44 files of prose — CLAUDE.md, AGENTS.md, TODO.md, 20 docs, both plugin design
documents, and the comment surface the earlier steps could not reach.
Applied against an explicit keep-list, not swept, because the word turned out to
have SIX meanings in this repository rather than the three the offscale doc
recorded:
permissions renamed (steps 1–2)
$OFFICER_ROOT/capabilities/ KEPT — the item store, and now the only thing
the word means that is ours
sidecar routing keys renamed to `handles` (step 3)
Lightning wallet KEPT — a domain term, and on the wire to the mobile apps
terminfo queries KEPT — XTGETTCAP, in the pty sidecar
InvoiceShelf KEPT — per-resource { write, bulkDelete } flags
The sweep still falsified two things, both caught by checking rather than by
review, and both in prose that discusses more than one meaning at once:
CLAUDE.md began claiming the item store lives at `$OFFICER_ROOT/permissions`.
It does not; that directory is on disk and full of skills and tools.
And the offscale doc's own note about the collision became
"Named `permissions`, NOT `permissions`" — a sentence that had eaten the thing
it existed to warn about.
Both restored, and the note rewritten to say what is now true: capability means
one thing of ours, and three that belong to somebody else's vocabulary.
Verified live after restart: self and admin permission endpoints 200, gated
route 200, agent-status 200, 9 grants intact with 6 permissions offered.
tsgo clean, 797 tests, 787 pass, same 7.
The rename is done. Four steps, no data lost, no client break that survived
the step it was introduced in.
The word meant four different things in this repo, not the three the offscale
doc records:
1. the permission registry → RENAMED here
2. $OFFICER_ROOT/capabilities/ items → kept; this is what capabilities are
3. sidecar routing keys → step 3, becoming `handles`
4. Lightning wallet features → kept; a domain term, and on the wire
to the mobile apps
The fourth was not in the doc and a global find-and-replace would have broken
the mobile wallet, which reads `{ kind, capabilities: Capability[] }` from the
wallet sidecar. So this renamed against an explicit file allowlist rather than
by sweeping the tree, and `CapabilityPage.tsx` — the UI for the item store, and
correctly named already — was left alone.
Moved: servers/capabilities/ → servers/permissions/, capability-gate.ts →
permission-gate.ts, users/capabilities-routes.ts → permissions-routes.ts,
hooks/useCapabilities.ts → usePermissions.ts. Identifiers follow.
Three breaks the typechecker could not see, all found by exercising it live.
The route paths moved with the prose sweep, so the server served
/user/permissions while the frontend still called /user/capabilities. A 404 on
every page load, and tsgo clean throughout.
The response FIELD moved too. `client.get<SelfPermissions>()` is an unchecked
cast, so `data.capabilities` became `undefined` at runtime with no compile
error — `can()` would have answered "no" to everything and the dock would have
emptied itself.
And the grants list was passed straight out of the database, so it arrived as
`{ role, capability, level }` while the screen read `grant.permission`. Every
role would have rendered as holding nothing. It is now mapped in the route:
the wire says `permission`, the column still says `capability`, and step 2
therefore changes nothing any client can see.
The stale react-query keys were the quiet one: two files still invalidated
['self-capabilities'] after the hook moved to ['self-permissions'], so
installing a plugin would have silently stopped refreshing the dock.
The database is untouched — `role_capabilities` and its `capability` column are
step 2, and the two call sites that cross that boundary say so in a comment.
Round-tripped the 9 live grants through the admin endpoint to prove the PUT
contract survived: 9 before, 9 after, Member's three intact.
Also reverted prettier churn on five landing-page files that a broad --write
picked up. Second time today; the lesson is not sticking.
tsgo clean. 797 tests, 787 pass, same 7 pre-existing failures — two of which
now read "path → permission" rather than "path → capability".
The tile background exists so a white lucide glyph has something to sit on —
on nothing it is invisible. Artwork does not need it, and a logo framed in an
arbitrary coloured square reads as a mistake.
badge rounded square filled with `color`, icon inset (what a glyph needs)
bare no background, artwork fills the tile (what a mark wants)
DEFAULTED from whether the plugin ships assets/icon.png — artwork gets bare, a
glyph gets badge — with `tile` on the manifest to override either way. Presence
is the declaration, as everywhere else here; the field exists only for the
plugin whose artwork genuinely wants a backdrop. Music sets nothing and gets
bare.
`color` is still required either way. It does four jobs and only one of them is
the square: the active glow, the indicator dot and the plugins-list tint all
read it too.
The icon was also smaller than it looked. The source carried ~8% transparent
margin on every side and the artwork is 233x221 inside a square frame, so with
the old `h-7 w-7` inset inside a `w-10` box the duck occupied roughly 39% of
the tile's area. Cropped to its alpha bounding box, padded back to square to
keep aspect, and rescaled: it now fills 95% of the frame instead of 79%, and
`bare` gives it the whole tile instead of half.
Measured rather than eyeballed — the bounding box came from extracting the
alpha plane and scanning it, then the crop was applied to the 1254px original
so nothing was resampled twice.
tsgo clean, 797 tests, 787 pass, same 7. Verified live: music reports
tile=bare, example and offscale still badge.
ALLOW_ANY_ORIGIN, ALLOW_ANY_ORIGIN_MUSIC, and everything they gated. The flag
defaulted to ON, so none of it ran on a real install — what comes out is
documented defence in depth that was already switched off. The file said so
itself: "Both flags and their call sites come out once the tailnet is the
perimeter."
Origin was never authentication here in any case. An app's `officer://<hex>`
origin is chosen by the client, forgeable outside a browser, and extractable from
a shipped binary.
Gone: the two flags, isOriginAllowed, isOriginCheckDisabled, isMusicOriginExempt,
originValidationMiddleware, ORIGIN_RULES and the whole OFFICER_<APP>_ORIGIN
scheme, PUBLIC_URL's origin/host derivation, and origin-validation.test.ts, which
existed only to pin them. CORS now echoes whatever Origin it is given, which is
what every install already did.
What SURVIVES is the reason this needed care. origin-validation.ts held two
unrelated things, and the second was the global authorization gate — a valid
non-owner token reaches only what its role grants, deliberately NOT under the
flag because it is account-based rather than origin-based. Its own comment called
it "the airtight half". Deleting the file wholesale would have deleted
authorization.
So it moves to _middlewares/capability-gate.ts as capabilityGateMiddleware, with
the name matching what it does: nothing in it reads an Origin header any more.
hono.ts mounts it in the same position, ahead of every router.
origin-middleware.ts stays and is untouched — it extracts the Origin for six auth
handlers that log it, and for passkeys. Extraction, not validation.
Also updates every claim that rested on the old model: CLAUDE.md's security
section and repo map, docs/secret-store.md, docs/mobile-api-keys.md, and five
messages in machine-setup's Tailscale section which told the owner to set
ALLOW_ANY_ORIGIN=false when declining a tailnet. That advice is now impossible to
follow, and the honest version is different: with no tailnet the token is the
whole lock, so put a proxy in front and restrict who can reach it.
Not typechecked (empty node_modules, frozen installs). Every changed file parses;
the setup section was run and writes four variables now.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Three things, from a member sitting on /music with no music capability on a server with
no music sidecar: an empty library, and 403s in the console.
PERMISSIONS AT THE ROUTE. `canVisit` filtered the dock and nothing else, so the tile was
hidden and the route was wide open — typing the path, following an old link or restoring
a tab rendered the screen anyway. RouteGate now wraps every screen in one place, inside
the error boundary.
It does not redirect. Sending someone to `/` erases what they asked for and reads as a
bug: they clicked Music and landed on Home. It says why instead, and the URL stays put so
a reload after installing the thing just works.
And it says which of the two reasons applies, because they need different screens and send
the reader to different places. `not-installed` is a fact about the SERVER — the owner gets
a link to the app store. `not-granted` is a fact about the ACCOUNT, and only the owner can
change it. Presenting either as the other sends you looking in the wrong place.
ROUTES FOLLOW THE SIDECAR. Free, once the above exists: `deniedRoutes` already covers
"held but its sidecar is not installed", so an uninstalled feature has no tile AND no
screen. The dock, the Permissions list and the routes now agree because they read one
answer.
NO MORE SEEDING. Downloads/Documents/Music/Videos/Pictures are gone from both places that
made them — the member's provisioning and, older and worse, `/ls`, which created folders in
somebody's home as a side effect of LOOKING at it. A listing that invents its own contents
is a listing you cannot trust, and the platform has no standing to choose a person's folder
layout. A new home is empty.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The 401 handler ended with location.replace('/'), guarded by "unless the path starts
with /signin". There is no /signin route — the sign-in screen IS path="/". So every 401
on the signed-out landing page navigated to the page it was already on, fetched again,
401'd again. A hard refresh loop with no way out of the tab.
The reload was never what fixed anything: useAuth already renders the sign-in screen
when there is no token. It only existed to drop a stale query cache. So it is now the
last thing attempted and bounded three separate ways, any one of which breaks a loop
alone:
1. no token -> return. A 401 while already signed out is expected, not a revocation.
This one alone ends it, because a reloaded document has nothing left to clear.
2. once per document, module flag.
3. once per tab, sessionStorage marker — which also covers a host that re-injects the
token on every load, where clearing storage cannot help and guard 1 never fires.
Anyone stuck in the loop from the previous build: localStorage.clear() in the console.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reported from two browser windows: an account deleted from the dashboard survived a
page refresh in the other one. Two independent halves.
Server: userMiddleware looked the account up, then read the result as
`dbUser?.passwordChangedAt` — so a DELETED account fell through the optional chain and
the request proceeded on a token that is still cryptographically valid, for up to the
full 30 days. `status` was the same hole from the other direction: signin refuses
anything that is not Active, but nothing rechecked it afterwards, so marking someone
Blocked did not end the session they already had, which is exactly when you would be
doing it. Now the account must exist and be Active on every request.
Client: nothing reacted to a 401 at all. onError fed the bug-report form and stopped
there, so the window kept rendering off cached React Query data. A 401 now clears every
storage key createClient reads and returns to the sign-in screen. /auth/ is exempt
because a wrong password is also a 401 and reloading the form would look like a crash.
window.officerBearerToken was declared non-optional, which made "there is no token"
unspeakable. It has always been one of five sources, any of which may be absent.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Three commits backed out a few hours ago as collateral, restored together because they are one fix:
243bd04 (queue sends until OPEN), bc13450 (defer the teardown close by a tick, cancellable) and
66a41d0 (count CONNECTING as ours, not only OPEN).
Why they are needed, from evidence rather than reasoning. d9857ee fixed the server side and Andre
still had nothing on https://macbook.pastilhas.dev after a restart. The decisive observation is an
ABSENCE: his attempts appear nowhere in officer's log — no "Model selected for chat", no
claude:stream for his session. Nothing reaches the server at all. Meanwhile a socket I drove by hand
against the same wss:// url ran a full turn in 2.5s, so the transport is not it.
That is `send` dropping the message. It returned silently on `readyState !== OPEN`, and the socket is
not OPEN because the effect cleanup closed it on a remount while it was still CONNECTING, then closed
its replacement the same way. Enter does nothing, forever, with the view sitting on Disconnected —
and no error anywhere, on either side, which is why this reads as a dead server.
Note what is still NOT fixed, and is written into the code comment rather than this message alone: a
/chat/new load opens TWO sockets, from two separate useChat instances mounting. Measured with a
constructor counter. Both connect, so it looks healthy; d9857ee is what makes it harmless.
Correction to d9857ee's message, so the record is not wrong: it claims the localhost/domain split is
latency changing the attach/close ordering. That is plausible and it is NOT what was demonstrated —
the server-side fix alone did not help. It is still worth having (a stale close silencing a live
client is real, and so is the idle GC gate), but the asymmetry is unexplained and the client drop
above is what actually stopped a message.
Client bundle changes, so this needs a hard reload as well as a restart. Not verified in a browser.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reverts 66a41d0 and bc13450. Both were justified by reasoning that measurement then contradicted:
the chat socket was never the fault. What actually fixed chat was tearing down and restarting the
whole pm2 ecosystem, so the failure lived in process state, not in this hook.
Leaves the tree identical to 31ffe08 — the pre-multi-server baseline Andre asked for — apart from
docs/agent-git-identity.md.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Follow-up to bc13450, found by actually driving a browser instead of reasoning about one. The
deferred close keeps a remount's socket alive mid-handshake, but `connect` only treated OPEN as
"already ours" — so the re-run built a second socket, overwrote socketRef, and left the first open
forever with its `open` handler bailing on the mismatch. CONNECTING now counts too.
What the browser actually says, headless Chrome against this server, fresh load of /chat/new:
#1 NEW wss://…/api/chat/ws?token=…
#2 NEW wss://…/api/chat/ws?token=…
#1 OPEN
#2 OPEN (neither ever closes, 12s)
header: green dot, no "Disconnected"
So the served code CONNECTS on a fresh load and the Disconnected report could not be reproduced
here — which points the remaining report at the client's cached bundle rather than at this code. The
chunk hash moved e3jsfax5 -> 81jec45w across these edits, so the rebuild is reaching the wire.
Two sockets per load survive this fix and are NOT what it addresses: they come from two separate
`useChat` instances mounting on that route, each with its own refs, so no per-instance guard can see
the other. Left alone deliberately — both connect, and one conversation opening two agent sockets
wants understanding before a fix.
Also retired here: my claim that StrictMode's double-invoke was the trigger. The served bundle has no
dev-only React internals at all (`doubleInvokeEffectsOnFiber`, `runWithFiberInDEV`,
`commitPassiveUnmountEffectsInsideOfDeletedTree`: zero hits), because pm2 runs `bun start` with
NODE_ENV=production.
Typecheck clean. Repro harness is in the session scratchpad, not committed.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Re-applies bcb3d6d, which the tabs/panes revert (0a4ff54) took out as collateral: the fix lived in
useChatWebSocket.ts, so reverting the panes work reverted it too. It was never panes-specific — the
mechanism is React remounting a subtree, which happens on this screen with one conversation just as
it did in a pane.
The cleanup closed the socket while it was still CONNECTING, and the replacement was closed in turn,
so the view churned and sat on Disconnected forever. The close is now deferred a tick and cancelled
if the effect re-runs: a remount reclaims the live socket, a real unmount has nobody to cancel it.
Diagnosed from the browser this time rather than guessed. A raw socket opened by hand from the
console on the same origin, with the same token, reports RAW OPEN and stays open:
new WebSocket(`wss://${location.host}/api/chat/ws?token=${localStorage.getItem('BEARER_TOKEN')}`)
so transport, auth, the tailnet proxy and the server are all fine and the app was closing its own
socket. Two earlier theories are dead and worth naming: the token resolution mismatch (52d5678) does
not apply — the token IS in localStorage.BEARER_TOKEN where the old code looks — and StrictMode's
double-invoke is not the trigger here, since pm2 runs `bun start` with NODE_ENV=production where
React does not double-invoke. Some other remount is.
Not verified in a browser yet: whether this alone clears Disconnected. If it does not, the remaining
suspect is a continuous remount rather than a single one, which a WebSocket-constructor counter in
the console will show as a rising count.
Typecheck clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Andre wants to log out and log back in against a single server, so this takes out dc6b623 and my
token-resolution change with it — the latter first, because it was written against
useServerClient, which dc6b623 introduced.
Gone: the connections store, the server chips, the per-server client and the per-server socket
url. `useClient()` is back to one origin, `/api`, and the session it already holds. The chat
socket url is back to what it was:
const token = localStorage.getItem('BEARER_TOKEN');
const wsUrl = `${protocol}//${window.location.host}/api/chat/ws?token=${token}`;
Verified: the staged tree is byte-identical to dc6b623^ across all of src/.
Two things he should know rather than discover.
The old line reads localStorage and nothing else — the same single spelling I widened an hour ago
and have now removed again. If his token is NOT in localStorage, this code fails exactly as
before, and worse: a missing one interpolates as the literal string "null" rather than an empty
value. Reverting cannot fix that class of problem; it restores it.
`officer.connections.v1` stays in his browser's localStorage with alpha's API key in it. Nothing
reads it now, so it is inert, but it is a credential sitting in a store nobody owns any more and
should be cleared by hand.
Typecheck clean. 600 pass, 2 fail — cliamp and pty, unchanged all evening and unrelated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reported after the revert: the app loads, the old layout is back, history lists — and the socket
never reaches connected.
The two doors disagreed. `createClient` accepts a token from seven places: window.officerBearerToken,
two body datasets, an `?officerToken=` query param, PERTENTO_EDITOR_AUTH_TOKEN, localStorage and
sessionStorage. The chat socket url read exactly one of them, `localStorage.BEARER_TOKEN`, so a
token held anywhere else authenticated every HTTP request and left the WebSocket with a bare
`?token=`.
That failure is silent and reads as a dead server: verified here, an empty token closes with 1002
"Expected 101 status code", and the hook's retry loop repeats it forever. Nothing logs a missing
credential, so the app looks fine in every way except the one that matters.
Resolution is now one exported function, `resolveBearerToken`, used by both. The point is that it
cannot be re-spelled: this bug is the second spelling drifting from the first.
Predates the tabs work and survived reverting it, which is the evidence it was never a panes bug.
Not fixed here, same shape, left alone deliberately: Terminal, Desktop, AudioStreamPlayer, the
pipeline and task runners, JobDetail and EmailList all build socket or fetch urls from
`localStorage.BEARER_TOKEN` directly and will fail identically for the same user.
Typecheck clean. 600 pass, 2 fail — cliamp and pty, unchanged and unrelated. Not verified in a
browser; Andre has the only client that reproduces it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Andre asked for zero, not another fix on top. Reverts ec4f06a..7726c9f — the ten commits from
"tabs and panes" onward: the tab bar and pane splitting, tab renaming and its page title, the
per-server directory picker, the render-loop fix, pane transcript resolution, the send queue,
the two socket fixes from the other session, the pane-socket notes, and my own socket-set change
from tonight. He is rebuilding from here.
Deliberately KEPT: dc6b623, "talk to two officers at once from one browser". That was a separate
ask that predates the tabs one, and the multi-server client, the server chips and the connections
store stand on their own without panes. Reverting it too is one more command if that was the
intent.
Collateral, worth naming: cb7ab55 carried an unrelated MusicPlayerHost change alongside its
socket instrumentation, so that came out with it.
Reverts, not a reset — every one of these is pushed and a second session is live in this repo.
Typecheck clean. 600 pass, 2 fail — cliamp path-escape and the pty transport test, both failing
identically before this and unrelated to chat.
What is NOT explained by this revert: the browser symptoms tonight. The server was verified good
throughout — two real turns streamed back through the public URL on both models, and the full
2,281-message history came through nginx intact. Whatever the client fault is, it is still
unfound, and the pre-tabs code is where it now has to be looked for.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Two things.
The music now-playing restore is disabled on the web. The music sidecar is not running on
every machine that serves this app, so every page load fired /music/now-playing and logged a
503 in the console of a browser that was not there for music. Restoring a paused track is a
nicety; a permanent error on every load of every screen is not. The player is untouched — it
simply no longer asks what WAS playing.
And the chat socket now logs its own lifecycle: create, open, close with code and whether it
was stale or tearing down, every message received, and every message sent or queued with the
socket readyState. window.__officerWs = false turns it off.
This is instrumentation I should have added two rounds ago. A pane connects and then sits
silent, and I have now reasoned from this hook source three times without explaining it — the
browser says a socket closed and never says who closed it or whether the message left. The
handover doc says instrument before theorising and I did not follow my own note.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
A pane on a remote server never connected: the console showed the socket closing before the
handshake finished, over and over, and the pane sat on Disconnected.
The stack named it — commitPassiveUnmountEffectsInsideOfDeletedTree plus
doubleInvokeEffectsOnFiber. The pane subtree is deleted and remounted, and the cleanup closed
the socket each time, while it was still CONNECTING. The replacement was then closed in turn.
React dev StrictMode double-invokes every effect on mount, so a fresh pane could churn
forever and never hold a connection.
The cleanup cannot tell a remount from a real unmount at the moment it runs, so it no longer
tries: the close is deferred a tick and cancelled if the effect re-runs. A remount reclaims
the live socket and the handshake completes; a real unmount has nobody to cancel it and
closes a frame later, which costs nothing.
Ruled out beforehand, by direct test: alpha accepts that exact key over wss on the first try,
with and without a browser Origin. The server was never involved.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Reported from the mac: the alpha pane opened and read fine, and sending produced nothing at
all. The console showed the socket closing before it was established.
send dropped the message — readyState !== OPEN returned, silently, no error and no retry — so
enter did nothing and no turn ever started. Alpha was never at fault: the same key opens that
socket from outside the browser on the first try.
The window is not rare. React dev StrictMode double-invokes effects, so every socket is
created, closed and recreated on mount, and a reconnect reopens it again; with three chat
panes there are three sockets doing it at once, and one is always briefly not OPEN. One pane
with one stable socket is why this never bit before.
Queued and flushed on open, in order, after the resume/attach handshake rather than in front
of it. Bounded at 50 so a socket that never returns cannot grow it without limit, oldest
dropped first because the newest message is the one being waited on.
The mobile chat app has had this queue all along, for this exact reason. I read it this
morning, wrote the reason down, and did not port it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The chat app on the iPad does this already and this is its model, not the music app one.
Music keeps its active server — one library at a time is the right question there. Chat is
the exception: two panels side by side, one on the laptop and one on alpha, both live, no
switching.
The mechanism is one string. A panel holds a serverId; that same string picks the base URL,
the credential, the websocket host and the tail of the react-query key. Nothing global is
consulted when it is named, which is exactly why two can be live at once — there is no
active server in connections.ts at all, because there is nothing to switch.
THIS ORIGIN IS NOT IN THE LIST. It is represented by null, so every existing useClient()
call is untouched and adding a connection cannot break the app you are already signed into.
That property is what makes this shippable before anyone has tried it.
A second server is reached with an ofk_ API key minted there, verified against /api/auth/me
before it is stored — a URL typo and a key from the wrong machine are otherwise
indistinguishable from an empty conversation list an hour later.
Copied deliberately from the mobile code: the base URL is derived per call rather than
memoised (a cached one hands back whichever server was asked for first), the row stamps its
server onto the selection BEFORE navigating (or the resolver reads the transcript from this
origin, where two officers can hold the same uuid), and changing server clears the cwd and
the open conversation, because a path from the machine you left names nothing on the one you
arrived at.
Not yet opened in a browser. Typecheck and 602 tests pass, and the cross-origin request with
an API key is verified by curl, but no human has clicked any of this.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ALL_DOCK_ITEMS was a hardcoded list of everything, so a fresh machine offered Photos, Jellyfin,
Transmission and the rest — each leading to a screen reporting itself unavailable — and adding a sidecar
meant editing the shell. Neither survives sidecars shipping from their own repositories.
Split in two. CORE_DOCK_ITEMS is the baseline that exists on every install: chat, files, terminal, the
app's own screens, and Gitea, which is in the light profile because it fronts a remote instance.
Everything else is derived from installed sidecars' UI manifests, delivered with /capabilities.
Sent with the capability answer rather than fetched separately so the dock has ONE source. Two requests
means two moments, and a dock rendered between them shows a tile for something uninstalled or nothing
for something installed. Filtered by capability server-side too: a member is not handed the manifest of
a feature they cannot use, because "hidden in the client" is the kind of privacy that lasts until
someone opens the network tab.
Verified live. The owner — who bypasses every permission check — does not bypass this: /photos is absent
from routes and present in deniedRoutes because Photos is not installed. Flipping a row's `enabled`
makes its tile leave and return with no process touched.
Two things fell out. A manifest can declare extraTiles, because CalDAV is one sidecar presenting as
Calendar AND Contacts, and collapsing them to keep the model tidy would make the app worse. And
DEFAULT_DOCK_PATHS no longer pins /music: useDock drops a path with nothing behind it, so the default
dock came up a tile short on any machine where Music was never installed — a default that references an
optional feature is how an app looks subtly wrong on a fresh install for no stated reason.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Maximize could only ever stop below the nav header — the content region is an `absolute z-2` stacking
context and the header a `fixed z-10` sibling, so that was the deepest a panel could get on its own.
Full screen reaches the rest by asking the shell to stand its header down, which leaves the shallow
version as a state nobody picks on purpose.
So it goes, and the two lights with it. `MaximizeMode` and the `{ id, mode }` session value collapse
back to a bare `fullscreenPanelId` — renamed because "maximized" would now be a lie about what it does
— under a new `FULLSCREEN_PANEL:` key, so a tab open across this reads nothing rather than an object
where a string belongs. `MaximizeButton` is gone; locked screens keep only the fullscreen toggle, which
writes no layout and so was always the one control the lock could permit.
Red stays. The amber used to REPLACE it while maximized so the way out could never be a way to delete;
with amber gone that guard would have cost the close button entirely, and red is already absent exactly
where it should be — locked screens render no traffic lights at all.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Also found uncommitted in the shared tree; unrelated to agent panels, so it lands
on its own.
`reset` closed over `initialValue` from the first render, and its `useCallback` dep
list deliberately omitted it — with an eslint-disable to silence the warning that was
correctly pointing at the bug. Any caller whose default is computed (derived from
props, from a fetch, from another piece of state) got reset to whatever that default
happened to be on mount, which after the first render is the wrong value.
Reads through a ref instead, so reset always sees the current default. The
eslint-disable goes away because there is nothing left to suppress — the dep list is
honest now.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
adding an email account failed with a bare "failed to add account" toast. three
defects stacked, each hiding the next.
the email sidecar's http.ts reconstructs what the platform's middleware used to
provide, but only did two of three — bodyParser was never remounted, so every
write route read ctx.get('body') as undefined and POST /accounts threw on
body.provider before ever reaching the credentials.
its onError then read `.status` off the thrown custom-error, which carries
`statusCode`. every deliberate 4xx fell through to the 500 branch and had its
message replaced with "internal error", so a rejected IMAP login and a genuine
crash looked identical. it also answered JSON where the rest of the api answers
errors as plain text. now mirrors hono.ts's handler rather than inventing a
second shape.
useClient threw a plain object, so the ~33 sites narrowing with
`err instanceof Error ? err.message : <fallback>` always took the fallback and
discarded the server's message. now throws an ApiError subclass keeping both
status and message, so those sites start surfacing real errors.
only email reads ctx.get('body'); every other sidecar is a pure proxy.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Four channels were bare string literals repeated across files, with the payload type supplied by each
caller. Neither hole errors: a typo yields a different, empty channel — publisher publishing into nowhere,
subscriber waiting forever — and a publisher and subscriber can simply disagree about the payload with
nothing to check them. defineChannel(name, initial) returns the hook, officerdev/src/channels.ts declares
the four, and every usePanelChannel call site in the repo now passes a shared constant.
files:refresh-signal was bumped two different ways: Date.now() at the Chat sites, setSignal((n) => n + 1)
at the FileViewer ones. The increment is wrong — useGlobal's functional setter applies against the value
captured at render, so two bumps in one render window both compute snapshot + 1 and the second writes the
same number as the first. Nobody re-reads and the file that was just written stays stale. Date.now() has
the same flaw at millisecond scale, and the four FileViewer sites (save, delete, extract, transcribe) sit
close enough to hit it. useFilesRefresh's bump is a module counter that never reads React state, so it is
right however many times it is called between renders, and it is identity-stable through a ref because
useGlobal's setter is a fresh closure every render and this goes into dependency lists.
system-settings:run-command is deleted. It had a writer once — 7c0b11c wired the AI harness installer to
it — and when that install moved server-side to POST /server-settings/chat-providers/install the write
went with it, leaving a channel whose only remaining writes were clears, a terminal pane nothing could
open, and a second layout nothing could select.
PanelComponentEntry's component, header and provider are typed with { panelId: string }, which is what
PanelSlot has always rendered them with. A no-prop component is still assignable, so no screen changed.
chat:active-session and preview:refresh are declared but still have no subscriber. preview:refresh has no
plausible one — the PreviewProvider that read it is gone from the repo — but both are published by the
chat panel, and that is not this branch's to change.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`<AppRegistry />` and `<WidgetRegistry />` seeded through `useGlobal`'s `initialData`, which is not a
write: it applies only to whichever component reads the slot first. They worked entirely by sitting
above `<App />` in frontend.tsx — any WorkspaceView that rendered first would have created the slot as
`{}`, with no second chance, and drawn every panel on that screen as an empty box.
Both are now plain functions taking the QueryClient, called before createRoot().render(). They take the
client rather than running as a module-scope side effect because the app list imports every panel app
and every panel app imports the Workspace framework; keeping the call in frontend.tsx, the one module
that is nobody's dependency, is what stops that being an import cycle. Making useAppRegistry default to
the static list was the obvious fix and is exactly that cycle.
registerApp and registerWidget go with the components. Nothing ever called either, and a registry that
can be added to at runtime is a registry whose contents depend on what has mounted so far.
Separately: officerdev/file-viewer was a registration for a provider fed by a `file-viewer:<panelId>`
channel that nothing writes, with availableOnPanel: false so it could not be picked either. The file
viewer users actually see is an ephemeral panel from useFileViewerPanels, which supplies the body and
header itself and reads the path from the URL. No stored layout referenced the key — zero rows across
dashboards, screens, dashboard_defaults, user_state and user_settings — so the meta and its wrapper are
deleted rather than repaired.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
useCapabilities is the frontend's view of the model and explicitly NOT its
enforcement — hiding a dock icon is a courtesy, the 403 in origin-validation
is the lock. so it fails OPEN: if the request errors the full dock renders.
a member clicking through to a 403 is a bad minute; an owner locked out of
their own platform by a transient network error is an incident, and the
server refuses what it should refuse either way.
the endpoint returns held routes AND denied routes, because absence from the
held list cannot distinguish a route this account lacks from one no
capability claims at all — `/`, the settings shell — and a guard that cannot
tell those apart either blanks the app or guards nothing. i wrote the first
version without the second list and it silently permitted everything.
`can` and `canVisit` are memoised on the query data. a verb rebuilt every
render gets a new identity every render, which is how every playback report
in the jellyfin player was disabled for days; the dock filter puts one in a
useMemo dependency list, so it would have been the same bug.
the permissions screen is one role at a time, with an explicit save and a
dirty state, rather than a roles-by-capabilities grid — a grid invites
reading across rows, which is not a question anyone has, and makes revoking
gitea for every member one click among fifty. it also states plainly why
terminal, chat, files and the rest are absent, so their absence reads as a
decision rather than as a missing feature.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Every verb ended in an unconditional res.json(), which throws
"Unexpected end of JSON input" on 201/204 responses that carry no body —
so a request that actually succeeded still surfaced as an error (e.g. a
sent chat message toasting a failure). Read text first and only parse
when non-empty, otherwise resolve undefined. Non-empty JSON is unchanged.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Completes the turn/session decoupling so nothing is lost across disconnects.
Phase 2 (durability):
- New chat_session_events table (global monotonic id = cursor) + queries
appendChatEvent / getChatEventsSince / pruneChatEventsOlderThan.
- Every durable outbound ServerMessage now goes through emitToSession: appended
to the queue (even while the client is disconnected) and delivered live with
its seq. Streaming deltas stay ephemeral (live-only, never persisted).
Phase 3 (resilient transport):
- New 'resume-cursor' client message → handleResumeCursor re-binds the socket to
the (still-live) session (cancels idle-GC via attachWs) and replays every event
since the client's cursor.
- useChatWebSocket already auto-reconnects; added an onOpen hook. useChat tracks
the max seq and, on every (re)connect with an established session, sends
resume-cursor — so a dropped connection self-heals with no manual navigate
away/back, and background task notifications that landed while offline replay.
Verified end-to-end: disconnect after a turn's result but before a background
task finishes, reconnect with the cursor → the missed task:notification is
replayed from Postgres, no duplicates.
Note: the DB is managed via drizzle push/direct DDL (no __drizzle_migrations
table), so 0001 was applied directly; the generated migration is committed for
the record.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Every verb ended in `return data as T | any`, and `T | any` collapses to `any` —
so client.get<Foo>() handed back `any` and no annotation downstream meant
anything. That was the source of most of the implicit-any errors: the callbacks
had nothing to infer from.
Returning `as T` drops the whole class (19 errors to 9) rather than annotating
each parameter. Two calls in useAuth were relying on the looseness and now
declare their response shapes.
signin also no longer stores `undefined` as the bearer token when the server
withholds one; that path returns early.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer is single-user: the server owner is the only account, created once by
/auth/bootstrap. Everything that existed to serve additional users was
unreachable, so it is gone rather than left looking like it does something.
Accounts: drop the invite / resend-invite / delete / list-users routes and the
Users settings screen, the inert /auth/signup handler, and the account
verification chain it fed (verify, resend-verification, VerifyScreen, the
UserInvite + VerifyAdmin + VerifyRegistration templates). /auth/verify-token
survives for password resets only, and now requires a reset-password token
rather than accepting any signed JWT.
Roles: drop the users.role column and the four-value USER_ROLES enum. The
permissions table granted every role identical methods, and every
role === 'Super Admin' check was permanently true. The JWT no longer carries a
role claim.
Sandbox: remove sidecar/sandbox.ts and its five call sites. bwrap was selected
only for non-Super-Admin users, so it never ran. It was also not a usable agent
jail as written — --share-net, the project root (with .env) bound read-only,
and runuser dropping to the server's own uid. Rebuilding it for agent
containment would be a different construction, and git history keeps this one.
getHomeDir keeps its DATA_PATH meaning; the new getOwnerHomeDir resolves the
owner's real login home, which is what terminals, chats and task runs use.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
pastilhas
