seed-stylechore: running prettier on the entire codebaseSep 20, 2025, 9:08 PMsend-emailsfeat: first working version of separated backendMay 6, 2025, 5:10 AMagent-board.shdocs: add agent board CLI, monitoring loops, and unified CRM design
Headless GitHub Issues task board (scripts/agent-board.sh), board/monitor-change/outbound skills, and post-merge/error-sweeper routine docs. Includes unified CRM + messaging migration design.
Co-authored-by: Cursor <<email>>Jun 28, 2026, 3:42 PMbun.lockfix(deps): resolve all medium/high/critical Dependabot vulnerabilities
Bumps ~40 packages across pnpm overrides, direct deps, and the
better-auth catalog entry to close ~100 open Dependabot alerts,
including major bumps to electron-builder (25→26, fixes app-builder-lib
and builder-util-runtime advisories), the @tiptap/* family (3.26→3.31,
ReDoS/prototype-pollution fixes), and @faker-js/faker in scripts/.
better-auth is pinned to ~1.6.33 rather than the newer 1.7.x line:
1.7.x drops MCP-plugin exports @zero/server depends on.
extract-zip (transitive, via electron-builder) has two high-severity
symlink-traversal advisories with no patched version published
upstream (still 2.0.1) — left as an accepted, build-time-only risk
since there's nothing to bump to.
Co-Authored-By: Claude Sonnet 5 <<email>>Sep 15, 2026, 7:27 AMcheck-brand-assets.mjsfix(lint): clear the four warnings the deny-warnings gate treats as errors
A spread that rebuilt a Set into an array only to iterate it once, an unused
`vi` import, and two `?? {}` fallbacks on a spread that already ignores
undefined. All four are no-ops at runtime; oxlint runs with --deny-warnings,
so they were failing the gate.
Co-Authored-By: Claude Opus 5 (1M context) <<email>>Sep 9, 2026, 11:33 PMenv-audit.mjsreplace cloudflare runtime with aws local servicesApr 6, 2026, 12:33 AMinstall-sherlock-hook.shfeat: Sherlock — self-learning customer success debugging system
Adds Sherlock: an autonomous debugging agent that investigates customer bugs,
attributes them to config or code, proposes evidence-backed fixes, and runs
a lightweight Haiku evaluator to monitor for regressions and config verification.
Key components:
- SHERLOCK_SYSTEM_KNOWLEDGE.md: auto-generated Cedar architecture reference (1150 lines)
- SKILL.md: 5-phase investigation workflow (parse → investigate → evaluate → fix → monitor)
- evaluate-monitor.ts: Haiku 4.5 evaluator — pass/fail/not_applicable from DB data only
- check-sherlock-monitors.ts: hourly cron, evaluates then flags pending_investigation
- invoke-sherlock.ts: spawns Claude Code subprocess for full investigations
- sherlock-webhook.ts: Linear + internal HTTP invocation endpoints
- scripts/sherlock.sh: CLI with --outstanding flag to batch-process flagged monitors
- sherlock-schema.ts: DB tables for investigations, monitors, symptom patterns, gaps
Co-Authored-By: Claude Sonnet 4.6 (1M context) <<email>>Jun 13, 2026, 2:17 PMkill-orphaned-typechecks.shfix: bound the task-link write to its owner, and resolve inbox CRM rules server-side
`taskId` became a tool INPUT on saveDraftTool, so it is now an id the model
chose — but the write it drove (`updateTaskActionData`) was scoped to nothing
at all, and the row it read back to stream `taskUpdated` was equally unscoped.
A caller with another user's task uuid could stamp their draft onto it and have
that task echoed into their own chat. `updateTaskActionData` now takes a params
object whose `userId` cannot be omitted, returns the row it actually wrote, and
optionally pins the task to the drafted-for conversation — so a wrong id leaves
the task alone instead of rehoming it. saveSlackDraftTool gets the same
conversation guard (it already had the owner one).
An inbox's CRM rule was likewise sent from the client on every list, count and
feed read. It compiles to a SQL subquery, so that meant an arbitrary filter ran
on every page load and the saved inbox no longer described what the inbox does.
All three routes now take an `inboxId` and look the rule up from the stored
record.
Also fixes the two typecheck gates this branch left red — `deriveSurface` could
not accept a key-typed RequestContext, and apps/mail's new tsconfig.test.json
had neither jest-dom's matchers nor the server project reference (`extends`
does not carry `references`, so ~940 server sources were being compiled under
mail's options). CI's mail job dropped its `tests/` path filter, which had been
skipping every suite under modules/**/__tests__ — 44 suites became 179.
- cleanup:orphans is scoped to its own checkout; it was killing vitest and tsc
in every other cedar-mail worktree on the machine
- isNonEmptyConversationFilter recurses, so `{include: [], exclude: []}` no
longer pins an inbox to the mirror with no Gmail fallback
- the unibox resolves its conversation subquery once instead of once per channel
- the completion chime awaits resume() rather than reading state synchronously,
which silently dropped the first chime of every session
Co-Authored-By: Claude Opus 5 (1M context) <<email>>Aug 5, 2026, 1:01 AMpackage.jsonfix(deps): resolve all medium/high/critical Dependabot vulnerabilities
Bumps ~40 packages across pnpm overrides, direct deps, and the
better-auth catalog entry to close ~100 open Dependabot alerts,
including major bumps to electron-builder (25→26, fixes app-builder-lib
and builder-util-runtime advisories), the @tiptap/* family (3.26→3.31,
ReDoS/prototype-pollution fixes), and @faker-js/faker in scripts/.
better-auth is pinned to ~1.6.33 rather than the newer 1.7.x line:
1.7.x drops MCP-plugin exports @zero/server depends on.
extract-zip (transitive, via electron-builder) has two high-severity
symlink-traversal advisories with no patched version published
upstream (still 2.0.1) — left as an accepted, build-time-only risk
since there's nothing to bump to.
Co-Authored-By: Claude Sonnet 5 <<email>>Sep 15, 2026, 7:27 AMpipe-to-axiom.jsreplace cloudflare runtime with aws local servicesApr 6, 2026, 12:33 AMREADME.mdfeat: remixify and whatever else needed to be doneMay 14, 2025, 1:44 AMrun.tsEnable spam email processing and improve label management workflow (#1948)
# Improved Email Labeling System with DEV_PROXY Support
## Description
This PR enhances the email labeling workflow with a more sophisticated approach to label management. It replaces the previous labeling system with a new implementation that better handles existing labels and user-defined topics.
Key improvements:
- Added DEV_PROXY environment variable to support local development
- Implemented a more robust label suggestion system that prioritizes existing account labels
- Added ability to create missing labels when appropriate
- Modified thread workflow to reload inbox after syncing
- Enabled processing of messages marked as spam (commented out spam filtering)
- Added a test:cron script for local testing of scheduled handlers
## Type of Change
- [x] ✨ New feature (non-breaking change which adds functionality)
- [x] 🐛 Bug fix (non-breaking change which fixes an issue)
- [x] ⚡ Performance improvement
## Areas Affected
- [x] Email Integration (Gmail, IMAP, etc.)
- [x] Development Workflow
## Testing Done
- [x] Manual testing performed
## Checklist
- [x] I have performed a self-review of my code
- [x] My changes generate no new warnings
- [x] I have updated the documentation
## Additional Notes
The new labeling system now follows a three-step process:
1. Retrieves existing user account labels
2. Gets user-defined topics for potential new labels
3. Intelligently suggests and applies labels, prioritizing existing ones
The DEV_PROXY environment variable allows for easier local development by redirecting notification requests through a local proxy when configured.
<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit
* **New Features**
* Improved label suggestion and synchronization, now incorporating user topics and existing labels for more accurate email organization.
* Added spam detection to prevent intent analysis on spam-tagged messages.
* Enhanced workflow steps for label management, including new steps for user topic retrieval and label suggestion generation.
* **Bug Fixes**
* Messages labeled as spam are now properly excluded from certain processing steps.
* **Chores**
* Updated environment variable defaults to enable workflows in local and staging environments.
* Added a new script for testing scheduled tasks via a local endpoint.
* Disabled the "seed-style" CLI command.
* **Other Improvements**
* Inbox folder now reloads automatically after thread updates.
* Improved logging for thread processing and label synchronization.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->Aug 7, 2025, 2:23 PMsend-slack-triage.tsfix: correct ticket URL regex to match '- ' prefix before Slack link conversion
Co-authored-by: isabelle-cedar <<email>>Mar 27, 2026, 12:24 PMsherlock.shfeat: Sherlock — self-learning customer success debugging system
Adds Sherlock: an autonomous debugging agent that investigates customer bugs,
attributes them to config or code, proposes evidence-backed fixes, and runs
a lightweight Haiku evaluator to monitor for regressions and config verification.
Key components:
- SHERLOCK_SYSTEM_KNOWLEDGE.md: auto-generated Cedar architecture reference (1150 lines)
- SKILL.md: 5-phase investigation workflow (parse → investigate → evaluate → fix → monitor)
- evaluate-monitor.ts: Haiku 4.5 evaluator — pass/fail/not_applicable from DB data only
- check-sherlock-monitors.ts: hourly cron, evaluates then flags pending_investigation
- invoke-sherlock.ts: spawns Claude Code subprocess for full investigations
- sherlock-webhook.ts: Linear + internal HTTP invocation endpoints
- scripts/sherlock.sh: CLI with --outstanding flag to batch-process flagged monitors
- sherlock-schema.ts: DB tables for investigations, monitors, symptom patterns, gaps
Co-Authored-By: Claude Sonnet 4.6 (1M context) <<email>>Jun 13, 2026, 2:17 PMtsconfig.jsonfeat: first working version of separated backendMay 6, 2025, 5:10 AM