- Add states.ts with GET/POST/PATCH/DELETE endpoints
- States scoped to project via projectId FK; workspace access resolved through project
- stateGroupEnum enforced (backlog|unstarted|started|completed|cancelled)
- List ordered by sortOrder, auto-increment on create
- Soft-delete via deletedAt column (added to schema)
- 3-step contract on every write: DB write, activity feed, pg_notify
- Register /api/states route in main index.ts
- Default state seeding already present in projects.ts
Replace flat status enum with stateId/stateGroup references:
- Import states table; add state_group filter via EXISTS subquery
- Add module_id and cycle_id filter params to task list endpoint
- Validate stateId on create/update (404 if state not found)
- Auto-set completedAt when state group is 'completed', clear otherwise
- Zero references to old taskStatusEnum remain
- Custom workflow statuses: per-project configurable status definitions
replacing the fixed task_status enum. Each project defines its own
workflow with drag-to-reorder, color coding, and category mapping.
- Gantt/timeline view: full project roadmap with task bars, dependency
arrows, milestone diamonds, zoom levels (day/week/month), and drag
to reschedule.
- Natural-language quick-add: NLP parser extracts dates, priorities,
projects, labels, and recurrence from free text. Floating bar with
'n' shortcut and live parsed preview.
- Automation rules: no-code trigger-action system per project. Triggers
on status change, task creation, due date approaching. Actions set
status/priority, add labels, create notifications.
- Notification center: in-app bell icon with unread badge, slide-out
panel, real-time SSE updates, mark read/all read. Replaces raw
activity feed dropdown.
Schema: adds status_definitions, automation_rules, notifications tables.
Migrations: 0007, 0008, 0009. 41 NLP parser tests pass.
Bug #2 (LOW): MCP endpoint was mounted at /mcp instead of /api/mcp,
inconsistent with all other API routes. Changed app.route("/mcp", ...)
to app.route("/api/mcp", ...) in apps/api/src/index.ts.
Bug #3 (MEDIUM): REST API endpoints only accepted JWT cookie/session
auth, not API key auth. Added authenticateApiKey() to authMiddleware
in apps/api/src/middleware/auth.ts so REST endpoints now accept
Authorization: Bearer <api_key> as a fallback after JWT verification.
Verification after commit d4c02a3 found Hono matching /:id BEFORE /activity
when the bare /api/agents/activity request hit the API — Postgres returned a
500 cast error because id='activity' was not a valid UUID.
Two changes:
1. Move GET /api/agents/activity registration to BEFORE GET /:id so Hono's
matcher picks the static path before the param path.
2. Add a UUID-format guard at the top of GET /api/agents/:id — returns
404 when id is not a UUID. Defense in depth: prevents future 500s if
a similarly-shaped static route collides with /:id.
Parent: t_e1cbd87d
Continuation of the T10 test report fixes (45d0810). The prior workers
for these bugs wrote the code but died before committing. This commit
captures their work and additionally restores a GET /:id/permissions
route that the prior helper-script accidentally deleted.
- Bug #4 HIGH: GET /api/agents/_all/activity now skips the WHERE clause
when the SPA passes '_all' as the id.
- Bug #5 MED: Settings > Appearance tab now reads/writes useThemeStore
(Zustand) so theme changes are consistent with the command palette.
- Bug #6 HIGH: /projects/:id detail page now exists. Plus 4 sibling
detail pages (tasks/:id, habits/:id, notes/:id, canvas/:id) wired
into the route tree.
- Bug #8 MED: GET /api/agents/activity (bare path) now returns the
last 100 activity items instead of falling into /:id/activity with
id='activity' (which failed the UUID cast).
- Bug #10 LOW: tasks/:id, habits/:id, notes/:id, canvas/:id detail
pages are now committed (the worker that wrote them never committed).
- graph.tsx and index.tsx overlap with earlier committed fixes
(t_cc5d9887 and t_296f0121); changes are additive and don't regress.
Also restores GET /api/agents/:id/permissions which the prior helper
script accidentally removed when reformatting agents.ts.
Parent: t_e1cbd87d
Server now sets the session cookie on successful login. SPA at same
origin includes the cookie on every subsequent request, so the auth
middleware can verify and the user is no longer bounced back to /login.
Parent: t_e1cbd87d (T10 test report)
bot-hermes
Hermes