scriptoriumadmin/veritas-kanban
1
0
Fork 0
mirror of https://github.com/BradGroux/veritas-kanban.git synced 2026-10-07 12:17:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
503 commits 244 branches 57 tags 157 MiB
Commit graph

32 commits

Author SHA1 Message Date
Brad Groux
5163e8debe chore: bump version to v3.2.0 + update CHANGELOG 2026-02-11 10:31:41 -06:00
Brad Groux
711ad608b5 chore: bump version to v3.1.0 2026-02-10 08:12:45 -06:00
Brad Groux
7f5745195c chore: bump version to v3.0.0 
Workflow engine release — 8 issues (#107-#114), 4 phases, ~19,000 lines.
Full CHANGELOG entry in CHANGELOG.md.
 2026-02-09 19:48:25 -06:00
Brad Groux
a0941809f2 feat(workflows): Phase 1 - Core workflow engine implementation 
- Add TypeScript types for workflow definitions and runs
- Implement WorkflowService (YAML load/save/validate, ACL, audit)
- Implement WorkflowStepExecutor (agent steps, template rendering, validation)
- Implement WorkflowRunService (sequential execution, retry routing, state persistence)
- Add workflow API routes (CRUD workflows + runs)
- Create example workflow (feature-dev-simple.yml)
- Add dependencies: yaml, ajv, sanitize-filename

Phase 1 deliverables complete per architecture spec.
OpenClaw integration (Phase 2), RBAC (Phase 3), and loop/gate steps (Phase 4) planned.

Refs: #107
 2026-02-09 16:34:22 -06:00
Brad Groux
e4ef471941 fix: status counter accuracy + bulk operation performance (#104, #105) 
- New GET /api/tasks/counts endpoint for sidebar totals (independent of board filters)
- New useTaskCounts() hook + BoardSidebar rewired
- New bulk endpoints: POST /api/tasks/bulk-update, bulk-archive-by-ids, /api/backlog/bulk-demote
- BulkActionsBar uses single API calls instead of N sequential requests
- Array size validation (max 100) on all bulk endpoints
- Parallel execution via Promise.allSettled() (~26x faster)
- Updated squad chat model field documentation (#106)
- Version bump to 2.1.4

Closes #104, #105
10/10/10/10 reviewed by TARS (gh-sonnet)
 2026-02-09 15:03:59 -06:00
Brad Groux
44b63455ea fix(docker): standardize path resolution across all services (#102) 
Created shared paths.ts utility as single source of truth for all path
resolution. Refactored 7 services to use it:

- server/src/utils/paths.ts: New shared utility with JSDoc docs
- task-service: Uses getTasksActiveDir()/getTasksArchiveDir()
- activity-service: Uses getDataDir()
- chat-service: Uses getChatsDir()
- audit-service: Uses getAuditDir()
- metrics/helpers: Uses getProjectRoot()/getTelemetryDir()
- backlog-repository: Uses getTasksBacklogDir()

Resolution priority: DATA_DIR/VERITAS_DATA_DIR env var > auto-discovery
of monorepo root (walks up looking for pnpm-workspace.yaml) > cwd fallback.
Filesystem root guard prevents silent '/' resolution (the original EACCES bug).

Backwards compatible: existing DATA_DIR configurations unchanged.
Cross-model reviewed: 10/10/10/10 (GPT-5.1 authored, Claude Sonnet 4.5 reviewed).

Closes #102

[author: gpt-5.1]
[reviewed-by: claude-sonnet-4.5]
Version: 2.1.3
 2026-02-07 22:02:05 -06:00
Brad Groux
d9b946b215 chore: bump version to 2.1.2 — Docker path resolution fix 
- Version bumped in all package.json files (root, server, web, shared)
- CHANGELOG: v2.1.2 entry documenting WORKDIR fix and root cause
- README: version badge updated to 2.1.2
- DEPLOYMENT.md: path resolution note added
- TROUBLESHOOTING.md: EACCES fix guide added
- docker-compose.yml: WORKDIR comment added

Reviewed: 10/10/10/10
Related: #102
 2026-02-07 16:57:37 -06:00
Brad Groux
e79b7c3f5b v2.1.0: Documentation, security hardening, performance optimizations 
Documentation:
- Updated README with all new features (squad chat, broadcasts, deliverables, polling, delegation, OpenClaw integration)
- Added Pre-Commit Review Protocol to CONTRIBUTING.md (mandatory 4 checks: code, functionality, performance, security)
- Added One Agent Per File development rule
- Created 5 comprehensive feature docs (docs/features/)
- Consolidated and cleaned up 8 scattered implementation docs
- Updated lessons learned with 6 additional insights from today

Security:
- Stripped gateway token from all API responses (write-only field)
- Added file locking to notification-service and config-service

Performance:
- Removed double cache invalidation in squad chat
- Added React.memo to message bubble components

Version bump: 2.0.0 → 2.1.0

All reviews passed 10/10 (code, functionality, performance, security)
Contributors: TARS, CASE, Ava, K-2SO, R2-D2, VERITAS
 2026-02-07 11:51:24 -06:00
Brad Groux
69cf3c334c chore: v2.0.0 release prep 
Version:
- Bump all packages to 2.0.0 (root, server, web, shared, mcp)

Security:
- Patch MCP SDK from ^1.25.3 to ^1.26.0 (GHSA-345p-7cg4-v4c7)
- Add rate limiting warning to README security section

Documentation:
- CHANGELOG: comprehensive v2.0.0 entry (18 features, fixes, credits)
- README: updated roadmap with v2.0 shipped features
- README: added v2.0 feature highlights (multi-agent, dashboard, lifecycle)
- README: version badge updated to 2.0.0
- AGENT-REGISTRY.md: VERITAS naming consistency (all caps)

Maintenance:
- Cleaned 21 stale feature branches (down to main only)
- Dashboard widget toggles scaffolding (#92)
- Pre-commit secret scan: clean
 2026-02-05 20:45:36 -06:00
Brad Groux
931d437b67 chore: Release v1.6.0 
## Highlights
- Activity Page Redesign — Full-width status history, clickable navigation, color-coded badges
- Task Templates UI (#39) — Full management interface for templates
- Analytics API (#43) — Timeline and aggregate metrics endpoints
- Status Transition Hooks — Quality gates for task status changes
- 7 GitHub Issues Closed (#47, #48, #49, #51, #53, #56, #82)

## Changes
- Bump all packages to 1.6.0
- Update CHANGELOG.md with comprehensive release notes
- Update README.md version badge and roadmap
- Update FEATURES.md with new sections:
  - Task Templates (v1.6.0)
  - Analytics API (v1.6.0)
  - Dashboard Filter Bar (v1.6.0)
  - Redesigned Activity Feed section
- Activity page: purple for sub-agent, amber for in-progress, blue for done
- Status badges: uniform width, color-coded by status type
 2026-02-04 22:11:13 -06:00
Brad Groux
9291ba1cb3 fix: Update version to 1.5.0 in all package.json files 
- Root package.json: 1.4.1 → 1.5.0
- server/package.json: 1.4.1 → 1.5.0
- web/package.json: 1.4.1 → 1.5.0
- shared/package.json: 1.4.1 → 1.5.0

Health endpoint now reflects correct version.
 2026-02-04 08:40:24 -06:00
Brad Groux
a87c28decf docs: align versioning to v1.4.1 (packages, README, changelog) 2026-02-03 01:51:21 -06:00
Brad Groux
9369ca8bcf docs: update all documentation for v1.2.0 + v1.3.0 
- Bump all package versions to 1.3.0
- README: version badge, blocked column, new feature highlights
- CHANGELOG: full v1.2.0 and v1.3.0 entries
- FEATURES.md: GitHub sync, activity feed, standup summary sections
- FEATURES.md: storage architecture, API envelope docs, new CLI commands
- FEATURES.md: updated API endpoints table and response format docs
 2026-01-31 23:33:37 -06:00
Brad Groux
d8dab5a612 chore: bump version to v1.1.0 + changelog 2026-01-31 07:09:18 -06:00
Brad Groux
0c0f5b344d security+quality: final codebase review fixes 
Security (critical):
- Remove shell:true from preview-service spawn (command injection fix)
- Replace exec() with execFile() in github-service (no shell interpolation)
- Add SIGKILL fallback after SIGTERM timeout in worktree-service

Stability:
- Add process cleanup handlers (SIGTERM/SIGINT) for preview servers
- Add MAX_PREVIEW_SERVERS=5 limit to prevent resource exhaustion
- Memoize WebSocket context value to prevent unnecessary re-renders

Code quality:
- Remove hardcoded 'Brad' author → 'User' (3 files)
- Replace hardcoded localhost:3001 URLs with API_BASE (AttachmentsSection)
- Fix SECURITY-AUDIT.md date (2025 → 2026)
- Add license/repository/author to all 6 package.json files

Data hygiene:
- Untrack all runtime data files (.veritas-kanban/*.json, telemetry, activity)
- Simplify .gitignore: .veritas-kanban/* except .gitkeep
- Removed ~15,700 lines of runtime data from git history
 2026-01-29 06:13:10 -06:00
Brad Groux
3edffec98c chore: bump version to 1.0.0, add CHANGELOG 
- Bump all 6 package.json files from 0.1.0 to 1.0.0
- Add CHANGELOG.md with full feature summary
- Git history scrubbed of security.json (JWT secret)
 2026-01-29 01:42:04 -06:00
Brad Groux
2ec4aa5ac2 fix(security): tighten CSP directives, remove unsafe-eval in dev 2026-01-28 17:47:13 -06:00
Brad Groux
d756889a1f fix(security): replace weak dev admin key with strong random key 2026-01-28 17:42:20 -06:00
Brad Groux
279221ee38 ci: add GitHub Actions CI pipeline 2026-01-28 17:12:18 -06:00
Brad Groux
ccff6e78c8 fix(security): sanitize Content-Disposition header for attachments 2026-01-28 17:09:38 -06:00
Brad Groux
615b9b03b4 feat(security): replace custom rate limiter with express-rate-limit 
- Swap hand-rolled Map-based rate limiter for battle-tested express-rate-limit
- Built-in MemoryStore handles TTL cleanup automatically (no memory leaks)
- Uses sliding window counter algorithm instead of fixed window
- Emits both IETF draft-7 (RateLimit-*) and legacy (X-RateLimit-*) headers
- Remove duplicate inline rate limiter from settings.ts, use shared strictRateLimit middleware
- Redis not warranted for single-instance local dev tool
 2026-01-28 12:22:34 -06:00
Brad Groux
06df2e2050 fix(security): validate Origin header for WebSocket connections 2026-01-28 12:11:53 -06:00
Brad Groux
9d0f5cae47 feat(perf): add gzip response compression middleware 2026-01-28 12:09:05 -06:00
Brad Groux
5aa31115ae fix(security): remove .env from git, add .env.example 2026-01-28 12:05:17 -06:00
Brad Groux
228fe0b6f8 fix: add dotenv to load .env file at server startup 
- Added dotenv package to server dependencies
- Import dotenv/config at top of server/src/index.ts
- Fixes AUTH_REQUIRED errors when using API keys and localhost bypass

Resolves issue where VERITAS_AUTH_LOCALHOST_BYPASS and VERITAS_ADMIN_KEY
environment variables were not being loaded from .env file.
 2026-01-28 10:31:07 -06:00
Brad Groux
887cfc9a7e feat(auth): Complete authentication sprint 
- UserMenu: Session indicator with lock icon, expiry display, logout (Cmd+Shift+L)
- SecurityTab: Change password form with strength indicator, danger zone
- Header: Integrated UserMenu with security settings link
- SettingsDialog: Added Security tab with lazy loading, defaultTab prop
- useAuth: Fixed setup() to not refresh status before showing recovery key

Completes: US-d-eQbD, US-fCAsJx
 2026-01-28 09:44:31 -06:00
Brad Groux
65e0c8b278 feat(US-1303): Add real-time WebSocket agent status hook 
- Create useRealtimeAgentStatus hook with WebSocket subscription
- Subscribe to agent:status events as primary transport
- Fall back to polling every 10s when WebSocket disconnects
- Auto-reconnect on WebSocket disconnect (via useWebSocket)
- Stale detection marks agent as idle after 5+ min without updates
- Memoized return value to prevent unnecessary re-renders
- Full TypeScript types for AgentStatusData, SubAgent, AgentStatusState
- Maintain backwards compatibility with useGlobalAgentStatus (polling-only)
 2026-01-28 07:42:00 -06:00
Brad Groux
39eccf3556 feat: Sprint US-1200 Refactoring batch — 13 tasks complete 
Completed refactors:
- RF-02: Fix dependency vulnerabilities (xlsx → exceljs, Hono updates)
- RF-05: Add React error boundaries (FeatureErrorBoundary wrapper)
- RF-06: Server error handling middleware (AppError classes, asyncHandler)
- RF-10: Split shared types.ts into domain modules (6 files)
- RF-11: Consolidate frontend API layer (hooks now use api.ts)
- RF-13: TaskConfigContext — eliminate prop drilling
- RF-14: Split god components (GitSection, TaskDetailPanel, CreateTaskDialog, DiffViewer)
- RF-16: Frontend accessibility (ARIA labels, sr-only text)
- RF-17: Modularize CLI (899 → commands/ structure)
- RF-18: Modularize MCP (843 → tools/ structure)
- RF-19: Create shared API client library
- RF-21: Server performance (batch loading, memory limits, timeouts, graceful shutdown)
- RF-23: Extract shared utilities (path, format, constants)

Stats: ~59 files changed, significant code reduction through modularization
 2026-01-28 06:08:59 -06:00
Brad Groux
76f71d2e0d feat(US-912): Implement task attachments with text extraction pipeline 
Backend:
- Add Attachment types, limits config, and MIME type allowlist to shared types
- Create AttachmentService for file storage, upload/delete, archive lifecycle
- Create TextExtractionService supporting PDF, DOCX, XLSX, HTML, JSON, plain text
- Add attachment routes with multer upload middleware
- Add /api/tasks/:id/context endpoint for agent consumption
- Update task-service to handle attachments in frontmatter and lifecycle
- Install dependencies: multer, unpdf, mammoth, xlsx, mime-types

Frontend:
- Build AttachmentsSection component with drag-drop upload zone
- Add inline image thumbnails and expandable text previews
- Implement token cost warning banner (amber alert when ≥2 attachments)
- Add Attachments tab to TaskDetailPanel
- Add paperclip badge with count to TaskCard
- Create React hooks: useUploadAttachment, useDeleteAttachment, useTaskContext

Tests:
- Comprehensive test suites for attachment-service and text-extraction-service
- Cover upload, delete, archive, extraction for all file types

All 13 subtasks completed. Project compiles cleanly.
 2026-01-27 21:49:00 -06:00
Brad Groux
45a5c37612 feat: complete US-102 (task parser) and US-103 (REST API) 
- Task schema with full types in shared package
- TaskService with injectable paths for testing
- gray-matter for markdown frontmatter parsing
- 15 unit tests for parser/service
- Full CRUD API with zod validation
- Fixed undefined value handling in frontmatter
- Updated sprint tracking
 2026-01-26 02:49:09 -06:00
Brad Groux
95e758337f fix: TypeScript errors in server and web packages 
- Remove slugify dependency, use custom makeSlug function
- Add explicit Router type annotation
- Remove unused ChevronUp import
- Build shared package for type exports
 2026-01-26 02:37:17 -06:00
Brad Groux
a489c5358f feat: initial project scaffolding 
- Dev container with Node.js 22
- pnpm workspace monorepo structure
- Express + WebSocket server
- React + Vite + shadcn/ui frontend
- Shared TypeScript types package
- Kanban board with drag-and-drop
- Task CRUD with file-based persistence
- Dark mode styling

Sprint 1 - US-101: Project scaffolding with dev container
 2026-01-26 02:34:54 -06:00