From 01f7c6658768d38d1aa30cbd97307ec98152c5ae Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:29:02 +0330 Subject: [PATCH 01/45] fix(deploy): route root installs to the protected public web entry --- .htaccess | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .htaccess diff --git a/.htaccess b/.htaccess new file mode 100644 index 0000000..88e21e3 --- /dev/null +++ b/.htaccess @@ -0,0 +1,22 @@ +Options -Indexes + + + RewriteEngine On + + # Keep repository metadata and secret dotfiles inaccessible. + RewriteRule (^|/)\.(?!well-known/) - [F,L] + + # An optional repository-root document root must never expose the source tree. + # Only the public assets are mapped directly; every application URL goes through PHP. + RewriteRule ^public(?:/|$) - [F,L,NC] + RewriteRule ^\.well-known/ - [END] + RewriteRule ^assets/(.*)$ public/assets/$1 [END,NC] + RewriteRule ^ public/index.php [QSA,END] + + + + Header always set X-Content-Type-Options "nosniff" + Header always set Referrer-Policy "strict-origin-when-cross-origin" + Header always set X-Frame-Options "DENY" + Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'" + From 87c7d51920da0e2ec1b5e1dae2abb1083bcefb2f Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:29:22 +0330 Subject: [PATCH 02/45] fix(assets): set explicit CSS and JavaScript MIME types --- public/.htaccess | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/public/.htaccess b/public/.htaccess index 26ca016..991bf0f 100644 --- a/public/.htaccess +++ b/public/.htaccess @@ -13,7 +13,16 @@ DirectoryIndex index.php RewriteRule ^ index.php [QSA,L] + + # Keep strict nosniff policies compatible with directly served static assets. + AddType text/css .css + AddType application/javascript .js + + + + Header set Cache-Control "public, max-age=31536000, immutable" + Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set X-Frame-Options "DENY" From 834245d49fb7a40d99974663fd495919b8c8d32b Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:29:24 +0330 Subject: [PATCH 03/45] test(ci): syntax-check the production workspace controller --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ba2c4cc..81dbf4e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -55,7 +55,7 @@ jobs: - name: Check JavaScript syntax run: | node --check public/assets/js/ui.js - node --check public/assets/js/design-system-demo.js + node --check public/assets/js/workspace.js - name: Run MariaDB integration tests env: From f0cee4d28f692bff1ed0b71a8429db6431494cd9 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:29:27 +0330 Subject: [PATCH 04/45] fix(assets): invalidate stale workspace CSS and JavaScript caches --- public/app.html | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/public/app.html b/public/app.html index aea8d23..11f5bda 100644 --- a/public/app.html +++ b/public/app.html @@ -6,10 +6,10 @@ TeamCode Hub — Workspace - - - - + + + + From 11187deea78cd3b59459b8a73b652b925f1d5991 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:29:30 +0330 Subject: [PATCH 05/45] fix(styles): refresh design-system layer cache keys --- public/assets/css/app.css | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/public/assets/css/app.css b/public/assets/css/app.css index e556f68..c5afc62 100644 --- a/public/assets/css/app.css +++ b/public/assets/css/app.css @@ -5,12 +5,12 @@ Production pages should load this single stylesheet with a versioned URL. ========================================================================== */ -@import url("./tokens.css?v=0.2.1-dev"); -@import url("./base.css?v=0.2.1-dev"); -@import url("./layout.css?v=0.2.1-dev"); -@import url("./components.css?v=0.2.1-dev"); -@import url("./patterns.css?v=0.2.1-dev"); -@import url("./utilities.css?v=0.2.1-dev"); +@import url("./tokens.css?v=0.2.2-dev"); +@import url("./base.css?v=0.2.2-dev"); +@import url("./layout.css?v=0.2.2-dev"); +@import url("./components.css?v=0.2.2-dev"); +@import url("./patterns.css?v=0.2.2-dev"); +@import url("./utilities.css?v=0.2.2-dev"); /* Keep the document canvas consistent when pages use a full-height shell. */ body { background: var(--surface); color: var(--text); } From acbc4dde8fd67751d2900ae9a9872ded2457e7cf Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:30:46 +0330 Subject: [PATCH 06/45] test(styles): validate production asset wiring instead of showcase demo --- tests/design-system.php | 44 +++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 21 deletions(-) diff --git a/tests/design-system.php b/tests/design-system.php index 9fecfd5..cda862f 100644 --- a/tests/design-system.php +++ b/tests/design-system.php @@ -40,17 +40,17 @@ $patterns = $read('public/assets/css/patterns.css'); $utilities = $read('public/assets/css/utilities.css'); $uiScript = $read('public/assets/js/ui.js'); -$demoScript = $read('public/assets/js/design-system-demo.js'); -$demoPage = $read('public/design-system.html'); -$demoCss = $read('public/assets/css/design-system-demo.css'); +$workspaceHtml = $read('public/app.html'); +$workspaceCss = $read('public/assets/css/workspace.css'); +$workspaceScript = $read('public/assets/js/workspace.js'); $expectedImports = [ - '@import url("./tokens.css?v=0.2.1-dev");', - '@import url("./base.css?v=0.2.1-dev");', - '@import url("./layout.css?v=0.2.1-dev");', - '@import url("./components.css?v=0.2.1-dev");', - '@import url("./patterns.css?v=0.2.1-dev");', - '@import url("./utilities.css?v=0.2.1-dev");', + '@import url("./tokens.css?v=0.2.2-dev");', + '@import url("./base.css?v=0.2.2-dev");', + '@import url("./layout.css?v=0.2.2-dev");', + '@import url("./components.css?v=0.2.2-dev");', + '@import url("./patterns.css?v=0.2.2-dev");', + '@import url("./utilities.css?v=0.2.2-dev");', ]; $lastPosition = -1; foreach ($expectedImports as $import) { @@ -60,7 +60,7 @@ } $assert(str_contains($tokens, '--font-sans:') && str_contains($tokens, 'system-ui'), 'typography uses an installed system-font fallback stack'); -$assert(!preg_match('/fonts\.googleapis\.com|fonts\.gstatic\.com|use\.typekit\.net/i', $entry . $tokens . $base . $layout . $components . $patterns . $utilities . $demoCss), 'design-system CSS does not require a hosted font service'); +$assert(!preg_match('/fonts\.googleapis\.com|fonts\.gstatic\.com|use\.typekit\.net/i', $entry . $tokens . $base . $layout . $components . $patterns . $utilities), 'design-system CSS does not require a hosted font service'); $assert(str_contains($tokens, 'data-theme="dark"'), 'an explicit dark theme token set is available'); $assert(str_contains($base, 'prefers-reduced-motion: reduce'), 'base styles respect reduced-motion preferences'); $assert(str_contains($base, ':focus-visible'), 'keyboard focus indicators are defined'); @@ -75,12 +75,14 @@ $assert(str_contains($patterns, '.btn-xs') && str_contains($patterns, '.check .box') && str_contains($patterns, '.tabs.pill'), 'legacy button, form-state, and pill-tab aliases are available'); $assert(str_contains($uiScript, 'textContent = String(message'), 'toast content is inserted as text rather than interpreted HTML'); $assert(str_contains($uiScript, 'data-modal-open') && str_contains($uiScript, 'data-dropdown-toggle'), 'interaction controller includes modal and dropdown behavior'); -$assert(str_contains($demoPage, '/i', $demoPage), 'showcase HTML contains no inline JavaScript blocks'); -$assert(str_contains($demoPage, '/assets/css/design-system-demo.css') && str_contains($demoPage, '/assets/js/design-system-demo.js'), 'showcase-specific behavior and styles are external assets'); -$assert(str_contains($demoScript, 'window.TCHUI.notify'), 'showcase buttons use the shared notification API'); +$assert(str_contains($workspaceHtml, ')/i', $workspaceHtml), 'product shell contains no inline styles'); +$assert(!preg_match('/]*\\bsrc=)[^>]*>/i', $workspaceHtml), 'product shell contains no inline JavaScript'); +$assert(str_contains($workspaceCss, '.app-shell') && str_contains($workspaceCss, '.project-files-layout') && str_contains($workspaceCss, '.chat-messages'), 'product stylesheet covers actual workspace, source files, and chat views'); +$assert(str_contains($workspaceScript, '/api/teams') && str_contains($workspaceScript, '/api/projects/') && str_contains($workspaceScript, 'credentials: "same-origin"'), 'workspace controller connects team/project APIs with same-origin requests'); +$assert(str_contains($workspaceScript, '"X-Csrf-Token"') && str_contains($workspaceScript, 'function renderTeams'), 'workspace mutations retain CSRF protection and team rendering'); $assert(str_contains($tokens, '--text-muted: var(--g500);'), 'muted text uses a readable neutral on light surfaces'); $assert(str_contains($tokens, '--text-muted: #a1a1aa;'), 'muted text remains legible against dark surfaces'); @@ -92,14 +94,14 @@ $assert(is_file($root . '/' . $relativePath), 'entry stylesheet import resolves: ' . $relativePath); } -/* Verify the showcase references existing local CSS and JavaScript assets. */ -preg_match_all('/(?:href|src)="(\/assets\/[^"]+)"/', $demoPage, $assetMatches); +/* Verify the product shell references existing local CSS and JavaScript assets. */ +preg_match_all('/(?:href|src)="(\/assets\/[^"]+)"/', $workspaceHtml, $assetMatches); foreach ($assetMatches[1] as $assetUrl) { $relativePath = 'public' . strtok($assetUrl, '?'); - $assert(is_file($root . '/' . $relativePath), 'showcase asset URL resolves: ' . $relativePath); + $assert(is_file($root . '/' . $relativePath), 'product asset URL resolves: ' . $relativePath); } -$assert(str_contains($demoScript, 'demo-upload') && str_contains($demoScript, 'selectPage'), 'showcase upload preview and pagination examples are interactive'); -$assert(str_contains($demoScript, 'chip was removed locally'), 'showcase removable chips operate locally without a server request'); +$assert(str_contains($workspaceHtml, 'id="page-content"') && str_contains($workspaceHtml, 'id="application"'), 'workspace shell contains the actual app mount points'); +$assert(str_contains($workspaceScript, 'async function boot()') && str_contains($workspaceScript, 'window.TCHWorkspace'), 'workspace controller initializes and exposes its guarded controller'); echo "\n{$assertions} design-system assertions passed.\n"; From aa092474f6608349b71ec1e4cd9a00ea286409c5 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:31:30 +0330 Subject: [PATCH 07/45] test(ci): run workspace UI contract assertions in pull requests --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 81dbf4e..2d87f5c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -52,6 +52,9 @@ jobs: - name: Check design-system assets run: php tests/design-system.php + - name: Check workspace UI contracts + run: php tests/workspace-ui.php + - name: Check JavaScript syntax run: | node --check public/assets/js/ui.js From c73e080bc647cff71cf3a22668c59b3d58b87565 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:31:33 +0330 Subject: [PATCH 08/45] test(workspace): cover root routing, asset MIME, cache policy, and CI wiring --- tests/workspace-ui.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tests/workspace-ui.php b/tests/workspace-ui.php index 859b69c..e4516b7 100644 --- a/tests/workspace-ui.php +++ b/tests/workspace-ui.php @@ -56,6 +56,7 @@ $projectFileMigration = $read('database/migrations/20261018000400_create_project_code_files.php'); $response = $read('app/Core/Response.php'); $workflow = $read('.github/workflows/ci.yml'); +$rootHtaccess = $read('.htaccess'); $htaccess = $read('public/.htaccess'); $assert(str_contains($html, ')/i', $html), 'workspace HTML contains no inline style blocks'); From ed4b3be808b78f9dd3b696c4e6f8b7f018c9f283 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:33:05 +0330 Subject: [PATCH 09/45] docs(styles): document the production design system without demo assets --- docs/DESIGN-SYSTEM.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/docs/DESIGN-SYSTEM.md b/docs/DESIGN-SYSTEM.md index 5039cea..6046437 100644 --- a/docs/DESIGN-SYSTEM.md +++ b/docs/DESIGN-SYSTEM.md @@ -11,20 +11,20 @@ This document describes the shared visual and interaction foundation used by Tea | `public/assets/css/base.css` | Browser defaults, semantic element defaults, focus visibility, and reduced motion | | `public/assets/css/layout.css` | Containers, responsive grids, page shell, sidebar, and header layouts | | `public/assets/css/components.css` | Buttons, forms, badges, cards, alerts, tables, tabs, overlays, and feedback | -| `public/assets/css/patterns.css` | Upload/range controls, avatar states, pagination, accordions, tooltips, workflow steps, quote/code, and footer patterns | +| `public/assets/css/patterns.css` | Reusable upload/range controls, avatar states, pagination, accordions, tooltips, workflow steps, and content patterns | | `public/assets/css/utilities.css` | Small composable spacing, text, surface, and alignment helpers | -| `public/assets/js/ui.js` | Accessible interactions shared by product pages |\n| `public/assets/css/workspace.css` | Product-specific workspace, dashboard, project, task, and chat presentation |\n| `public/assets/js/workspace.js` | Authenticated API integration and workspace interactions |\n| `public/app.html` | English workspace shell and sign-in form | -| `public/assets/css/design-system-demo.css` | Styles unique to the reference showcase | -| `public/assets/js/design-system-demo.js` | Demo-only button handlers | -| `public/design-system.html` | English component reference page | +| `public/assets/css/workspace.css` | Product-specific workspace, dashboard, team, project, task, and chat presentation | +| `public/assets/js/ui.js` | Accessible interactions shared by product pages | +| `public/assets/js/workspace.js` | Authenticated API integration and workspace interactions | +| `public/app.html` | English workspace shell and sign-in form | ## Loading the design system Load the entry stylesheet and the shared UI controller from a page template. Keep product-specific styles and behavior in separate files and avoid inline style or script blocks. ```html - - + + ``` The entry stylesheet imports tokens, base rules, layout, core components, extended patterns, and utilities in dependency order. Every imported stylesheet URL carries a cache key. When CSS changes, bump the CSS asset query keys in the entry imports and HTML entry points together. A production release should use its actual SemVer version. @@ -85,14 +85,14 @@ Run: ```sh php tests/design-system.php node --check public/assets/js/ui.js -node --check public/assets/js/design-system-demo.js +node --check public/assets/js/workspace.js ``` CI runs these checks in addition to PHP lint, smoke tests, and MariaDB integration tests. These checks do not replace manual browser review, assistive-technology testing, or visual regression testing. ## Current scope -The showcase is a reference implementation of the style system, not a claim that the product dashboard, team/project screens, or chat interface are complete. Product screens must be built on the existing APIs and retain server-side authentication and authorization checks. +The shared style layers are loaded by the actual workspace shell; they are not a standalone product or a substitute for connected application behavior. Team, project, task, file, and chat actions must use the existing APIs and retain server-side authentication and authorization checks. ## Extended component coverage From c31213dce62ee732a7226999fdd6a411393f22a1 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:33:08 +0330 Subject: [PATCH 10/45] docs(workspace): document supported web roots and production-only UI --- docs/WORKSPACE-UI.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/WORKSPACE-UI.md b/docs/WORKSPACE-UI.md index 7ab1a7a..3d2a351 100644 --- a/docs/WORKSPACE-UI.md +++ b/docs/WORKSPACE-UI.md @@ -7,13 +7,14 @@ This document maps the English browser application to the existing server APIs. - `/` — authenticated workspace shell; shows sign-in when there is no active session. - `/login` — the same progressive-enhancement shell, initially displaying sign-in when unauthenticated. - `/verify-email` — the workspace shell used to confirm a one-time token supplied in the URL fragment. -- `/design-system.html` — component reference page. - `public/app.html` — semantic workspace shell. - `public/assets/css/app.css` and its token/base/layout/component/pattern/utility layers — shared design-system styles. - `public/assets/css/workspace.css` — product-only styles layered on the core design system. - `public/assets/js/workspace.js` — same-origin API client, navigation, rendering, forms, and chat polling. - `public/assets/js/ui.js` — shared design-system interactions. +The preferred deployment sets the document root to `public/`. A repository-root document root is also supported by the top-level `.htaccess`, which maps `/assets/*` to `public/assets/*`, routes application paths to `public/index.php`, and blocks direct access to the `public/` prefix and repository files. + Project repository links accept only public HTTPS GitHub URLs. The server shares one daily cached snapshot per repository and caps refresh attempts to 20 distinct repositories per UTC day. The HTML has no inline style or script blocks. The front controller returns HTML with a restrictive same-origin Content Security Policy. CSS and JavaScript are external, versioned files; update their query-string version when releasing a changed asset set. @@ -103,4 +104,4 @@ php tests/workspace-ui.php node --check public/assets/js/workspace.js ``` -These checks validate the static asset contract and JavaScript syntax. They do not replace manual browser testing across supported devices, keyboard-only interaction, screen-reader review, or visual regression tests. The design-system showcase includes extended input, avatar, chip, accordion, workflow-step, pagination, and content patterns. +These checks validate the static asset contract and JavaScript syntax. They do not replace manual browser testing across supported devices, keyboard-only interaction, screen-reader review, or visual regression tests. The style contract tests check actual production assets and route wiring; reusable patterns stay in the shared `patterns.css` layer instead of a separate demo page. From 2f0821f61ccbce856693afecfd95a579b4b83eed Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:33:11 +0330 Subject: [PATCH 11/45] docs(readme): align version and validation commands with production UI --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 99f907b..58d545a 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # TeamCode Hub -**Version:** 0.2.0-dev +**Version:** 0.2.1-dev **Status:** Active development TeamCode Hub is a modular, security-focused collaboration platform for software teams, designed for conventional PHP hosting with cPanel/DirectAdmin and MySQL/MariaDB. @@ -72,8 +72,8 @@ php tests/run.php php tests/design-system.php php tests/workspace-ui.php node --check public/assets/js/ui.js -node --check public/assets/js/design-system-demo.js node --check public/assets/js/workspace.js +php tests/workspace-ui.php ``` ## Remaining product work From 125a28125d6718b614002c8c4ecba1b1f740633f Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:33:14 +0330 Subject: [PATCH 12/45] docs(operations): explain safe root-document-root fallback --- docs/OPERATIONS.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md index 314fa66..de7674b 100644 --- a/docs/OPERATIONS.md +++ b/docs/OPERATIONS.md @@ -3,6 +3,7 @@ ## Before deployment - Configure the document root to the repository's `public/` directory where possible. +- If the host cannot point its document root at `public/`, the repository-root `.htaccess` provides a locked-down fallback: it exposes only `/assets/*` from `public/assets/` and routes app paths through `public/index.php`. Do not disable the root rewrite rules, because they prevent direct access to repository source files. - Configure database environment variables through the host or a private configuration mechanism outside the web root. - Create a dedicated database user with only the permissions the application requires. - Enable HTTPS and configure session cookie security accordingly. If TLS terminates at a trusted reverse proxy, set `APP_HTTPS=true` only when the deployment topology guarantees HTTPS to the browser. From 5bcbd46172f7ae2b6a5d2c388efffa0d19cfedac Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:33:17 +0330 Subject: [PATCH 13/45] docs(changelog): record asset delivery and production UI cleanup --- CHANGELOG.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8313304..a198616 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ ## Unreleased +- Fix CSS/JavaScript delivery for hosts whose document root is the repository root by routing `/assets/*` to the public asset directory without exposing application source files. +- Explicitly declare static CSS/JavaScript MIME types and apply immutable caching to versioned assets; bump workspace asset keys to avoid stale cached styles and scripts. +- Run the previously unwired workspace UI contract test in CI and syntax-check the production `workspace.js` controller. +- Remove the standalone visual showcase page and demo-only assets; retain shared design-system CSS that the live workspace uses. + + - Removed unused duplicate team/project settings handlers and aligned UI contract tests with the registered transactional update endpoints. - Add a project Files tab with a searchable private source-file directory, lightweight text editor, save/reload controls, and revision-history restore. From f63c4d38ada6e9d80560ae822b06e30993f888c2 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:33:45 +0330 Subject: [PATCH 14/45] refactor(ui): remove standalone visual showcase from product routes --- public/design-system.html | 324 -------------------------------------- 1 file changed, 324 deletions(-) delete mode 100644 public/design-system.html diff --git a/public/design-system.html b/public/design-system.html deleted file mode 100644 index 84ba265..0000000 --- a/public/design-system.html +++ /dev/null @@ -1,324 +0,0 @@ - - - - - - - - - - Design System — TeamCode Hub - - - - - - - - - - - - -
-
- - - TeamCode Hub - - -
- - Explore UI -
-
-
- -
- -
-
-

Interface foundation · Version 0.2.0-dev

-

A calm, consistent interface.

-

A practical, accessible design system for TeamCode Hub. Neutral surfaces, clear hierarchy, predictable controls, and responsive layouts — without external font downloads or frontend dependencies.

-
- Browse components - View foundations -
-
-
-

Principles

-
-
01

Clarity first

Content before decoration.

-
02

Accessible by default

Keyboard and screen-reader support.

-
03

No runtime dependencies

System fonts and local assets only.

-
-
-
- - -
-
-

01 / Foundations

Color system

-

Neutral base · Semantic status colors

-
-
-

Primary

#0A0A0A

-

Muted surface

#F4F4F5

-

Success

#15803D

-

Danger

#B91C1C

-
- -
-

Type scale

System typography

-

No external font request

-
-
-

Display / 40px

Build better together.

-
-

Heading / 24px

Project activity

-
-

Body / 15px

Keep interface copy concise and actionable. Use spacing and contrast to establish hierarchy instead of adding unnecessary visual effects.

-
-

Caption / 12px

Updated a few moments ago · All times shown in UTC

-
-
- - -
-
-

02 / Components

Actions and states

-

Consistent sizing and focus behavior

-
- -
-
-

Button variants

-
- - - - - - -
-
-
-

Status badges

-
- DefaultDraft - CompletedPending - BlockedIn review -
-
-
-
Choose a short, recognizable name.
-
Status can be changed later.
-
-
-

Preferences

- - - - -
-
-
- -
-

Feedback

Alerts and notifications

-

Use the tone that matches the situation

-
-
-

Changes saved

Your project settings have been updated.

-

Review required

Two project members are waiting for approval.

- -
- - -
- - -
-
-
-
- - -
-
-

03 / Patterns

Dashboard building blocks

-

Responsive and content-first

-
-
-

Active projects

12

+2 since last month

-

Open tasks

38

Across 4 teams

-

Pending reviews

04

Requires your attention

-
- -
-

Recent activity

A compact table pattern for project updates

-
- - - - - - - -
ProjectActivityStatusUpdated
Core APITask completedCompleted5 min ago
Web clientMember invitedPending28 min ago
DocumentationProject updatedIn review1 hour ago
-
-
Showing 3 of 12 activitiesDemo content only
-
- -
-
-

Release readiness

72%

In progress
-
-

Progress bars expose their value to assistive technology.

-
-
- -

No pinned projects yet

-

Pin a project to make it easier to find from your dashboard.

- -
-
- -
-

Tabbed content

Keyboard navigation with arrow keys, Home, and End

-
-
- - - -
-

Project overview

Summarize the goal, current status, and next milestone here.

- - -
-
- -
-
-

Input patterns

-

Upload and range

- -

The file input is local to this showcase and has no upload handler.

-
- - -

Native keyboard-operable range control with shared styling.

-
-
-
-

People and status

-

Avatars and chips

-
- AL - MK - JR -
-
- API team - Design review -
- -
-
- -
-
-

Disclosure

-

Accessible accordion

-
-
- What belongs in a design token? -
A reusable decision such as color, spacing, type scale, radius, elevation, or motion belongs in a central token set.
-
-
- Do these styles download fonts? -
No. The font stack uses system fonts already available on the visitor's device.
-
-
-
-
-

Progress and workflow

-

Status steps

-
-
Plan
- -
2Build
- -
3Ship
-
-
Release readiness72%
-
-
HealthyReviewBlocked
-
-
- -
-
-

Pagination

-

Bounded list navigation

-

Use pagination for large tables; prefer incremental cursors for live chat.

- -
-
-

Content pattern

-

Quote and code

-
-

Good interfaces make the next safe action obvious without hiding useful detail.

-
Product principle · Clarity before decoration
-
-

Use aria-live for dynamic status messages that need to be announced.

-
-
-
-
- - - - - -
- - -
-
- © 2026 TeamCode Hub - Design system · English interface · System fonts only -
-
- - - From 8fc11cad120392b6baf834bd6f779073f2422cc7 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:33:48 +0330 Subject: [PATCH 15/45] refactor(styles): remove demo-only showcase stylesheet --- public/assets/css/design-system-demo.css | 25 ------------------------ 1 file changed, 25 deletions(-) delete mode 100644 public/assets/css/design-system-demo.css diff --git a/public/assets/css/design-system-demo.css b/public/assets/css/design-system-demo.css deleted file mode 100644 index de3df7c..0000000 --- a/public/assets/css/design-system-demo.css +++ /dev/null @@ -1,25 +0,0 @@ -/* ========================================================================== - TeamCode Hub Design System Showcase — Page-only styles - File: public/assets/css/design-system-demo.css - Purpose: Keep the reference page's layout details out of its HTML markup. - ========================================================================== */ - -.demo-principles { width: min(100%, 300px); } -.demo-swatch { height: 78px; } -.demo-swatch-primary { background: #0a0a0a; } -.demo-swatch-muted { background: #f4f4f5; } -.demo-swatch-success { background: #15803d; } -.demo-swatch-danger { background: #b91c1c; } -.demo-divider { margin-block: 4px; } -.demo-table-wrap { border: 0; border-radius: 0; } -.demo-foot-note { margin-inline-start: auto; } -.demo-tab-panel { padding-block: var(--space-4); } -.demo-tab-panel[hidden] { display: none; } - -@media (max-width: 720px) { - .demo-foot-note { margin-inline-start: 0; } -} - -/* Typography samples are classes rather than inline declarations, keeping markup clean. */ -.demo-type-display { font-size: clamp(2rem, 5vw, 2.5rem); letter-spacing: -.04em; } -.demo-type-heading { font-size: 24px; } From f380fab7904711fa26930ed2a2ab5c3f672a1d81 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:33:50 +0330 Subject: [PATCH 16/45] refactor(ui): remove demo-only showcase script --- public/assets/js/design-system-demo.js | 98 -------------------------- 1 file changed, 98 deletions(-) delete mode 100644 public/assets/js/design-system-demo.js diff --git a/public/assets/js/design-system-demo.js b/public/assets/js/design-system-demo.js deleted file mode 100644 index 8782624..0000000 --- a/public/assets/js/design-system-demo.js +++ /dev/null @@ -1,98 +0,0 @@ -/* ========================================================================== - TeamCode Hub Design System Showcase — Demo-only behavior - File: public/assets/js/design-system-demo.js - Purpose: Wire the reference page's sample buttons without inline JavaScript. - ========================================================================== */ - -(function () { - "use strict"; - - /* Do not fail silently if the main interaction controller is unavailable. */ - function initializeShowcase() { - const toastButton = document.getElementById("show-toast"); - const emptyAction = document.getElementById("empty-action"); - const year = document.getElementById("year"); - - if (toastButton) { - toastButton.addEventListener("click", function () { - if (window.TCHUI && typeof window.TCHUI.notify === "function") { - window.TCHUI.notify("This is a sample notification from the design system."); - } - }); - } - - if (emptyAction) { - emptyAction.addEventListener("click", function () { - if (window.TCHUI && typeof window.TCHUI.notify === "function") { - window.TCHUI.notify("The projects page will be connected when its UI is implemented."); - } - }); - } - - /* Keep removable chip examples interactive without touching application data. */ - document.querySelectorAll(".chip .x").forEach(function (button) { - button.addEventListener("click", function () { - const chip = button.closest(".chip"); - if (chip) chip.remove(); - if (window.TCHUI && typeof window.TCHUI.notify === "function") { - window.TCHUI.notify("The example chip was removed locally."); - } - }); - }); - - /* Make the showcase pager update its selected page and boundary states. */ - document.querySelectorAll(".pager").forEach(function (pager) { - const pageButtons = Array.from(pager.querySelectorAll("button")) - .filter(function (button) { - return !button.hasAttribute("aria-label") && /^\d+$/.test(button.textContent.trim()); - }); - const previous = pager.querySelector('[aria-label="Previous page"]'); - const next = pager.querySelector('[aria-label="Next page"]'); - - function selectPage(index) { - if (!pageButtons.length) return; - const boundedIndex = Math.max(0, Math.min(pageButtons.length - 1, index)); - pageButtons.forEach(function (button, buttonIndex) { - const selected = buttonIndex === boundedIndex; - button.classList.toggle("active", selected); - if (selected) button.setAttribute("aria-current", "page"); - else button.removeAttribute("aria-current"); - }); - if (previous) previous.disabled = boundedIndex === 0; - if (next) next.disabled = boundedIndex === pageButtons.length - 1; - } - - pageButtons.forEach(function (button, index) { - button.addEventListener("click", function () { selectPage(index); }); - }); - if (previous) previous.addEventListener("click", function () { - const activeIndex = pageButtons.findIndex(function (button) { return button.classList.contains("active"); }); - selectPage(activeIndex - 1); - }); - if (next) next.addEventListener("click", function () { - const activeIndex = pageButtons.findIndex(function (button) { return button.classList.contains("active"); }); - selectPage(activeIndex + 1); - }); - }); - - /* File selection is preview-only; no bytes leave the browser in this showcase. */ - const uploadInput = document.getElementById("demo-upload"); - if (uploadInput) { - uploadInput.addEventListener("change", function () { - const file = uploadInput.files && uploadInput.files[0]; - const dropzone = uploadInput.closest(".dropzone"); - const title = dropzone ? dropzone.querySelector("b") : null; - if (title && file) title.textContent = "Selected locally: " + file.name; - }); - } - - /* Keep the footer year accurate without embedding script in the HTML page. */ - if (year) year.textContent = String(new Date().getFullYear()); - } - - if (document.readyState === "loading") { - document.addEventListener("DOMContentLoaded", initializeShowcase, { once: true }); - } else { - initializeShowcase(); - } -})(); From 2a758b347355634fb341fa5650aaf408e2cc5609 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:36:40 +0330 Subject: [PATCH 17/45] fix(assets): correct the Apache static-file match expression --- public/.htaccess | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/public/.htaccess b/public/.htaccess index 991bf0f..1f2475e 100644 --- a/public/.htaccess +++ b/public/.htaccess @@ -20,7 +20,7 @@ DirectoryIndex index.php - + Header set Cache-Control "public, max-age=31536000, immutable" Header always set X-Content-Type-Options "nosniff" From 57eae3470ad5a02b72a362f9c55f70fa73224f4f Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:40:45 +0330 Subject: [PATCH 18/45] fix(styles): define missing workspace design-token aliases --- public/assets/css/tokens.css | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/public/assets/css/tokens.css b/public/assets/css/tokens.css index eaca133..7ee0420 100644 --- a/public/assets/css/tokens.css +++ b/public/assets/css/tokens.css @@ -43,6 +43,13 @@ /* Keep secondary copy readable on white surfaces (WCAG AA contrast target). */ --text-muted: var(--g500); + /* Compatibility aliases used by product-level workspace components. */ + --text-primary: var(--text); + --surface-hover: var(--g100); + --surface-subtle: var(--surface-muted); + --surface-code: var(--surface-raised); + --radius-md: var(--r-lg); + /* Corner radii. */ --r-xs: 4px; --r-sm: 6px; From 80c8ad1f09ffe57df121492c6c73417136174408 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:40:49 +0330 Subject: [PATCH 19/45] test(styles): guard workspace token aliases against missing variables --- tests/design-system.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/design-system.php b/tests/design-system.php index cda862f..61a58ca 100644 --- a/tests/design-system.php +++ b/tests/design-system.php @@ -87,6 +87,10 @@ $assert(str_contains($tokens, '--text-muted: var(--g500);'), 'muted text uses a readable neutral on light surfaces'); $assert(str_contains($tokens, '--text-muted: #a1a1aa;'), 'muted text remains legible against dark surfaces'); +$assert(str_contains($tokens, '--text-primary: var(--text);'), 'workspace primary text alias resolves to the active theme text token'); +$assert(str_contains($tokens, '--surface-hover: var(--g100);') && str_contains($tokens, '--surface-subtle: var(--surface-muted);'), 'workspace hover and selected surfaces resolve from the active neutral palette'); +$assert(str_contains($tokens, '--surface-code: var(--surface-raised);') && str_contains($tokens, '--radius-md: var(--r-lg);'), 'source editor surface and legacy radius aliases are defined centrally'); + /* Verify every stylesheet imported by the entry point exists on disk. */ preg_match_all('/@import\s+url\("([^"]+)"\)/', $entry, $importMatches); foreach ($importMatches[1] as $importUrl) { From 3afa684b11a1ada690acdd11452d12ca38e54294 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:41:34 +0330 Subject: [PATCH 20/45] fix(workspace): connect the team shortcut and remove the fake guide tile --- public/app.html | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/public/app.html b/public/app.html index 11f5bda..66f0c3a 100644 --- a/public/app.html +++ b/public/app.html @@ -171,11 +171,11 @@

Verify your email

-
+
+ Your teamsLoading teams… + +
-
Need a hand?Workspace guide
U Your accountWorkspace member From 7d2c56c6ad739324b92aaca2f335ab6671bdc604 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:41:37 +0330 Subject: [PATCH 21/45] style(workspace): add interaction states for the connected teams shortcut --- public/assets/css/workspace.css | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/public/assets/css/workspace.css b/public/assets/css/workspace.css index 876625c..9b81d75 100644 --- a/public/assets/css/workspace.css +++ b/public/assets/css/workspace.css @@ -20,6 +20,9 @@ .workspace-switcher { display:flex; align-items:center; gap:10px; width:100%; padding:11px 10px; margin-bottom:24px; border:1px solid var(--border); border-radius:var(--r-lg); background:var(--surface); text-align:left; } .workspace-avatar { display:grid; place-items:center; width:35px; height:35px; flex:0 0 35px; border-radius:var(--r); background:var(--g100); color:var(--text); font-size:10px; font-weight:800; letter-spacing:-.04em; } .workspace-switcher-copy,.profile-copy { display:flex; flex-direction:column; gap:1px; min-width:0; flex:1; } +.workspace-switcher { text-align:left; cursor:pointer; transition:background var(--t),border-color var(--t); } +.workspace-switcher:hover { border-color:var(--border-strong); background:var(--surface-muted); } +.workspace-switcher:focus-visible { outline:2px solid var(--g700); outline-offset:3px; } .workspace-switcher-copy strong,.profile-copy strong { overflow:hidden; text-overflow:ellipsis; white-space:nowrap; font-size:12px; font-weight:650; } .workspace-switcher-copy small,.profile-copy small { color:var(--text-muted); font-size:11px; } .switcher-caret { color:var(--text-muted); font-size:18px; } @@ -36,12 +39,6 @@ .side-nav-item.is-active .nav-count { background:rgb(255 255 255 / 14%); color:#fff; } .nav-count-alert { background:var(--danger-bg); color:var(--danger); } .sidebar-bottom { margin-top:auto; padding-top:25px; } -.sidebar-help { display:flex; align-items:center; gap:10px; padding:12px 10px; margin-bottom:15px; border:1px solid var(--border); border-radius:var(--r-lg); } -.help-mark { display:grid; place-items:center; width:28px; height:28px; border:1px solid var(--border); border-radius:50%; color:var(--text-secondary); font-size:12px; font-weight:700; } -.sidebar-help strong,.sidebar-help small { display:block; } -.sidebar-help strong { font-size:11px; font-weight:650; } -.sidebar-help small { color:var(--text-muted); font-size:10px; } -.help-arrow { margin-inline-start:auto; color:var(--text-muted); font-size:14px; } .sidebar-profile { position:relative; display:flex; align-items:center; gap:9px; padding:13px 4px 2px; border-top:1px solid var(--border); } .sidebar-profile .avatar { width:34px; height:34px; border-radius:10px; font-size:11px; } .profile-menu-button { width:29px; min-width:29px; height:29px; font-size:18px; } From 3515666afe4774439aec70eca37924ebeaa70471 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:41:39 +0330 Subject: [PATCH 22/45] test(workspace): reject decorative fake actions and assert live team navigation --- tests/workspace-ui.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tests/workspace-ui.php b/tests/workspace-ui.php index e4516b7..3639b68 100644 --- a/tests/workspace-ui.php +++ b/tests/workspace-ui.php @@ -71,6 +71,9 @@ $assert(str_contains($html, 'data-theme="light"') && str_contains($read('public/assets/js/ui.js'), 'root.dataset.theme = next'), 'workspace theme switcher updates the shared light/dark design tokens'); $assert(str_contains($html, 'id="login-form"') && str_contains($html, 'id="application"'), 'login and authenticated application shells are present'); + +$assert(str_contains($html, 'class="workspace-switcher" type="button" data-page="teams"') && str_contains($html, 'id="sidebar-team-count"'), 'sidebar team shortcut navigates to the real teams view and reflects the live team count'); +$assert(!str_contains($html, 'Workspace guide') && !str_contains($css, '.sidebar-help'), 'non-functional decorative workspace guide markup and styles are absent'); $assert(str_contains($html, 'id="register-form"') && str_contains($html, 'id="verification-resend-form"') && str_contains($html, 'id="verify-screen"'), 'public registration, resend, and explicit email verification forms are present'); $assert(str_contains($js, 'registerAccount') && str_contains($js, 'resendVerification') && str_contains($js, 'state.verificationToken'), 'authentication UI connects registration, resend, and token confirmation flows'); $assert(str_contains($bootstrap, "/api/auth/register") && str_contains($bootstrap, "/api/auth/verification/resend") && str_contains($bootstrap, "/api/auth/verify-email"), 'public account lifecycle endpoints are registered'); From 75f5a389fdef967810a09b2dac3765af31523373 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:42:24 +0330 Subject: [PATCH 23/45] fix(deploy): apply asset MIME and cache headers to root-hosted assets --- .htaccess | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.htaccess b/.htaccess index 88e21e3..a35b0f2 100644 --- a/.htaccess +++ b/.htaccess @@ -14,7 +14,15 @@ Options -Indexes RewriteRule ^ public/index.php [QSA,END] + + AddType text/css .css + AddType application/javascript .js + + + + Header set Cache-Control "public, max-age=31536000, immutable" + Header always set X-Content-Type-Options "nosniff" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set X-Frame-Options "DENY" From ce9949433c729073f2fb73adc6f8abf9aa758234 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:42:27 +0330 Subject: [PATCH 24/45] test(deploy): assert MIME and cache policy for repository-root hosting --- tests/workspace-ui.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/workspace-ui.php b/tests/workspace-ui.php index 3639b68..b37a45c 100644 --- a/tests/workspace-ui.php +++ b/tests/workspace-ui.php @@ -110,6 +110,8 @@ $assert(str_contains($html, 'id="workspace-main"') && str_contains($html, 'class="skip-link"'), 'workspace provides a skip link and main landmark'); $assert(str_contains($rootHtaccess, 'RewriteRule ^assets/(.*)$ public/assets/$1 [END,NC]'), 'repository-root hosting maps requested asset URLs into the public asset directory'); +$assert(str_contains($rootHtaccess, 'AddType text/css .css') && str_contains($rootHtaccess, 'AddType application/javascript .js'), 'root-hosted assets have explicit CSS and JavaScript MIME types'); +$assert(str_contains($rootHtaccess, 'Cache-Control "public, max-age=31536000, immutable"'), 'root-hosted versioned assets use immutable caching'); $assert(str_contains($rootHtaccess, 'RewriteRule ^public(?:/|$) - [F,L,NC]') && str_contains($rootHtaccess, 'RewriteRule ^ public/index.php [QSA,END]'), 'repository-root hosting protects source files and routes app requests through the public front controller'); $assert(str_contains($htaccess, 'AddType text/css .css') && str_contains($htaccess, 'AddType application/javascript .js'), 'public hosting declares correct external CSS and JavaScript MIME types'); $assert(str_contains($htaccess, 'Cache-Control "public, max-age=31536000, immutable"'), 'versioned public assets have an explicit immutable cache policy'); From fc04e0ed3c40ac9bfa1dbb72379624cebd13a15c Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:43:15 +0330 Subject: [PATCH 25/45] fix(deploy): correct static asset cache matching at repository root --- .htaccess | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.htaccess b/.htaccess index a35b0f2..e2f816e 100644 --- a/.htaccess +++ b/.htaccess @@ -20,7 +20,7 @@ Options -Indexes - + Header set Cache-Control "public, max-age=31536000, immutable" Header always set X-Content-Type-Options "nosniff" From 7cba6469fcd20812466f88032e2dc16fffa04a70 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:43:18 +0330 Subject: [PATCH 26/45] test(deploy): validate static-asset cache matcher for both web roots --- tests/workspace-ui.php | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/workspace-ui.php b/tests/workspace-ui.php index b37a45c..8e6c936 100644 --- a/tests/workspace-ui.php +++ b/tests/workspace-ui.php @@ -112,6 +112,7 @@ $assert(str_contains($rootHtaccess, 'RewriteRule ^assets/(.*)$ public/assets/$1 [END,NC]'), 'repository-root hosting maps requested asset URLs into the public asset directory'); $assert(str_contains($rootHtaccess, 'AddType text/css .css') && str_contains($rootHtaccess, 'AddType application/javascript .js'), 'root-hosted assets have explicit CSS and JavaScript MIME types'); $assert(str_contains($rootHtaccess, 'Cache-Control "public, max-age=31536000, immutable"'), 'root-hosted versioned assets use immutable caching'); +$assert(str_contains($rootHtaccess, '') && str_contains($htaccess, ''), 'both document-root modes use a correct extension match for versioned static assets'); $assert(str_contains($rootHtaccess, 'RewriteRule ^public(?:/|$) - [F,L,NC]') && str_contains($rootHtaccess, 'RewriteRule ^ public/index.php [QSA,END]'), 'repository-root hosting protects source files and routes app requests through the public front controller'); $assert(str_contains($htaccess, 'AddType text/css .css') && str_contains($htaccess, 'AddType application/javascript .js'), 'public hosting declares correct external CSS and JavaScript MIME types'); $assert(str_contains($htaccess, 'Cache-Control "public, max-age=31536000, immutable"'), 'versioned public assets have an explicit immutable cache policy'); From 7b92f9af6fbd06154e4d9a2fab4d3f1a351b3473 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:45:43 +0330 Subject: [PATCH 27/45] ci: cancel superseded checks on the same branch --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2d87f5c..467a715 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,5 +1,9 @@ name: PHP Checks +concurrency: + group: php-checks-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + on: push: branches: [main, "feat/**", "fix/**", "test/**"] From c694079e2fb3f1c7a296bb1d902d15587d7d601c Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:45:46 +0330 Subject: [PATCH 28/45] test(ci): require branch-scoped cancellation for superseded checks --- tests/workspace-ui.php | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/workspace-ui.php b/tests/workspace-ui.php index 8e6c936..b4026c3 100644 --- a/tests/workspace-ui.php +++ b/tests/workspace-ui.php @@ -117,6 +117,7 @@ $assert(str_contains($htaccess, 'AddType text/css .css') && str_contains($htaccess, 'AddType application/javascript .js'), 'public hosting declares correct external CSS and JavaScript MIME types'); $assert(str_contains($htaccess, 'Cache-Control "public, max-age=31536000, immutable"'), 'versioned public assets have an explicit immutable cache policy'); $assert(str_contains($workflow, 'php tests/workspace-ui.php') && str_contains($workflow, 'node --check public/assets/js/workspace.js'), 'CI runs workspace UI contracts and parses the production JavaScript controller'); +$assert(str_contains($workflow, 'cancel-in-progress: true') && str_contains($workflow, 'php-checks-${{ github.workflow }}-${{ github.ref }}'), 'CI cancels superseded checks for each branch instead of building an unbounded queue'); $assert(str_contains($html, '/assets/css/workspace.css?v='), 'product stylesheet is loaded as an external versioned asset'); $assert(str_contains($html, '/assets/js/workspace.js?v='), 'product controller is loaded as an external versioned asset'); $assert(!preg_match('/)/i', $html), 'workspace HTML contains no inline style blocks'); From 0b7493d911d74137555b71482b237b64262169c6 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:48:41 +0330 Subject: [PATCH 29/45] docs(readme): remove duplicate workspace test command --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 58d545a..9e6fe7d 100644 --- a/README.md +++ b/README.md @@ -73,7 +73,6 @@ php tests/design-system.php php tests/workspace-ui.php node --check public/assets/js/ui.js node --check public/assets/js/workspace.js -php tests/workspace-ui.php ``` ## Remaining product work From bd5328b7bd6571945e551f5938b2aaa642a92925 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:50:11 +0330 Subject: [PATCH 30/45] test(styles): detect undefined CSS custom properties across product stylesheets --- tests/design-system.php | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tests/design-system.php b/tests/design-system.php index 61a58ca..95f5a07 100644 --- a/tests/design-system.php +++ b/tests/design-system.php @@ -91,6 +91,20 @@ $assert(str_contains($tokens, '--surface-hover: var(--g100);') && str_contains($tokens, '--surface-subtle: var(--surface-muted);'), 'workspace hover and selected surfaces resolve from the active neutral palette'); $assert(str_contains($tokens, '--surface-code: var(--surface-raised);') && str_contains($tokens, '--radius-md: var(--r-lg);'), 'source editor surface and legacy radius aliases are defined centrally'); +/* Catch undefined CSS custom properties across the real production stylesheets. */ +$allCss = implode("\n", [$entry, $tokens, $base, $layout, $components, $patterns, $utilities, $workspaceCss]); +preg_match_all('/(--[a-zA-Z0-9_-]+)\\s*:/', $allCss, $definedMatches); +preg_match_all('/var\\(\\s*(--[a-zA-Z0-9_-]+)/', $allCss, $referencedMatches); +$definedTokens = array_fill_keys($definedMatches[1], true); +/* --progress is intentionally supplied on individual progress indicators, not as a global token. */ +$dynamicTokens = ['--progress' => true]; +$undefinedTokens = array_values(array_diff( + array_unique($referencedMatches[1]), + array_keys($definedTokens), + array_keys($dynamicTokens) +)); +$assert($undefinedTokens === [], 'production CSS has no undefined custom properties' . ($undefinedTokens ? ': ' . implode(', ', $undefinedTokens) : '')); + /* Verify every stylesheet imported by the entry point exists on disk. */ preg_match_all('/@import\s+url\("([^"]+)"\)/', $entry, $importMatches); foreach ($importMatches[1] as $importUrl) { From 28ac2d24aeda30fb826bba53baeacbcf121a45d0 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:55:21 +0330 Subject: [PATCH 31/45] test(ci): match idempotent project file migration DDL --- tests/workspace-ui.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/workspace-ui.php b/tests/workspace-ui.php index b4026c3..ffa489d 100644 --- a/tests/workspace-ui.php +++ b/tests/workspace-ui.php @@ -85,7 +85,7 @@ $assert(str_contains($html, 'data-page="github"') && str_contains($js, '/api/github/activity'), 'GitHub activity page is connected to its authenticated endpoint'); $assert(str_contains($bootstrap, "'/api/projects/{projectId}/github'") && str_contains($bootstrap, 'project-github.controller'), 'project GitHub endpoints are registered through a dedicated controller'); $assert(str_contains($bootstrap, "'/api/projects/{projectId}/files'") && str_contains($bootstrap, "'/api/projects/{projectId}/files/{fileId}'") && str_contains($bootstrap, "'/api/projects/{projectId}/files/{fileId}/edit'") && str_contains($bootstrap, "'/api/projects/{projectId}/files/{fileId}/history'") && str_contains($bootstrap, "'/api/projects/{projectId}/files/{fileId}/restore'"), 'project file listing, detail, edit, history, and restore routes are registered'); -$assert(str_contains($projectFileMigration, 'CREATE TABLE project_files') && str_contains($projectFileMigration, 'CREATE TABLE project_file_versions'), 'project file migration creates both private storage tables'); +$assert(str_contains($projectFileMigration, 'CREATE TABLE IF NOT EXISTS project_files') && str_contains($projectFileMigration, 'CREATE TABLE IF NOT EXISTS project_file_versions'), 'project file migration creates both private storage tables'); $assert(str_contains($js, 'renderProjectFiles') && str_contains($js, 'createProjectFileModal') && str_contains($js, 'saveProjectFile') && str_contains($js, 'showProjectFileHistory'), 'project workspace connects file browsing, editing, saving, and history'); $assert(str_contains($js, 'confirmDiscardProjectFileChanges') && str_contains($js, 'expected_version: Number(expectedVersion)'), 'file editor warns before discarding unsaved content and uses optimistic concurrency'); $assert(str_contains($projectFileRepository, 'MAX_FILE_BYTES = 262144') && str_contains($projectFileRepository, 'MAX_PROJECT_BYTES = 10485760') && str_contains($projectFileRepository, 'MAX_PROJECT_HISTORY_BYTES = 20971520'), 'project file storage enforces per-file, project, and revision quotas'); From eccc0d19180612537eda07393271980e24cedfd1 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:55:46 +0330 Subject: [PATCH 32/45] ci: avoid duplicate push and pull-request runs --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 467a715..3cd36fe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -5,8 +5,10 @@ concurrency: cancel-in-progress: true on: + # Pull requests validate topic branches; push runs are reserved for main to avoid + # duplicate CI runs for every commit on a branch that already has an open PR. push: - branches: [main, "feat/**", "fix/**", "test/**"] + branches: [main] pull_request: workflow_dispatch: From 1327f3698451fe75a9481813f12ee072e373b208 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:56:12 +0330 Subject: [PATCH 33/45] ci(cd): add manually gated SSH deployment workflow --- .github/workflows/deploy.yml | 106 +++++++++++++++++++++++++++++++++++ 1 file changed, 106 insertions(+) create mode 100644 .github/workflows/deploy.yml diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml new file mode 100644 index 0000000..9bcd3db --- /dev/null +++ b/.github/workflows/deploy.yml @@ -0,0 +1,106 @@ +name: Deploy production + +on: + workflow_dispatch: + inputs: + confirm_production: + description: Type DEPLOY to confirm a production deployment + required: true + type: string + +permissions: + contents: read + +concurrency: + group: production-deployment + cancel-in-progress: false + +jobs: + deploy: + if: ${{ inputs.confirm_production == 'DEPLOY' }} + runs-on: ubuntu-latest + environment: production + timeout-minutes: 15 + steps: + - name: Check out the selected revision + uses: actions/checkout@v4 + + - name: Validate deployment configuration + shell: bash + env: + DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} + DEPLOY_USER: ${{ secrets.DEPLOY_USER }} + DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }} + DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }} + DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }} + run: | + set -euo pipefail + for name in DEPLOY_HOST DEPLOY_USER DEPLOY_SSH_PRIVATE_KEY DEPLOY_KNOWN_HOSTS DEPLOY_PATH; do + if [[ -z "${!name}" ]]; then + echo "::error::Required production secret is missing: ${name}" + exit 1 + fi + done + case "$DEPLOY_PATH" in + /*) ;; + *) echo "::error::DEPLOY_PATH must be an absolute remote path"; exit 1 ;; + esac + if [[ "$DEPLOY_PATH" == "/" || "$DEPLOY_PATH" == "/home" || "$DEPLOY_PATH" == "/var" ]]; then + echo "::error::DEPLOY_PATH is too broad to be a safe application target" + exit 1 + fi + + - name: Configure pinned SSH identity + shell: bash + env: + DEPLOY_SSH_PRIVATE_KEY: ${{ secrets.DEPLOY_SSH_PRIVATE_KEY }} + DEPLOY_KNOWN_HOSTS: ${{ secrets.DEPLOY_KNOWN_HOSTS }} + run: | + set -euo pipefail + install -m 700 -d "$HOME/.ssh" + printf '%s\n' "$DEPLOY_SSH_PRIVATE_KEY" > "$HOME/.ssh/deploy_key" + chmod 600 "$HOME/.ssh/deploy_key" + printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts" + chmod 600 "$HOME/.ssh/known_hosts" + + - name: Validate remote SSH access and target directory + shell: bash + env: + DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} + DEPLOY_USER: ${{ secrets.DEPLOY_USER }} + DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }} + DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }} + run: | + set -euo pipefail + port="${DEPLOY_PORT:-22}" + [[ "$port" =~ ^[0-9]+$ ]] || { echo "::error::DEPLOY_PORT must be numeric"; exit 1; } + ssh -i "$HOME/.ssh/deploy_key" -p "$port" \ + -o BatchMode=yes -o StrictHostKeyChecking=yes \ + "$DEPLOY_USER@$DEPLOY_HOST" \ + "test -d '$DEPLOY_PATH' && test -w '$DEPLOY_PATH'" + + - name: Deploy application files without deleting remote data + shell: bash + env: + DEPLOY_HOST: ${{ secrets.DEPLOY_HOST }} + DEPLOY_USER: ${{ secrets.DEPLOY_USER }} + DEPLOY_PATH: ${{ secrets.DEPLOY_PATH }} + DEPLOY_PORT: ${{ secrets.DEPLOY_PORT }} + run: | + set -euo pipefail + port="${DEPLOY_PORT:-22}" + rsync -az --checksum \ + --exclude='/.git/' \ + --exclude='/.github/' \ + --exclude='/tests/' \ + --exclude='/docs/' \ + --exclude='/.env' \ + --exclude='/.env.*' \ + --exclude='/*.log' \ + -e "ssh -i $HOME/.ssh/deploy_key -p $port -o BatchMode=yes -o StrictHostKeyChecking=yes" \ + ./ "$DEPLOY_USER@$DEPLOY_HOST:$DEPLOY_PATH/" + + - name: Remove temporary SSH credentials + if: always() + shell: bash + run: rm -f "$HOME/.ssh/deploy_key" "$HOME/.ssh/known_hosts" From c5019b8e493d5b51a1c88e3333095073077755c6 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:56:28 +0330 Subject: [PATCH 34/45] security(cd): restrict production deploy refs and target paths --- .github/workflows/deploy.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 9bcd3db..7069044 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -17,7 +17,7 @@ concurrency: jobs: deploy: - if: ${{ inputs.confirm_production == 'DEPLOY' }} + if: ${{ inputs.confirm_production == 'DEPLOY' && github.ref == 'refs/heads/main' }} runs-on: ubuntu-latest environment: production timeout-minutes: 15 @@ -41,11 +41,11 @@ jobs: exit 1 fi done - case "$DEPLOY_PATH" in - /*) ;; - *) echo "::error::DEPLOY_PATH must be an absolute remote path"; exit 1 ;; - esac - if [[ "$DEPLOY_PATH" == "/" || "$DEPLOY_PATH" == "/home" || "$DEPLOY_PATH" == "/var" ]]; then + if [[ ! "$DEPLOY_PATH" =~ ^/[A-Za-z0-9._/-]+$ ]]; then + echo "::error::DEPLOY_PATH must be an absolute path using only letters, numbers, dot, underscore, slash, or hyphen" + exit 1 + fi + if [[ "$DEPLOY_PATH" == *"/../"* || "$DEPLOY_PATH" == */.. || "$DEPLOY_PATH" == "/" || "$DEPLOY_PATH" == "/home" || "$DEPLOY_PATH" == "/var" ]]; then echo "::error::DEPLOY_PATH is too broad to be a safe application target" exit 1 fi From 824d6e4e51374f0c1675f839e72f6bfddc649d28 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:56:39 +0330 Subject: [PATCH 35/45] docs(cd): document gated deployment and required secrets --- docs/OPERATIONS.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md index de7674b..d2e8de2 100644 --- a/docs/OPERATIONS.md +++ b/docs/OPERATIONS.md @@ -11,6 +11,19 @@ - Confirm private storage, configuration, backup, and log paths cannot be downloaded over HTTP. - Back up the database and files before applying schema changes. +## GitHub Actions deployment (manual) + +The `.github/workflows/deploy.yml` workflow is a manual SSH-based delivery path. It only permits the `main` branch, requires typing `DEPLOY`, uses the GitHub `production` environment, verifies a pinned SSH host key, checks that the target directory already exists and is writable, and does not delete remote files. Configure environment-scoped secrets before using it: + +- `DEPLOY_HOST` — server hostname (no protocol or path). +- `DEPLOY_USER` — dedicated deployment account with access only to the application directory. +- `DEPLOY_SSH_PRIVATE_KEY` — private key for that account; never commit it. +- `DEPLOY_KNOWN_HOSTS` — independently verified SSH host-key line(s), not output blindly trusted from a runtime `ssh-keyscan`. +- `DEPLOY_PATH` — absolute application-root path containing the `app/` and `public/` directories; it must not be the filesystem root or a broad system directory. +- `DEPLOY_PORT` — optional SSH port; defaults to `22`. For a non-standard port, the pinned `known_hosts` entry must use the matching `[host]:port` format. + +Set production environment reviewers and branch restrictions in GitHub repository settings. Point the web server document root to the deployed `public/` directory when possible. The workflow deliberately does not run database migrations or create an administrator automatically: take a backup, review pending migrations, and apply `php bin/migrate.php` from a trusted server-side CLI session as a separate controlled operation. Configure the required application environment variables on the server before enabling traffic. The first deployment must be tested on a staging target before production use. + ## Registration and email verification Public registration is enabled after the account-token migration has been applied. Configure these environment variables outside the web root: From 54cb35c7322002463b205074741c00ce5b8edcbe Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:57:05 +0330 Subject: [PATCH 36/45] test(cd): protect production deployment safety contracts --- tests/deployment-workflow.php | 39 +++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 tests/deployment-workflow.php diff --git a/tests/deployment-workflow.php b/tests/deployment-workflow.php new file mode 100644 index 0000000..d8f0272 --- /dev/null +++ b/tests/deployment-workflow.php @@ -0,0 +1,39 @@ + Date: Mon, 19 Oct 2026 19:57:11 +0330 Subject: [PATCH 37/45] ci(cd): test production deployment safety gates --- .github/workflows/ci.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3cd36fe..fe2bb49 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -61,6 +61,9 @@ jobs: - name: Check workspace UI contracts run: php tests/workspace-ui.php + - name: Check deployment workflow safety + run: php tests/deployment-workflow.php + - name: Check JavaScript syntax run: | node --check public/assets/js/ui.js From d4da9f06f0203f17df65a85d9c8c5b080eb7f29c Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:57:17 +0330 Subject: [PATCH 38/45] docs(release): document guarded manual production delivery --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 9e6fe7d..8f72bd3 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # TeamCode Hub -**Version:** 0.2.1-dev +**Version:** 0.2.2-dev **Status:** Active development TeamCode Hub is a modular, security-focused collaboration platform for software teams, designed for conventional PHP hosting with cPanel/DirectAdmin and MySQL/MariaDB. @@ -63,7 +63,7 @@ See [docs/API.md](docs/API.md) for request bodies, status codes, retention, and ## Validation -CI checks PHP syntax and smoke tests, design-system and workspace UI contracts, JavaScript syntax, and MariaDB integration tests on PHP 8.2, 8.3, and 8.4. +CI checks PHP syntax and smoke tests, design-system and workspace UI contracts, deployment safety contracts, JavaScript syntax, and MariaDB integration tests on PHP 8.2, 8.3, and 8.4. Production delivery is manual-only from `main`, requires a typed confirmation and pinned SSH host key, and must be configured with environment-scoped deployment secrets; it never deletes remote files or runs migrations automatically. Run the lightweight local checks with: From d78ee8c6406f3e3d73cfa2b15c7ba088ace3f7c2 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:58:11 +0330 Subject: [PATCH 39/45] test(cd): assert deployment never uses destructive rsync flags --- tests/deployment-workflow.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/deployment-workflow.php b/tests/deployment-workflow.php index d8f0272..aa291b3 100644 --- a/tests/deployment-workflow.php +++ b/tests/deployment-workflow.php @@ -32,7 +32,7 @@ $assert(str_contains($workflow, 'test -d') && str_contains($workflow, 'test -w'), 'deployment checks that the destination exists and is writable'); $assert(str_contains($workflow, 'DEPLOY_PATH must be an absolute path') && str_contains($workflow, 'DEPLOY_PATH is too broad'), 'deployment rejects unsafe destination paths'); $assert(str_contains($workflow, 'rsync -az --checksum'), 'deployment uses incremental rsync transfer'); -$assert(!preg_match('/rsync[^\n]*--delete/', $workflow), 'deployment never deletes remote files by default'); +$assert(!str_contains($workflow, '--delete'), 'deployment never deletes remote files by default'); $assert(str_contains($workflow, 'if: always()') && str_contains($workflow, 'rm -f'), 'temporary SSH credentials are removed even after a failed deployment'); $assert(!str_contains($workflow, 'bin/migrate.php') && !str_contains($workflow, 'bootstrap-admin.php'), 'deployment never runs database migrations or administrator bootstrap automatically'); From fa81259df0e48b5eb0134a2de9926bcafc4f89f8 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:58:23 +0330 Subject: [PATCH 40/45] docs(changelog): record CI failure fixes and guarded CD workflow --- CHANGELOG.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index a198616..a36e60d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,11 @@ ## Unreleased +- Add a manual, main-only production delivery workflow with typed confirmation, production environment gate, pinned SSH host verification, destination validation, and non-destructive rsync. +- Add CI contract tests for deployment safety and document required production secrets and controlled migration steps. +- Reduce redundant CI traffic by running topic-branch validation through pull requests and reserving push-triggered CI for main. +- Fix a workspace UI contract test to match idempotent `CREATE TABLE IF NOT EXISTS` migration statements. + - Fix CSS/JavaScript delivery for hosts whose document root is the repository root by routing `/assets/*` to the public asset directory without exposing application source files. - Explicitly declare static CSS/JavaScript MIME types and apply immutable caching to versioned assets; bump workspace asset keys to avoid stale cached styles and scripts. - Run the previously unwired workspace UI contract test in CI and syntax-check the production `workspace.js` controller. From 22ec82b0fb904d670e2cff92a824f90604ab77b9 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:58:50 +0330 Subject: [PATCH 41/45] ci: update checkout runtime and bound job duration --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fe2bb49..2cab376 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,7 @@ permissions: jobs: checks: runs-on: ubuntu-latest + timeout-minutes: 20 services: mariadb: image: mariadb:10.11 @@ -37,7 +38,7 @@ jobs: php: ["8.2", "8.3", "8.4"] steps: - name: Check out repository - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Set up PHP uses: shivammathur/setup-php@v2 From c035b5b44e625fae98a488f4bf98fe6f018b9fd5 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 19:58:52 +0330 Subject: [PATCH 42/45] ci(cd): update checkout runtime for production workflow --- .github/workflows/deploy.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 7069044..29e869b 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -23,7 +23,7 @@ jobs: timeout-minutes: 15 steps: - name: Check out the selected revision - uses: actions/checkout@v4 + uses: actions/checkout@v5 - name: Validate deployment configuration shell: bash From 55700319b39fadb127986816d868ba3c8d6a5fa6 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 20:00:11 +0330 Subject: [PATCH 43/45] docs(ci): include deployment safety test in local checks --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 8f72bd3..3b16624 100644 --- a/README.md +++ b/README.md @@ -71,6 +71,7 @@ Run the lightweight local checks with: php tests/run.php php tests/design-system.php php tests/workspace-ui.php +php tests/deployment-workflow.php node --check public/assets/js/ui.js node --check public/assets/js/workspace.js ``` From d23077fdacae9780921859ca5c1ba0203e852d67 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 20:11:21 +0330 Subject: [PATCH 44/45] test(ci): fix variable interpolation in workspace route assertions --- tests/workspace-ui.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/workspace-ui.php b/tests/workspace-ui.php index ffa489d..2a1e42c 100644 --- a/tests/workspace-ui.php +++ b/tests/workspace-ui.php @@ -145,7 +145,7 @@ $assert(str_contains($js, '/api/dashboard') && str_contains($js, '/api/teams') && str_contains($js, '/api/projects/') && str_contains($js, '/api/notifications'), 'controller connects the existing dashboard, team, project, and notification APIs'); $assert(str_contains($bootstrap, "/api/teams/{teamId}/edit") && str_contains($bootstrap, "/api/projects/{projectId}/edit"), 'team and project metadata update routes are registered'); $workspaceController = $read('app/Http/WorkspaceController.php'); -$assert(str_contains($bootstrap, "->updateTeam(\\$request, \\$params)") && str_contains($bootstrap, "->updateProject(\\$request, \\$params)"), 'settings routes call the existing update handlers'); +$assert(str_contains($bootstrap, '->updateTeam($request, $params)') && str_contains($bootstrap, '->updateProject($request, $params)'), 'settings routes call the existing update handlers'); $assert(str_contains($workspaceController, 'public function updateTeam(') && str_contains($workspaceController, 'public function updateProject('), 'registered settings handlers enforce validation and permissions'); $assert(!str_contains($workspaceController, 'public function renameTeam(') && !str_contains($workspaceController, 'public function editProject('), 'unused duplicate settings handlers stay removed'); $assert(str_contains($workspaceController, 'updateNameForOwner') && str_contains($workspaceController, 'updateMetadataForTeamManager'), 'settings controllers reuse transactional repository authorization boundaries'); From cd7d2b4d5c4912fdc3c37e4093ca7905ed6b3291 Mon Sep 17 00:00:00 2001 From: Elman Coder Date: Mon, 19 Oct 2026 20:17:27 +0330 Subject: [PATCH 45/45] fix(workspace): repair literal escapes in hash routing --- public/assets/js/workspace.js | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/public/assets/js/workspace.js b/public/assets/js/workspace.js index f39f7d0..de32f4b 100644 --- a/public/assets/js/workspace.js +++ b/public/assets/js/workspace.js @@ -689,7 +689,13 @@ function routeFromHash() { const hash = location.hash.replace(/^#/, ""); - if (hash.startsWith("team/")) {\n const teamId = Number(hash.split("/")[1]);\n if (teamById(teamId)) openTeam(teamId);\n else navigate("teams", false);\n return;\n }\n if (hash.startsWith("project/")) { + if (hash.startsWith("team/")) { + const teamId = Number(hash.split("/")[1]); + if (teamById(teamId)) openTeam(teamId); + else navigate("teams", false); + return; + } + if (hash.startsWith("project/")) { const id = Number(hash.split("/")[1]); const project = projectById(id); if (project) openProject(project, false);