6a5a769203
sec(auth-api): implement zero-trust scope guards and permission middleware
2026-08-25 15:39:54 -07:00
563723c654
Merge pull request #30 from mrteye/jules-universal-agent-framework-14468551201613136790
...
feat(protocol): add task specification for universal multi-agent framework
2026-08-25 15:26:47 -07:00
google-labs-jules[bot]
e54496b51f
feat(protocol): add universal agent framework task specification
...
Drafts a task specification file `tasks/new/2026-0825.01.jul.story.protocol.universal-agent-framework-1945.md` outlining the extraction of the multi-agent orchestration workflow from Auth-Yes into a clean, reusable, repository-agnostic blueprint. This specification adheres to `tasks/GUIDELINES.md` and covers both a foundational architecture guide and a drop-in scaffolding template bundle.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-25 22:26:32 +00:00
f130b97838
docs: add engineering lifecycle and task protocols map to README and AGENTS.md
2026-08-25 12:25:26 -07:00
5c72544eca
docs(tasks): establish plan.md, debug.md and streamline path.md master index
2026-08-25 12:20:31 -07:00
d0a1492f6c
docs(tasks): establish tasks/do.md execution protocol and link from path.md
2026-08-25 12:08:59 -07:00
36bad05b35
Merge pull request #29 from mrteye/jul-monolith-audit-16234354212497883361
...
story(arch): draft monolith decomposition roadmap
2026-08-25 11:56:17 -07:00
google-labs-jules[bot]
1353153df2
story(arch): draft monolith decomposition roadmap
...
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-25 18:56:02 +00:00
d53d3143ae
docs(tasks): extract and establish audit-1 and audit-2 protocol templates
2026-08-25 11:34:50 -07:00
f64777602d
Merge pull request #28 from mrteye/chore-ui-redesign-sessions-drawer-task-13578358291952217030
...
chore(tasks): add UI redesign task for sessions drawer
2026-08-25 11:19:43 -07:00
e4bc07513f
Merge pull request #27 from mrteye/zero-trust-scope-guards-task-6161145555757642969
...
sec(tasks): draft task for zero-trust scope guards
2026-08-25 11:19:31 -07:00
google-labs-jules[bot]
ad5cc14858
chore(tasks): add UI redesign task for sessions drawer
...
Create a system analysis task plan in `tasks/new/` detailing how to redesign
the Sessions management page's header and unified drawer, strictly adhering to
the Auth-Yes SSR JSX standards and vanilla JS implementations.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-25 18:19:28 +00:00
google-labs-jules[bot]
dad21ff257
sec(tasks): draft task for zero-trust scope guards
...
Drafts a comprehensive task specification for implementing zero-trust
scope guards on internal API routes and SSR UI pages, as requested.
The file adheres strictly to the repository's Kanban and Markdown
metadata guidelines.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-25 18:19:16 +00:00
70871726bc
docs: soften approval wording in AGENTS.md to confirms execution
2026-08-25 10:28:48 -07:00
3b340257ee
docs: add strict deliberation and user approval protocol to AGENTS.md
2026-08-25 10:26:47 -07:00
e4955f4bd2
feat(ui): add workshop pass creator drawer and 1-click app destination picker
2026-08-25 10:20:00 -07:00
8d4069709d
fix(ui): resolve JS try-block syntax error and add SSR script syntax test suite
2026-08-25 10:10:05 -07:00
22bcd889c3
ui(sessions): simplify delegation copy and labels across sessions page and routes
2026-08-25 09:59:27 -07:00
e9a9fb500f
docs: mark all tasks in ephemeral passes & event cockpit plan complete
2026-08-25 09:42:09 -07:00
f5bafbca78
fix(valkey,tasks): prevent unhandled connection hangs in sandbox and constrain test directives
2026-08-25 09:38:27 -07:00
a82136fc95
feat(cockpit): add live event metrics, seat roster, and master kill-switch
2026-08-25 09:33:44 -07:00
62fc91eb25
docs(tasks): point task 3 targets to server/routes/events.ts
2026-08-25 08:31:55 -07:00
578f3d06ac
Merge pull request #26 from mrteye/feat/event-passes-and-magic-links
...
feat(passes): implement ephemeral 1-click magic links, multi-claim event passes, PIN portal, and CLI 1-liner
2026-08-25 08:27:39 -07:00
39f3b2e3fa
refactor(server): modularize main.ts into dedicated sub-routers (passes, events, sessions, forward-auth)
2026-08-25 08:17:06 -07:00
40804fd813
feat(passes): implement ephemeral 1-click magic links, event passes, PIN join portal, and CLI 1-liner
2026-08-25 08:14:16 -07:00
368150c2c0
Merge pull request #25 from mrteye/feat-ephemeral-magic-passes-11255256777317370393
...
feat: 1-Click Ephemeral Magic Link Redemption
2026-08-25 01:25:51 -07:00
google-labs-jules[bot]
2d34aa15a7
feat: implement ephemeral 1-click magic link redemption (/pass)
...
Implements the GET /pass?token=... endpoint for validating session tokens, resolving the correct target application domain dynamically, and routing users seamlessly using ephemeral 1-click magic links.
Also updates the Sessions Hub UI hand-off modal to display the 1-Click Magic Link and adds full test coverage.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-25 08:25:31 +00:00
7033c532b2
docs(plan): add plan and tasks for ephemeral magic links and multi-claim event passes
2026-08-25 00:40:33 -07:00
2af9ef1f40
docs: add Dual-Audience Development Guide for Agent-First APIs and Mobile-First UI
2026-08-25 00:11:56 -07:00
5f88733fc6
feat(sessions): implement agent session delegation with scoped permissions and instant handoff
2026-08-24 23:46:44 -07:00
80cab8454e
feat(api): support Authorization: Bearer <session_id> in addition to Cookie headers for agent queries
2026-08-24 23:29:39 -07:00
85772659b7
feat(ui,api): polish a11y, mobile decks, app/role edit drawers, display name management, and instant search
2026-08-24 23:21:35 -07:00
509e6019b0
feat(ui): adapt admin management screens into responsive mobile cards and timeline feed
2026-08-24 22:20:47 -07:00
7ab1405459
feat(ui): implement adaptive card decks for launchpad, sessions, and passkeys with emergency recovery backup
2026-08-24 22:20:10 -07:00
a3f5c5c286
feat(ui): implement hero passkey authentication, conditional UI autofill, and 12-word recovery setup
2026-08-24 22:19:20 -07:00
029c32e022
feat(ui): implement design tokens and mobile-first adaptive navigation shell
2026-08-24 22:18:34 -07:00
8e7efcc1d1
docs(tasks): include Recovery PIN setup and 12-word voucher generation in task specs
2026-08-24 22:16:28 -07:00
449b428cea
docs(tasks): add 4 phased task specifications for mobile-first UI revamp
2026-08-24 22:11:32 -07:00
c5f8f6fcbc
docs: add technical design spec for mobile-first UI revamp
2026-08-24 22:10:09 -07:00
b9f4ccd71d
feat(auth): resolve mobile cookie shadowing and synchronize tasks/path.md
...
- Implement iterative session cookie candidate resolution in getAuthenticatedUser
- Eliminate Hono first-match limitation causing mobile login redirect loops
- Use absolute UTC ISO strings for PostgreSQL session expiry queries
- Opportunistically clear host-level cookies upon shadow detection
- Ensure exhaustive server-side session revocation across all cookie candidates on logout
- Add automated regression test for cookie shadowing in server/main.test.ts
- Rename and standardize tasks/path.md with 5-template orchestrator standard
2026-08-24 21:48:33 -07:00
b66cc8209c
Merge pull request #24 from mrteye/jules/investigate-mobile-login-cookie-bug-12452066356128611281
...
chore: Complete Investigation on Mobile Login Cookie Redirect Failure
2026-08-24 21:23:18 -07:00
google-labs-jules[bot]
947b38d81a
Investigate mobile login cookie persistence bug
...
- Investigated Chromium Android wildcard domain cookie behavior.
- Researched Hono's `getCookie` first-match parsing behavior.
- Added experimental Deno test scripts in `scratch/` for Hono cookie header parsing and pg timezone concepts.
- Wrote full root-cause analysis and ranked architectural solutions in `scratch/INVESTIGATIVE_REPORT.md`.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
2026-08-25 00:31:19 +00:00
4b78f70efd
fix(auth): eliminate conflicting deleteCookie and add created_at to users table
2026-08-24 17:14:07 -07:00
250e9c625b
test: update logout redirect assertion
2026-08-24 16:23:12 -07:00
561588624a
feat(ui): allow direct logout redirects to safe return urls instead of forcing login page
2026-08-24 16:22:15 -07:00
8babb8a46e
fix(session): clear invalid cookies on redirect and add cache-control headers to prevent 302 caching loops
2026-08-24 15:57:02 -07:00
0a46e2bdfc
fix(ui): use instant window.location.replace and hold loading state during auth redirect
2026-08-24 15:46:27 -07:00
54cdf0c442
fix(auth): remove invalid transports column reference in passkeys query
2026-08-24 15:41:49 -07:00
324ad24d05
fix(auth): add allowCredentials to login challenge options when username provided
2026-08-24 15:36:54 -07:00
cf42a32800
fix(auth): eliminate competing deleteCookie on login verify and ensure proper session persistence
2026-08-24 15:32:26 -07:00
