Bug #2 (LOW): MCP endpoint was mounted at /mcp instead of /api/mcp,
inconsistent with all other API routes. Changed app.route("/mcp", ...)
to app.route("/api/mcp", ...) in apps/api/src/index.ts.
Bug #3 (MEDIUM): REST API endpoints only accepted JWT cookie/session
auth, not API key auth. Added authenticateApiKey() to authMiddleware
in apps/api/src/middleware/auth.ts so REST endpoints now accept
Authorization: Bearer <api_key> as a fallback after JWT verification.
Verification after commit d4c02a3 found Hono matching /:id BEFORE /activity
when the bare /api/agents/activity request hit the API — Postgres returned a
500 cast error because id='activity' was not a valid UUID.
Two changes:
1. Move GET /api/agents/activity registration to BEFORE GET /:id so Hono's
matcher picks the static path before the param path.
2. Add a UUID-format guard at the top of GET /api/agents/:id — returns
404 when id is not a UUID. Defense in depth: prevents future 500s if
a similarly-shaped static route collides with /:id.
Parent: t_e1cbd87d
Continuation of the T10 test report fixes (45d0810). The prior workers
for these bugs wrote the code but died before committing. This commit
captures their work and additionally restores a GET /:id/permissions
route that the prior helper-script accidentally deleted.
- Bug #4 HIGH: GET /api/agents/_all/activity now skips the WHERE clause
when the SPA passes '_all' as the id.
- Bug #5 MED: Settings > Appearance tab now reads/writes useThemeStore
(Zustand) so theme changes are consistent with the command palette.
- Bug #6 HIGH: /projects/:id detail page now exists. Plus 4 sibling
detail pages (tasks/:id, habits/:id, notes/:id, canvas/:id) wired
into the route tree.
- Bug #8 MED: GET /api/agents/activity (bare path) now returns the
last 100 activity items instead of falling into /:id/activity with
id='activity' (which failed the UUID cast).
- Bug #10 LOW: tasks/:id, habits/:id, notes/:id, canvas/:id detail
pages are now committed (the worker that wrote them never committed).
- graph.tsx and index.tsx overlap with earlier committed fixes
(t_cc5d9887 and t_296f0121); changes are additive and don't regress.
Also restores GET /api/agents/:id/permissions which the prior helper
script accidentally removed when reformatting agents.ts.
Parent: t_e1cbd87d
Server now sets the session cookie on successful login. SPA at same
origin includes the cookie on every subsequent request, so the auth
middleware can verify and the user is no longer bounced back to /login.
Parent: t_e1cbd87d (T10 test report)
bot-hermes
Hermes