BountyBoard

etalon/BountyBoard

Fork 0

Commit Graph

Author	SHA1	Message	Date
etalon	35168b9b83	fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir - chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML entities the browser emits (e.g.   for the space after a mention chip, or & for a typed "&") no longer render as literal " "/"&". Re-escaping keeps output XSS-safe. Adds regression tests. - Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo data dir (700-perm files); Makefile lint now gofmt's tracked files only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-13 12:26:32 +02:00
etalon	b232b4b3d3	feat: structured @-mentions (notify+clickable+hover), distinct links, Ctrl-rebalance sliders - Mentions now insert a span carrying the user id (handles names with spaces): the sanitizer permits <span class="mention" data-user-card="ULID">, comment and chat notifications resolve by id and only fire for users with access, and mentions render as clickable chips with the shared hover user-card. - Messages composer inserts an atomic, non-editable mention chip so the trailing space no longer collapses while typing. - Links inside chat messages and task comments are underlined/accented so they read as clickable. - Atomization: hold Ctrl/Cmd while dragging an effort slider to rebalance the sibling coefficients proportionally (sum stays ~1.00); added a hint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-13 12:09:17 +02:00
etalon	70a813edfa	feat: bounty board, task lifecycle, AI work performer flow, notifications (phase 8) - whitelist HTML sanitizer (stdlib tokenizer) with XSS vector tests - developer board: pool-scoped visibility, customer/search/minBounty/sort filters, stale-task age badges, competing-claims visibility setting, saved filters in profile extras - claims: request/withdraw (developer), approve/decline (consultant) with notifications to winners and losers; unassign/abandon back to board - work tracking: start, sanitized comments with @mention notifications, time logging, submit for review - review queue + review with per-AC checklist stored on the timeline; approve writes the immutable bountyAwards row (human assignees only) - assign-to-AI: §5.2 job submission, HMAC-verified callback endpoint, idempotent by jobId, artifacts downloaded into GridFS, failure path keeps the task assigned with timeline + notification - notifications API + bell with unread badge, dropdown, page, WS toasts - pages: bounty board, my-tasks kanban, task detail (role-driven actions, review dialog, AI dialog), review queue, developer pool Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-12 20:11:05 +02:00

Author

SHA1

Message

Date

etalon

35168b9b83

fix: sanitizer double-escaped entities ( /&); dot-prefix volumes dir

- chat.SanitizeHTML/SanitizePlain decoded-then-escape text runs, so HTML
  entities the browser emits (e.g. &nbsp; for the space after a mention chip,
  or &amp; for a typed "&") no longer render as literal "&nbsp;"/"&amp;".
  Re-escaping keeps output XSS-safe. Adds regression tests.
- Rename ./volumes -> ./.volumes so `go build/vet/test ./...` skip the mongo
  data dir (700-perm files); Makefile lint now gofmt's tracked files only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-13 12:26:32 +02:00

etalon

b232b4b3d3

feat: structured @-mentions (notify+clickable+hover), distinct links, Ctrl-rebalance sliders

- Mentions now insert a span carrying the user id (handles names with spaces):
  the sanitizer permits <span class="mention" data-user-card="ULID">, comment
  and chat notifications resolve by id and only fire for users with access,
  and mentions render as clickable chips with the shared hover user-card.
- Messages composer inserts an atomic, non-editable mention chip so the
  trailing space no longer collapses while typing.
- Links inside chat messages and task comments are underlined/accented so they
  read as clickable.
- Atomization: hold Ctrl/Cmd while dragging an effort slider to rebalance the
  sibling coefficients proportionally (sum stays ~1.00); added a hint.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-13 12:09:17 +02:00

etalon

70a813edfa

feat: bounty board, task lifecycle, AI work performer flow, notifications (phase 8)

- whitelist HTML sanitizer (stdlib tokenizer) with XSS vector tests
- developer board: pool-scoped visibility, customer/search/minBounty/sort
  filters, stale-task age badges, competing-claims visibility setting,
  saved filters in profile extras
- claims: request/withdraw (developer), approve/decline (consultant) with
  notifications to winners and losers; unassign/abandon back to board
- work tracking: start, sanitized comments with @mention notifications,
  time logging, submit for review
- review queue + review with per-AC checklist stored on the timeline;
  approve writes the immutable bountyAwards row (human assignees only)
- assign-to-AI: §5.2 job submission, HMAC-verified callback endpoint,
  idempotent by jobId, artifacts downloaded into GridFS, failure path
  keeps the task assigned with timeline + notification
- notifications API + bell with unread badge, dropdown, page, WS toasts
- pages: bounty board, my-tasks kanban, task detail (role-driven actions,
  review dialog, AI dialog), review queue, developer pool

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-12 20:11:05 +02:00

3 Commits