Bug #2 (LOW): MCP endpoint was mounted at /mcp instead of /api/mcp,
inconsistent with all other API routes. Changed app.route("/mcp", ...)
to app.route("/api/mcp", ...) in apps/api/src/index.ts.
Bug #3 (MEDIUM): REST API endpoints only accepted JWT cookie/session
auth, not API key auth. Added authenticateApiKey() to authMiddleware
in apps/api/src/middleware/auth.ts so REST endpoints now accept
Authorization: Bearer <api_key> as a fallback after JWT verification.
The COPY apps/web step was failing with:
cannot copy to non-directory: .../app/apps/web/node_modules/@hookform/resolvers
because the host node_modules symlink conflicted with BuildKits overlayfs
cache mount. Adding --exclude=node_modules sidesteps the conflict (the
node_modules in the image is freshly created by the earlier bun install).
Parent: t_e1cbd87d
Verification after commit d4c02a3 found Hono matching /:id BEFORE /activity
when the bare /api/agents/activity request hit the API — Postgres returned a
500 cast error because id='activity' was not a valid UUID.
Two changes:
1. Move GET /api/agents/activity registration to BEFORE GET /:id so Hono's
matcher picks the static path before the param path.
2. Add a UUID-format guard at the top of GET /api/agents/:id — returns
404 when id is not a UUID. Defense in depth: prevents future 500s if
a similarly-shaped static route collides with /:id.
Parent: t_e1cbd87d
The tasks/notes/projects/habits/domains tables all have a tsvector
search_vector column and a GIN index, but nothing was populating it.
GET /api/search returned zero results for every query.
This migration adds a BEFORE INSERT OR UPDATE trigger on each of the
five searchable tables. The trigger function uses to_tsvector with
the appropriate title + description/content columns and is named
project_e_search_vector_<table>_update. Drops any pre-existing trigger
of the same name so re-running the migration is safe.
Backfills 64 existing rows.
Parent: t_e1cbd87d
Continuation of the T10 test report fixes (45d0810). The prior workers
for these bugs wrote the code but died before committing. This commit
captures their work and additionally restores a GET /:id/permissions
route that the prior helper-script accidentally deleted.
- Bug #4 HIGH: GET /api/agents/_all/activity now skips the WHERE clause
when the SPA passes '_all' as the id.
- Bug #5 MED: Settings > Appearance tab now reads/writes useThemeStore
(Zustand) so theme changes are consistent with the command palette.
- Bug #6 HIGH: /projects/:id detail page now exists. Plus 4 sibling
detail pages (tasks/:id, habits/:id, notes/:id, canvas/:id) wired
into the route tree.
- Bug #8 MED: GET /api/agents/activity (bare path) now returns the
last 100 activity items instead of falling into /:id/activity with
id='activity' (which failed the UUID cast).
- Bug #10 LOW: tasks/:id, habits/:id, notes/:id, canvas/:id detail
pages are now committed (the worker that wrote them never committed).
- graph.tsx and index.tsx overlap with earlier committed fixes
(t_cc5d9887 and t_296f0121); changes are additive and don't regress.
Also restores GET /api/agents/:id/permissions which the prior helper
script accidentally removed when reformatting agents.ts.
Parent: t_e1cbd87d
Server now sets the session cookie on successful login. SPA at same
origin includes the cookie on every subsequent request, so the auth
middleware can verify and the user is no longer bounced back to /login.
Parent: t_e1cbd87d (T10 test report)
- Snapshot DB schema to .migration-baseline-schema.sql (ground truth for API port)
- Add BASELINE.md documenting current state before UI redesign
- Pre-flight cleanup: removed node_modules, .next, tsbuildinfo (~527 MB freed)
- Next.js web container stopped (big-bang per user decision)
- Bun 1.3.14 installed via official installer (see script/setup-bun.sh)
Parent: t_e1cbd87d
Follows: HermesBriefcase/Personal/Projects/Project-E-UI-Redesign-Spec.md
Bug #10 (LOW): TipTap editor text input leaks into Search field.
The EditorContent wrapper had no tabIndex so the global keyboard
shortcut (which treats inputs/textareas/buttons as focused but
not contenteditable divs) sent typed text to the search field
instead of the editor. Adding tabIndex={0} makes the wrapper
focusable; TipTap's contentEditable=true then routes the
keyboard events to the editor.
Bug #1 (LOW): Task List view infinite toast loop. The catch block
fired toast.error on every realtime-triggered fetch failure with
no dedup, causing infinite toast spam on 429 or persistent
errors. Realtime subscription also called fetchTasks() on every
event with no debounce, amplifying the problem.
Fixes:
- Add lastErrorRef to track the last error message; only toast
when the message class changes.
- Distinguish 429/rate-limited from generic 500 in the toast text.
- Reset lastErrorRef on successful fetch.
- Debounce the realtime-triggered refetch by 750ms so event
bursts collapse to a single fetch.
Bug #8 (LOW): TaskCard in Board view not keyboard-focusable.
The TaskCard in tasks-kanban-view.tsx already has role=button,
tabIndex={0}, onKeyDown for Enter/Space, and aria-label. No
change needed; verified in the tree that the fix is present
(probably landed as part of an earlier leaf integration).
Bug #1 + Bug #8 + Bug #10 all addressed in this commit.
Note: Bug #9 (Search returns No results) is fixed by P0 (the
search route was patched to use resolveActiveDomain). Verified
working without further changes needed.
Bug #7 (MEDIUM): Calendar week/day view toggle broken. The
BigCalendarWrapper used defaultView (uncontrolled) so when the
parent updated the view state via onView, the calendar continued
to show the original view. Switched to view (controlled) so the
calendar re-renders with the correct view.
Bug #6 (MEDIUM): Dashboard Quick Capture button was dead. The
Add button had no onClick handler and the form was wired to
the wrong endpoint (per-type /api/tasks|habits|notes). Switched
to POST /api/quick-capture with {type, text} (the new endpoint
created by P0). Added Project to the type select. Added toast
feedback on success/error. Made the Add button type=button with
explicit onClick so it bypasses form-submit and the global
shortcut handler.
Bug #2 (MEDIUM): Canvas create -> page crash. Already fixed by
P0 (commit c3bce0b removed the hardcoded 'personal' domain
filter). The orphan modification to canvas/page.tsx is also
included here to keep the diff complete.
Bug #6 + Bug #7 + Bug #2 all fixed in this commit.
Bug #3 (HIGH): New habit button on /habits did not open the create
dialog. The HabitCreateDialog was mounted but the topbar's
useCreateDialogStore had no consumer on /habits, so topbar clicks
were no-ops.
Bug #4 (HIGH): New project button on /projects had the same issue.
Fix: mount CreateItemDialog (type=habit or type=project) on each
page so the topbar store is consumed. Switch the page-level button
to use the store too. The existing local HabitCreateDialog /
ProjectCreateDialog still work as a fallback.
Bug #5 (HIGH): Domain Add button on /settings/domains opened the
Command Palette instead of creating the domain. Two-part cause:
1. The sticky topbar Quick add button was visually overlapping
the form Add button (both anchored top-right). On click the
topbar handleCreate fired and dispatched a synthetic Cmd+K
opening the palette.
2. /api/domains POST required a slug field that the form did not
send, returning 400.
Fix: hide the topbar Quick add button on pages without a relevant
quick-create (only show on /projects, /habits, /tasks). Make the
form Add button explicit type=button with stopPropagation as
defense in depth. Auto-generate the domain slug from the name
on the server when not provided.
Bug #3 + Bug #4 + Bug #5 all fixed in this commit.
The HabitCreateDialog and ProjectCreateDialog were mounted with local
state but the topbar uses useCreateDialogStore, and the store had no
consumer on /habits or /projects. So topbar clicks did nothing, and the
page-level button may have been dead too due to a stale build.
Mount <CreateItemDialog> in both pages so:
- The topbar New habit / New project button opens the dialog
- The page-level buttons open the same dialog via the store
- A single CreateItemDialog handles task/project/habit creation
Bug #3 (New habit) + Bug #4 (New project) are fixed by this commit.
Same fix as the agent schema commit — zod 3.25 (resolved by ^3.25.0)
requires z.record() to take both key and value schemas. The single-arg
form is v4 syntax.
Fixed 15 remaining call sites across canvas, project, report, common,
webhook, habit, task, note, and milestone schemas. Pure type-only fix —
runtime behavior identical.
zod 3.25 (the version resolved by ^3.25.0) requires z.record() to take
both a key and a value schema. The single-arg form z.record(z.unknown())
is zod v4 syntax, which trips next build's typecheck.
Four call sites in packages/shared/src/schemas/agent.ts were written in
v4 form (lines 39, 41, 73, 74). This is a pure type-only fix — runtime
behavior is identical.
- New resolveActiveDomain() helper in apps/web/lib/auth.ts: returns the
user's first existing domain (ordered by sort_order then created_at),
or auto-creates a default 'Personal' domain if they have none.
- 7 affected API routes (agents, canvases, domains, habits, projects,
search, tasks) now fall back to resolveActiveDomain when the request
omits a domain param. This eliminates the UNDEFINED_VALUE on domain_id
and 22P02 invalid uuid errors that broke 6+ UI flows.
- New POST /api/quick-capture route: switches on type=task|habit|note|project
to create the right entity, after resolving the active domain. This is
the API the dashboard quick-capture widget calls.
- packages/db/src/schema.ts: added ownerId: uuid('owner_id') to the
domains table so each user owns their domains.
- drizzle/0004_add_owner_id_to_domains.sql: matching migration with
column add + index.
- apps/web/__tests__/lib/auth.test.ts: unit tests for both branches of
resolveActiveDomain (returns existing / creates Personal).
- apps/web/app/(dashboard)/canvas/page.tsx: removed hardcoded
domain: 'personal' from the quick-create payload so server-side
resolution can do its job.
This unblocks all of: /tasks, /habits, /projects, /search, /settings/agents,
/settings/domains, /canvas, and dashboard quick-capture.
Hermes
bot-hermes