Replace broad `.env*` ignore rule with explicit entries for real env files (`.env`, `.env.local`, `.env.development`, `.env.test`, `.env.production`) while preserving `.env.example` and adding exceptions for the new `.env.development.example`, `.env.test.example`, and `.env.production.example` templates.
Add environment-specific example files to document required variables for development, test, and production setups, including API base URLs, WebSocket endpoints, API timeouts, Auth.js secret, OAuth credentials (Google, Facebook), and Cloudflare CDN configuration.
Introduce a tracked .env.example file documenting all required environment
variables (app env, API/WebSocket base URLs, timeouts, Google/Facebook OAuth
credentials, Cloudflare CDN zone/token). Update .gitignore to allow this
file despite the blanket .env* ignore rule. Also simplify the push
success/failure output in scripts/deploy/_deploy_lib.sh by removing
verbose troubleshooting hints.
Adds a `git_hooks/post-receive` script that runs `pnpm run build:start`
(equivalent to `next build && next start`) automatically after a push is
received, enabling deployment on `receive.denyCurrentBranch=updateInstead`
configured repos (e.g., production/test servers).
Updates the README with a new "Git Hooks" section explaining:
- How to enable the hooks locally via `git config core.hooksPath git_hooks`
- That `core.hooksPath` is a local config and must be set per clone
- That `post-receive` fires on the receiving (push target) machine, not
the local dev machine
- Move AiDisclosure and EmptyState logic into a new AiDisclosureBanner component
- Remove isGuest prop from ChatArea as it's no longer needed there
- Update styling with explicit color values for better visibility
- Remove redundant `loadingMoreHistory` and `ready` states from chat machine, consolidating history loading flow
- Add `align-self: flex-start` to chat row container for proper alignment
- Clean up commented-out margin rules in text bubble styles
- Update deploy script GIT_REMOTE from "server" to "test"
- Split chat state machine actors (chatInit, sendMessageHttp, loadMoreHistory, chatWebSocket) into a dedicated module
- Add comprehensive console logging across the chat state machine for full trace debugging
- Comment out margin on text bubble CSS for layout adjustment
- Add debug logging to chat input bar send handler
- Clean up redundant comments in auth-screen component
- Remove ChatScreenVisible and ChatScreenInvisible events from chat state machine
- Remove legacy ChatInit event handler
- Migrate state transitions to use absolute references (#chat.guestSession, #chat.userSession, #chat.idle)
- Adjust legal text wording for Cozsweet privacy agreement
Next.js Image scans only inline style for 'auto' to determine whether
sizing is fully delegated to CSS. The .logo class already sets
height: var(--auth-logo-height) and width: auto, but the inline auto
hint is required to suppress the width/height-modified warning.
Applies to both auth-facebook-panel and auth-email-panel where the same
login logo is rendered.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update auth-legal-text copy to "I agree to the Cozsweet Privacy
Agreement and Terms of User", keeping the two external links.
- Center the Facebook icon and "Login with Facebook" label as a group
inside the main Facebook button (change .facebookLabel flex).
- Apply the same centering to the shared AuthSocialButton .label rule
so the Email and Facebook entries in the "Other Sign-in Options"
bottom sheet also render icon+text centered.
Co-Authored-By: Claude <noreply@anthropic.com>
- chat-screen no longer manages WebSocket directly; it now dispatches three
auth lifecycle events (ChatGuestLogin, ChatNonGuestLogin, ChatLogout)
derived from auth.loginStatus
- chat-machine internally owns the WebSocket long-lived actor via
fromCallback, completing the previously deferred migration scope
- removed ChatWebSocket import, getWsToken helper, and direct WS
effect from chat-screen; renamed dispatchInitialLoad to
dispatchAuthLifecycle to reflect the new responsibility
- decouples auth from chat machine via event-driven boundary: machine
stays unaware of loginStatus, guest semantics live at the dispatch
layer (guest → skip WS, non-guest → connect with token)
The screen-lifecycle events were dead code: the transitions in chat-machine
(idle <-> ready) had no caller behavior tied to them, and the dispatches
in chat-screen.tsx were the only senders. Drop the union members, both
state transitions, and the mount-effect dispatches.
The idle state remains declared as initial but is no longer reachable
at runtime; can be refactored in a follow-up.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove ChatAuthStatusChanged dispatch from auth login flow; chat screen now subscribes directly to auth state machine (loginStatus) to derive isGuest and drive WS lifecycle
- Gate quota-exceeded and warning dialogs to guests only (non-guests have no message limit)
- Dispatch ChatLoadMoreHistory for non-guest initial load vs ChatInit for guests
- Fix AppConstants import path from @/core/constants/app_constants to @/core/app_constants
- Add defensive isGuest checks in quota effects to prevent non-guest quota triggers
TextBubble now fills the available half-row width instead of being
capped at 75%. Add 16px margin on the avatar-side edge (margin-left
for AI, margin-right for user) so short messages still feel airy
and long messages are no longer artificially clipped.
Co-Authored-By: Claude <noreply@anthropic.com>
Move breakpoints, fonts, and app_constants into the core directory for better organization:
- Move src/lib/breakpoints.ts to src/core/breakpoints.ts
- Move src/lib/fonts.ts to src/core/fonts.ts
- Move src/core/constants/app_constants.ts to src/core/app_constants.ts and clean up outdated comments
Skip /auth/guest round-trip on splash Skip when localStorage already
holds a valid guestToken. Avoids redundant API call (and the
fingerprintjs deviceId probe) every time the user reopens splash.
Trade-off: a server-revoked token still resolves "guest" until the
first protected API call returns 401, which the HTTP layer handles.
Co-Authored-By: Claude <noreply@anthropic.com>
- Splash Skip button now dispatches `AuthGuestLoginSubmitted` instead of
direct routing, keeping guest auth under the state machine
- Update PWA install dialog copy ("Add to Home Screen") and drop favicon
entry from manifest icons
- Add debug logging and routing sequence docs to splash-button
Integrate the Logger into `Result.wrap` so that caught exceptions are
recorded with stack trace, error type, and a `component: "Result"`
tag before being wrapped into a `Result<T>`. Errors are first
normalized via `toError` to preserve `.stack`, `.code`, and `.status`
fields, then logged through the standard pipeline (dev console in
development, JSON pipeline in production). Callers continue to receive
a `Result<T>` — re-throwing remains opt-in via `Result.unwrap`.
Add pino v10.3.1 to project dependencies for structured logging support, along with its transitive dependencies (pino-abstract-transport, pino-std-serializers, quick-format-unescaped, atomic-sleep, etc.).
Add align-self: flex-end to .bubbleRowUser so the user message row
sizes to its content and pins to the right edge of the chat area.
Combined with the existing flex-end cross-axis alignment, this places
the user avatar at the right edge with the bubble to its left,
producing a proper left-to-right AI / right-to-left user mirror.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Match the Dart lib/ui/sidebar/sidebar_screen.dart + profile_view.dart
exactly:
- White inner shell with 24px padding
- Back button row (arrow icon + "Back" text, no "Profile" header)
- Single "Other" section with one "Log out" row
- Drop profile card, Account/Data/Session sections, and Sign-in CTA
Match Flutter row visuals in the shared SettingsSection:
- Gray (#f5f5f5) rounded row pill on a white card
- 20px chevron, 1px rgba(61,49,74,0.5) divider
- Destructive color #ff6b6b, 14px/600 black section title
Add tokens: --color-settings-card-background, --color-settings-row-background,
--color-settings-divider, --color-chevron-icon, --color-destructive.
Wire the BlocConsumer listener equivalent: on currentUser transitioning to
null, dispatch ChatAuthStatusChanged + AuthReset and router.replace("/chat").
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Add AuthStatusChecker mounted in RootProviders to dispatch AuthStatusCheckSubmitted on mount. The new checkAuthStatusActor retrieves the device id, checks for an existing login or guest token, and falls back to a guest login API call when neither is present. Wires the new event/actor through the auth machine to enable automatic session restoration and guest-mode bootstrap.
Change flex-direction from column to row on .bubbleRowAi and
.bubbleRowUser so the avatar and message content render side-by-side
as the JSX and JSDoc already intend.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Wire the Google/Facebook OAuth callback flow end-to-end so the provider's id_token (Google) and access_token (Facebook) captured by NextAuth are forwarded to the backend in exchange for business tokens:
- Extend the NextAuth config with jwt/session callbacks that surface `account.id_token` / `account.access_token` to the client during first sign-in
- Add an `OAuthSessionSync` bridge mounted inside `RootProviders` that listens to `useSession()` and dispatches new `AuthGoogleSyncSubmitted` / `AuthFacebookSyncSubmitted` events
- Add corresponding actors in the auth XState machine that call `authRepository.googleLogin` / `facebookLogin`, persisting the backend's `LoginResponse` through the existing repository path
This keeps all authentication orchestrated by the auth state machine while preserving NextAuth's OAuth redirect UX.
Update the PWA install dialog styling and content to align with the
original Dart design, including a white background with large 40px
radius, 86x86 PNG icon, gradient primary button, and dynamic app title
sourced from AppConstants.
Move the `SidebarPage` and `BottomNavItem` enum definitions from
`sidebar-machine.ts` to `sidebar-state.ts` to avoid a circular
dependency between the two modules. Since both enums are tightly
coupled to the state shape (they define the value sets of
`currentPage` and `selectedBottomNavItem`), they now live alongside
the state itself.
- Move enum declarations and types from `sidebar-machine.ts` to
`sidebar-state.ts`
- Update `sidebar-events.ts` import path to reference `sidebar-state`
- Keep `sidebar-machine.ts` re-exporting `SidebarState` and
`initialState` to preserve its public API
Move new AuthPlatform(provider).signIn() out of UI components and into
the auth state machine. UI now dispatches AuthGoogle/FacebookLoginSubmitted
events; a new oauthSignIn actor inside the machine calls next-auth/react's
signIn(provider). Errors and the OAuth redirect window are exposed via
the existing state.isLoading / state.errorMessage surface, removing the
local busy / error state in auth-facebook-panel.
Co-Authored-By: Claude <noreply@anthropic.com>
- Move state management from `src/contexts` to `src/stores` (zustand-based)
- Update barrelsby config to include new stores directory
- Add bottom-sheet and auth-background components
- Auto-open browser on dev server ready in VS Code launch config
- Refresh generated barrel index files
Replace the separate FacebookLogin and GoogleLogin classes with a single
AuthPlatform class that takes a provider name ("facebook" | "google") as a
constructor argument. This consolidates duplicate OAuth sign-in logic behind
one entry point while preserving the existing NextAuth flow.
- Add new src/lib/auth/auth_platform.ts exporting AuthPlatform and
AuthProvider type
- Update auth-facebook-panel.tsx and splash-button.tsx to use the new API
- Rename initialContext → initialState in the auth machine for consistency
- Update inline docs and comments to reference AuthPlatform
No behavioral change for end users; both providers still route through
NextAuth's signIn() with the same callbacks and cookies.
Extract `<Name>Context` interface + `initialContext` const into
`<name>-context.ts` and the event union into `<name>-events.ts` for
all four state machines (auth, chat, sidebar, user) under src/stores/.
- `*-machine.ts` keeps helpers, actors, actions, and the
`setup().createMachine()` body; re-exports the types/initial value
to preserve its public API.
- `*-types.ts` re-exports from the new files for backward compatibility
(sidebar keeps enum re-exports, chat keeps GuestChatQuota).
- `index.ts` barrels updated to re-export the new files.
- Removed unused model imports (AuthMode, AuthPanelMode) from
auth-machine.ts; kept LoginType, UiMessage, UserView where still
used by actors/helpers.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Remove unused CharacterIntro export from chat components index
- Drop stale JSDoc block from splash-screen server component
- Set mobile shell background to explicit black so the desktop area outside the 500px viewport is black instead of inheriting from parent
Extract background image into a reusable AuthBackground component and restructure AuthScreen to use MobileShell as the top-level wrapper, mirroring the SplashScreen implementation.
Reorganize project structure by relocating chat-websocket and message-queue modules from `src/integrations/` to `src/core/net/` to better reflect their networking purpose and improve code organization.
Update chat-header and chat-input-text-field CSS to match the
Dart counterparts (chat_header.dart, chat_input_text_field.dart):
- Header: remove outer padding/background, use transparent base
- Guest banner: switch to --spacing-sm/md tokens
- Header row: add margin-left and symmetric padding
- Menu button: use 32px radius and #0d0b14 @ 0.7 background
- Input field: add white background, 32px radius, accent caret
color, and flex centering for vertical text alignment
Add allowBuilds configuration for sharp and unrs-resolver packages
to permit their postinstall scripts to run, and ignore the local
.pnpm-store directory.
Allow pnpm to run build scripts for next, @tailwindcss/postcss, and tailwindcss by adding the onlyBuiltDependencies configuration. This is required to prevent pnpm from blocking post-install build scripts for these packages.
Replace the previous Next.js build + rsync + archive workflow with a
minimal `push_to_server` helper that only does `git push` to the
`server` remote. Build, install, and start are now expected to be
handled by the server's post-receive hook, removing duplicate logic
and shrinking the script from 164 lines to 46. The old `build`,
`deploy`, `archive`, `setup_env`, and `check_local_build_dir`
functions (along with pnpm/rsync/sshpass usage) have been removed.
- Drop AuthGate/AuthGateState re-exports from @/lib/auth/nextauth
- Simplify SplashButton by removing skipHref prop and hardcoding ROUTES.chat
- Update comments to reference useSession() (next-auth/react) directly instead of the AuthGate wrapper, since the auth UI gate no longer needs the extra abstraction layer.
Migrate from function-based social login helpers (`facebookLogin`, `googleLogin`)
to class-based services (`new FacebookLogin().signIn()`, `new GoogleLogin().signIn()`),
updating call sites in `AuthFacebookPanel` and `SplashButton` with try/catch error
handling. The NextAuth route handler is also refactored to the v4 pattern, importing
pre-built `GET` / `POST` exports from `@/lib/auth/nextauth` instead of constructing
the handler inline with `NextAuth(authOptions)`.
admin
kanban