- Added seed-security.ts with comprehensive audit data for all 5 projects
- Real findings from actual code inspection: auth, CORS, rate limiting,
error handling, dependencies, TLS certs, infrastructure
- 35 audit entries across Hammer Dashboard, Network App, Todo App, nKode,
and Infrastructure
- Fixed unused deleteAudit import warning in SecurityPage
- New todos table in DB schema (title, description, priority, category, due date, completion)
- Full CRUD + toggle API routes at /api/todos
- Categories support with filtering
- Bulk import endpoint for migration
- New TodosPage with inline editing, priority badges, due date display
- Add Todos to sidebar navigation
- Dark mode support throughout
- Backend: daily_summaries table, API routes (GET/POST/PATCH) at /api/summaries
- Frontend: SummariesPage with calendar view, markdown rendering, stats bar, highlights
- Sidebar nav: added Summaries link between Activity and Chat
- Data population script for importing from memory files
- Bearer token + session auth support
- New /api/activity endpoint returning combined timeline of progress notes
and comments across all tasks, sorted chronologically
- Activity page now fetches from unified endpoint instead of extracting
from task data client-side
- Type filter (progress/comment) and status filter on Activity page
- Comment entries show author avatars and type badges
- 30s auto-refresh on activity feed
- New task_comments table (separate from progress notes)
- Backend: GET/POST/DELETE /api/tasks/:id/comments with session + bearer auth
- TaskComments component on TaskPage (full-page view) with markdown support,
author avatars, delete own comments, 30s polling
- CompactComments in TaskDetailPanel (side panel) with last 3 + expand
- Comment API functions in frontend lib/api.ts
- Extract pure utility functions to lib/utils.ts for testability
- Add 28 unit tests covering: computeNextDueDate, resetSubtasks,
parseTaskIdentifier, validators, statusSortOrder
- Add Gitea Actions workflow (.gitea/workflows/ci.yml) that runs
tests and type checking on push/PR to main
- Refactor tasks.ts to use extracted utils
- Added recurrence field (daily/weekly/biweekly/monthly) to tasks schema
- Backend: auto-creates next task instance when recurring task completed
- Copies title, description, assignee, project, tags, subtasks (unchecked)
- Computes next due date based on frequency
- Optional autoActivate to immediately activate next instance
- Frontend: recurrence picker in CreateTaskModal and TaskDetailPanel
- Recurrence badges (🔄) on TaskCard, KanbanBoard, TaskPage, DashboardPage
- Schema uses JSONB column (no migration needed, db:push on deploy)
- Added tags (JSONB array) to tasks schema with full CRUD support
- Tag editor in TaskDetailPanel with chip UI, Enter/comma to add, Backspace to remove
- Tag badges on TaskCard, KanbanBoard cards, and DashboardPage
- Sort controls on QueuePage: sort by priority, due date, created, updated, name
- Sort direction toggle (asc/desc) with persistence to localStorage
- Tag filter dropdown in QueuePage header (populated from existing tags)
- Search now matches tags
- Backend: tags in create/update, progressNotes in PATCH body
- Schema: added due_date and subtasks JSONB columns to tasks
- API: CRUD endpoints for subtasks (/tasks/:id/subtasks)
- API: due date support in create/update task
- TaskDetailPanel: due date picker with overdue/soon badges
- TaskDetailPanel: subtask checklist with progress bar
- TaskPage: full-page task view at /task/HQ-{number}
- Dashboard: task cards link to detail page, show subtask progress & due date badges
- Migration: 0001_mighty_callisto.sql
- Updated webhook notification message to use dash domain
- Caddy now proxies /hooks/* to gateway, blocks all other paths
- Control UI no longer exposed publicly
- Added assignee_id and assignee_name columns to tasks table
- PATCH /api/tasks/:id now accepts assigneeId and assigneeName
- db:push on startup will auto-migrate the columns
- Single domain for hooks + WebSocket (path-based routing)
- No need for ws.hammer or hooks.hammer subdomains
- Caddy proxies everything to gateway on this VPS
- Add React Router with sidebar layout (DashboardLayout)
- Queue is now a routed page at /queue
- Chat placeholder page at /chat
- Admin page accessible from sidebar
- Dark sidebar with amber accent for active nav
- Updated CORS and auth to support dash.donovankelly.xyz
- Renamed to Hammer Dashboard
- Webhook URL must be set via env var (no fallback)
- Webhook URL must start with https:// or it's rejected
- Both URL and token required, skip silently if missing
- Default CLAWDBOT_HOOK_URL to VPS hook-proxy (72.60.68.214:18790)
- Add default CLAWDBOT_HOOK_TOKEN in compose for Dokploy deploys
- Add extra_hosts for host.docker.internal resolution
- Queue backend on remote server can now reach Clawdbot gateway
- All logged-in users can create/edit/manage tasks (no bearer token needed)
- Added user role system (user/admin)
- Donovan's account auto-promoted to admin on startup
- Admin page: view users, change roles, delete users
- /api/me endpoint returns current user info + role
- /api/admin/* routes (admin-only)
- Removed bearer token UI from frontend
- Bearer token still works for API/bot access
- Add serial task_number column to tasks table
- Display HQ-{number} on cards and detail panel
- API resolveTask() supports UUID, number, or HQ-N prefix
- GET /api/tasks/:id endpoint for single task lookup
- All PATCH/POST/DELETE endpoints resolve by number or UUID
- Add better-auth to backend and frontend
- Create auth tables (users, sessions, accounts, verifications)
- Mount BetterAuth handler on /api/auth/*
- Protect GET /api/tasks with session auth
- Add login page with email/password
- Add invite route for creating users
- Add logout button to header
- Cross-subdomain cookies for .donovankelly.xyz
- Fix page title to 'Hammer Queue'
- Keep bearer token for admin mutations (separate from session auth)
- Update docker-compose with BETTER_AUTH_SECRET and COOKIE_DOMAIN
- Backend: Elysia + Bun + Drizzle ORM + PostgreSQL
- Frontend: React + Vite + TypeScript + Tailwind CSS
- Task CRUD API with bearer token auth for writes
- Public read-only dashboard with auto-refresh
- Task states: active, queued, blocked, completed, cancelled
- Reorder support for queue management
- Progress notes per task
- Docker Compose for local dev and Dokploy deployment
