- api: Fastify POST /auth/signup (validation, scrypt hash, in-memory store)
- web: React+Vite SignUp form and chat shell with dev proxy
- 35 tests green (api 5, web 2, e2e 28)
- provider-agnostic llm-client (grok + openrouter) with page-slug context
- live golden run scored and passing via x-ai/grok-4.6
- ADR 0010; spike docs flipped to done
Stand up the monorepo skeleton and land the first Phase 0 artifacts:
pairing threat model, plugin catalog, builder detect, 20-prompt golden
harness, and synthetic 2GB mirror timing.
- Shell decision changed from Electron + Code-OSS to Tauri (Rust) + Monaco Editor
- Fast startup (~0.3-0.8s), low memory (100-200MB) via system webview
- Rust backend for tool bus, knowledge graph parser, permission engine, runtime manager
- Rationale documented vs Electron and Zed
- Model changed from Claude to Grok (xAI), BYO API key
- IMPLEMENTATION.md rewritten for Rust/Tauri stack: crates layout, Rust TDD tests, cargo-based CI
- Phase 1 roadmap, test strategy, decisions section updated to match
Root cause: the React DevTools browser extension injects a hook stub at
document_start (before HTML parsing), so hook.inject can be undefined
when React Fast Refresh runs. React Refresh destructures inject as
undefined and later calls undefined.apply() -> TypeError. This prevents
React from ever setting injectedHook, so onCommitFiberRoot is never called.
Fix: unconditionally replace hook.inject with a wrapper that tries the
captured previous inject (with try/catch) then falls back to our own
renderer ID allocation. Works regardless of script execution order.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
indexer.ts imports typescript directly. Bundling it into an ESM output
causes 'Dynamic require of fs is not supported' because typescript uses
CJS require() for Node built-ins internally.
Marking typescript as external drops the CLI bundle from 9.9 MB to 417 KB
and fixes the startup crash on Node 22.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
React's injectInternals() calls hook.inject(renderer) before it will ever
invoke onCommitFiberRoot. When inject is missing, React's try/catch silently
bails and injectedHook stays null — our handler is never reached regardless
of how correctly onCommitFiberRoot is set up.
Fix: define inject() on the hook we create (returns a renderer ID and stores
the renderer in hook.renderers, matching the React DevTools spec). Also
patches inject onto any existing stub hook that lacks it, so third-party
minimal hooks don't silently block registration.
This is the root cause of the 'Static HTML page' false positive on apps
that don't have the React DevTools browser extension installed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Next.js 13+ App Router calls hydrateRoot on <html> or <body> directly
(not on a #__next div), so __reactFiber$ annotations land on
document.documentElement or document.body.
Changes:
- Add document.documentElement to the candidate list (covers App Router)
- Extract getFiber() helper to remove repeated key-scan loop
- Add DOM-wide fallback scan (querySelectorAll('*')) so any React app
is found regardless of its root container convention
- Remove the early !tree bail-out — post FIBER_TREE_UPDATE even with a
sparse tree, matching onCommitFiberRoot's behaviour
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Three related fixes for the canvas live-render panel:
1. captureExistingTree() in fiber-hook — retroactively walks the already-
mounted React fiber tree via __reactFiber$ DOM annotations. Called
immediately on READY (handles post-hydration race) and again at 2 s
(handles deferred hydration / Suspense). Prevents the 'Static HTML page'
false positive on React apps that mounted before the hook script ran.
2. Static-page timer bumped from 4 s → 8 s in LiveArtboard to give the
2-second captureExistingTree safety-net enough headroom before the
no-React verdict fires.
3. Route discovery same-origin fix applied to both renderer/fiber-hook.ts
and live-sdk/hook.ts — root-relative hrefs (starting with '/') are now
accepted regardless of origin so CLI-proxied pages (where links still
point to the original domain) expose their navigation routes correctly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace the plain body background on auth pages with the product's canvas
aesthetic — the same canvasBg colour and radial dot-grid used by the
canvas editor, toggling correctly between dark and light themes.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
EmptyArtboardContent.save() accepted any string as renderUrl — a relative
path or the Originmain app URL would cause the artboard iframe to resolve
against the Originmain origin, loading the app inside itself.
- Added URL validation (same as UrlOnboardingOverlay) with inline error UI
- toCanvasArtboard now validates renderUrl at read time so stale bad data
already in the DB is also guarded against
- CanvasArtboard now carries artboard_type, isolation_component,
isolation_file, isolation_props so phase-3 isolation artboards render
correctly; previously these fields were silently dropped by the hook
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Next.js only statically inlines NEXT_PUBLIC_* variables when accessed via
dot notation (process.env.NEXT_PUBLIC_SUPABASE_URL). The generic requireEnv
helper used bracket notation (process.env[name]) which Next.js cannot
replace at build time, causing the browser bundle to always see undefined
regardless of what is set in the Vercel dashboard.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
One userId reference survived the rename to email in WorkspaceSettingsForm,
causing a TypeScript build failure on Vercel.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
InsertIntentDiff.author_id was renamed to author_email in the email
identity migration. useDiffs.ts still referenced the old field name in
its Omit<> types, causing the Next.js build to fail on Vercel and Render.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
SinachPat