Commit Graph

432 Commits

Author SHA1 Message Date
Jeff Emmett de9cc21301 feat(rmeets): require username on join, fix settings/background, add MI toolbar
- Enable prejoin page so users must enter a display name before joining
- Add requireDisplayName, SETTINGS_SECTIONS, disableVirtualBackground config
- Add floating Meeting Intelligence button with recordings/search links
- Add chat, settings, participants-pane to folk-jitsi-room toolbar
- Also includes: rDocs module expansion, tab-cache/view-history updates,
  converter rewrites, MCP tool additions, OAuth fixes, backlog tasks

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-10 14:06:47 -04:00
Jeff Emmett 8887e18dda fix: rename rsheet module to rsheets (fixes missing module crash)
The rsheet→rsheets rename was partially applied - server/index.ts
imported rsheets/mod but the files still lived at rsheet/. This
caused a crash on startup: "Cannot find module '../modules/rsheets/mod'".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-10 11:19:32 -04:00
Jeff Emmett 1de038eeab feat(comments): spatial comment pins on all rApp module pages
Adds Figma-style threaded comment markers anchored to data-collab-id
elements across all module pages. Comments stored in per-space Automerge
doc, synced via existing local-first stack. Bell is now context-aware
(canvas pins on canvas, module pins on module pages). Notifications
route through existing WS/push/email system with new module_comment
and module_mention event types.

New files: module-comment-types, module-comment-schemas,
rstack-module-comments component. Updated: shell, comment bell,
notification routes. Added data-collab-id to crowdsurf, rtime, rmeets.
Fixed pre-existing SKILL_LABELS import error in rtime/mod.ts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-10 11:15:05 -04:00
Jeff Emmett 2e8e702d75 feat(mcp): 101 MCP tools across all 35 rApps + security hardening + MI integration
- Add centralized auth helper (_auth.ts) with resolveAccess() enforcing
  space visibility (public/permissioned/private) and role-based access
- Retrofit 5 existing tool groups (rcal, rnotes, rtasks, rwallet, spaces)
  with resolveAccess gates
- Add 30 new MCP tool files covering all remaining rApps:
  rsocials, rnetwork, rinbox, rtime, rfiles, rschedule, rvote, rchoices,
  rtrips, rcart, rexchange, rbnb, rvnb, crowdsurf, rbooks, rpubs, rmeets,
  rtube, rswag, rdesign, rsplat, rphotos, rflows, rdocs, rdata, rforum,
  rchats, rmaps, rsheet, rgov
- Add ForMI data exports to all module mod.ts files
- Wire 6 core modules into MI context (mi-data-queries.ts, mi-routes.ts)
- forceAuth for sensitive modules (rinbox, rchats)
- Omit sensitive fields (storagePath, fileHash, bodyHtml) from responses

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-10 10:25:17 -04:00
Jeff Emmett dd38dcb631 feat(tabs): close-all button with confirmation dialog
Adds a ✕ button next to the + tab button that closes all open rApp tabs
and returns to the user dashboard. Shows a confirm() prompt with tab count
before proceeding.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-09 15:56:30 -04:00
Jeff Emmett de698a2aa3 feat(comments): notify all space members on new comments and replies
Broadcasts in-app, push, and email notifications to all space members
when a comment pin is created or replied to. @mentioned users get their
specific mention notification instead (no double-notify). Fixes pre-existing
TS error in rtasks local-first-client (missing dueDate default).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-09 14:12:09 -04:00
Jeff Emmett 85cf54b811 feat: global bug report button — floating widget on every page
Adds a small bug icon (bottom-right) that opens a modal to collect
errors, device info, comments, and optional screenshots, then emails
the report to jeff@jeffemmett.com via the existing SMTP transport.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-09 14:03:27 -04:00
Jeff Emmett 83267a2209 fix(link-preview): add ca-certificates to Docker + implement design-agent route
The oven/bun:1-slim image lacks system CA certs, causing TLS verification
failures on outbound HTTPS for link-preview. Also implements the
/api/design-agent SSE endpoint — Gemini Flash tool loop driving the
Scribus bridge for DTP layout generation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-09 13:57:16 -04:00
Jeff Emmett 5ddde13b0d feat: magic link responses for polls and RSVPs
HMAC-signed stateless tokens let external respondents vote on rChoices
polls or RSVP to rCal events via a single tap — no account required.
Routes mounted at /respond/:token bypass space auth. Typed EventAttendee
schema replaces unknown[] on CalendarEvent.attendees. Invite endpoints
on both modules generate tokens and optionally send email invitations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-09 13:41:17 -04:00
Jeff Emmett 35c3a48296 fix(sidecar): bump Docker API version from 1.43 to 1.44
Docker Engine 29.0.4 on Netcup requires minimum API version 1.44,
causing all sidecar starts (Blender, FreeCAD, KiCad, Ollama) to fail
with "client version 1.43 is too old".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-09 12:43:24 -04:00
Jeff Emmett ccaef33a20 fix(rtasks): exempt rtasks API from space auth middleware
The clf space is private, so all API calls were getting 401'd by the
space access middleware before reaching the rtasks routes. Add
/rtasks/api/ to the public endpoint exemption list (like rwallet,
rdesign, rvote already are).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-06 19:00:38 -04:00
Jeff Emmett 6c1298b796 fix(routing): prevent cached 301 redirects on root and standalone domains
Root route now sends no-cache headers to bust stale 301s from the
rcal standaloneDomain mishap. Standalone domain redirects changed from
301 (permanent/browser-cached) to 302 (temporary) so misconfiguration
can never stick in user browsers again.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-06 12:27:53 -04:00
Jeff Emmett 7e07170304 fix: ranking drag-drop, spider slider drag, video gen timeout & progress
- Ranking: replace broken :hover drop-target with getBoundingClientRect hit testing
- Spider: add #isSliding guard to prevent slider destruction during drag
- Video gen: bump timeout to 10min, show real fal.ai queue position/status
- Fix NotificationCategory type to include 'payment' in db.ts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-05 16:03:58 -04:00
Jeff Emmett b1c54a6e66 fix: update rCal landing, de-spam info popups, fix stale URLs & banner persistence
- rCal landing: strip inline style overrides, use standard rl-* CSS classes
- rCal mod: update standaloneDomain from rcal.online to rspace.online
- Info popup: change from per-rApp auto-show to global one-time auto-show
- Update banner: track dismissal in sessionStorage so it stops re-showing
  on every page load within the same session (likely the "persistent banner")
- rpubs landing: fix stale rcart.online URLs → demo.rspace.online/rcart

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-04 19:14:27 -04:00
Jeff Emmett bf8e11d426 feat(rexchange): add P2P crypto/fiat exchange module with escrow & reputation
Community members post buy/sell intents for CRDT tokens (cUSDC, $MYCO, fUSDC)
against 8 fiat currencies. Bipartite solver matches intents every 60s. Escrow
via token-service burn/mint trio. Reputation scoring with badges. 14 API routes,
canvas shape with physics orbs, and landing page.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-04 18:32:16 -04:00
Jeff Emmett 7f98dfcdb1 fix: load persisted docs before module onInit to prevent re-seeding
Module onInit functions (rvote, rtasks, rcal, etc.) call seedDemoIfEmpty
which checks the sync server for existing docs. Previously onInit ran
as an IIFE before loadAllDocs completed, so it always found empty docs
and re-seeded demo data — overwriting user deletions/changes. Now
onInit runs inside the loadAllDocs .then() chain, ensuring persisted
data is loaded before any seed checks run.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-04 04:05:51 +00:00
Jeff Emmett 0e2eebf890 feat(encryptid): add wallet lookup + payment notification APIs
Add internal endpoints for payment infrastructure integration:
- GET /api/internal/user-by-wallet — resolve wallet to email/username
- POST /api/internal/notify — trigger in-app notifications by wallet/DID
- Add 'payment' notification category and payment_sent/received event types

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-04 01:28:33 +00:00
Jeff Emmett 42546c9a63 fix: use internal mailcow relay (port 25) for all SMTP transports
SMTP auth on port 587 was broken across all modules due to stale
credentials. Since rspace is on the mailcow Docker network, all 6
SMTP transports now use unauthenticated relay on port 25 when the
host is the internal postfix container. Fixes emails for: payment
receipts, space invitations, inbox approvals, agent notifications,
scheduled emails, and publication sharing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-03 15:12:42 -07:00
Jeff Emmett d4612d6fb8 fix(ascii-gen): handle raw HTML response from ascii-art service
The ascii-art service returns raw HTML, not JSON. Wrap response in
{html, text} JSON envelope and strip tags for plain text version.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-03 14:31:22 -07:00
Jeff Emmett 46c326278a feat: ASCII art canvas tool, video gen fixes, scribus/notebook sidecars
- Add folk-ascii-gen canvas shape with pattern/palette selectors
- Add POST /api/ascii-gen proxy to ascii-art service
- Register create_ascii_art in canvas tools + triage panel
- Fix WAN 2.1 t2v endpoint URL (fal-ai/wan/v2.1 → fal-ai/wan-t2v)
- Convert video gen to async job queue (avoids Cloudflare timeouts)
- Fix Docker API Content-Type bug in sidecar-manager
- Convert scribus-novnc and open-notebook to on-demand sidecars
- Add ensureSidecar("scribus-novnc") to rDesign bridge proxy
- Fix Hono ContextVariableMap and handleTransakMessage type errors

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-03 14:25:48 -07:00
Jeff Emmett 4a54e6af16 fix: enforce subdomain routing — spaces are subdomains, never path segments
Audit and fix ~60 violations across 47 files where URLs were constructed
as /{space}/moduleId instead of /moduleId (subdomain provides the space).

- Add getModuleApiBase() helper to shared/url-helpers.ts
- Fix client components: use getModuleApiBase() for fetch URLs,
  rspaceNavUrl() for navigation
- Fix server routes: use c.get("isSubdomain") for redirects and
  JSON response URLs
- Fix OAuth callbacks (notion, google, clickup): subdomain-aware redirects
- Fix email notification URLs (rvote): use {space}.rspace.online format
- Fix webhook registration (rtasks/clickup): subdomain-aware endpoint URL
- Replace broken #getSpaceSlug() methods in folk-feed, folk-splat
- Replace NODE_ENV checks with proper isSubdomain checks (rdata, rnetwork)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-03 14:09:53 -07:00
Jeff Emmett f375eb1b43 feat(rgov): add rGov governance decision circuit module
Implements 5 new FolkShape web components for visual governance:
- folk-gov-binary: Yes/No signoff gates
- folk-gov-threshold: Numeric progress gates with contributions
- folk-gov-knob: SVG rotary parameter knobs with temporal viscosity
- folk-gov-project: Circuit aggregators (walks arrow graph backward)
- folk-gov-amendment: Modification proposals with approval voting

Also adds "satisfied" gate condition to folk-arrow, 5 AI canvas
tools, module registration, and all canvas.html wiring.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-03 13:01:08 -07:00
Jeff Emmett d8e954dfb6 fix: persist docs created via setDoc (fixes payment not found)
SyncServer.setDoc() was not calling onDocChange, so documents created
via setDoc (including payment requests) were only stored in memory and
lost on container restart. This caused "Payment request not found"
errors after deploys. Now setDoc triggers the same persistence callback
as changeDoc.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 02:54:11 +00:00
Jeff Emmett 6364eb8deb feat(shell): add Request Access button and Go to My Space fallback on access gate
When a logged-in user visits a private space they don't have access to,
the gate now shows a "Request Access" button (calls POST /api/spaces/:slug/access-requests)
and a "Go to {username}'s Space" secondary link. Handles already-pending (409) gracefully.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 16:20:56 -07:00
Jeff Emmett 1cdbce0bcc fix(shell): update space-switcher on landing pages to show user's space or demo
Landing, module-landing, and sub-page-info pages showed a stale "Spaces"
dropdown. Now checks encryptid_session and sets the switcher to
{username}'s Space (logged in) or demo (logged out).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 16:05:14 -07:00
Jeff Emmett 5b4300db77 fix(ipfs): correct Kubo container hostname (collab-server-ipfs-1)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 15:06:05 -07:00
Jeff Emmett 1672477f68 feat(ipfs): add IPFS integration for backups and generated files
Pin encrypted backups and AI-generated files to Kubo (ipfs.jeffemmett.com)
as fire-and-forget redundancy. Filesystem remains primary storage — IPFS
failures are logged and swallowed. Adds /api/ipfs routes for status,
pin/unpin, and gateway proxy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 14:24:39 -07:00
Jeff Emmett 4b2592c27f fix(rinbox): handle IMAP socket errors to prevent server crash-loop
ImapFlow clients were created without .on('error') handlers. Socket
timeouts emitted unhandled errors that crashed the entire process,
taking down all 32 modules. Added error handlers to all 3 ImapFlow
instantiation sites and a process-level uncaughtException/unhandledRejection
safety net.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-02 13:50:45 -07:00
Jeff Emmett c8e4aede02 feat(canvas): module-aware canvas architecture — shapes, tools, and toolbar gated by module
Modules now declare their canvas shapes and AI tools (canvasShapes/canvasToolIds
on RSpaceModule), creating a single source of truth that the canvas enforces:

- Phase 1: Extended RSpaceModule + ModuleInfo, added moduleId to CanvasToolDefinition
  with getToolsForModules() filter, added moduleOf() to ShapeRegistry, populated
  declarations in 9 modules, fixed 8 ungated toolbar buttons (rchoices, rwallet, rsocials)
- Phase 2: AI prompt sends enabledModules, server filters Gemini tool declarations
- Phase 3: folk-commitment-pool and folk-task-request show lock overlay when rtime disabled
- Phase 4: Extracted MODULE_META into shared lib/module-display.ts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 15:19:12 -07:00
Jeff Emmett 3b0999da64 feat(rtime): commitment notifications + email delivery channel
- Fire commitment_accepted/commitment_declined notifications when solver
  results are accepted/rejected in intent-routes.ts
- Fire commitment_declined when a connection is deleted in mod.ts
- Add metadata (resultId, fromCommitmentId) to commitment_requested notify
- Fix actionUrl to use /rtime (subdomain-relative), not /{space}/rtime
- Add Accept/Decline action buttons in notification bell for
  commitment_requested events (same pattern as space_invite)
- Add email delivery channel to notification-service: sends from
  {space}-agent@rspace.online via SMTP, respects emailEnabled preference,
  inline HTML template with dark theme

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 14:59:10 -07:00
Jeff Emmett 5b8b638661 feat: add commitment pool + task request canvas shapes for rTime
Two new FolkShape subclasses enable drag-from-pool-to-task interactions on
the canvas. Orbs dragged from the commitment pool highlight matching skill
slots on task request cards and POST connections via the rTime API. Adds
commitment_requested notification type so commitment owners are notified
when their time is requested.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 14:38:41 -07:00
Jeff Emmett ddf5772025 Fix space navigation redirects: server-side auth redirect + subdomain enforcement
Authenticated users visiting {space}.rspace.online/ now get a server-side
302 to /rspace instead of rendering the full dashboard then JS-redirecting
(eliminates flash of wrong header + 2-3 redirect chain → single redirect).

Bare domain rspace.online/{space} now 301-redirects to {space}.rspace.online/
so /{space}/ never appears in the URL bar.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 14:13:24 -07:00
Jeff Emmett 7420228ce9 feat: add Mermaid diagram generator canvas tool + share panel role selector
- Add folk-mermaid-gen web component: AI-powered diagram generation via
  Ollama, client-side SVG preview via mermaid.js, animated GIF export via
  mermaid.rspace.online API
- Register in canvas tools, toolbar, and shape registry
- Add role selector dropdown to share panel invite form (backend already
  supports role parameter)
- Fix pre-existing TS errors: SankeyNode missing address field,
  SpaceMember type mismatch in WebSocket auth fallback

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 14:01:52 -07:00
Jeff Emmett 45372c6681 Fix sidebar showing all modules: hide Manage panel when none disabled
- App switcher: only show "Manage rApps" when there are actually
  disabled modules or active restrictions. Move "Available to Add"
  above "Remove" to prioritize adding. Eliminates duplicate module
  listing when all modules are enabled.
- Shell: update app switcher on modules-changed event (was only
  updating tab bar and folk-rapp, not the sidebar itself).
- SMTP: use space-agent@rspace.online as From for invite/approval
  emails with proper envelope sender for DKIM alignment.
- Shell CSS: fix banner z-index, smooth header transition on banner.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 12:32:53 -07:00
Jeff Emmett d2fa533519 Improve rTasks drag-drop UX + sync space members on invite claim
CI/CD / deploy (push) Failing after 9s Details
rTasks: port backlog-md ordinal algorithm (bisection + rebalance),
fix column detection via bounding-box hit test, add empty-column
drop zones, source column dimming, no-op detection, and optimistic
DOM updates (no flash). New bulk-sort-order rebalance endpoint.

EncryptID: sync claimed invite members to Automerge doc immediately,
redirect to space subdomain after identity claim.

Server: add /api/internal/sync-space-member endpoint, fallback
member check in WebSocket auth for not-yet-synced invites.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 12:19:37 -07:00
Jeff Emmett fef217798e Fix PWA install banner: persist dismiss, prevent duplicates
- Add appinstalled event listener so browser-initiated installs also
  permanently dismiss the banner
- Ensure only one banner shows at a time (update hides install first)
- Refactor dismiss logic into single helper function

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-01 12:07:17 -07:00
Jeff Emmett 9a45b19435 Add rSheet module — collaborative spreadsheets via dSheet
- New module at modules/rsheet/mod.ts using externalApp pattern
- Embedded Y.js-backed spreadsheet grid with real-time sync
- Connects to shared y-websocket server for collaboration
- Registered in server/index.ts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 19:25:36 -07:00
Jeff Emmett 32093a0fc3 refactor(connections): move from space settings to user account
Connections are per-user, not per-space. Move the platform connections
dashboard from the space settings modal (5th tab) to the My Account
modal as a collapsible section. Add selective sharing: users connect
platforms to their personal data store, then choose which community
spaces to share data into via per-provider space checkboxes.

New endpoints: GET/POST /api/oauth/sharing for per-user sharing config.
Sharing config stored as Automerge doc {userSpace}:oauth:sharing.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 15:52:15 -07:00
Jeff Emmett bed124f869 feat(infra): add ollama to on-demand sidecar lifecycle
Ollama now starts on API request and stops after 5min idle, saving
~5-6GB RAM when not in use. Part of server-wide resource caps rollout.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 14:26:23 -07:00
Jeff Emmett dbfddb2fb5 feat(infra): on-demand sidecar lifecycle + resource caps
KiCad, FreeCAD, and Blender sidecars now start on API request and stop
after 5min idle, saving ~8GB RAM when not in use. Docker socket mounted
into rspace container for container lifecycle control. Memory/CPU limits
added to all services to prevent runaway resource consumption.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 13:29:42 -07:00
Jeff Emmett 26aa6433be feat(connections): add platform connections dashboard in space settings
New "Connections" tab in space settings with n8n-style visual dashboard
showing platform cards (Google, Notion, ClickUp live + 7 coming soon)
connected via SVG bezier lines to central rSpace hub node. Includes
OAuth connect/disconnect flows and GET /api/oauth/status endpoint.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 13:04:02 -07:00
Jeff Emmett bb31bd33c2 fix(routing): prevent /modules/ path from being redirected as a space slug
The subdomain canonicalization logic treated "modules" as a space slug,
redirecting /modules/rmeets/... to modules.rspace.online/rmeets/... (503).
Add "modules" to the serverPaths exclusion set so module JS assets
served from /modules/ are handled by Hono instead of redirected.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 12:26:23 -07:00
Jeff Emmett bb19b4bc89 fix: consolidate PWA banners — install in browser, update in PWA only
Remove duplicate purple update banner from website/shell.ts that overlapped
with the server/shell.ts banner. Now a single banner system:
- Browser: "Install rSpace app" prompt (via beforeinstallprompt)
- Installed PWA: "New version available" prompt (via SW update detection)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 12:09:59 -07:00
Jeff Emmett 2cbff8925d fix(layout): viewport-filling rApp layout — eliminate body scroll
Make #app a flex column with height:100vh so all rApps fill the viewport
exactly. Wrap module body in .rapp-content flex child. Replace all
hardcoded calc(100vh - Npx) with height:100% across 20+ components.
Remove sticky positioning from subnav/tabbar (now flex items).
Generalize mobile body-flex to all pages (not just canvas-layout).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 10:57:09 -07:00
Jeff Emmett 0a21caa5e5 feat(pwa): install banner + update notification for service worker
- Install banner appears above header when beforeinstallprompt fires
  (dismissed state persisted in localStorage, never shows again)
- Update banner appears when a new SW version is detected waiting
  (click "Update" → SKIP_WAITING message → SW activates → page reloads)
- SW no longer auto-skipWaiting on install; waits for client message
- Bumped SW cache version to v5 and registration to ?v=5
- Banner CSS: fixed at top, z-index above all chrome, slide-in animation
- Header/tab-row/app offsets adjust when banner visible

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 10:40:07 -07:00
Jeff Emmett 7888596623 refactor(shell): move minimize chevron from tab row to subnav bar
The minimize toggle now lives at the right edge of each rApp's subnav
bar instead of the tab row. When minimized, both header and tab row
slide up and the subnav becomes a thin fixed strip with just the
restore chevron. Every rApp already has a subnav (except canvas which
has its own chrome).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 10:23:42 -07:00
Jeff Emmett 6b6646af1a fix: add space-switcher dropdown to main landing page header
The rspace.online root page was missing the rstack-space-switcher
component that all other pages (module pages, space dashboard,
module landing pages) already include in their headers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-31 09:58:07 -07:00
Jeff Emmett b5c6477f47 feat(rtime): add timebank commitment pool & weaving dashboard rApp
Port hcc-mem-staging SPA into rSpace as the rTime module. Canvas-based
commitment pool with physics orbs, SVG weaving editor with hex nodes
and bezier wires, execution panel, and optional Cyclos timebank proxy.
Automerge CRDT persistence, demo seeding, and full landing page
explaining community-based ledgers and emergent collaboration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-30 23:42:49 -07:00
Jeff Emmett 36ae954da4 feat(shell): add header minimize toggle for more viewport space
Adds a [^] chevron button at the right end of the tab row that collapses
all header bars into a thin 24px restore strip. State persists via
localStorage across page reloads. Works on both desktop (fixed) and
mobile (sticky) layouts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-30 23:35:12 -07:00
Jeff Emmett df202df06c fix: bare-domain module URLs now show landing pages instead of demo hub
rspace.online/{moduleId} was rewriting to /demo/{moduleId}, serving the
internal nav hub. Now calls renderModuleLanding() with the module's rich
landing page when available, falling back to demo rewrite otherwise.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-30 22:24:25 -07:00
Jeff Emmett f9457a0e11 perf(shell): add fragment mode for fast rApp tab switching
When switching rApps from the dropdown, TabCache now requests
?fragment=1 which returns a lightweight JSON payload (~200 bytes)
instead of re-rendering the full 2000-line shell HTML template.
This eliminates server-side shell rendering and client-side
DOMParser overhead. Also prefetches fragments on hover.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-31 02:28:09 +00:00
Jeff Emmett 5852b91f4c feat(mi): make MI aware of all 48 canvas shape types
- Expand MI system prompt "Available shape types" from 20 → 48 shapes,
  organized by category (Core, AI, Creative, Social, Decisions, Travel,
  Tokens, Geo, Video)
- Expand Shape Mapping Rules from 12 → 30 triage rules covering all
  shape types with prop hints
- Expand KNOWN_TRIAGE_SHAPES from 15 → 48 so Gemini triage no longer
  silently downgrades unknown shapes to folk-markdown
- Add 22 missing TOOL_HINTS to mi-tool-schema.ts (travel, tokens, CAD,
  creative, geo, meta shapes) for keyword-based chip suggestions
- Add all 48 shapes to SHAPE_ICONS in mi-triage-panel.ts (was 13)
- Register folk-image-studio and folk-transaction-builder in canvas.html
  (were ghost shapes — imported but never defined/registered)
- Add SHAPE_DEFAULTS for folk-social-thread/campaign/newsletter,
  folk-design-agent, folk-image-studio

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-28 16:45:11 -07:00
Jeff Emmett 9084de7adb feat(rsocials): wire social shapes into all cross-rApp systems
- Add GET /api/threads, /api/threads/:id, /api/campaigns, /api/campaigns/:id
  REST endpoints so other rApps can fetch rsocials data
- Register folk-social-thread/campaign/newsletter in MI triage panel,
  tool schema, system prompt, and KNOWN_TRIAGE_SHAPES
- Add rsocials MODULE_PORTS (threads-out, campaigns-out, post-published,
  campaign-data) and WIDGET_API to folk-rapp for embed/widget mode
- Add rsocials to folk-feed FEED_ENDPOINTS (threads, campaigns, newsletter)
  and normalize response arrays (threads, campaigns, drafts)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-28 16:25:26 -07:00
Jeff Emmett 77ac0c1e32 feat(rsocials): newsletter drafts, subscribers + MI route updates
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 20:11:31 -07:00
Jeff Emmett f966f02909 feat(spaces,rsocials): invite-based member adds + clickable campaign content
Space invites: Convert both username-add and email-invite (existing user)
paths from direct-add to invite flow — creates space_invite via EncryptID,
sends invite email with Accept button, dispatches space_invite notification
with Accept/Decline buttons in the notification bell. No one gets forcefully
added to a space anymore.

rSocials content linking: All generated campaign content now links through
to actual editable content. Draft post cards in thread gallery are clickable
(thread editor or campaign view). Campaign manager post cards expand on click
and thread badges link to thread editor. Wizard success screen shows
individual thread links. CampaignPost schema gains threadId field, stored on
commit so posts maintain their thread association.

Also includes canvas social media tools, social shape components
(folk-social-thread, folk-social-campaign, folk-social-newsletter),
and MI context-aware suggestion registry.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 20:03:52 -07:00
Jeff Emmett ad75781efd fix(spaces): set clf and bcrg to permissioned on startup
One-shot migration to fix visibility for spaces that were changed
by stale client sync. Also imports updateSpaceMeta in index.ts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 18:08:51 -07:00
Jeff Emmett c0b4250e96 fix(spaces): pin visibility and ownerDID as server-authoritative
Automerge CRDT sync could overwrite space visibility when a client
with a stale cached doc reconnects and merges. Now the server
snapshots visibility and ownerDID before processing sync messages
and reverts any client-side changes to these fields.

These fields can only be changed through the authenticated API
(PATCH /api/spaces/:slug), not through CRDT sync.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 18:03:43 -07:00
Jeff Emmett dce608ae1b fix: cache-bust sw.js registration + no-cache header for SW/manifest
- Add ?v=4 to all SW registration URLs to bypass stale CF CDN cache
- Set Cache-Control: no-cache for sw.js and manifest.json so future
  SW updates are never blocked by CDN caching

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 18:02:14 -07:00
Jeff Emmett 23083c32b0 fix: serve sw.js and manifest.json with no-cache header
Cloudflare was caching sw.js for 4 hours (default JS caching),
preventing service worker updates from reaching clients.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 17:55:52 -07:00
Jeff Emmett c4972079dd fix(cad): CSS containment + Scribus image gen for all CAD shapes
- KiCad, FreeCAD, Blender, Scribus: add .wrapper flex container with
  height:100% + min-height:0 so content stays within element bounds
- KiCad assembler: regex fallback for non-JSON tool results (SVG, Gerber, PDF)
- Scribus image gen: actually write downloaded fal.ai images to disk
  (was creating imagePath but never saving bytes)
- Mount rspace-files volume in scribus-novnc so generated images are
  accessible from both containers

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 17:53:42 -07:00
Jeff Emmett 92629e239e fix(blender,freecad): contain render in element, fix FreeCAD file serving
Blender: add wrapper with height:100%, min-height:0 for flex shrink,
object-fit:contain on img — render stays within shape bounds.

FreeCAD: update assembleFreecadResult to scan all tool results for file
paths (.step, .stl, .png), not just execute_python_script JSON parsing.
Add preview PNG rendering instruction to system prompt. Add subdirectory
file serving routes for /data/files/generated/:subdir/:filename. Add
STEP/STL/SVG/PDF mime types.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 17:40:25 -07:00
Jeff Emmett 8d4e1fd0ff fix(mi,canvas): filter disabled modules from MI assistant and eliminate app-switcher flash
MI now loads space doc to filter module list, capabilities, and fallback
by enabledModules. Canvas fetches /api/modules and space modules in
parallel via Promise.all, calling setModules once with filtered list.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 17:26:07 -07:00
Jeff Emmett ac028cbe04 fix(blender): use shutil.move for cross-fs copy, disable denoiser
os.rename fails across Docker volume boundaries (different filesystems).
Debian Blender 3.4 lacks OpenImageDenoiser — disable denoising in prompt.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 17:21:53 -07:00
Jeff Emmett 555a51f8a7 fix(blender): add EGL/GL libs and use Cycles CPU renderer
EEVEE needs GPU; Cycles CPU works headless. Added libegl1, libgl1-mesa-dri,
libglx-mesa0 to Dockerfile. Updated Gemini prompt to specify Cycles engine
with 64 samples.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 17:17:34 -07:00
Jeff Emmett aa02473d0d fix(shell): evict tab pane from cache on script load failure
When a module script (e.g. canvas-*.js) fails to load (502 during
deploy, network error), the pane stayed in cache with a blank canvas.
Subsequent tab switches showed the broken cached pane instead of
re-fetching. Now script onerror removes the failed tag and evicts
the pane, so the next switchTo does a fresh fetch.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 17:10:23 -07:00
Jeff Emmett 101cc3b848 fix(shell): show rApp info popup once per module, then only via icon
Extract autoShowIfFirstVisit() so it runs both on initial page load
and on SPA tab switches. Uses localStorage rapp_info_seen_{moduleId}
to ensure each rApp's landing popup shows exactly once.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 17:01:54 -07:00
Jeff Emmett c046acf9ce fix(blender): switch from Ollama to Gemini Flash for script generation
Ollama runs CPU-only on Netcup — 7B models take minutes, exceeding
Cloudflare's 100s timeout (524). Gemini 2.0 Flash responds in seconds.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 16:51:35 -07:00
Jeff Emmett 0db5addc17 fix(rdesign): switch to StreamableHTTP transport, fix KiCad Python path
SSE transport crashes on concurrent connections (supergateway
single-session limit). StreamableHTTP supports multiple sessions.
Also set KICAD_PYTHON=/usr/bin/python3 for existsSync validation
and install missing requests package.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 16:48:11 -07:00
Jeff Emmett 1c338529bf fix(presence): relay presence-leave messages and clean up listener on disconnect
- Server now relays presence-leave alongside presence messages for immediate peer removal
- Overlay properly unsubscribes leave listener on disconnectedCallback

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 16:42:49 -07:00
Jeff Emmett 2f8ce08e3c feat: add rDesign module metadata, collab presence-leave cleanup
- Register rDesign in folk-rapp MODULE_META and shell FAVICON_BADGE_MAP
- Handle explicit presence-leave messages for immediate peer cleanup

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 16:35:10 -07:00
Jeff Emmett 6b81f808f5 feat(canvas): mobile toolbar flush, zoom icon toggle, SW update banner
- Mobile toolbar collapsed position now flush with bottom-toolbar (bottom: 8px)
- Toolbar defaults to collapsed on mobile (<768px)
- Zoom expand/minimize uses distinct icons (magnifier +/-) instead of CSS rotation
- SW update banner on all pages: "New version available — Tap to update"
  - Detects controllerchange + updatefound events
  - Purple gradient bar, dismissible, reloads on tap
  - Added to both shell.ts (module pages) and canvas.html (standalone)
- folk-rapp: filter picker/switcher by enabled modules
- server/shell: react to modules-changed event for runtime module toggling
- collab-presence: minor overlay updates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 16:34:48 -07:00
Jeff Emmett 395623af66 feat(rdesign): deploy KiCad & FreeCAD MCP as Docker sidecars
Switch from broken StdioClientTransport (child process) to
SSEClientTransport (HTTP to sidecar containers via supergateway).
Both sidecars share rspace-files volume so generated CAD files
(STEP, STL, Gerber, SVG) are directly servable without copying.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 16:25:23 -07:00
Jeff Emmett 55b973ebc2 fix(blender): use correct Ollama model (qwen2.5-coder:7b)
qwen2.5:14b doesn't exist on the server, causing silent 404 from
Ollama and 502 to the client. Also added error logging for non-ok
Ollama responses.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 16:10:11 -07:00
Jeff Emmett aa23108f5f fix(invites): redirect to invited space, improve invite emails
- Fix invite accept fetch URL in shell.ts (was missing /api/spaces prefix)
- After accepting invite, redirect to the invited space instead of reloading
- Notification actionUrls now point to the space subdomain (https://slug.rspace.online)
- Direct-add email includes inviter name, role, and space description
- Identity invite email includes space name/role context when inviting to a space

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 15:39:58 -07:00
Jeff Emmett 2f3a4a13dc fix(blender): make RunPod optional, fix script-only generation
RunPod was hard-gated — returned 503 when RUNPOD_API_KEY missing,
blocking even LLM script generation. Now generates script via Ollama
regardless, only attempts RunPod render if key is configured. Health
check returns warnings (non-blocking) vs issues (blocking). Default
model switched to qwen2.5:14b (available on server). Regex also
handles non-python-tagged code blocks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 15:38:49 -07:00
Jeff Emmett 59d2cc9933 feat(spaces): add visibility/description to settings panel, merge invite sources
- Space Settings section in dropdown with visibility (public/permissioned/private)
  and description fields, matching the full edit space modal
- GET /api/spaces/:slug now includes description field
- listSpaceInvites merges both space_invites and identity_invites tables
  so email invites appear in Pending Invites
- revokeSpaceInvite falls through to identity_invites table

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 15:29:33 -07:00
Jeff Emmett 32be9d7b94 fix(ui): bump subnav sticky top to avoid header overlap
Increase .rapp-subnav top from 92px to 93px so pill buttons
don't clip under the fixed header + tab-row border.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 11:54:23 -07:00
Jeff Emmett c2d7e8b238 fix(shell): prevent infinite loop when rapidly switching tabs
Abort previous in-flight fetch when switchTo() is called again, and
guard the shell's fallback navigation against stale callbacks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 11:44:38 -07:00
Jeff Emmett 22b5c00a13 fix(routing): prevent domain stacking and remove Try Demo button
- Fix server-side redirect to always use canonical rspace.online as base
  domain instead of deriving from hostClean (prevents demo.rspace.rspace.online)
- Fix bare-domain check to exact match instead of .includes() (prevents
  stacked subdomains from triggering bare-domain routing)
- Fix client-side rspaceNavUrl to guard against reserved subdomain names
  being used as space subdomains (e.g. rspace.rspace.online)
- Fix identity component _navUrl with same canonical domain guards
- Remove "Try Demo" header button from all shell rendering functions
- Remove demo-btn CSS styles
- Fix pre-existing SchemaType error in Gemini tool declarations

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-25 11:16:46 -07:00
Jeff Emmett dd46905e12 feat(mi): agentic upgrade — multi-turn loop, LiteLLM, media gen, live data
Transform MI from single-shot chat into an agentic system:

- LiteLLM provider with Claude Sonnet/Haiku models via proxy
- Agentic loop (max 5 turns): stream → parse actions → execute server-side → feed results back
- Server-side media generation (fal.ai + Gemini) as first-class MI actions
- Module data queries (rnotes, rtasks, rcal) read directly from Automerge
- System prompt enriched with recent notes, open tasks, and calendar events
- Client handles new NDJSON types (turn, action-start, action-result)
- Extracted shared media helpers, refactored image/video endpoints

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 19:26:56 -07:00
Jeff Emmett a5c7eef466 fix(startup): move space alias provisioning after loadAllDocs
The IIFE raced with doc loading so listCommunities returned empty.
Moved into the .then() callback to ensure all docs are loaded first.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 19:06:06 -07:00
Jeff Emmett 193588443e fix(routing): eliminate /{space} from paths on subdomain routing
On subdomain routing (e.g. demo.rspace.online), the space slug belongs
only in the subdomain — never in the URL path. This fixes all server
and client code that was generating /{space}/module paths on subdomains.

Server fixes:
- index.ts: notification actionUrls, template/disabled-module redirects,
  subdomain passthrough (now redirects HTML, rewrites API), WS notifications
- output-list.ts: subdomain-aware path prefix for hrefs and fetch URLs
- shell.ts: dashboard pushState URL

Client fixes (basePath getter pattern):
- folk-book-shelf.ts, folk-splat-viewer.ts: _basePath getter
- folk-campaign-wizard.ts: basePath subdomain check
- folk-trips-planner.ts: use __rspaceNavUrl for canvas export
- rschedule/landing.ts: onclick handlers use __rspaceNavUrl
- rsplat/mod.ts: legacy view redirect subdomain check

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 18:45:16 -07:00
Jeff Emmett 75ad3f8194 feat(rinbox): per-space email forwarding via Mailcow aliases
Provision {space}@rspace.online forwarding aliases that route to
opted-in members' personal emails. Admins/mods opted in by default;
regular members can opt in via PUT /api/spaces/:slug/email-forwarding/me.

New: space-alias-service.ts, schema tables, 8 DB functions, 6 API routes.
Hooks: rinbox onSpaceCreate/Delete, spaces.ts member lifecycle, startup migration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 18:40:29 -07:00
Jeff Emmett 41051715b9 feat(rtasks): ClickUp two-way sync integration
Add bidirectional sync between rTasks and ClickUp:
- API client with 100 req/min rate limiter
- OAuth2 + personal API token connection flows
- Import wizard (workspace → space → list picker)
- Outbound push queue (5s intervals, 10-item batches)
- Inbound webhook with HMAC-SHA256 validation
- Field-level conflict detection (rTasks wins)
- Source badges (purple CU) with sync status dots on task cards
- Sync status indicator in board header for connected boards

Also fix 6 pre-existing TS errors across crowdsurf, rcal, rnotes.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 17:37:01 -07:00
Jeff Emmett 677a69645e debug(shell): add console logging to trace tab-switch failure for rspace
Adds diagnostic console.log to layer-switch handler, TabCache.switchTo,
fetchAndInject, and reconcileRemoteLayers to identify why clicking the
rspace tab closes all tabs and shows the dashboard.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 16:32:57 -07:00
Jeff Emmett 433833da0c fix(shell): prevent remote sync from wiping all tabs and showing dashboard
reconcileRemoteLayers() could wipe all local tabs when Automerge sync
or BroadcastChannel delivered empty layer data (CRDT initial state,
sync race). This caused clicking tabs to show an infinite-loading
dashboard. Now: empty remote layers are rejected when an active module
exists, and the current module always stays in the tab list.

Also adds 10s fetch timeout to TabCache.fetchAndInject() to prevent
infinite loading spinners on slow/failed module fetches.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 16:23:45 -07:00
Jeff Emmett 3655632e0f fix(auth): check cross-subdomain cookie in access gate and dashboard redirects
The access gate and space dashboard redirect scripts checked only
localStorage, which is per-origin. When navigating between subdomains
(e.g. demo → jeff), the session wasn't found. Now both scripts also
check the eid_token cross-subdomain cookie and sync it to localStorage.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 14:24:30 -07:00
Jeff Emmett bf0661fab2 feat(cad): LLM-orchestrated MCP tool-calling for KiCad and FreeCAD
Add Gemini Flash agentic loop that converts natural language prompts
into real MCP tool call sequences for PCB design (KiCad) and parametric
CAD (FreeCAD). Dynamic schema conversion from MCP tools to Gemini
function declarations, 8-turn/60s loop with real execution and result
feedback.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 14:07:19 -07:00
Jeff Emmett d8736ba341 fix(rcal): add post-load migration for tags field on existing events
Automerge docs created before the tags schema don't have the field.
The migration runs 5s after startup (after loadAllDocs completes),
patches missing tags onto events, and assigns known demo event tags.
Also removes debug endpoint and tracing logs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 14:01:01 -07:00
Jeff Emmett 9ae88e14b7 debug: add tags tracing logs 2026-03-24 13:56:22 -07:00
Jeff Emmett 2dd5e764cd feat(rcal): MI calendar awareness, tags, saved views, MCP server
Phase 1: MI now knows the current date/time and upcoming events (14-day
lookahead, 5 events max) via direct Automerge read — no HTTP overhead.

Phase 2: Tags (string[] | null) on CalendarEvent for first-class filtering.
Saved views (named filter presets) with full CRUD API. Tag filter on
GET /api/events via comma-separated AND logic. Demo events seeded with tags.

Phase 3: Calendar MCP server (5 tools: cal_list_events, cal_get_event,
cal_list_sources, cal_list_views, cal_create_event) registered in .mcp.json.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 13:28:02 -07:00
Jeff Emmett f2c3245240 fix: ensure demo community visibility is always public on startup
The demo Automerge doc had visibility: "private" from initial creation.
ensureDemoCommunity now forces visibility to "public" on every startup
if it drifted.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 13:21:59 -07:00
Jeff Emmett 7f327eb07a fix: whitelist rvote GET API as public + guard campaign wizard auth client-side
1. Add GET /rvote/api/* to public endpoint whitelist so proposal
   listings work on private/permissioned spaces without auth.
2. Campaign wizard now checks for auth token before POSTing,
   showing "Please sign in" instead of a cryptic 401.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 12:58:21 -07:00
Jeff Emmett 7ad5666b9a fix: enforce enabledModules check on module root path
The sub-path middleware (/:space/:moduleId/*) already blocked disabled
modules, but the root path (/:space/:moduleId) didn't. Now both paths
consistently check enabledModules before allowing access.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 12:38:01 -07:00
Jeff Emmett 6e4d1436e0 fix: mixed content on bare-domain API calls + SSE stream error handling
Two fixes:
1. Bare-domain routing used url.protocol (always http: behind TLS
   termination) for redirects, causing mixed-content blocks. Added
   proto helper that uses https: on production domains. Also rewrite
   /{space}/api/... calls internally instead of redirecting to the
   subdomain.
2. rDesign SSE stream reader now catches QUIC protocol errors on
   stream close gracefully.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 12:20:20 -07:00
Jeff Emmett 724c0e16ba fix(auth): redirect logged-out visitors from private spaces to module landing
Non-demo space dashboards now redirect logged-out visitors to
rspace.online/ instead of showing another user's rApp grid. Private
space module pages redirect to rspace.online/{moduleId} instead of
showing the sign-in gate overlay.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 11:39:39 -07:00
Jeff Emmett f9767191e8 fix(auth): reload page on logout and redirect logged-in users from space grid
After logout, reload the page so the server re-renders the current rApp
in logged-out/demo mode instead of showing a blank screen. Cross-tab
logout also triggers a reload. Space dashboard now redirects logged-in
users to the rSpace canvas instead of showing the rApp grid.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 10:54:35 -07:00
Jeff Emmett 21b38e7297 fix(tabs): server-authoritative tab sync across browser sessions
Changed syncTabsFromServer to replace local tabs with server tabs
instead of merging (union). This prevents tabs closed in browser A
from being resurrected when browser B refreshes. Also added server
sync to the iframe module landing path which was localStorage-only.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 10:53:24 -07:00
Jeff Emmett f70972cfb7 fix(rdesign): add design-agent API to public endpoint exemptions
The demo space auth middleware was blocking POST requests with 403.
Add /rdesign/api/ to isPublicEndpoint list, matching rwallet pattern.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 10:32:18 -07:00
Jeff Emmett 77b7aba893 feat(rdesign): Scribus noVNC + AI design agent + CRDT sync
Replace Affine wrapper with full Scribus DTP stack:
- Docker container: Scribus 1.5 + Xvfb + x11vnc + noVNC + Python bridge
- Bridge API: Flask server (port 8765) proxying to Scribus Python API via Unix socket
- Design agent: Gemini tool-calling loop drives Scribus headlessly from text briefs
- CRDT sync: Automerge schema v2 with pages/frames, bidirectional SLA bridge
- Canvas tool: folk-design-agent shape + create_design_agent in canvas-tools registry
- Module UI: inline text prompt + step log + SVG layout preview (no iframe)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-24 10:06:04 -07:00