7 Commits

Author	SHA1	Message	Date
Antigravity	bd495be965	feat: design system overhaul — sidebar, AI chats, settings, brainstorm, color cleanup ... - Sidebar: dynamic brand-accent colors, brainstorm section restyled - AI chat general: popup panel with expand/collapse, hides when contextual AI open - AI chat contextual: tabs reordered (Actions first), X close button, height fix - Settings: all tabs restyled, 6 new color presets (sage, terracotta, iron, etc.) - Global color cleanup: emerald/orange hardcoded → brand-accent dynamic - Brainstorm page: orange → brand-accent throughout - PageEntry animation component added to key pages - Floating AI button: bg-brand-accent instead of hardcoded black - i18n: all 15 locales updated with new AI/billing keys - Billing: freemium quota tracking, BYOK, stripe subscription scaffolding - Admin: integrated into new design - AGENTS.md + CLAUDE.md project rules added	2026-05-16 12:59:30 +00:00
Antigravity	718f4c6900	perf: optimize MCP server (O(1) auth, compact JSON, trashedAt fix) + memento-note performance (lazy loading, server-side filtering, XSS fixes, dead code removal, security hardening) ... MCP Server: - Fix validateApiKey: O(1) direct lookup by shortId instead of loading all keys - Add trashedAt:null filter to ALL note queries (trashed notes leaked in results) - Compact JSON output (~40% smaller responses) - Bounded session cache (Map with MAX_SESSIONS=500) to prevent memory leaks - PostgreSQL connection pooling (connection_limit=10) - Rewrite all 22 tool descriptions in clear English - Fix /sse fallback to proper 307 redirect memento-note Performance: - loading=lazy on all note images - Split notebooksRefreshKey from global refreshKey (note CRUD no longer re-fetches notebooks) - Remove searchKey from trash count deps (no re-fetch on every keystroke) - Server-side notebookId filter in getAllNotes() (biggest win) - Skip collaborator fetch for non-shared notes (eliminates N+1 API calls) - next/dynamic for MarkdownContent + 4 modals (code-split remark/rehype/KaTeX) - Memoize DOMPurify sanitize with useMemo Security: - XSS: DOMPurify sanitize in note-card and note-history-modal - Auth anti-enumeration: uniform errors in auth.ts - CRON_SECRET mandatory on cron endpoints - Rate limiting on login (5 attempts/min per email) - Centralized API auth helpers (requireAuth/requireAdmin) - randomize-labels changed GET→POST - Removed debug endpoints (/api/debug/config, /api/debug/test-chat) Cleanup: - Removed dead code: .backup-keep, settings-backup, fix-*.js, debug-theme, fix-labels route - Removed sensitive console.error in auth.ts - Ollama fetchWithTimeout (30s/60s AbortController) - i18n: full Arabic translation, Farsi missing keys - Masonry drag-and-drop fix (localOrderMap, cross-section block) - Sidebar notebook tooltip on truncation	2026-05-03 18:41:38 +00:00
sepehr	fa72672aac	security: fix critical auth gaps, SSRF, IDOR, and embedding error handling ... CRITICAL: - Add auth + admin check to 10 unprotected API routes (test-*, debug/*, config, models, fix-labels) - Add CRON_SECRET bearer auth to /api/cron/reminders (was fully open) - Add SSRF protection to getOllamaModels (blocks private/internal IPs) HIGH: - Fix getAllLabels() missing userId filter (leaked all users' labels) - Fix /api/labels OR clause leaking other users' labels - Fix IDOR in toggleAgent/getAgentActions (add ownership check) - Fix getEmbeddings() returning [] on error in all 5 providers (corrupted semantic search with NaN cosine similarity) — now throws instead Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-30 21:02:13 +02:00
sepehr	9779dd7a79	fix: refresh agents on tab focus + hide stale nextRun + add cron logging ... - Add visibilitychange listener: refreshes agent data immediately when user returns to the tab (more reliable than interval-only polling) - Only show toast for actions created within last 5 minutes to avoid false positives on page reload - Hide "Prochaine exécution" line entirely if nextRun is in the past instead of showing confusing "En attente de déclenchement" - Add detailed logging to cron endpoint for debugging Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-26 13:16:32 +02:00
sepehr	f0999263a0	fix: remove nextRun recalculation from getAgents() that blocked cron ... The getAgents() function was recalculating nextRun to future dates when it found past values. This prevented the cron scheduler from ever finding due agents (nextRun <= now was always false since getAgents had already pushed it to the future). Also fix toast polling: use null sentinel for agents without initial actions so first execution is still detected. Limit cron to 3 agents per cycle and add logging. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-26 13:00:55 +02:00
sepehr	73de1cd26d	feat: implement agent scheduled execution with cron and time picker ... - Add scheduledTime, scheduledDay, timezone fields to Agent schema - Create calculateNextRun() helper with timezone-aware scheduling - Add POST /api/cron/agents endpoint for external scheduler - Calculate nextRun on agent create, update, and after execution - Add time/day picker in agent form (daily/weekly/monthly) - Show "Next run" countdown in agent card - Add i18n keys for schedule UI (FR + EN) External scheduler (N8N, Vercel Cron) should call /api/cron/agents every 5-15 min. Requires `prisma db push` to apply schema changes. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-26 10:45:48 +02:00
Sepehr Ramezani	e4d4e23dc7	chore: clean up repo for public release ... - Remove BMAD framework, IDE configs, dev screenshots, test files, internal docs, and backup files - Rename keep-notes/ to memento-note/ - Update all references from keep-notes to memento-note - Add Apache 2.0 license with Commons Clause (non-commercial restriction) - Add clean .gitignore and .env.docker.example	2026-04-20 22:48:06 +02:00