Bug #2 (LOW): MCP endpoint was mounted at /mcp instead of /api/mcp,
inconsistent with all other API routes. Changed app.route("/mcp", ...)
to app.route("/api/mcp", ...) in apps/api/src/index.ts.
Bug #3 (MEDIUM): REST API endpoints only accepted JWT cookie/session
auth, not API key auth. Added authenticateApiKey() to authMiddleware
in apps/api/src/middleware/auth.ts so REST endpoints now accept
Authorization: Bearer <api_key> as a fallback after JWT verification.
The COPY apps/web step was failing with:
cannot copy to non-directory: .../app/apps/web/node_modules/@hookform/resolvers
because the host node_modules symlink conflicted with BuildKits overlayfs
cache mount. Adding --exclude=node_modules sidesteps the conflict (the
node_modules in the image is freshly created by the earlier bun install).
Parent: t_e1cbd87d
Verification after commit d4c02a3 found Hono matching /:id BEFORE /activity
when the bare /api/agents/activity request hit the API — Postgres returned a
500 cast error because id='activity' was not a valid UUID.
Two changes:
1. Move GET /api/agents/activity registration to BEFORE GET /:id so Hono's
matcher picks the static path before the param path.
2. Add a UUID-format guard at the top of GET /api/agents/:id — returns
404 when id is not a UUID. Defense in depth: prevents future 500s if
a similarly-shaped static route collides with /:id.
Parent: t_e1cbd87d
The tasks/notes/projects/habits/domains tables all have a tsvector
search_vector column and a GIN index, but nothing was populating it.
GET /api/search returned zero results for every query.
This migration adds a BEFORE INSERT OR UPDATE trigger on each of the
five searchable tables. The trigger function uses to_tsvector with
the appropriate title + description/content columns and is named
project_e_search_vector_<table>_update. Drops any pre-existing trigger
of the same name so re-running the migration is safe.
Backfills 64 existing rows.
Parent: t_e1cbd87d
Continuation of the T10 test report fixes (45d0810). The prior workers
for these bugs wrote the code but died before committing. This commit
captures their work and additionally restores a GET /:id/permissions
route that the prior helper-script accidentally deleted.
- Bug #4 HIGH: GET /api/agents/_all/activity now skips the WHERE clause
when the SPA passes '_all' as the id.
- Bug #5 MED: Settings > Appearance tab now reads/writes useThemeStore
(Zustand) so theme changes are consistent with the command palette.
- Bug #6 HIGH: /projects/:id detail page now exists. Plus 4 sibling
detail pages (tasks/:id, habits/:id, notes/:id, canvas/:id) wired
into the route tree.
- Bug #8 MED: GET /api/agents/activity (bare path) now returns the
last 100 activity items instead of falling into /:id/activity with
id='activity' (which failed the UUID cast).
- Bug #10 LOW: tasks/:id, habits/:id, notes/:id, canvas/:id detail
pages are now committed (the worker that wrote them never committed).
- graph.tsx and index.tsx overlap with earlier committed fixes
(t_cc5d9887 and t_296f0121); changes are additive and don't regress.
Also restores GET /api/agents/:id/permissions which the prior helper
script accidentally removed when reformatting agents.ts.
Parent: t_e1cbd87d
Server now sets the session cookie on successful login. SPA at same
origin includes the cookie on every subsequent request, so the auth
middleware can verify and the user is no longer bounced back to /login.
Parent: t_e1cbd87d (T10 test report)
Hermes