The consent-first scan replaces the automatic project creation that main
fixed in #116; main's git checkout fix and sidebar classes are kept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
main's shell contrast test finds the sidebar Today button by its English
label here; the sidebar keeps main's token classes with this branch's
English sources.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
main's contrast test now waits for the sidebar trading status before
measuring; this branch removes that status.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
spaces.create linked any workspacePath to the new project, and
computer.files and computer.readFile then listed and read files under
that folder for anyone in the space. On a deployment with signups, any
member could link / or the API's own checkout and read whatever the API
process can read, such as its .env file. Linking also ran git in the
chosen folder and stored its remote URL.
A linked folder lives on the host, and the host is the deployment
owner's machine, the rule the onboarding scan already follows:
- spaces.create refuses a folder from anyone but the deployment owner,
before the space is created or the folder is touched.
- Project files are listed and read only for the deployment owner, so a
space a member linked before this change stays closed too. Space
navigation no longer shows a linked folder's path and git remote to
other members.
- A linked folder is stored as its real path, and listing and reading
follow symlinks only while they stay inside it. Symlinks that leave
the folder or lead nowhere are left out of a listing instead of
failing it.
- The web New project dialog offers the folder field only to the
deployment owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EyQw3AEaHYXegvgvTPAsi1
The scan's project phase called prisma.space with fields the Space model
does not have (title, path). Both calls threw, a per-repository
try/catch swallowed the errors, and no project was ever created. With
the field names fixed, the space would still have had no organization
or membership, so nobody could have seen it.
The phase now goes through createSpaceForMember and
wireProjectWorkspace, the helpers behind spaces.create: each repository
becomes a project of the deployment owner in their current
organization, linked to its folder with its git remote, branch and
head. It still runs only in the owner's scan with ONBOARDING_SCAN_HOME
set. A repository whose real folder one of the owner's projects already
links is skipped, so scanning again creates nothing; the phase stops at
the per-member space limit; and a second start while a scan runs (a
StrictMode remount, a retry) joins it instead of linking everything
twice. Discovery no longer descends into dot folders, where shell and
editor plugin checkouts would otherwise become projects. The Prisma
client is typed, so a field the schema lacks is a compile error again
instead of a swallowed one.
readGitCheckout loaded child_process with require(), which does not
exist in the ES module runtime the API runs in, so linking any folder
with a .git directory threw "require is not defined", in the scan and
in the New project dialog alike. It now imports spawn statically; the
module is only reachable through its server-only subpath, so browser
bundles still never load it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ebcq9seT9eCoHtqxuWEUzg
The main conversation's sidebar row now previews the latest reply, so the
unscoped text lookup matched the sidebar too and failed in strict mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
Secondary shell text was muted text dimmed further with opacity: the
section labels, the projects caption, the sidebar "+" icons, the privacy
panel, the trading subtitle and the Heute brief's Mission Control link.
Muted text measures 4.4:1 on the light sidebar, so these fell to 1.9 to
3.4:1 in the light theme; a few were below 4.5:1 in dark as well.
- Secondary sidebar text and icons share `rk-sidebar-muted`, the sidebar
foreground at 65% that row times already used (5.0:1 on the light
sidebar). Row times now use the class too.
- Section labels and space or project group titles use the dimmed
foreground in light and keep the 80% muted color in dark; group titles
move up from 60%, which was 3.4:1 in dark.
- The privacy panel heading is plain text with a success-colored check
instead of emerald text, and its details pass 4.5:1 in both themes.
- Needs-you chips keep the warning tint and border; their label uses the
foreground color in light.
- The Mission Control link uses the full muted color.
- E2E: the shell test checks every text in the sidebar except the logo,
and the Heute brief, in both themes, and captures
`shell-contrast-{light,dark}-heute`.
- AGENTS.md: agents make routine calls themselves, verify the result and
report it, and ask only before irreversible actions or for product
decisions without a sensible default.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SSVQGR4WU92LaddTP19GcQ
* ci: resolve attestation eligibility from repository API
The publish guard in #103 used github.repository_owner_type, which is not
part of the documented github context and evaluates empty on push. That
made the OR condition true and the attest step always ran.
Query repos/{owner}/{repo} for owner.type and private, skip attestation
only for User-owned private repositories, and gate the attest action on
the resolved step output.
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
* test: escape workflow placeholders for Biome noTemplateCurlyInString
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
AGENTS.md asks for top-level `import type` instead of inline `type`
specifiers; this applies it to the import statements the coach work added
or changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The onboarding cards, the closing line and the coach routine names were English server text
for every user. The server keeps the state and an English fallback; the web now words them
through Lingui, so there is one translation source.
- Choice cards: the web says the question, the option labels and the placeholder from the
step and option ids, and keeps the server text for anything it does not know (quiet-hour
ranges are already written in the user's locale). Another bot's focus card is recognized
by its option ids. Mobile and agent history keep the server text.
- The "Got it. … are a good place to start." line is gone: the app cards speak for
themselves, and with no cards nothing is said.
- The closing line becomes an intake_note block (note "done", nextCheckInAt, English text).
The web words it with the first check-in in the user's clock; mobile blockText and
blocksToAgentHistoryText read its text through their generic fallback.
- Routines carry coachKey. The routine list and editor show a check-in under its label in
the UI language until the user renames it; saving an untouched label keeps the stored
name. The English names move to contracts (COACH_ROUTINE_NAMES); prompts stay English.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The shell contrast test added on main looks up the sidebar button by the
old German source text, which this branch replaces with "Today".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The shell contrast test added on main measured the sidebar trading status,
which this branch removes; it now measures the rows that remain.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
Brings in profile editing, the cross-space inbox and consent-first discovery. The wizard
keeps both changes: no preferences step, and the new scan step without the main bot lookup.
The harness lists both new onboarding Postgres suites.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
- onboarding-intake.spec walks focus, goal (after typing into the composer, which still
works), check-ins, quiet hours and the notifications card when the browser offers it,
with the onboarding-intake-goal, -rhythm and -done screenshots.
- completeOnboarding and the wizard specs drop the preferences step; the scan step is
optional (skipped when it asks, otherwise it advances by itself).
- The user-profile spec now checks the browser-filled profile and the focus fact; the
conversation spec checks the shorter app suggestion and the following goal question.
- The hover spec measures a reply that fills its row (a bot row's rail sits at the row's
end, so the old long onboarding line was what made it pass) and scopes Send to the
composer, since an open goal card has its own.
- Mobile shows a choice card as its question and answer instead of an empty bubble.
- The focus options drop their unused summary.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
Heute only listed runs and linked to a hard-coded local Mission Control
address, so the coach's work had nowhere to show.
- Today's brief at the top, habits with a check-off and their streak,
and active goals, each only when there is something to show; then the
existing needs-you, doing and done lists.
- One icon button opens the check-in times (morning, evening, weekly),
loaded when opened and saved on every change.
- The page reads coach.today, refreshes it when a run finishes or the
tab becomes visible, and checks habits off optimistically; the date
header uses the user's time zone from the profile.
- Removes the Mission Control link and its constant.
- Tests: helper unit tests and a web E2E that writes the brief through
the main bot, checks a habit off across a reload and sets check-in
times (screenshots heute-coach and heute-rhythm).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The onboarding scan started on its own, discarded what it found, claimed
to read email and calendars, simulated progress for everyone who could
not scan, and its project creation always failed (wrong Space fields and
a space lookup by title across tenants).
Discovery now asks first and creates nothing without a choice:
- The scan step appears only for the deployment owner when
ONBOARDING_SCAN_HOME is set; everyone else skips it. The simulated
scan is gone.
- It shows the folder and asks. Only directory listings are read: git
projects up to four levels deep, their languages and a few tools
(Docker, GitHub Actions, Terraform). Symlinks are never followed and
each chosen folder is resolved again before use, so nothing outside
the folder is reached. Results stay with the account that scanned.
- Found projects are a checklist (none preselected); found languages and
tools are facts (preselected). "Add" creates one project space per
chosen project with createSpaceForMember and wireProjectWorkspace in
the user's own organization, reusing the user's own space already
linked to that folder, and saves the chosen facts as onboarding facts
under the profile lock and fact limit.
- When a connection becomes connected (direct connect, authorization
round trip, or catalog reconciliation), "Uses <App>" is remembered as
a tools fact from the connector. Revoking keeps it.
The E2E harness now points ONBOARDING_SCAN_HOME at a fixture folder and
starts without a deployment owner, so owner-only onboarding steps appear
only in specs that take the seat through /__e2e/deployment-owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
readGitCheckout loaded node:child_process through require(), which does
not exist in the ESM API runtime. Linking a project space to a folder
that is a git checkout therefore failed after the space was created.
The lazy load is no longer needed: the reader is only reachable through
the server-only "@rakazo/core/git-checkout" subpath, never through the
package entry the web app bundles. Import spawn at the top instead.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The payload, target and outcome types are shared by the Expo and web push senders, so they now
live with PushSender in push-notifications.ts instead of in the web push adapter. The settings
E2E also stubs the Notification permission (headless Chromium reports it as denied even when
granted), and the quiet-hours inputs are wide enough for 12-hour times.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
Small buttons in ui-web merge their text-ui-label size over the default
variant's text color, so the small Save button rendered ink on ink. The
editor now uses default-size controls, with the category select at the same
height.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
Users had no way to turn on push for a browser, set quiet hours or opt out of nudges.
Settings gains a compact Notifications section: a switch for push on this device (only where
web push works: a secure context outside the desktop app), quiet hours with from/to times
(22:00-07:00 when first turned on) and a switch for nudges. Changes save in order as they are
made. A browser that blocked notifications says so instead of offering a dead switch. Logging
out unregisters the browser first, so a shared computer stops receiving the account's pushes.
The E2E stubs the Push API (headless Chromium has no push service), walks all three controls,
checks they survive a reload and captures the notification-settings screenshot.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The quiet-hours CHECK accepted a row with only one bound set, because a NULL comparison made
the whole condition NULL; it now requires both bounds explicitly. The migration has not shipped
yet, so it is corrected in place.
- Unit: quiet-hours math across midnight, time zones and daylight saving; VAPID key handling
(configured, generated once and shared, invalid); the web push sender (encrypted VAPID-signed
request, gone on 404/410, no private or non-https endpoints); the fan-out with fake senders.
- PostgreSQL: settings and subscription repositories (constraints, per-user removal, endpoint
hand-over, device cap, concurrent nudge cap, cascade on account deletion), delivery and
notify_user against a real main conversation, and every notification RPC through the API
including cross-user isolation and endpoint validation.
- .env.example documents the optional VAPID keys and VAPID_SUBJECT.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
With the coach and notification modules merged, the onboarding answers now take effect:
- the goal card creates a goal (source onboarding) through createGoal;
- the rhythm card sets the main bot's check-in routines through setCoachRhythm, and the
closing line names the first check-in from the routines that were saved;
- the quiet-hours card updates the notification settings;
- the choice card tells the server whether this browser can still turn push on, so the
notifications card is offered only there, and "Turn on" subscribes before answering.
The thread lock becomes NO KEY UPDATE so a rhythm routine, which references the thread, can
be written while the answer holds the lock. The goal answer is capped at the coach title
length. A Postgres suite walks the questions end to end: answers, skips, a dismissed card, a
stale and a doubled answer, another bot's focus card, and another user's access.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The composer, the shell frame and sidebar, the right side panel and the
create-bot modal were hard-coded dark while the text on them follows the
theme, so in the light theme the typed draft, the sidebar rows and the
side panel forms rendered dark on dark.
- Composer: the island uses the card and foreground tokens; attach, stop
and chips use border and foreground tokens, and send is the default
primary button. The focus and shadow utilities on the bar are removed:
.apple-island always overrode them, so they never rendered.
- Shell frame and page background use the background token. The frame's
radial gradient never rendered under Tailwind v4 and is dropped.
- Sidebar: the panel uses the sidebar tokens on desktop too. The main
conversation, roster, project and Heute rows share one token-based
row style; muted text measures 4.4:1 on the light sidebar, so row
times use a dimmed foreground instead.
- Side panel and create-bot modal use background, popover and overlay
tokens. Settings helper texts and inactive tabs use the full muted
color, which stays above 4.5:1 in light.
- Stage vignette, stage pill, ensemble and hero orb, and the transcript
paths behind the call overlay use tokens.
- E2E: chat-contrast.spec.ts gains a shell test that measures the
composer draft, sidebar rows, the new bot form and the bot settings
form in both themes and captures screenshots.
Claude-Session: https://claude.ai/code/session_01SSVQGR4WU92LaddTP19GcQ
Co-authored-by: Claude <noreply@anthropic.com>
The web app needs to show and change the user's coach data, and the
check-in times need a way to change after onboarding.
- coach.today, coach.goals.*, coach.habits.*, coach.checkIns.* and
coach.rhythm.get/set, owner-only and not space-scoped; another user's
ids read as not found, invalid input as a bad request.
- coach-rhythm reuses the shared clock-time helpers.
- Tests: an API suite covering ownership and validation for every
procedure, the coach tools driven through the main bot (and refused
for a specialist), and a morning check-in routine that fires in the
main conversation and writes today's brief; the unauthenticated
authorization sweep lists the new procedures.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The inbox in the main conversation only showed asks, approvals, takeovers and
unread threads of the current space. The main conversation lives in the home
space, so anything a bot needed in a project space never reached it.
- inbox.list now covers every space the user belongs to (except spaces being
deleted), still only the user's own bots, runs and threads. Items from
another space carry that space's id and name.
- The web inbox shows the space name next to the bot for those items, answers
them with that space's header so the existing thread procedures check
membership and ownership for that space, and opens their thread in it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
About you could only confirm or delete what the bots know about the user, so a
fact that was slightly wrong or filed under the wrong category had to be
deleted and taught again, and a fact could not be limited to some spaces from
the app even though the profile supports it.
- Each fact gets an Edit button that turns its row into an inline editor:
wording, category, and (when the user has more than one space, or the fact
is already limited) which spaces it shows in. Escape or Cancel leaves it
unchanged; only changed fields are sent through profile.update editFacts.
- A limited fact names its spaces next to its source.
- The repository validates edits like new facts: a wording whose normalized
form is empty or equals another fact of the user is refused, all edits of
one update apply atomically, and the stored embedding is only dropped when
the wording really changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The prompt budget was a separate 32 KB constant; it is now twice the
per-document limit, so a full bot document and a full space document keep
fitting if either number changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The committed catalogs were last extracted weeks ago: about 330 source
messages were missing from every locale, and production builds keep only
message ids, so those strings rendered as hash ids (sidebar sections,
privacy settings, profile, timeline, ...). German also had 226 empty
entries, and every extraction rewrote the files because references carried
line numbers.
- lingui.config.ts: po references without line numbers, and a stable sort
that breaks Lingui's ordering ties (explicit ids, equal text) by id, so
the output no longer depends on file-system order.
- Re-extract all catalogs with --clean (drops 25-44 obsolete entries per
locale; no existing translation changed).
- Translate every German entry (du form, consistent with the existing
catalog). Other locales keep empty entries and fall back to English.
- i18n-catalog-sync.test.ts extracts into a copy of the catalogs and fails
when the committed files differ or a German entry is empty, so stale
catalogs fail the unit test job (offline, about 5 s).
Adds @lingui/format-po (already installed through @lingui/cli) as a direct
dev dependency to configure the formatter.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
Several web surfaces hard-coded German (the project card, roster and
activity status labels, the sidebar "Heute" label) or used German text as
the Lingui source message (sidebar sections, project timeline, bot picker,
voice entry, group stage, copy and read-aloud buttons). English users saw
German, and because production builds keep only message ids, none of these
strings could be translated per locale.
Convert them to English source messages, keeping the meaning:
- ProjectCreatedCard: Lingui Trans/Plural instead of literals.
- agent-activity: labels go through i18n._ with literal ids so the module
stays importable from plain unit tests; the extractor still collects them.
- Shell, ProjectSessionTimeline, bot-picker, StageVoiceEntry, OoStage:
English sources, reusing existing messages where one already fit
("just now", "{n}m ago", "Search", "No bots match", "Set up voice",
"Group conversation", "Transcript").
- The conversation picker matches its create entry against the translated
label instead of a fixed German string.
The German wording returns through the de catalog in the next commit.
Unit and E2E tests now assert the English labels.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
Picks up the shared clock-time schema and the notification interfaces so
later merges of the coach work stay conflict-free.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The main agent had no way to record what the user wants to achieve or how
their day went, and its prompt never showed their goals or habits.
- update_goal, update_habit, log_check_in and write_daily_brief, main-bot
only and, like update_user_profile, withheld from shared channels and
from runs that answer another owner's agent. Goals and habits can be
named by id or exact title.
- The main bot's own runs list active goals and habits (with ids, done
state and streak) in the <user> block; the basics-only block and every
other bot never see them. The main agent role adds a short coaching
stance and names each coach tool only when the run has it, so the
check-in routine prompts stay tool-agnostic.
- The scripted runtime understands a few coach commands and the morning
check-in, so tests can drive the tools end to end.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
Run notifications reached at most one phone and nothing could hold them back at night.
- PushNotificationProvider sends each notification to all of the user's registered devices
(web push and Expo), skips everything during quiet hours in the profile time zone, drops
devices the push service reports gone (404/410, DeviceNotRegistered), records lastUsedAt and
links each push to its conversation.
- Expo tokens move from DATA_DIR/push-tokens files into push_subscriptions: the API imports and
deletes the legacy files at start; notifications.registerPush/unregisterPush keep their
contract for the mobile app (tokens must look like Expo tokens).
- NotificationMessage gains the nudge kind, and the main bot gets notify_user: a short push to
the main conversation that respects the nudge switch, quiet hours and a cap of three per day.
It is withheld from shared messaging channels and from runs answering another owner's agent.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
Brings in the coach and notification interfaces the onboarding goal, rhythm, quiet-hours
and notification steps write to.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
The wizard asked for the account name again and a "Tell us about yourself" form, and the
focus answer in the main conversation was never saved. The main bot now gets to know the
user in the main conversation instead, one card after each answer.
- UserOnboarding keeps the pending step, the focus and when onboarding finished.
- onboarding-intake.ts declares the steps (focus, goal, rhythm, quiet hours, notifications)
as cards plus what their answers change; onboarding.ts commits an answer, the focus app
suggestions and the next card or the closing line in one transaction.
- The choice block gains a step, an optional text input and the typed answer; choose takes
the step, the text and whether the device can still turn push on.
- The focus answer becomes a goals fact; the goal, rhythm and quiet-hours effects and the
push seam are placeholders until the coach and notification modules are merged.
- The wizard drops the preferences step and fills time zone, locale and language from the
browser; the main bot's prompt notes open onboarding cards; agent history shows a card's
question and answer.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MRtGG9ARfqqhma3t85Ro2u
