Commit graph

285 commits

Author SHA1 Message Date
Brad Groux
0c0f5b344d security+quality: final codebase review fixes
Security (critical):
- Remove shell:true from preview-service spawn (command injection fix)
- Replace exec() with execFile() in github-service (no shell interpolation)
- Add SIGKILL fallback after SIGTERM timeout in worktree-service

Stability:
- Add process cleanup handlers (SIGTERM/SIGINT) for preview servers
- Add MAX_PREVIEW_SERVERS=5 limit to prevent resource exhaustion
- Memoize WebSocket context value to prevent unnecessary re-renders

Code quality:
- Remove hardcoded 'Brad' author → 'User' (3 files)
- Replace hardcoded localhost:3001 URLs with API_BASE (AttachmentsSection)
- Fix SECURITY-AUDIT.md date (2025 → 2026)
- Add license/repository/author to all 6 package.json files

Data hygiene:
- Untrack all runtime data files (.veritas-kanban/*.json, telemetry, activity)
- Simplify .gitignore: .veritas-kanban/* except .gitkeep
- Removed ~15,700 lines of runtime data from git history
2026-01-29 06:13:10 -06:00
Brad Groux
3edffec98c chore: bump version to 1.0.0, add CHANGELOG
- Bump all 6 package.json files from 0.1.0 to 1.0.0
- Add CHANGELOG.md with full feature summary
- Git history scrubbed of security.json (JWT secret)
2026-01-29 01:42:04 -06:00
Brad Groux
5d3f75bda6 perf: add pagination and summary mode to reduce API payload 2026-01-28 17:38:04 -06:00
Brad Groux
6793b23310 perf: reduce polling when WebSocket connected 2026-01-28 12:13:48 -06:00
Brad Groux
71200bca36 feat(US-1010): Add daily digest feature
- Add digest service for 24h activity aggregation
- Add GET /api/digest/daily endpoint (JSON and Teams format)
- Add GET /api/digest/daily/preview for testing
- Add scripts/daily-digest.sh for cron scheduling
- Skip empty digests when no activity

Content includes:
- Tasks completed/created/in-progress counts
- Agent runs with success rate by agent
- Token usage by agent
- Top accomplishments (recently done tasks)
- Failed runs and blocked items
2026-01-28 08:08:06 -06:00
Brad Groux
a424d0a7c5 refactor(RF-15): split Board and Settings god components
- Extract useBoardDragDrop hook from KanbanBoard (drag-drop logic)
- Extract BoardLoadingSkeleton component from KanbanBoard
- Extract useSortableList hook from ManagedListManager
- Extract SortableListItem component from ManagedListManager

Line count improvements:
- KanbanBoard.tsx: 329 → 210 lines (-36%)
- ManagedListManager.tsx: 372 → 128 lines (-66%)

All extracted components follow single-responsibility principle.
2026-01-28 07:59:17 -06:00
Brad Groux
22509f1808 feat(web): add Task Metrics Panel (US-1002)
- Created useTaskMetrics hook to fetch and aggregate telemetry events for a task
- Built TaskMetricsPanel component with:
  - Summary cards for total runs, success rate, duration, tokens, cost
  - Last run status display
  - Expandable per-attempt breakdown with full details
- Integrated as new 'Metrics' tab in TaskDetailPanel
- Fetches via GET /api/telemetry/events/task/:taskId endpoint
2026-01-28 07:55:48 -06:00
Brad Groux
38ec9a99ce feat(telemetry): Add POST /api/telemetry/events endpoint (US-1401)
- Add POST endpoint for ingesting run telemetry events
  - Accepts: run.started, run.completed, run.error, run.tokens
  - Zod validation with discriminated union schema
  - Stores events in date-partitioned NDJSON files
  - Returns 201 with generated id and timestamp

- Add WebSocket broadcast for telemetry events
  - New broadcastTelemetryEvent() in broadcast-service
  - Emits 'telemetry:event' messages to connected clients

- Update shared telemetry types for flexibility
  - RunStartedEvent, RunCompletedEvent, RunErrorEvent types
  - TokenTelemetryEvent with optional cacheTokens and cost fields
  - Change agent field from AgentType to string for external sources

- Update metrics-service to handle optional totalTokens
  - Calculate totalTokens from input+output when not provided
2026-01-28 07:40:35 -06:00
Brad Groux
cb87b2df52 feat(sprint-1500): status refactor review→blocked + blocked reason tracking
- Rename TaskStatus.review to TaskStatus.blocked across codebase
- Add migration service (auto-converts on startup, idempotent)
- Add blocked reason tracking (category + notes)
- Add blocked badges on Kanban cards
- Add dashboard breakdown by blocked category
- Add 30d metrics period, per-agent breakdown, streaming NDJSON
- Add 8 migration tests, all 112 tests passing
- Fix attachment test regex to allow hyphens in IDs

US-1501, US-1502, US-1503, US-1504, US-1505, US-1506, US-1507, US-1403
2026-01-28 07:30:05 -06:00
Brad Groux
3c2eb55ca8 US-1501: Rename TaskStatus review → blocked in shared types
- Updated TaskStatus union from 'review' to 'blocked' in shared/src/types/task.types.ts
- Updated Zod enum in server/src/routes/tasks.ts
- ReviewComment and ReviewState interfaces unchanged (still valid for code review)
2026-01-28 06:47:57 -06:00
Brad Groux
75cee87a3d fix: browser compatibility for shared api-client
- Add typeof check for process.env to avoid ReferenceError in browser
- process.env only exists in Node.js, not browser environments
- Fixes white screen issue when loading web frontend
2026-01-28 06:22:29 -06:00
Brad Groux
39eccf3556 feat: Sprint US-1200 Refactoring batch — 13 tasks complete
Completed refactors:
- RF-02: Fix dependency vulnerabilities (xlsx → exceljs, Hono updates)
- RF-05: Add React error boundaries (FeatureErrorBoundary wrapper)
- RF-06: Server error handling middleware (AppError classes, asyncHandler)
- RF-10: Split shared types.ts into domain modules (6 files)
- RF-11: Consolidate frontend API layer (hooks now use api.ts)
- RF-13: TaskConfigContext — eliminate prop drilling
- RF-14: Split god components (GitSection, TaskDetailPanel, CreateTaskDialog, DiffViewer)
- RF-16: Frontend accessibility (ARIA labels, sr-only text)
- RF-17: Modularize CLI (899 → commands/ structure)
- RF-18: Modularize MCP (843 → tools/ structure)
- RF-19: Create shared API client library
- RF-21: Server performance (batch loading, memory limits, timeouts, graceful shutdown)
- RF-23: Extract shared utilities (path, format, constants)

Stats: ~59 files changed, significant code reduction through modularization
2026-01-28 06:08:59 -06:00
Brad Groux
f0c72717d3 feat(US-1101, US-1102): settings infrastructure + feature toggle hooks
- Added FeatureSettings types (Board, Tasks, Agents, Telemetry, Notifications, Archive)
- AppConfig.features field with backward-compatible defaults
- ConfigService auto-merges defaults for missing keys on load
- Deep merge utility for partial config updates
- GET/PATCH /api/settings/features endpoints
- useFeatureSettings, useFeatureSetting, useUpdateFeatureSettings hooks
- Debounced update helper for rapid toggle changes
- Optimistic updates with rollback on error
2026-01-28 02:16:23 -06:00
Brad Groux
ce5eda58b1 feat: add drag-and-drop task reordering within columns
- Add position field to Task type (shared/types.ts)
- Add POST /api/tasks/reorder endpoint to persist ordering
- Update task-service with reorderTasks() method
- Switch TaskCard from useDraggable to useSortable (@dnd-kit/sortable)
- Wrap KanbanColumn tasks in SortableContext with verticalListSortingStrategy
- Update KanbanBoard DnD handlers to support both within-column reorder
  and cross-column status changes
- Sort tasks by position in useTasksByStatus hook
- Use closestCorners collision detection for better sortable support

Fixes: task_20260128_4qCzGr
2026-01-28 01:08:21 -06:00
Brad Groux
2b5d07c1f1 Convert hardcoded sprints to managed list
- Added SprintConfig interface extending ManagedListItem in shared types
- Created SprintService with seed migration from existing tasks
- Added /api/sprints endpoints using managed list router pattern
- Implemented useSprints and useSprintsManager hooks
- Updated TaskDetailPanel and CreateTaskDialog to use dynamic sprint list
- Added sprint management UI to SettingsDialog
- Sprint IDs match existing task.sprint values for backward compatibility
- Reference counter prevents deletion of sprints with tasks
2026-01-28 00:29:16 -06:00
Brad Groux
331fd966a8 refactor: remove tags feature entirely, fix TS errors and path traversal sanitization
- Removed tag-service, TagPicker, useTags hook, tags routes, tags.json
- Stripped tag references from TaskCard, TaskDetailPanel, CreateTaskDialog,
  ApplyTemplateDialog, SettingsDialog, ArchiveSidebar, KanbanBoard/Column
- Removed tags from shared Task type and template types
- Fixed ManagedListManager prop types (Promise<void> → Promise<any>)
- Fixed unused imports in FilterBar, CreateTaskDialog, TaskDetailPanel
- Fixed unused generic param in UseManagedListOptions
- Fixed path traversal in attachment filename sanitization (collapse ..)
- All tests passing (62/62), full build clean
2026-01-27 23:33:15 -06:00
Brad Groux
fc087bba50 feat: US-914 Project management with dropdown selection 2026-01-27 22:16:41 -06:00
Brad Groux
157630cb8b feat: US-915 ManagedListService + US-913 Custom task types
PHASE 1: US-915 ManagedListService Foundation
- Added ManagedListItem and ManagedListServiceOptions types to shared/src/types.ts
- Created ManagedListService<T> base class with full CRUD, reorder, and reference checking
- Created createManagedListRouter factory for generic Express routes
- Created useManagedList hook for React with TanStack Query integration
- Added managedList API helpers to web/src/lib/api.ts
- Created ManagedListManager React component with drag-to-reorder using @dnd-kit

PHASE 2: US-913 Custom Task Types
- Changed TaskType from union to string in shared types
- Added TaskTypeConfig interface extending ManagedListItem with icon and color
- Created TaskTypeService using ManagedListService with 4 built-in default types
- Registered task-types routes at /api/task-types
- Updated server validation in tasks.ts and templates.ts to accept dynamic types
- Created useTaskTypes hook with helper functions (getTypeIcon, getTypeLabel, etc.)
- Updated FilterBar to use dynamic task types
- Updated TaskCard to accept and use dynamic task types
- Updated KanbanBoard and KanbanColumn to fetch and pass task types
- Updated TaskDetailPanel to use dynamic task types
- Updated CreateTaskDialog to use dynamic task types
- Updated SettingsDialog template form to use dynamic task types
- Added Task Types management section to Settings with full CRUD and customization
- Added taskTypes API namespace to web/src/lib/api.ts

All UI components now render task types dynamically from .veritas-kanban/task-types.json
Icon and color customization available in Settings with 20+ Lucide icons and 10 colors
2026-01-27 22:09:21 -06:00
Brad Groux
76f71d2e0d feat(US-912): Implement task attachments with text extraction pipeline
Backend:
- Add Attachment types, limits config, and MIME type allowlist to shared types
- Create AttachmentService for file storage, upload/delete, archive lifecycle
- Create TextExtractionService supporting PDF, DOCX, XLSX, HTML, JSON, plain text
- Add attachment routes with multer upload middleware
- Add /api/tasks/:id/context endpoint for agent consumption
- Update task-service to handle attachments in frontmatter and lifecycle
- Install dependencies: multer, unpdf, mammoth, xlsx, mime-types

Frontend:
- Build AttachmentsSection component with drag-drop upload zone
- Add inline image thumbnails and expandable text previews
- Implement token cost warning banner (amber alert when ≥2 attachments)
- Add Attachments tab to TaskDetailPanel
- Add paperclip badge with count to TaskCard
- Create React hooks: useUploadAttachment, useDeleteAttachment, useTaskContext

Tests:
- Comprehensive test suites for attachment-service and text-extraction-service
- Cover upload, delete, archive, extraction for all file types

All 13 subtasks completed. Project compiles cleanly.
2026-01-27 21:49:00 -06:00
Brad Groux
f1c01eae72 feat(US-911): add task comments system for agent activity logs 2026-01-27 21:05:16 -06:00
Brad Groux
f99c3efde8 feat(US-905): Multi-task blueprints
- Blueprint templates create multiple linked tasks with dependencies
- CreateTaskDialog shows blueprint preview with task list
- Dependencies resolved via refId mapping (blockedByRefs -> actual task IDs)
- All blueprint tasks created sequentially, dependencies auto-wired
- Added blockedBy support to CreateTaskInput
- Blueprint UI shows task count, dependencies, and subtask count
2026-01-27 20:29:14 -06:00
Brad Groux
a452b6a279 feat(US-902): Subtask templates
- Add subtasks field to CreateTaskInput
- Task service creates subtasks from template when task is created
- CreateTaskDialog displays subtasks from template
- Users can remove individual subtasks before creating
- Subtasks sorted by order field and auto-generated with IDs
2026-01-27 20:22:58 -06:00
Brad Groux
8a731e27d8 feat(US-901): Enhanced template schema
- Extend TaskTemplate with version, category, tags, agent, subtaskTemplates, and blueprint fields
- Add SubtaskTemplate and BlueprintTask interfaces
- Implement v0 to v1 migration in template service (backward compatible)
- Export template types from shared package
- Server validates enhanced schema on create/update
2026-01-27 20:21:16 -06:00
Brad Groux
ed014fe1ed feat(telemetry): add TelemetryService for event logging (US-801)
- Add TelemetryService with NDJSON file storage
- Date-partitioned event files (events-YYYY-MM-DD.ndjson)
- Configurable retention with automatic cleanup
- Query API with filters (type, since, until, taskId, project, limit)
- REST endpoints: GET /api/telemetry/events, /status, /count

New types:
- TelemetryEvent (base), TaskTelemetryEvent, RunTelemetryEvent, TokenTelemetryEvent
- TelemetryConfig, TelemetryQueryOptions

Includes 18 passing tests covering emit, query, filtering, and configuration.
2026-01-26 12:02:02 -06:00
Brad Groux
858460f0cb US-710: Add time tracking with start/stop timer and manual entries
- TimeEntry and TimeTracking types
- TaskService: startTimer, stopTimer, addTimeEntry, deleteTimeEntry, getTimeSummary
- API endpoints for time operations
- TimeTrackingSection component with:
  - Start/stop timer with live elapsed display
  - Manual entry dialog (1h 30m format)
  - Entries list with delete
- Time indicator on TaskCard with animated icon when running
- formatDuration/parseDuration utilities
2026-01-26 06:26:44 -06:00
Brad Groux
a9ee3d16da US-708: Add preview mode with embedded dev server
- DevServerConfig type for repo settings (command, port, readyPattern)
- PreviewService to manage dev server processes per task
- Auto-detect port and ready state from server output
- API endpoints for preview start/stop/status/output
- PreviewPanel slide-out with iframe, terminal output toggle
- Preview button in TaskDetailPanel for code tasks
2026-01-26 06:13:40 -06:00
Brad Groux
4eb6fa01c4 US-707: Add GitHub PR creation from task detail UI
- GitHubService using gh CLI for PR operations
- Added prUrl/prNumber to TaskGit type
- API endpoints for status check and PR creation
- Create PR dialog with title, description, draft option
- View PR button when PR exists
- Auto-opens new PR in browser
2026-01-26 06:09:20 -06:00
Brad Groux
dfff667490 feat(US-704): Task dependencies with blocking
- Added blockedBy field to Task type
- Added blocking status API endpoint
- Added server-side validation for blocked tasks
- Created DependenciesSection component
- Added blocked indicator badge on task cards
- Tooltip shows blocker names on hover
- Cannot move blocked task to In Progress
2026-01-26 05:52:12 -06:00
Brad Groux
d952e1aa5c feat(US-703): Subtasks with progress tracking
- Added Subtask type to shared types
- Added subtask routes: add, update, delete
- Added subtask hooks: useAddSubtask, useUpdateSubtask, useDeleteSubtask
- Created SubtasksSection component with:
  - Progress bar (X/Y complete)
  - Checkbox completion
  - Inline add/delete
  - Auto-complete parent option
- Added Checkbox and Switch UI components
2026-01-26 05:49:28 -06:00
Brad Groux
59fcafbc19 fix: add automation field to UpdateTaskInput type
Fixes TypeScript build error where automation field was used in
automation.ts but not defined in UpdateTaskInput interface.
2026-01-26 04:39:04 -06:00
Brad Groux
6112517ee7 feat(US-503): Veritas sub-agent integration
- Added 'veritas' agent type for automation tasks
- New automation field on tasks (sessionKey, spawnedAt, completedAt, result)
- New API endpoints:
  - POST /api/automation/:id/start - start automation task
  - POST /api/automation/:id/complete - complete automation task
  - GET /api/automation/pending - list pending automation tasks
  - GET /api/automation/running - list running automation tasks
- CLI commands: automation:pending, automation:start, automation:complete, automation:running
- MCP tools: list_pending_automation, list_running_automation, start_automation, complete_automation
2026-01-26 04:26:28 -06:00
Brad Groux
44ff0d7fe9 feat(US-403): approval workflow with review decisions
- ReviewState type with decision, timestamp, summary
- ReviewPanel component with approve/changes/reject buttons
- Summary input for changes-requested and rejected
- Current review status display with clear option
- Review tab in task detail panel
- Comment count display in review panel
2026-01-26 03:34:45 -06:00
Brad Groux
a210a2d287 feat(US-402): line-level review comments
- Add review comments to task schema
- Inline comment input on diff lines
- Comment display with amber highlighting
- Comment counts in file tree and headers
- Remove comment with X button
- Auto-save comments with debounced update
2026-01-26 03:33:05 -06:00
Brad Groux
6b7a2f56ca feat(US-301-307): agent orchestration
US-301: Agent configuration
- Settings UI for enabling/disabling agents
- Default agent selection
- Shows command and args for each agent

US-302: Start agent on task
- AgentService for process management
- POST /api/agents/:taskId/start
- Spawns agent in worktree directory
- Creates attempt record in task

US-303: Real-time agent output streaming
- WebSocket subscription for agent output
- useAgentStream hook with reconnection
- Terminal-style output panel with colors
- Auto-scroll with manual override

US-304: Agent conversation log persistence
- Logs saved to .veritas-kanban/logs/
- Markdown format with task metadata
- Full stdin/stdout/stderr capture

US-305: Send follow-up message to agent
- stdin input to running process
- Message input field in UI
- Displays with 'You:' prefix

US-306: Stop agent
- POST /api/agents/:taskId/stop
- SIGTERM then SIGKILL after timeout
- Confirmation dialog
- Marks attempt as failed

US-307: Agent completion handling
- Detects process exit
- Updates attempt status (complete/failed)
- Updates task status to 'review'
- WebSocket notification
2026-01-26 03:12:26 -06:00
Brad Groux
a489c5358f feat: initial project scaffolding
- Dev container with Node.js 22
- pnpm workspace monorepo structure
- Express + WebSocket server
- React + Vite + shadcn/ui frontend
- Shared TypeScript types package
- Kanban board with drag-and-drop
- Task CRUD with file-based persistence
- Dark mode styling

Sprint 1 - US-101: Project scaffolding with dev container
2026-01-26 02:34:54 -06:00