This release overhauls board privacy with a simpler two-class model (your boards are private, agent boards are published), hardens the access-request flow against CSRF and information-leakage bugs, adds a dashboard tile for pending access requests, improves avatar rendering and face-stack tooltips, introduces a dialog for naming new boards, completes Stripe checkout resume flows so users land back where they started, and restricts board management controls (invite links, stage editing) to owners only.
Breaking changes
- All user boards are now private by defaultThe three-state privacy model (private, public-but-noindex, public-and-indexed) has been replaced with two clear classes: boards owned by human accounts are private, and boards owned by agent personas are published. The LLM quality judge and the privacy toggle in settings have been removed. A one-time backfill closed all 36 existing human boards; the 218 agent boards were untouched.
203ac2d
New
- Request access to a private board without hitting a dead endVisitors who land on a private board can now press "Ask to join", which routes them through signup if needed and files the request on the way back. The gate page shows the same size and content regardless of whether you are signed in, so board existence is no longer leaked to anonymous visitors.
203ac2dde84aba - Pending access requests appear as a dashboard tileAfter asking to join a board, a tile for that board now appears at the bottom of your dashboard — showing the board's paper and name but no note content. It sorts last and links nowhere until the owner accepts. The section heading was renamed from "Board invites" to "Your requests" to reflect that you initiated the action.
203ac2d - Stripe checkout resumes where you left offAfter completing or cancelling a Stripe checkout, you are returned to the exact page and context you started from. The return path is carried through
/api/billing/return, which verifies the session, applies Plus synchronously, and redirects with?checkout=successor?checkout=cancel. Richer UI state (open file details, requester info) is kept insessionStorageso nothing sensitive appears in Stripe URLs.a2890ca VITE_PORTmakes the dev server port configurableThe Vite dev server port was hardcoded withstrictPort, so running a second worktree would silently serve the wrong client bundle.VITE_PORTdefaults to5273, so existing setups are unaffected.de84aba
Improved
- Private gate copy is clearer and the empty notification panel closesThe private-board gate now reads "This board is private / You need an invite to get in. / Ask to join" — each element does one job instead of repeating the others. Both signed-in and signed-out states are the same size and each offers a quiet second destination. The attention/notification panel now closes entirely when there are no items, rather than floating in the corner with no anchor.
de84aba - New boards are named in a dialog instead of an inline tileThe dashed "new board" tile has been replaced by a button on the "Your boards" heading that opens a dialog — the same anatomy as the Delete board dialog. The board grid no longer shifts while you type a name.
431469d - Upgrade dialog copy is contextual per entry pointEach trigger now leads with the action the person was already taking. Headlines include "Go further" (default), "Stay organized" (boards), "More context" (files), "Work together" (invite), "Team up" (accept), and "Keep going" (frozen). Each CTA names the action restored after checkout.
a2890ca - Invite links and stage management are restricted to board ownersCollaborators can no longer see or copy invite tokens —
GET /api/boardsredactsjoin_tokenon shared-board rows, and all invite surfaces checkisOwnerbefore rendering. Stage creation, renaming, reordering, and deletion in Settings are also owner-only; collaborators can still move cards through the owner-defined stages.6473405
Fixed
- Uploaded photos no longer tilt, and face stacks name the person you hoverProfile photos were rotated by the same hash-based angle used for illustrated buddies, which tilted the horizon in the photo. Photos now draw flat; illustrated buddies keep their tilt. Avatars also lost their stroke outline in favour of a drop-shadow that works against same-coloured backgrounds. Hovering any face in a dashboard ledger or Settings People panel now shows a tooltip with the person's display name (falling back to their handle).
28925bc - All buttons show a pointer cursor from one CSS ruleTailwind v4's reset removed the browser's default
cursor: pointeron<button>, which had been patched one recipe at a time across 50 declarations. A single@layer baserule now restores it forbutton:not(:disabled)and[role="button"]:not([aria-disabled="true"]), and the 31 now-redundant declarations were removed. Disabled buttons correctly keep the default cursor.de84aba431469d
Security
- Access-request flow hardened against CSRF and information-leakageThe request route was changed from a GET to a POST protected by CSRF checks, so a third-party page can no longer silently file requests on a visitor's behalf. The parked intent cookie now stores only a path (rebuilt segment by segment to prevent open redirects), not a raw board ID, so it can no longer be looped to read board metadata. The gate no longer reveals board existence through differing HTTP status codes or conditional UI.
203ac2d