping, and sandbox.
- `rpc.test.ts`: ConnectRPC SPIFFE and RBAC tests.
- `auth.test.ts`: Audit ledger, WebAuthn PRF, passkey magic links.
- `events.test.ts`: Multi-claim join endpoints and killswitch.
- `scopes.test.ts`: Zero-trust guards and self-revocations.
Successfully maintained all tests cleanly isolated via standard mocking and deleted `main.test.ts` after migrating and executing `deno test --allow-all` with zero failures.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Decomposes the monolith `infra/setup/cli.ts` into clean `infra/setup/prompts/` and `infra/setup/commands/` directories while adhering to Cliffy idiomatic modularity. Validated via `deno check`, tests, and format.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Extracts Auth, Registration, and Passkey routes into `server/routes/auth.ts`.
- Extracts all Admin API endpoints into `server/routes/admin.ts`.
- Extracts RPC Connect setup and mTLS listener into `server/rpc.ts`.
- Extracts global rate limiters and IP helpers into `server/middleware.ts`.
- Reduces `server/main.ts` purely to an entrypoint mounting orchestrator.
- Ensures all existing tests and quality gates pass with zero regressions.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Refactored AdminInvitesPage, AdminUserDetailsPage, AdminRolesPage, and AdminAppsPage to use the new pure Hono SSR JSX stateless components.
Fixed missing import definitions in AdminRolesPage.
Moved task file to complete state.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Removed the dual top buttons from SessionsPage.tsx.
- Removed the `#eventDrawer` and wrapped its fields, buttons, and modal under `<form id="eventForm">` inside `#tabWorkshopPass` of `#delegateDrawer`.
- Wrapped the 1:1 Direct pass form fields, buttons, and modal under `<form id="delegateForm">` inside `#tabDirectPass` of `#delegateDrawer`.
- Added a vanilla Javascript tab switching logic for UI interaction without client-side frameworks.
- Removed deprecated `openEventDrawer` and `closeEventDrawer`.
- Replaced the single main button to trigger `openDelegateDrawer`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Drafts a task specification file `tasks/new/2026-0825.01.jul.story.protocol.universal-agent-framework-1945.md` outlining the extraction of the multi-agent orchestration workflow from Auth-Yes into a clean, reusable, repository-agnostic blueprint. This specification adheres to `tasks/GUIDELINES.md` and covers both a foundational architecture guide and a drop-in scaffolding template bundle.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Create a system analysis task plan in `tasks/new/` detailing how to redesign
the Sessions management page's header and unified drawer, strictly adhering to
the Auth-Yes SSR JSX standards and vanilla JS implementations.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Drafts a comprehensive task specification for implementing zero-trust
scope guards on internal API routes and SSR UI pages, as requested.
The file adheres strictly to the repository's Kanban and Markdown
metadata guidelines.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
Implements the GET /pass?token=... endpoint for validating session tokens, resolving the correct target application domain dynamically, and routing users seamlessly using ephemeral 1-click magic links.
Also updates the Sessions Hub UI hand-off modal to display the 1-Click Magic Link and adds full test coverage.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Add idempotent migrations for `is_public`, `bypass_paths`, and `allowed_cidrs` in `server/db.ts`.
- Update `AppRecord` and `getAppByHost` in `server/auth-session.ts` to cache bypass rules in Valkey.
- Implement native Deno, fast-path prefix (`isPathBypassed`) and CIDR matchers (`isIpAllowed`).
- Update `GET /api/forward-auth` to evaluate dynamic rules and properly return 302/403 for unregistered domains.
- Create `ui/components/UnregisteredAppPage.tsx` SSR view for browser fallbacks.
- Update `AdminAppsPage.tsx` to handle the new ingress settings visually and post to `/api/admin/apps`.
- Add `POST /api/guests/sandbox` to generate ephemeral Valkey guest sessions.
- Update `POST /api/register/verify` to detect `upgrade_session` and promote guests to full users in-flight.
- Add `docs/TIER1_INGRESS_SPEC.md`.
- Ensure tests run cleanly and add comprehensive unit test cases for the bypass matrix.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Add isSafeRedirectUrl utility to prevent open-redirect vulnerabilities.
- Update GET /logout to handle ?redirect=, clear cookies safely, and log audit events.
- Create AppLaunchpadPage.tsx using pure Hono SSR JSX for application visibility and SSO launching.
- Update GET /dashboard and AuthenticatedLayout.tsx to mount the Launchpad as the default authenticated view with Zero-Knowledge querying.
- Add HYBRID_INGRESS_PLAYBOOK.md documentation for Traefik ForwardAuth routing.
- Implement exhaustive unit tests in server/main.test.ts for redirect preservation, anomaly logging, and Zero-Knowledge role filtering.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Scaffolds a new Rust crate `wasm/sss_recovery` for constant-time Shamir's Secret Sharing over GF(256) with strict Wasm `zeroize`
- Implements purely typed BIP-39 fallback mapped via Deno WebCrypto in `ui/utils/bip39.ts`
- Migrates `server/recovery.ts` logic mapping Device/Voucher + Server shares with Valkey rate-limiting
- Applies mandatory in-memory JS zeroization on all reconstructed buffers
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
* Added `prf_enabled` and `prf_salt` columns to the `passkeys` table.
* Updated registration API endpoints to request and store the PRF extension capability and generate a secure salt.
* Updated the login API endpoints to map stored PRF salts into the `evalByCredential` array for the WebAuthn challenge.
* Enhanced the client-side WebAuthn SDK (`auth-client.js`) to extract the PRF Base64URL string output, decode it into a `Uint8Array`, and securely derive a 256-bit AES-GCM Key Encryption Key (KEK) via `crypto.subtle.deriveKey` using the `auth-yes:prf:device-share:v1` info string.
* Implemented graceful fallbacks throughout the stack to ensure registration and standard logins proceed if PRF is unsupported.
* Added corresponding unit tests to verify PRF flow and rejection logic.
* Verified visual and functional changes for the optional username input on the login page via Playwright scripts.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
- Expanded database schema to include `leaf_hash` in `audit_records` and added `audit_sths` table.
- Implemented `server/audit_merkle.ts` for native WebCrypto RFC 6962 tree computations and inclusion proofs.
- Created asynchronous micro-batcher in `server/audit.ts` to compute STH, sign with SPIFFE key, save to DB, and broadcast via Valkey.
- Refactored `auditLog` to compute leaf hashes synchronously before database inserts.
- Added hermetic unit tests with mock fallback patterns for SPIFFE/FFI in `server/audit_merkle.test.ts`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
