The trailing wildcard on the three rm -rf deny entries spanned path
separators, so Bash(rm -rf /*) matched every absolute path on the
machine rather than the filesystem root, and the ~ and $HOME entries
had the same shape. Narrowed to the exact literal forms.
These rules match literal command text, so they still stop a typo on
rm -rf /, rm -rf ~ or rm -rf $HOME exactly, but they no longer stop a
recursive delete aimed at any other path. That reduced cover is
deliberate, not an oversight.
`make setup` ran build_runner and reported success whether it produced the
39 files a fresh clone needs or almost nothing. `flutter test`'s only guard
checked a single sentinel file, which is why the 2026-08-09 4-of-46 gap
still read as 26 passed / 17 failed instead of a missing build step.
ci/check_codegen.sh walks every `part` directive under lib/ and confirms
the sibling file it names exists, then wires into both `setup` (fail loud
right after codegen if it under-produced) and `test` (fail loud, exit 69,
if nobody ran setup at all). Replaces the one-file guard, which would have
missed 44 of the 45 directives that exist today.
.claude/settings.local.json was tracked — the one file in the workspace whose
whole purpose is to stay out of version control. .gitignore has listed it since
it was added and line 130 even carries the git rm --cached command, but gitignore
cannot act on a path git already tracks, so the rule had never once fired.
Nothing leaked. Both committed versions held four permission rules and no env
keys, checked per commit rather than only at HEAD. The risk was prospective: the
next person to put a credential in the local overrides file would have committed
it, and the ignore rule would have stayed silent about it.
The four rules are worth sharing, so they move rather than disappear. They allow
chrome-devtools screenshot/snapshot/navigate and puppeteer evaluate — visual
verification, which is routine work in a Flutter UI and not one person's
preference. settings.json is committed by design and already carries 16 allow
and 43 deny rules, so they now sit with their peers. Anyone cloning this repo
keeps the tooling; before this commit they only got it by accident.
The file itself stays on disk, so no one loses local settings. It is simply no
longer shared, and the existing ignore rule now has something it can act on.
Closes T-1.
Co-Authored-By: Claude <noreply@anthropic.com>
First ticket in this repo's vault, so the changelog files are new. Committed
because the database is gitignored and the changelog is what makes a ticket
travel with a clone (workspace D-15); uncommitted, this ticket would exist only
on one machine.
The bug itself: .gitignore has listed .claude/settings.local.json since it was
added, and line 130 even carries the git rm --cached command, but gitignore does
not apply to paths git already tracks — so the rule has been inert the whole
time. This is the only repo in the workspace where that file is tracked.
No credentials were ever committed; both existing versions hold four permission
rules and no env keys, checked per commit rather than only at HEAD. The ticket
records that explicitly, because a previous survey misread this same file as
credentials across nine repos and the correction is worth keeping attached to it.
Not fixing it here. The four rules allow browser-automation MCP tools, and
untracking silently removes them from every clone — whether they are personal or
belong in the committed settings.json is a judgement about how people work in
this repo, not something to decide while filing.
Co-Authored-By: Claude <noreply@anthropic.com>
flutter analyze exits non-zero on info-level findings too, so all five had to
go for `make pre-push` to pass. Four were mechanical. The fifth was not.
envApiUser was reported as an unused declaration. Removing it revealed that the
field behind it, _envApiUser, was then unused as well -- and the pair turns out
to be a closed loop nothing could enter: the getter is public but sits on
_DashboardContentState, a private class, so no caller outside this file could
ever have reached it. The field was written once per session and never read.
The debugPrint next to it logs envData.user directly, so the logging the
comment describes never depended on the stored copy. Field, getter and
assignment removed; _hasLoggedEnvUser stays, because it genuinely guards the
log-once.
Deleting the first warning exposing the second is the useful part: unused_field
could not fire while a dead getter was "using" it. Dead code hides dead code.
The two `if (x != null) x` collection entries become null-aware elements, which
is the same intent spelled the way the SDK now expects. The two casts in
data_grid_test were the second cast of a pair -- `mode as InfiniteDataMode` on
the preceding line already promotes the local.
flutter analyze: No issues found. The edited test file still passes all 37.
Note the gate still prints "not gated here yet: test (T-56)" -- analysis is
green, tests remain unwired, and that is deliberately left visible.
Co-Authored-By: Claude <noreply@anthropic.com>
The hook carried ~50 lines of gitleaks logic and a comment explaining it was
self-contained because "this repo has no Makefile". It has one now, so the
reason is gone and the arrangement is backwards: a hook is a trigger, and
logic belongs where it can be read, run by hand, and changed under review.
.githooks/pre-push is now a byte-identical shim onto `make pre-push` in every
repo in the workspace. The scan itself moves to ci/secrets.sh unchanged, and
`make secrets` runs it on its own.
The call surface is identical everywhere; what it runs is not, and should not
be — each repo gates what it actually has. That is the point of standardising
the name rather than the contents: nobody has to read a repo to find out how
to check it.
secrets runs first, deliberately. It is the only failure here that cannot be
undone by fixing it afterwards — a failed lint costs another commit, a pushed
credential is cached and indexed whether or not it is later deleted.
Some of these gates fail today, on lint debt that predates them, and they are
left wired anyway. The board was measured once and written down in T-56
instead of being worked around here. Narrowing each gate to whatever already
passes would produce a gate that reports success for doing nothing, which is
the failure this workspace keeps rediscovering.
Co-Authored-By: Claude <noreply@anthropic.com>
Environment guards now exit 69 rather than 1, so a caller can tell a suite
that could not start from one that ran and failed. The first toj test sweep
reported "3 repositories failed" and none of the three had executed a test —
two could not find go, one had no venv. That points the reader at the tests
when the fault is in the environment.
Only the environment guards change. A gitleaks finding, a failed test run and
a vulncheck hit still exit 1, because those did run and did fail.
Co-Authored-By: Claude <noreply@anthropic.com>
The suite reported 26 passed and 17 failed, which reads as broken tests and
was actually a missing build step. *.freezed.dart and lib/**/*.g.dart are
gitignored, so a fresh tree has none of them and most of the suite fails to
compile rather than to assert. After running build_runner the same suite is
452 passed, unchanged.
setup now runs pub get then generate, and generate exists on its own for after
a model change. test guards on a known generated file and says which command
fixes it, because "cannot compile" and "assertion failed" are different
problems and the runner presents them identically.
Co-Authored-By: Claude <noreply@anthropic.com>
Every repo gets one at the root: help, plus test and lint where those exist.
The point is that a target name means the same thing in every repo, so an
agent or a person can act without reading the repo first.
Paths resolve here rather than in callers (D-10). python3 on this host is 3.8
and cannot parse these sources, and a bare pytest or ruff resolves only in a
login shell — so both are named explicitly through the venv, and a missing
venv fails with the command to fix it rather than a bare no-such-file.
Co-Authored-By: Claude <noreply@anthropic.com>
pql is now a bare word on PATH, which removed the long incantation that had
been forcing --vault into every call by habit. Convenience lowered the cost
of the wrong thing without lowering the cost of the right one: a three-word
pql ticket new targets whichever vault the cwd happens to sit in, and there
are nine of them with colliding id sequences.
PQL_VAULT in each project settings file makes the vault a property of the
session rather than of the working directory — the same lesson Rule 3 records
for git -C, applied to pql. Verified the env var overrides cwd discovery,
that an explicit --vault still beats the env var, and that the harness
hot-reloads it without a restart.
This does not make provenance visible: no output says which vault answered,
so a forgotten --vault still returns a well-formed answer about the wrong
dataset. That remains T-37.
Co-Authored-By: Claude <noreply@anthropic.com>
toj is now on the global PATH as /usr/local/bin/toj, so its scope boundary
had to stop being "the absolute path is inconvenient to type" and start
being a rule. Its repo and settings verbs operate on the workspace root; run
from inside this repo they answer about the wrong tree.
Both spellings are denied, bare and absolute, because a deny with one
spelling left open is decorative.
Co-Authored-By: Claude <noreply@anthropic.com>
No repo here scanned for committed credentials. The hook is self-contained
rather than delegating to a Makefile, because this repo has none and a hook
reaching into a sibling repo breaks the moment this one is cloned elsewhere.
Scans the outgoing range rather than full history: history carries settled
findings — test fixtures, vendored third-party code — and a gate that fails
on something unfixable gets bypassed within a week.
Setting core.hooksPath means pql init must replant its replication shims into
.githooks, which is why they are gitignored here alongside the tracked
pre-push. Same layout pql itself uses.
Co-Authored-By: Claude <noreply@anthropic.com>
Decision ids are per-vault sequences, so they collide by construction
once there is more than one vault -- and every repo now has one. A bare
D-15 here will mean this repo's D-15 the moment this repo records one.
Cross-vault references are therefore qualified: workspace D-15.
Not hypothetical: pql holds D-1 through D-31 while the workspace holds
D-1 through D-21, so every workspace id currently collides with an
unrelated pql one. A bare id is not wrong the day it is written -- it
decays into wrong as the other vault grows, and nothing flags it.
Co-Authored-By: Claude <noreply@anthropic.com>
One agent doc per repo, and it is CLAUDE.md. Written fresh rather than
reformatted. PHILOSOPHY.md linked to the old file, so that pointer moves
with it, and its standing requirement to be read before working here is
carried forward rather than lost in the rewrite.
Two claims did not survive verification. The app is published on 9999,
not the tower:8092 the old file gave, and it pointed at portainer-core
for full-stack documentation -- that repo is deprecated and must not be
used as a source of infra facts.
Establishing what is live needs a different method here: there is no
sys.modules to read, since the container holds a compiled web build
rather than source. A transitive walk of import/export/part directives
from lib/main.dart found 8 of 132 files unreachable, and five of those
are exactly what runs in production. They are conditional-import targets
-- `import 'a.dart' if (dart.library.html) 'b.dart'` -- and a walk that
takes the first string misses the branch. Since this ships as Flutter
web, the _web half is live and the _stub/_native half is dormant. The
naive reading was not merely wrong but inverted.
Of the three genuinely unreferenced files, stack_model.dart is imported
only by its own test, so the suite is green and vouches for a model the
app never uses. permission_gate.dart sits next to an unimplemented auth
redesign and is recorded as undetermined rather than dead.
Co-Authored-By: Claude <noreply@anthropic.com>
Commits a .claude/settings.json rather than leaving permissions to
per-developer local state, and initialises a pql vault for this repo's
tickets and internal decisions.
Every git deny rule appears in both the `git <verb>` and `git * <verb>`
forms. Only the second catches `git -C <path>`, and without it the whole
deny list is decorative -- it looks like a policy and stops nothing.
The allow list carries pql's absolute path alongside the bare name.
pql is installed to ~/.local/bin, which is on the login PATH but not the
one a non-interactive shell gets, so the bare-name rules match nothing on
their own and every call would prompt anyway.
.gitignore now covers .claude/settings.local.json, which is machine-local
and must never be shared. `pql init` contributed the .pql/* rules with an
exception for the changelog, which is the replication log of record and
has to be committed for tickets to travel with a clone.
Co-Authored-By: Claude <noreply@anthropic.com>
CI resolves dependencies fresh (pubspec.lock is gitignored), so the
v1.7.0 build failed when dio 5.10 introduced transformTimeout. A
default clause absorbs future enum additions on either dio version;
unknown keeps identical behavior through it.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Network-migration release: default Core API and Tatlock API URLs now
point at the public https schweitz.net domains, and the decommissioned
Netdata / code-server quick links are removed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Netdata was never deployed and code-server was decommissioned on
2026-07-19; their quick links pointed at dead domains. The
portainerUrl/netdataUrl constants had no consumers (quick links
hardcode their own URLs). The Portainer quick link stays — its
portainer.schweitz.net host arrives with the port-lockdown phase.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Browser clients run on machines other than the host, and the homelab is
retiring direct LAN IP:port access (ports move to loopback behind NPM),
so the 192.168.86.149 defaults would stop working. The public domains
work from anywhere; LAN clients bypass Authentik via source-IP rules.
LAN development can still override via --dart-define.
Portainer (9000) and Netdata (19999) defaults are left unchanged: no
*.schweitz.net proxy hosts exist for those services yet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The .internal registry domain is being retired; git.schweitz.net now
serves the registry without SSO on /v2/.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Add NewsTickerWidget with horizontal auto-scrolling at 40px/sec
- Add NewsData and NewsHeadline Freezed models
- Add news datasource fetching from /tools/news endpoint
- Add news provider with 30-minute auto-refresh
- Place ticker between Welcome card and System Stats on dashboard
- Show placeholder headlines when no data (italic, muted style)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Weather/Air Quality dividers align with Sun Position horizon
- Forecast card bottoms align with same horizon line
- Unified visual rhythm across all cards
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- All environment widgets align content from bottom for visual harmony
- Wind chip now shows direction (e.g., "SE 14 km/h")
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Consistent 170px minHeight across Weather, Air Quality, Forecast widgets
- Swap sunrise/sunset labels at night to match arc direction
- Weather header shows "Weather" instead of location
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Constrain arc height to fit within card boundaries
- Scale radius down when arc would overflow on wider displays
- Revert user display in section header, use debugPrint instead
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add user display in environment section header for debugging OIDC
user resolution issues.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Arc angle now proportional to day/night duration (day = daylight/24 × 360°)
- Horizon points represent sunrise/sunset times
- Day arc with sun icon and yellow/orange gradient
- Night arc with moon icon and blue/indigo gradient
- Position updates every 10 minutes aligned to clock (0/10/20/30/40/50)
- Default to 07:00-17:00 when API data unavailable (asymmetric for visual effect)
- All environment cards maintain consistent height in "no data" state
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Desktop: 4-in-a-row layout (30/20/20/30 distribution)
- Tablet: 2x2 grid layout
- Mobile: Stacked vertically
- All widgets show "No data available" state instead of being hidden
- Sun position calculates from clock, defaults to 6am/6pm
- Environment refresh changed from 5min to 1 hour
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
feat: add dynamic environment widgets
Add live weather, sun position, and forecast widgets to Front Hall dashboard,
powered by data from the Qdrant volatile collection via core-api.
New widgets:
- SunPositionWidget: Animated arc showing sun/moon position with gradient colors
- ForecastWidget: Multi-day weather outlook
- Updated WeatherWidget and AirQualityWidget to accept API data
Infrastructure:
- Environment datasource calling GET /tools/environment
- Environment provider with 5-minute auto-refresh
- Freezed models for environment data
Tests:
- 12 widget tests for environment section
- Updated existing tests with givenEnvironment() harness method
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add shared screen size constants and configureScreenSize() helper in
test/harness/screen_sizes.dart. Add responsive test groups to all page
tests covering desktop (1920x1080), tablet landscape (1024x768), tablet
portrait (768x1024), mobile (375x812), and small mobile (320x568).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Decentralized Room Registry pattern
- Each room registers itself with central registry
- Dynamic navigation tabs and settings dropdown
- New Media Room and Parlor feature folders
- Permission-based room filtering support
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Root `/` now redirects to user's preferred default room
- Front Hall moved to `/front-hall` route (was `/`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add PageUrlState utility for URL ↔ state serialization
- Add column `id` field for unique column identification in URLs
- Update idSelector to return String for URL compatibility
- All DataGrid pages now support URL params: search, sort, order, id
- Browser URL updates via replaceState (no GoRouter rebuilds)
- Add FilterPanelSemantics for filter panel semantic IDs
- Add TESTING.md documentation
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Created lib/core/semantics/ with semantic ID constants and helper widget
- Enabled SemanticsBinding on web builds for accessibility tree exposure
- Added semantic IDs to:
- ProfileDropdown (button, settings, theme options, logout)
- TopHeaderBar room tabs (frontHall, controlRoom, security, parlor)
- NavPanel items (nav_item_{id})
This enables browser automation tools like Puppeteer and WebDriver to
discover and interact with Flutter widgets via the accessibility tree.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The AuthInterceptor was calling signOut() on any 401 error, which caused
the theme toggle to trigger logout when the preferences API returned 401.
Now 401 errors propagate to calling code for graceful handling.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Applied @persistentRiverpod annotation to AuthNotifier so it persists
for app lifetime. Previously, theme changes could trigger AuthProvider
rebuild via auto-dispose, causing AsyncLoading state and auth issues.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add @persistentRiverpod annotation for providers that need keepAlive
- ThemeProvider now persists for app lifetime
- Refactored API clients to use @persistentRiverpod
- Documented in ARCHITECTURE.md
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Settings page with Appearance, Navigation, and Account sections
- Theme toggle (System/Light/Dark) in profile dropdown
- Theme syncs with API preferences on login
- Default room preference syncs with backend
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
