Use Realmroot only for human and machine authentication, authorize AMA through the browser user's multi-resource grant, and restore AK-managed Ed25519 Agent sessions.
Preserve Better Auth source tables while removing the mistaken Realmroot Agent binding and machine M2M paths.
BREAKING CHANGE: AK no longer accepts Realmroot Agent tokens or AMA machine credentials; active browser users must sign in again to authorize the AMA resource.
Replace Better Auth user, machine, and agent authentication with Realmroot native flows, migrate tenant ownership, and route AMA access through the cutover adapter. Preserve this deployed migration state as the baseline for the narrower user-auth-only redesign.
The root tsconfig is solution-style (files:[] + references to non-composite
projects), so 'tsc --noEmit' there type-checks nothing — which let an arity bug
slip into taskDispatch.ts. Add a typecheck script that runs tsc --noEmit per
project (shared, cli, web incl. server/worker) and point the CLAUDE.md regression
step at it.
Unify the app into a single Worker deployment:
- Move functions/api/ → server/, add worker/index.ts entry point
- Merge relay-worker DO (TunnelRelay) into the main worker
- Replace Pages Functions with @cloudflare/vite-plugin build
- Integrate share SSR (OG meta injection) into Hono routes
- Remove dayjs dep from shared (native Date suffices)
- Simplify dev to single `vite dev`, deploy via CF Git integration
- Delete packages/relay-worker/ and Pages-specific _routes.json
Replace old-style commands (ak task list, ak task log, ak task view, etc.)
with new kubectl-style format (ak get task, ak create note, etc.). Remove
references to daemon-managed commands (assign, complete, release, link/unlink).
Add task lifecycle subcommands (claim, cancel, review, reject) and create
task options reference.
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove all human task management from UI — task creation (+ Task button,
onboarding Create Task step), status transitions (claim/cancel/release/assign),
delete button, and AssignDropdown component.
Board is now observation-only. Only reject and complete buttons remain,
shown exclusively for in_review tasks. Onboarding simplified from 3 to 2 steps.
Update CLAUDE.md with UI Principles and Post-Write Workflow to include
Playwright tests for frontend changes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Coverage improved from 36.73% to 47.33%. Four new test files with 115 test
cases covering board CRUD, repository CRUD, all HTTP routes, and SSE streaming.
Shared test infrastructure extracted to tests/helpers/db.ts. Updated CLAUDE.md
with test ownership rule: main agent owns source code, test-writer agent owns
test code.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Add CI workflow: build, type check, test with coverage on PRs and master
- Configure vitest coverage (v8 provider) scoped to source directories
- PR coverage report via vitest-coverage-report-action
- Coverage badge via GitHub Pages (no external services needed)
- Update CLAUDE.md with post-write workflow and testing conventions
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Each agent gets a cryptographic Ed25519 identity. Daemon generates
ephemeral keypair per spawn, registers public key with the server.
Agents authenticate via short-lived JWT instead of sharing machine
API key.
Backend:
- Integrate agentAuth plugin (Ed25519, 24h TTL, autonomous mode)
- Three-way auth: machine API key, agent JWT, user session
- Clear permission boundaries: requireMachine (daemon), requireAgent
(agent), requireUser (web)
- agents table gains public_key column
CLI:
- Daemon registers as Host on first start
- Ed25519 keypair generated per agent spawn (ephemeral, in-memory)
- AgentClient signs requests with EdDSA JWT (60s expiry)
- ProcessManager uses AgentClient for message relay and usage reporting
Frontend:
- Identicon: 5×5 symmetric SVG grid derived from public key hash
- Per-agent color: hue 160-220 (cyan-blue spectrum) from key bytes
- Fingerprint: 4-byte hex (XX:XX:XX:XX) displayed in agent profiles
- Task cards glow with agent-specific color when active
- Falls back to initials avatar for agents without public key
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Project and Board were 1:1 with no independent value. Board now absorbs
owner_id and description, becoming the workspace unit directly. API
surface changes from /api/projects/* to /api/boards/* with a new PATCH
endpoint for updates. Migrations consolidated into a single file.
Frontend: board switcher modal replaces dropdown, settings page gains
board rename/description/delete, CLI command renamed from project to board.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Repositories now belong to owner (like machines) instead of projects.
Schema: project_id → owner_id with UNIQUE(owner_id, url).
New tenant-scoped API endpoints: GET/POST/DELETE /api/repositories.
New top-level Repositories page in web UI with task count per repo.
CLI: ak link registers repo at tenant level, maps repoId → localPath.
Daemon resolves work directory via task.repository_id → links lookup.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Project is now the central workspace unit; Board is 1:1 internal entity (no public API)
- project_resources table → repositories table (simpler: name + url)
- tasks.project_id → tasks.repository_id (nullable FK to repositories)
- Board CRUD routes removed; GET /api/projects/:id/board added
- createProject atomically creates both project and board via db.batch()
- CLI: board command removed, project board subcommand added
- Frontend: useBoard fetches via projects API, FilterBar filters by repository
- Onboarding creates project (board auto-created), not board directly
- Dead code removed: project.ts, CreateBoardInput, DEFAULT_BOARD_NAME, RESOURCE_TYPES
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add In Review and Cancelled task statuses
Add two new kanban columns (In Review, Cancelled) with full-stack support:
- API endpoints: POST /api/tasks/:id/review and /cancel
- CLI commands: task review, task cancel
- D1 migration: 0003_review_cancel.sql
- Frontend: 5-column grid, ActivityLog labels/styles
- Agent idle check now considers In Review as active
- Dependency blocked check treats Cancelled as finished
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(qa): ISSUE-001 — use dynamic grid columns instead of hardcoded grid-cols-5
Tailwind JIT can't generate grid-cols-N dynamically. Use inline style
with gridTemplateColumns based on actual column count from API.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(qa): ISSUE-002 — rename migration to 0004 to avoid conflict with 0003_projects.sql
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: reject cancel on completed tasks — Done → Cancelled guard
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: add coverage for In Review and Cancelled constants
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: bump version and changelog (v1.2.1)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: Agent Kanban v2 — agent observatory, dependencies, SSE streaming
Transform the board from a task tracker into an agent observatory with
real-time visibility, platform-driven assignment, and dependency-aware
task coordination.
- Agent entity: status tracking (idle/working/offline), GET /api/agents
- Task dependencies: depends_on with cycle detection, blocked computation
- Task origin: created_from for subtask tracking
- Assign/Release: POST /api/tasks/:id/assign and /release endpoints
- Stale detection: auto-release after 2h, write-on-read in board fetch
- SSE streaming: GET /api/tasks/:id/stream with polling fallback
- CLI: task assign/release, agent list, --parent/--depends-on flags
- UI: ActivityLog, AssignDropdown, AgentProfile, SubtaskList, blocked badges
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix(review): address 5 review findings from pre-landing review
- Narrow SSE auth bypass to exact path pattern (was too broad)
- Fix SSE reconnection: resolve log ID to timestamp for since filtering
- Compute blocked status in getBoard() so kanban view shows blocked badges
- Remove dead code in useSSE polling fallback
- Rename fetch→load in useAgents to avoid shadowing global
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: bootstrap test framework (vitest)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* test: enum completeness coverage for v2 actions and agent statuses
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* chore: bump version and changelog (v1.2.0)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* docs: sync CLAUDE.md with v1.2.0 patterns
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
saltbo