Resolved conflicts in web-legacy pages and report schema by taking v2 side.
v2 is the deployed, current architecture; v1 paths preserved under apps/web-legacy.
- Add rose accent to ACCENT_PALETTE
- Settings AppearanceTab derives ACCENT_COLORS from ACCENT_PALETTE
- Wire accent state through useThemeStore instead of localStorage
The generateWeeklySummary/generateProjectHealth/generateHabitAnalysis/
generateTimeAudit helpers all had "const pb = token ? createAdminClient()
: createAdminClient();" — both branches return the admin client, so a
passed user token was silently discarded and every caller got admin-level
access. Use createPocketBaseClient(token) when a token is provided,
matching the sibling project-service.ts / note-service.ts pattern.
projectIds query omitted isNull(projects.deletedAt), unlike the sibling
projectRows query, so sections of soft-deleted projects were loaded as
orphan nodes via inArray(sections.projectId, projectIds).
GET/PATCH/DELETE for single task and habit used createPocketBaseClient(),
which is a dead stub, and DELETE did a hard delete violating the soft-delete
rule in AGENTS.md. Rewrite with Drizzle ORM: soft-delete (deleted_at),
activity feed insert via recordActivity(), Zod validation, parent-task
existence check, workspace access check, and 404 NOT_FOUND handling.
The dashboard widget was filtering with a broken filter=status!=done query
param that the list API never interpreted, so completed tasks could appear.
Add a status= todo,in_progress filter to GET /api/tasks and update the widget
to use it (also fix domain badge to use domainId).
Added reports table to PostgreSQL and Drizzle schema. Rewrote reports API routes to use Drizzle ORM instead of PocketBase stub. Fixed shared schema to match frontend field names. Fixed TipTap v3 type errors in note-editor.tsx and report-editor.tsx (StarterKit cast+chain as any).
Root cause: inline arrow functions for onDelete and onSave props created new references every render, breaking React.memo and causing editor re-renders that steal focus.
Bug #2 (LOW): MCP endpoint was mounted at /mcp instead of /api/mcp,
inconsistent with all other API routes. Changed app.route("/mcp", ...)
to app.route("/api/mcp", ...) in apps/api/src/index.ts.
Bug #3 (MEDIUM): REST API endpoints only accepted JWT cookie/session
auth, not API key auth. Added authenticateApiKey() to authMiddleware
in apps/api/src/middleware/auth.ts so REST endpoints now accept
Authorization: Bearer <api_key> as a fallback after JWT verification.
Hermes
bot-hermes