Extension-less imports compiled fine but 404'd in the browser because
Express static only serves EventListeners.js, not EventListeners.
Was hidden until TokenUpdater started importing ActivityAnalyser client-side.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Fixes two root-cause bugs: browser tabs racing the same single-use refresh
token, and Electron never refreshing after its one-shot startup call.
Browser:
- TokenUpdater: periodic 5-min + activity-triggered pings to /api/auth/me,
EventSlot-driven valid/refreshing/expired/network-error state.
Web Locks leader election (one tab runs the updater; others follow via
BroadcastChannel). Falls back to leader-always without Locks API support.
- GuardedCall: three-tier wrapper (user/editor/silent) with pre-flight state
check and tier-specific retry. Replaces ad-hoc fetch calls in Editor and
editor-shell layout save/load.
- auth-connector: jwtMiddleware proactively rotates access-token cookie
within 15 min of real expiry (server clock, no client-side exp needed).
Electron:
- Periodic token updater in main process: reads JWT exp directly, uses
server-corrected clock (Date response header offset) for comparisons,
refreshes within 15 min of expiry. Replaces one-shot startup refresh.
- Session heartbeat: running instance writes accessToken + timestamp every
10 s. New instance mints its own session via POST /api/auth/new-session
if heartbeat is ≤30 s old — skips login screen transparently.
- Retired plaintext last-password.txt auto-login.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Claude API provider (@anthropic-ai/sdk): streaming, separate session history,
tool use support, rojo-settings-panel claude endpoint type
- Claude Code subprocess provider: --print --output-format stream-json --verbose,
--session-id/--resume multi-turn, shell:false Windows fix,
rojo-settings-panel claude-code endpoint type (no API key)
- Rojo local-mode fixes: detection, creation, system-prompt delivery
- Three subprocess bugs fixed: missing --verbose, stdin blocking, cmd.exe mangling
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Full tab tree (panels → sections → tab-containers → tabs + open files) saved and
restored per project per device. FileEditorPanel extended with getCurrentFile().
.roject/ hidden from file tree listings. Boards, outline, and history updated.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
File tree: open-state preserved on refresh, "Mark As Root Directory" moved
to context menu, "Open >" submenu for alternate editors, context menu label
truncated to filename (20 chars max). Page editor: mode buttons moved into
toolbar (sidebar removed). EditorConsole singleton + console-panel tab for
centralised message log with es-info header fade. openDocumentIn fix: derives
editorTag from panelElement.tagName, not registry. History folder renames
corrected (25-Friday→24-Friday, 30-Wednesday→30-Thursday, 31-Friday added).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Renames html-editor-panel → page-editor-panel and changes the handled
extension from .html/.htm to .page. The new editor introduces a structured
format (page-header / page-root / page-block / page-area / page-footer),
a block registry with Full Width and Two Columns templates, a two-mode
sidebar (Blocks / Areas), rich-text wrapSelection helper, auto-template
injection for empty files, sandbox="allow-same-origin" on the iframe,
and editor-style injection that is stripped before saving.
Adds a default-roject theme (dark BG, Barlow font, blue headings) embedded
as a <style> block in the page <head>, scoped to [data-theme="default-roject"]
on both <body> and <page-root>. Areas toolbar gains H1, H2, H3 buttons.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Electron fixes:
- extractToken (auth-connector): Bearer header checked before cookie — prevents stale
Electron session cookie from winning over injected token
- JWT_CLOCK_TOLERANCE env var: passed to jwt.verify as clockTolerance; set to 7200
in .env to absorb ~65 min clock skew between Windows dev machine and prod auth server
- Startup token refresh: main.ts calls POST /api/auth/refresh before opening main window;
shows login on failure instead of opening with expired tokens
- Quit-on-login fix: createMainWindow() is async; login-success now awaits it before
closing the login window (zero windows → app.quit() race was killing the process)
- Credential persistence: email + password stored in userData; remember-me checkbox
controls save behaviour; clear button removes saved files; fields pre-fill on load
- Electron session cookies cleared in createMainWindow() to avoid stale token reuse
CSS: z-index: 10 on .pld-nav (project-list-default) — fixed mobile nav buried under rows
Boards: cleared Done lane, added Electron fixes and nav z-index entries; backlog MVP
entry for local testing solution; bugs.html: 401-handling bug moved to Done.
Outline: auth card updated with extractToken order note and JWT_CLOCK_TOLERANCE docs.
History: Friday 18 July entry expanded with session 2 cards.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- editor-shell: redirect to / if not authenticated on load
- file-tree: open file in first clean matching panel, create new panel if all dirty
- Editor: add openDocumentIn() with targetElement for precise panel targeting
- panels: skip onDocumentOpened if targeted at a different panel
- FileEditorRegistry: add Godot extensions (gd, gdshader, gdshaderinc, gdinclude, glsl, tscn, tres, cs, gdextension)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Rokojori