Bug #2 (LOW): MCP endpoint was mounted at /mcp instead of /api/mcp,
inconsistent with all other API routes. Changed app.route("/mcp", ...)
to app.route("/api/mcp", ...) in apps/api/src/index.ts.
Bug #3 (MEDIUM): REST API endpoints only accepted JWT cookie/session
auth, not API key auth. Added authenticateApiKey() to authMiddleware
in apps/api/src/middleware/auth.ts so REST endpoints now accept
Authorization: Bearer <api_key> as a fallback after JWT verification.
Continuation of the T10 test report fixes (45d0810). The prior workers
for these bugs wrote the code but died before committing. This commit
captures their work and additionally restores a GET /:id/permissions
route that the prior helper-script accidentally deleted.
- Bug #4 HIGH: GET /api/agents/_all/activity now skips the WHERE clause
when the SPA passes '_all' as the id.
- Bug #5 MED: Settings > Appearance tab now reads/writes useThemeStore
(Zustand) so theme changes are consistent with the command palette.
- Bug #6 HIGH: /projects/:id detail page now exists. Plus 4 sibling
detail pages (tasks/:id, habits/:id, notes/:id, canvas/:id) wired
into the route tree.
- Bug #8 MED: GET /api/agents/activity (bare path) now returns the
last 100 activity items instead of falling into /:id/activity with
id='activity' (which failed the UUID cast).
- Bug #10 LOW: tasks/:id, habits/:id, notes/:id, canvas/:id detail
pages are now committed (the worker that wrote them never committed).
- graph.tsx and index.tsx overlap with earlier committed fixes
(t_cc5d9887 and t_296f0121); changes are additive and don't regress.
Also restores GET /api/agents/:id/permissions which the prior helper
script accidentally removed when reformatting agents.ts.
Parent: t_e1cbd87d
Bug #10 (LOW): TipTap editor text input leaks into Search field.
The EditorContent wrapper had no tabIndex so the global keyboard
shortcut (which treats inputs/textareas/buttons as focused but
not contenteditable divs) sent typed text to the search field
instead of the editor. Adding tabIndex={0} makes the wrapper
focusable; TipTap's contentEditable=true then routes the
keyboard events to the editor.
Bug #1 (LOW): Task List view infinite toast loop. The catch block
fired toast.error on every realtime-triggered fetch failure with
no dedup, causing infinite toast spam on 429 or persistent
errors. Realtime subscription also called fetchTasks() on every
event with no debounce, amplifying the problem.
Fixes:
- Add lastErrorRef to track the last error message; only toast
when the message class changes.
- Distinguish 429/rate-limited from generic 500 in the toast text.
- Reset lastErrorRef on successful fetch.
- Debounce the realtime-triggered refetch by 750ms so event
bursts collapse to a single fetch.
Bug #8 (LOW): TaskCard in Board view not keyboard-focusable.
The TaskCard in tasks-kanban-view.tsx already has role=button,
tabIndex={0}, onKeyDown for Enter/Space, and aria-label. No
change needed; verified in the tree that the fix is present
(probably landed as part of an earlier leaf integration).
Bug #1 + Bug #8 + Bug #10 all addressed in this commit.
Note: Bug #9 (Search returns No results) is fixed by P0 (the
search route was patched to use resolveActiveDomain). Verified
working without further changes needed.
Bug #7 (MEDIUM): Calendar week/day view toggle broken. The
BigCalendarWrapper used defaultView (uncontrolled) so when the
parent updated the view state via onView, the calendar continued
to show the original view. Switched to view (controlled) so the
calendar re-renders with the correct view.
Bug #6 (MEDIUM): Dashboard Quick Capture button was dead. The
Add button had no onClick handler and the form was wired to
the wrong endpoint (per-type /api/tasks|habits|notes). Switched
to POST /api/quick-capture with {type, text} (the new endpoint
created by P0). Added Project to the type select. Added toast
feedback on success/error. Made the Add button type=button with
explicit onClick so it bypasses form-submit and the global
shortcut handler.
Bug #2 (MEDIUM): Canvas create -> page crash. Already fixed by
P0 (commit c3bce0b removed the hardcoded 'personal' domain
filter). The orphan modification to canvas/page.tsx is also
included here to keep the diff complete.
Bug #6 + Bug #7 + Bug #2 all fixed in this commit.
Bug #3 (HIGH): New habit button on /habits did not open the create
dialog. The HabitCreateDialog was mounted but the topbar's
useCreateDialogStore had no consumer on /habits, so topbar clicks
were no-ops.
Bug #4 (HIGH): New project button on /projects had the same issue.
Fix: mount CreateItemDialog (type=habit or type=project) on each
page so the topbar store is consumed. Switch the page-level button
to use the store too. The existing local HabitCreateDialog /
ProjectCreateDialog still work as a fallback.
Bug #5 (HIGH): Domain Add button on /settings/domains opened the
Command Palette instead of creating the domain. Two-part cause:
1. The sticky topbar Quick add button was visually overlapping
the form Add button (both anchored top-right). On click the
topbar handleCreate fired and dispatched a synthetic Cmd+K
opening the palette.
2. /api/domains POST required a slug field that the form did not
send, returning 400.
Fix: hide the topbar Quick add button on pages without a relevant
quick-create (only show on /projects, /habits, /tasks). Make the
form Add button explicit type=button with stopPropagation as
defense in depth. Auto-generate the domain slug from the name
on the server when not provided.
Bug #3 + Bug #4 + Bug #5 all fixed in this commit.
The HabitCreateDialog and ProjectCreateDialog were mounted with local
state but the topbar uses useCreateDialogStore, and the store had no
consumer on /habits or /projects. So topbar clicks did nothing, and the
page-level button may have been dead too due to a stale build.
Mount <CreateItemDialog> in both pages so:
- The topbar New habit / New project button opens the dialog
- The page-level buttons open the same dialog via the store
- A single CreateItemDialog handles task/project/habit creation
Bug #3 (New habit) + Bug #4 (New project) are fixed by this commit.
- New resolveActiveDomain() helper in apps/web/lib/auth.ts: returns the
user's first existing domain (ordered by sort_order then created_at),
or auto-creates a default 'Personal' domain if they have none.
- 7 affected API routes (agents, canvases, domains, habits, projects,
search, tasks) now fall back to resolveActiveDomain when the request
omits a domain param. This eliminates the UNDEFINED_VALUE on domain_id
and 22P02 invalid uuid errors that broke 6+ UI flows.
- New POST /api/quick-capture route: switches on type=task|habit|note|project
to create the right entity, after resolving the active domain. This is
the API the dashboard quick-capture widget calls.
- packages/db/src/schema.ts: added ownerId: uuid('owner_id') to the
domains table so each user owns their domains.
- drizzle/0004_add_owner_id_to_domains.sql: matching migration with
column add + index.
- apps/web/__tests__/lib/auth.test.ts: unit tests for both branches of
resolveActiveDomain (returns existing / creates Personal).
- apps/web/app/(dashboard)/canvas/page.tsx: removed hardcoded
domain: 'personal' from the quick-create payload so server-side
resolution can do its job.
This unblocks all of: /tasks, /habits, /projects, /search, /settings/agents,
/settings/domains, /canvas, and dashboard quick-capture.
Hermes
bot-hermes