Under the project dropdown: Dashboard (project insights), Installation
(connect guide, moved out of Settings), Settings (project facts). Active
states follow the open view/panel; the inline gear next to the dropdown is
gone. 46/46 e2e.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbiaaVM2ACxeRi8ySG9ybc
The ⋯ menu's Insights opens /insights/<current path>: a folder scopes the
treemap/scatter/hot-path/agent-coverage to its subtree, a file to itself;
crumb and title show the scope. urlForView now carries targets for insights
like it did for history. 45/45 e2e.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbiaaVM2ACxeRi8ySG9ybc
Topbar button, ⋯ menu entry, palette action, hidden file input, and the
upload plumbing (upload.ts) are gone; the server upload API stays (devices
and the store proxy depend on it). Spec reworked to seed via API and assert
the affordance is absent. 44/44 green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbiaaVM2ACxeRi8ySG9ybc
- header is the brand only (BearDrive), linking home
- Projects section is a dropdown (native select, styled) with the project
mark, plus the project-settings gear beside it and + to create
- sidebar footer is the account row (avatar, name, email) opening a popover:
Organization → <org> Settings, Hub → Signup & access (admins), Account →
Log out (danger red)
- volume mode unchanged (sign-out stays in its header)
- Playwright suite reworked for the new layout — 44/44 green; static rebuilt
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbiaaVM2ACxeRi8ySG9ybc
Design feedback applied:
- icons are lucide-react (lucide.dev) behind the existing <Icon name> API;
the inline SVG sprite is gone
- org bar (sidebar footer): the Manage text button is a gear icon opening
the org admin panel; sign-out moved here, after the gear
- header: the org-manage (people) button is removed; the header gear now
opens a new per-PROJECT settings panel (identity facts + connect guide);
sign-out stays in the header only when no project/org bar is present
(volume mode, loading, empty state)
Playwright suite updated and green (44/44); static/ rebuilt.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VbiaaVM2ACxeRi8ySG9ybc
Two viewer features plus the security fix the second one surfaced:
- Missing file/folder paths now get a not-found view: the path, and the
hint that a just-created file may still be uploading or syncing from a
teammate's device — the tree polls every few seconds so it appears on
its own, plus a Check again button that refetches immediately. The
topbar's share/download actions no longer show for nonexistent files.
- Opening an .html file renders it as a page (sandboxed iframe,
allow-scripts only) instead of showing source text.
- SECURITY: /api/file was already serving synced HTML inline as
text/html on the hub origin with session cookies — a stored-XSS
surface reachable by direct navigation, previously masked only by the
viewer showing HTML as text. Inline HTML and SVG responses now carry
'Content-Security-Policy: sandbox allow-scripts' (the same wall as
/s/* share pages); downloads are exempt (attachments never execute in
the hub origin).
Tests: Go CSP-header matrix (html/svg sandboxed, md clean, download
exempt); e2e: sandboxed-iframe rendering incl. in-frame content + CSP
assertion, and the not-found → late-upload → Check again flow. 44 specs
green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Field report follow-up: an agent with a stale skill copy couldn't find
the gated URL after creating a file. Instructions rot; hook output is
computed fresh from the binary every turn. Claude Code's turn-start
pull hook now runs 'bdrive sync --hook claude-code', which:
- pulls as before, and stamps the session note from the event JSON
(replacing the sh/sed pipeline for the pull leg)
- emits the project's gated-link formula as UserPromptSubmit
additionalContext: whenever the agent mentions a synced file path in
prose, it appends the hub link on an emoji — `<path>` [🔗](<url>) —
path plain (it's the local path), hyperlink on the emoji only; code
blocks stay plain; bdrive share stays explicit-opt-in-public
Blind-tested: an agent given only the injected context decorated every
path mention correctly, kept the code-block command plain, and checked
files were synced before linking.
- hooks install now CONVERGES marker-identified groups to the current
shape (command/matcher/flags), so improvements reach existing
projects on reinstall instead of being frozen by the idempotency
marker; hermes same
- plugin: UserPromptSubmit → beardrive-pull.sh (stdout passes through);
version 0.3.0
- SKILL 'Share what you make' generalized to 'Link what you mention'
(URL formula documented for non-Claude platforms); install.md pointer
template updated
Never fails the turn: every error path in --hook mode is a silent
successful exit; offline still emits (links serve online teammates).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
A leading YAML frontmatter block used to render as goldmark's
thematic-break soup (hr + stray text). It now renders as a compact
table: keys in the author's order (yaml.Node, not a map), flat lists
comma-joined, nested values as compact YAML in <code>, everything
HTML-escaped. Anything that isn't a well-formed YAML mapping — mid-doc
fences, unclosed fences, list-shaped or invalid YAML — falls through
and renders exactly as before; empty frontmatter is simply hidden.
Applies everywhere the server renders markdown: the hub viewer and
public share pages, each with theme-matched styling. Matters most for
OKF/gbrain-style frontmattered knowledge bases.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Desktop right-aligns Search/Share/⋯ via #meta's flex:1 spacer, but the
mobile styles hide #meta — nothing absorbed the middle space, so the
buttons sat next to the breadcrumb mid-bar (user-reported). On <=900px
the crumb is now the spacer. Verified at 390px: ⋯ right edge at 382/390.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Rounds 4 and 5 both scored every category >=8 with zero high-severity
findings — the exit bar (two consecutive passing designer rounds) is
met. Post-exit cleanup: restore id=search-btn dropped in the React port
so the existing mobile rule hiding the ⌘K badge matches again. Two
remaining observations recorded as won't-fix in the spec with reasons.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Designer round 4: all categories >=8, zero high or medium findings, all
seven round-3 fixes confirmed with measurements. Residual lows fixed for
the confirmation round: insights lens chips, guide tabs, and modal text
inputs to 44px on mobile; at <=430px the share dialog's destructive
Revoke takes its own row instead of sitting 9px from Done.
All responsive CSS on the same URLs — no mobile-specific routes.
42 e2e specs green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Designer round 3 FAILED the bar (6/6/7/9/6, one high) — it caught a
regression my round-2 fix introduced: .ai-main { overflow-wrap:anywhere }
let flex min-content collapse invite/share URL rows to one character per
line at 360/390 (496px-tall rows). Streak reset. Fixes:
- H1: on mobile the admin row's name/URL takes the full row
(flex-basis 100%; controls drop below) and break-word replaces
anywhere, so URLs wrap readably at natural break points
- M1: onboarding inputs collapsed to 18px (.ob-row goes column on
mobile, so flex:1 became flex-basis:0) — now flex:none, 44px
- L1: overflow-menu items 44px; L2: server auth pages get 44px
inputs/buttons at <=900px; L4: .markdown gets width:100% so short
docs stop shrink-to-content floating; L5: .hmeta centers so the
size stays attached when the author line wraps
go build/vet/test green; 42 e2e specs green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Designer round 2: layout 9 / readability 8 / tap-targets 8 /
navigation 9 / polish 8, zero high or medium findings; every round-1
fix confirmed with measurements (no page-level horizontal scroll on any
of the 24 surface x viewport combinations; desktop 1360 unaffected by
the 900px breakpoint).
Remaining low cosmetics fixed for the confirmation round:
- .hsize never wraps ('67 B' split across lines at 360)
- guide Copy button is a real 44px touch target (code blocks get the
height to hold it), admin selects/buttons 40 -> 44px
- truncated emails/URLs wrap on touch instead of dead-end ellipsis
- history timestamps 12px (11px was borderline on small phones)
42 e2e specs green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Designer round 1 scored layout 5 / readability 7 / tap-targets 6 /
navigation 8 / polish 7, one high finding:
- HIGH: tablet 768 and phone-landscape 844 fell between breakpoints —
full desktop topbar + fixed 264px sidebar overflowed the page
(scrollWidth 849 vs 768). The mobile media query now covers
max-width 900px, giving those widths the off-canvas sidebar and
collapsed topbar.
- MED: admin-row selects (28px) and .ai-btn/.ai-del (27px) bumped to
40px targets on mobile, rows wrap; modal buttons to 44px; share
dialog's destructive Revoke pushed away from Done; Escape now
dismisses the share dialog.
- MED: <=430px drops the verbose .dl-meta so filenames stop truncating.
- LOW: gd-copy gets an opaque backing over scrolling code; compact
nowrap history timestamps; invite/pbtn/palette rows to 44px.
42 e2e specs green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Field report: an agent session read a dozen-plus files via Bash
(grep/cat/tail/find) and Grep, but read heat showed almost nothing —
the read-log hook only matched the native Read tool.
- matchers broadened per platform: claude Read|Grep|Bash, codex
read_file|shell, gemini +search_file_content|run_shell_command,
hermes read_file|grep|bash; plugin hooks.json matches Read|Grep|Bash
- read-log is now tool-aware: shell events mine the command line for
existing files it names (redirect targets and flags excluded), grep
events mine the response for the files the matches came from
(content lines and filename lists), and listing tools (Glob, ls) are
deliberately ignored — seeing a file's name is not reading it
- hooks install upgrades a registered hook's stale matcher in place, so
re-running it after a binary upgrade rolls coverage out to existing
projects instead of being skipped by the idempotency marker
- docs: SKILL.md platform table + read-heat wording, install/init
commands, README command table
Note from the same report, verified not a bug: read-log resolves the
mount via the folder's own .bdrive/config.json (config.ResolveMount),
so a stale duplicate registry entry cannot swallow reads.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
- #root { display: contents } so body's flex layout sees through the
React mount point (main pane was stuck at content width)
- README: Web frontend development section; CLAUDE.md: commands +
webapp description rewritten for the React/Vite reality (committed
dist, check-dist pre-release step, the no-router-library and
no-post-commit-DOM-patching lessons)
- verified: clean git-archive checkout builds with no Node and serves
the React app; visual parity pass across desktop + mobile surfaces;
42 e2e specs green; plugin docs untouched (no frontend internals)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
- org admin: rename, member roles/removal (self marked), project
rename/delete, invite links (create/copy/revoke, uses + expiry),
org-wide public-share audit with revoke; members get a read-only view
- hub settings: verification/approval policy toggles (verification
disabled without SMTP), read-only domains/self-signup/admins, pending
signup queue with approve/deny (count feeds the admin bar)
- panels replace the content pane without becoming routes (classic-app
parity): Browser takes a panel prop, HubApp owns the state and any
navigation closes it
- e2e: 8 admin specs, all mutations self-reverting (42 total green)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
- project home at /<pid>: connect-an-agent guide (Claude plugin flow,
Hermes/Codex CLI tabs, persisted choice, copy buttons, real hub origin
+ project id), with Insights embedded below for admins/org-owners
- Insights: squarified treemap, reads×freshness scatter with danger
quadrant, hot-path list, agent coverage matrix — classic math ported
verbatim into JSX SVG; dedicated /insights route
- history views: whole-project / subtree / per-file feeds with kind tags,
device attribution, expandable linkified session notes
- REPLACED react-router-dom with src/nav.ts (~40-line synchronous history
router): v7 wraps navigation in startTransition, which left the old
view on screen for seconds after the URL changed (flaky navigations,
35KB heavier bundle). Routing semantics are unchanged.
- e2e: 12 new specs porting the original 17 parity checks (34 total,
~13s, stable across repeated runs)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
- FileTree with fold state, lone-root auto-open, reveal-on-deep-link;
folder listings with heat dots and the journals-backed change feed
- FileView: markdown (HTML transformed BEFORE render, link clicks
delegated — React re-applies dangerouslySetInnerHTML markup on
unrelated updates, so post-commit DOM patching loses handlers),
images, text, download card
- breadcrumbs, per-route scroll restoration (location.key memo)
- topbar actions: share dialog (mint/copy/open/revoke), history/upload/
download buttons, ⋯ overflow menu; upload via upload/init direct or
relay path, then tree refresh + open
- ⌘K command palette: fuzzy files/projects/actions with stemming
- e2e: 11 new browse specs (22 total green in ~12s); helpers cache one
session cookie per identity to stay under the 10/min auth rate limit
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
- URL as source of truth: parseRoute/urlForPath/urlForView ported verbatim
(src/router.ts), single catch-all route so encoded slashes survive
- hub shell: project nav with color chips, org bar, admin bar with pending
count, sign-out per session flags; volume shell renders too
- empty-state onboarding (invite paste + create project), /join/<token>
invite accept that survives the login redirect
- toast + modal prompt/confirm primitives (imperative promise API over a
React host, matching the classic behavior)
- e2e: 7 new hub specs (11 total green); harness gains a no-org 'solo'
account to reach the empty state
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
- Vite+React+TypeScript workspace at internal/webapp/frontend; vite build
emits committed assets into internal/webapp/static (the go:embed target),
so plain 'go build' still needs no Node
- style.css and the SVG sprite ported verbatim; boot layer (api/config,
401->login redirect) ported so the auth flow works end to end
- frontend(): content-hashed assets/* now served immutable; index.html
stays no-cache (TestFrontendSPAFallback covers both)
- committed e2e harness (BDRIVE_E2E_SERVE=1, deterministic seeded hub on
:8993) wired as Playwright webServer; 4 shell specs green
- check-dist.sh guards against stale committed build output
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Clicking a project now lands on an index page (/<project-id>) instead of
redirecting to Insights: a tabbed guide for mounting the project locally
and wiring it to a coding agent, with the Insights dashboard embedded
below for admins/org-owners.
- Claude Code & Cowork share one tab guiding through the plugin
(/plugin marketplace add + /beardrive:install with this hub's URL and
the project id pre-filled); Hermes and Codex get the four-step CLI flow
(install, login, init, hooks install) with real copyable commands.
- /<project-id>/insights stays a dedicated deep-linkable route; the
sidebar project name is now a home link.
- Copy buttons, localStorage-persisted tab choice, scroll/back-forward
behavior consistent with the other views.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
- No-flicker polling: tree and heat refreshes compare fetched data and skip
DOM rebuilds when nothing changed; in-place listing re-renders preserve
scroll.
- RESTful routes: /<project>/insights and /<project>/history[/<path>]
replace query-param views; the reserved first segments survive refresh,
deep links, and back/forward. Per-route scroll restore (manual
scrollRestoration) returns the reader to where they were.
- History rows unified: every entry (recent changes and full history) is a
clickable row that opens the file — view/download version links removed;
old versions remain reachable via the blob API until the time-travel
viewer lands. Folder tree loses the per-dir history icon.
- Hot path: danger rows use the amber accent, ⚠ trails the filename, and a
tooltip explains the flag (reads/30d, days unchanged).
- Frontend responses send Cache-Control: no-cache so upgrades never leave
browsers on a stale embedded UI.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
History notes still clamp to one line so the feed stays scannable, but
clicking (or Enter on) the note expands the full text and back — links
inside keep working. Selecting a project now lands admins/org owners on
the Insights dashboard instead of the empty "select a file" pane;
members keep the placeholder, and routes that carry a path still open
that file or folder.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
AgentHeat aggregates agent-kind buckets per device per top-level folder;
the handler joins the device registry (name/OS) and sorts by total. Human
and share buckets are never consulted, so human actor identities cannot
appear in the response — asserted by test, along with registry join, root
folder bucketing, sort order, and invalid-by rejection.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Insights (admin/org-owner) becomes a stacked dashboard driven by one heat
fetch plus the tree, with the all/human/agent lens applied throughout: a
dependency-free squarified treemap of every file (cell size = reads in the
window, color = staleness, ⚠ on hot+stale, one delegated click handler —
readable at 500+ files, group labels open folders, cells open files); the
reads×freshness scatter demoted to drill-down with density handling
(translucent dots, radius = agent share); and a hot-path top-20 list with
stacked agent/human bars replacing the plain danger list. The agent
coverage matrix section renders when the server provides the by=device
breakdown. Design addendum recorded in docs/design/read-heatmap.md;
calendar/streamgraph explicitly deferred.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Admin/org-owner Insights view (⋯ menu): dependency-free SVG scatter of
every file by 30-day reads × days since last change, log scales, with the
hot-but-stale danger quadrant shaded and a ranked fix-these-first list;
lens toggle for all/human/agent reads. The Claude Code plugin gains a
PostToolUse(Read) hook so plugin users feed agent-read telemetry without
project-level hook registration. Docs synced: README, SKILL.md,
plugin install/init commands, CLAUDE.md, design doc marked implemented.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Phase 3 of the read heatmap: `bdrive read-log` parses any platform's hook
event JSON from stdin and queues in-project file reads (mount-relative,
ignore/include-filtered) in a per-volume spool — no network on the hook
path. The sync cycle drains the spool best-effort to the hub's new
POST /api/p/<id>/reads via the remote ReadReporter capability (https
backend only); a failed report retries next cycle and never fails or
offlines the cycle. `bdrive hooks install` now registers a third hook per
platform on its read-tool matcher (claude Read, codex read_file
best-effort, gemini read_file|read_many_files, hermes read_file), each
idempotent on its own marker so sync-only configs upgrade in place. Agent
reads land as agent traffic in the heat view, actor = device id.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Read telemetry per docs/design/read-heatmap.md: a ReadLedger over a new
batch-oriented MetaStore ReadRepo (file reads.json + SQL read_stats)
aggregates viewer and share reads into daily per-actor buckets, debounced
to visits, folded into all-time rows past retention. GET /api/p/<id>/heat
serves per-path counts (human/agent/share, distinct readers, last read) —
never identities. /store sync traffic and history blob views are not reads.
The viewer shows heat dots and read counts on folder listings and the file
meta line.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
`bdrive hooks install` detects the agent platforms in use — Claude Code
(.claude/), Codex (.codex/), Gemini CLI (.gemini/), Hermes (~/.hermes/) —
and idempotently merges beardrive's turn-boundary sync hooks into each
platform's own hook config (JSON for claude/codex/gemini, YAML for
hermes), preserving existing hooks. All four pipe hook JSON with a
session_id, so one POSIX-sh hook command serves every platform: pull at
turn start, push after edits, changes stamped "<agent> session <id>".
Bare `bdrive hooks` prints the detection/registration table.
The beardrive skill now runs it automatically after `bdrive init`, and
/beardrive:install's hand-maintained settings.json block is replaced by
the command, so the hook content has one source of truth in the binary.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
`bdrive sync --note <text>` stamps session context onto every op the cycle
commits and persists it in the volume store (note.json, --note-ttl default
30m) so the daemon's own scans stamp it too — winning the race between
one-shot hook syncs and the 3s daemon scan. The plugin sync hook extracts
session_id from hook stdin JSON and passes it automatically, so history
links every change to the Claude Code session that made it. Conflict-copy
ops keep their own note; expired/cleared notes stop applying.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
Folders in the file tree are now selectable: the row opens the folder
(chevron still folds) and the main pane lists its contents, with clickable
breadcrumbs, folder URLs/deep links, palette entries, and uploads landing
inside the selected folder. In hub mode the listing includes a Recent
changes feed for the subtree; the history API now classifies puts as
add|edit (replayed over all ops before filtering) so entries are badged
added/edited/deleted, and op notes render under entries with URLs
linkified.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
A subdirectory with its own .bdrive/config.json now syncs only through
its own project: the parent mount never scans into it, materializes
over it, or emits deletes for paths under it (cached paths are dropped
without delete ops, the same posture as newly ignored files). Detection
is presence-based (config.IsMount) so even a corrupt nested config
still fences. This makes the team-knowledge-folder-inside-a-personal-
mount topology safe.
The plugin's init command and skill gain a "connecting knowledge
tooling" playbook: a detection ladder (gbrain -> OKF wiki -> plain
docs folder -> starting-point menu) and two hard rules — one transport
per folder (git-tracked dirs are handed off via git rm --cached +
gitignore before syncing) and knowledge-as-scoped-subfolder (never a
repo root). Conflict copies documented with their exact glob
(*.bdrive-conflict-*), since openknowledge validate cannot see them.
New flow tests: shared-subfolder scope both ways, teammate connect
over identical/divergent local content, nested mount syncing
independently on two projects, and a guard pinning the conflict-copy
filename to the documented glob.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5cxPQdSGJnjXCYY9GeWXt
The initial import was latency-bound: the push loop uploaded blobs strictly
serially, doing an Exists round-trip then a Put per blob (~2-3N sequential
round-trips against the hub).
- Upload unique blobs in parallel (errgroup, 16 in flight) — the main win.
- Drop the separate Exists round-trip: the backend's Put is idempotent and
the hub already skips content it has (reported during signing), so the
check was redundant.
- Session.OnProgress emits upload progress (done/total files + bytes) from
the push phase; the CLI renders an in-place bar on a TTY and periodic
percentage lines otherwise, wired into `bdrive init`'s initial cycle and
`bdrive sync`. The daemon stays silent.
Multi-device convergence tests pass with -race; new TestPushProgress covers
the progress emission.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Add a database/sql MetaStore (db_sql.go) targeting SQLite locally and
Postgres/Supabase in production through one portable schema: real tables
(accounts, tokens, auth_policy, projects, orgs, org_members, invites,
shares, devices), idempotent CREATE TABLE IF NOT EXISTS migrations at Open,
?→$N placeholder rebinding for Postgres, times as RFC3339 text, and
transactional multi-row writes (an org and its members). Pure-Go drivers
only (modernc.org/sqlite, jackc/pgx v5) so CGO-free builds keep working.
One shared conformance suite (db_conformance_test.go) runs the same
service-level operations — accounts+tokens, policy, pending/approve,
projects create-or-join/rename/delete, org roles, invite create/redeem/
uses/validity, share create/revoke/expiry, devices — then reopens the store
and asserts everything persisted. Runs against file AND sqlite always, and
postgres when BDRIVE_TEST_POSTGRES is set. Verified green on all three
against a real local Postgres.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Introduce a pluggable metadata persistence layer: a MetaStore of typed
repositories (AccountRepo, ProjectRepo, OrgRepo, ShareRepo, DeviceRepo).
The five registries keep their in-memory maps + logic and now persist each
change as one record through a repo, instead of rewriting a whole JSON file
inline. The `file` backend (db_file.go) reproduces the exact on-disk JSON
formats, so a running hub loads unchanged. Open*(path) constructors stay as
thin wrappers over the file backend.
Zero behavior change: full webapp suite green; the example hub boots and
existing auth.json/orgs.json/projects.json load and sign-in works.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
A hub on a public URL could be signed up to with any fake email. Make the
safe posture the default and turn the dangerous ones into startup errors.
Three supported postures:
- invite-only (NEW default): allow_signup defaults false. A valid org
invite link bootstraps an account even when self-signup is closed — the
only way in. pageLogin/pageSignup detect a /join/<token> target via
BuiltinAuth.InviteValid (wired to OrgDB.ValidInvite) and offer account
creation; signupInvited skips the domain/approval/verification gates and
activates immediately (the owner's invite is the vetting).
- approval-gated: allow_signup + require_approval (no SMTP needed).
- domain-restricted + verified: allow_signup + allowed_domains +
require_verification (needs smtp).
Hardening:
- BuiltinAuth.ValidateSignupPolicy (run at hub startup in web.go) refuses to
boot an open hub with no gate, or require_verification without a mailer
(the link would otherwise only reach the server log).
- handleAdminPolicy rejects enabling verification without SMTP; the UI
toggle is disabled with clearer copy in that case.
Tests: TestValidateSignupPolicy, TestInviteBootstrapsAccountWhenSignupClosed,
TestPolicyVerificationNeedsMailer. Verified end to end in the running hub
(outside-domain invitee onboards via a link; direct signup stays closed).
Docs updated (README, CLAUDE.md, SKILL.md).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Replace the frontend's hash-based routing with the History API and real
`/` paths, so URLs read like native file paths:
/#p-4e61c7d4/shared%2Fidea.md -> /p-4e61c7d4/shared/idea.md
/#shared%2Fnotes.md -> /shared/notes.md (volume mode)
/#join/<token> -> /join/<token>
Client (app.js):
- parseRoute() reads location.pathname; pushURL/syncURL push native paths
(segments percent-encoded, "/" kept literal); a popstate handler restores
back/forward. Invites read from /join/<token>.
- All api/ fetches and the app.js/style.css refs are now root-absolute so a
deep path doesn't break relative URL resolution.
Server (server.go):
- New Server.frontend handler: real assets serve directly; every other
non-API/auth/share GET returns index.html (SPA fallback), so deep links
and refreshes resolve instead of 404ing. Reserved prefixes stay 404s.
- Invite links minted as /join/<token> (orgs.go).
Tests: TestFrontendSPAFallback covers the fallback + reserved-prefix 404s;
existing invite test updated. Verified end to end in the running hub
(deep-link reload, back/forward, no %2F/# in the bar). Docs updated.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Rework the bdrive web UI away from the violet Obsidian-ish theme to a
near-black, honey-accented, hairline-crafted look in the spirit of Linear:
- Replace the mixed emoji glyphs (chevrons, clocks, palette icons, admin
badge, history markers, share dialog) with one coherent SVG line-icon
sprite + a svgIcon() helper; colored letter-marks for projects.
- Repoint the design tokens and rewrite style.css: near-black grounds,
7% hairline borders, tightened type, honey spent only on active state,
the ⌘K selection, and brand marks.
- Restyle the server-rendered auth pages and the public /s/ share shell
to the same tokens so sign-in and the app read as one product.
File-tree behavior:
- Folders start collapsed; a lone root folder opens on load.
- Opening a file (search, wikilink, deep link) unfolds the path to it and
scrolls the row into view. State now tracks open dirs (not collapsed),
so it survives the periodic tree refresh.
- Plain-text/JSONL views wrap long unbreakable lines instead of
overflowing the reading column.
Verified in the running example hub across desktop + mobile; go build,
go vet, go test ./... all green; zero horizontal page overflow.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Flips the final objective gate (contrast_aa) true; design-only.
- Palette match-highlight on a SELECTED row: recolor .plabel b to
--accent-bright (#c9b3ff) → 6.19:1 on the tinted row (was accent 3.98:1).
- Auth-page secondary text .alt #8a8a8a→#969696 → 5.12:1 on the card
(was 4.38:1).
- Polish: active-project marker uses --accent-bright to match its label;
Upload/Download join Share/History as uniform ghost buttons so no
secondary action shouts louder than the rest.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Closes the remaining design-review gaps (design-only; no flow changes).
Accessibility (the failing objective gate + residuals):
- Mobile 44px now reaches the PRIMARY tap targets: file tree rows,
project rows, the org "Manage" button, new-project +, and folder-history
all sized to 44px min (round 1 had only reached the header/sidebar icons).
- Residual sub-AA small text fixed: --text-faint #8a8a8a→#969696 (AA on the
#262626 sidebar, measured 5.1); selected palette row's kind/icon lifted
to #c4c4c4 (6.6); filled-button hover moved to --accent-press #5a3bc9 so
white labels stay ≥4.5 on hover (7.2, was 2.9).
- Directory rows expose aria-expanded, updated on collapse toggle.
UX (the main remaining seam):
- Native prompt()/confirm() replaced with in-app modal components
(modalPrompt / modalConfirm, destructive variant) for new project,
rename, delete, remove member, and revoke invite/share — so every
decision shares one visual language with the share modal and toasts.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Addresses the baseline design review's failing objective gates and layout
defects; no backend or flow changes.
Accessibility (was the ceiling — 3 of 4 objective gates failed):
- Contrast to AA: lifted --text-faint (#6e6e6e→#8a8a8a) and --text-dim;
darkened --accent-dim (#7c5cd6→#6a48e0) so white button labels reach
4.5:1; new --accent-bright (#c9b3ff) for accent text on the tinted
active background (tree/project active rows, admin badge, invite/ghost
buttons all lifted off sub-AA pairings). Same fix applied to the
server-rendered auth pages, which now share the app's token values.
- Keyboard + focus: file tree, project, and org-name rows are now
focusable (tabindex/role + Enter/Space) with a global :focus-visible
ring; restored input focus rings on app and auth pages.
- Touch targets: every header + sidebar control is a 44x44 hit area on
mobile; secondary file actions (History/Upload/Download) collapse under
a "⋯ More" menu so the row still fits with zero horizontal overflow.
Layout defects:
- #meta no longer wraps to 5 lines / shoves the action buttons — single
truncating line; #crumb truncates too.
- Long tree filenames ellipsize (label span flex:1 min-width:0) instead
of hard-clipping.
Consistency:
- Fixed the .markdown specificity leak: admin/history/onboarding views no
longer inherit markdown type rules (content class toggles per view), so
the admin type scale renders as declared.
- Recolored the off-system gold Admin badge to the accent family; added a
3-step radius token scale; swapped the mojibake-ish ▣/⛛ markers.
- Added a global [hidden] guard so explicit display rules can't override
the hidden attribute.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Both usability personas cleared the bar this round (admin 4.8, user 4.8;
every dimension >=4, zero blocker/major). Final touches from their notes:
copyText() guards navigator.clipboard so invite/share copy degrades to
"copy it manually" on a non-HTTPS origin instead of throwing; the join
toast now says "joined the <name> team, opening its projects" to
distinguish org from project.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Fixes the two round-2 majors.
User: on mobile the per-file actions (Share/History/Upload/Download) are
now icon buttons in the header — reachable again (round 2 wrongly hid
them). Search tolerates simple English plurals (ideas→idea), the
no-matches state states what search covers, the sidebar shows the hub
brand instead of the raw device name, and history-row downloads carry a
download attribute. Logged-out loads redirect to sign-in from /api/config
instead of firing 401-ing API calls.
Admin: a hub-admin "Signup & access" settings screen (⚙ Admin in the
sidebar) toggles email verification and admin approval live — persisted to
auth.json and surviving restart — while the domain allowlist and admin
list are shown read-only (deliberately server-config-owned so a browser
session can't widen access). Pending approvals live on the same screen.
Config toggles are now *bool so an explicit config value pins the setting
each boot, else the UI-saved policy stands. Invite revoke confirms; role
change re-renders the panel.
Tests: policy persistence + reload, policy API admin-only.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Admin: top-level ⚙ settings entry (owners/admins), signup form states the
domain restriction up front, invite list shows creator + join count,
org-wide share audit shows creator/date and confirms before revoke,
self-row role/remove controls disabled to avoid footguns.
User: mobile header no longer overflows (per-file actions move to the ⌘K
palette on narrow viewports; tables/pre scroll in their own container),
empty-state copy works on mobile, share confirmation is now an explicit
"anyone with this link can view" dialog with copy/open/revoke, invite
links carry a "you've been invited" banner through login, joining opens
the joined project, brand shown as the title, logout labeled, palette
placeholder clarified to "file names".
Tests: invite use-counter + creator in the owner list.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Makes a self-hosted hub safe to expose on a public URL and operable
without hand-editing JSON — addressing the blocker/major findings from
the persona usability evaluations.
Signup gating (config auth block, all optional):
- allowed_domains: signup email must match (e.g. only @runbear.io)
- require_verification: email-link activation before sign-in (reuses mailer)
- require_approval: hub admins approve new accounts (admins list)
- brand shown on the sign-in page; allow_signup:false already hid Sign up
Accounts carry a Status (active/unverified/pending); non-active accounts
cannot authenticate.
Admin lifecycle (endpoints + web UI):
- org: rename, member role change, member remove (last-owner guarded),
invite list + revoke
- project: create (web), rename, delete (from the org panel)
- hub admins: approve/deny pending signups (sidebar bell + panel)
- org-wide public-share audit with revoke
UX: onboarding empty-state (explains invites, paste-invite + create-project)
instead of a blank sidebar; visible "Search ⌘K" button; toasts replace
blocking alert(); responsive layout with an off-canvas sidebar; joining
via #join now survives a logged-out click (token carried through login).
Web uploads are attributed to the signed-in account, not the server.
Login/signup are rate-limited per IP.
Tests: domain/verification/approval gates, auth rate limit, org+project
lifecycle, owner-only guards, invite→join→role→remove over HTTP.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
Rendered-markdown share pages get a small "Shared with BearDrive" footer
linking to the repo — the shell template only, so shared raw HTML is
still served byte-for-byte and the /s/ sandbox CSP is unchanged. All
/s/* responses now sit behind a per-IP token bucket (default 120 req/min
sustained + burst, tunable via "share_rpm" in the web config) so the one
unauthenticated surface of a hub can't be scraped into a free CDN.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
The quota counterpart of AuthProvider: CheckWrite(org, addedBytes) runs
before every write path (browser upload via server or presign/commit,
the device-sync store proxy's sign and put), RecordUsage after success,
and CheckSeat before an invite adds a member. Denials surface as 403.
The open-source server ships only UnlimitedQuota and a nil provider
means unlimited — zero behavior change here; a managed deployment
enforces plans by swapping the provider. Unit test asserts the hooks
fire with the correct org and byte counts and that denials block
without recording usage.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R7Q9ZKSZRTdvrSJkYLUmYs
