v0.2.0

0.2.0 (2026-10-07)

Features

• mobile: upgrade to Expo SDK 57 / React Native 0.86 with the New Architecture (daa1301), closes #87
• add reversible fast app bootstrap (4481ce9)
• add scoped task metadata bootstrap client (96c2db9)
• share scoped task metadata queries (a5d9d6b)
• profile: load activity stats on demand (f259ac6)
• gate shell startup by resolved scope (348a434)
• auth: add Ever ID sign-in provider (off unless configured) (fe221db)
• auth: follow the API's retry answers for Ever ID, resume unfinished setups (9249aab)
• i18n: translate the Ever ID sign-in messages (201fa1f)
• web: allow image hosts at runtime without rebuilding the image (a1cd214)
• web: modernize application workspace UI (edc6bbd)
• web: read public config at runtime so one image serves any deployment (46eebbd)
• web: show build versions in footer (830d32d)
• nothing a reuser may want to customize stays locked in the image (62a18a0)
• web: unbrand the theme picker and keep error documents honest (62898eb)

Bug Fixes

• auth: an Ever ID sign-in never creates an account itself (58a354c)
• auth: bind the Ever ID sign-up to its page, tune the per-key budgets (29b54f5)
• auth: keep the chooser list until the workspace sign-in, scope give-backs (df3029f)
• auth: keep the Ever ID one-time key out of URLs, harden the Ever ID routes (173f242)
• auth: re-own fast queries after token refresh (97f42be)
• auth: resume Ever ID setups that stopped after the tenant (6abf3f1)
• auth: retryable back-channel failures, subject-only logout tokens (44055c4)
• auth: rotate fast request tokens safely (3142109)
• auth: stop stale refresh schedulers (6cac0ac)
• chatgpt: make the image buildable and its widget domain configurable (bc64f8c)
• ci: complete the ARM64 signing gate - drop WIN_CSC_LINK from ARM64 builds too (4afea42)
• ci: gate Windows signing off for ARM64 (Azure Trusted Signing has no ARM64 tooling) (8a780d7)
• ci: harden fast startup verification (ddd16ed)
• ci: install Cypress with pinned CLI (1357a07)
• ci: keep the uploaded working tree clean of the internal registry (d44508c), closes #10036
• ci: make the k8s-build-examples images build again (10a0fc6)
• ci: pass APPLE_TEAM_ID via env, not inline secret expansion (7b15901)
• ci: preserve secret and env-file semantics (5ea6a8f)
• ci: remove empty ${...} expression from iOS workflow comment (7457889), closes #4421
• ci: resolve portable preservation tools (59e5799)
• ci: work around app-builder-lib macOS keychain bug that blocks all mac signing (5d27fb8)
• cspell: add easignore, creds, cicd, esac — Cspell red on develop since 2026-08-15 (32c452a)
• docker: never advertise a social login by default (#4493) (d299edb)
• mobile: build against the iOS 26 SDK — Apple rejected build 78 (ITMS-90725) (edcf3a7)
• mobile: gate the Play Store upload when GOOGLE_CREDENTIALS is empty (92b9b27)
• mobile: install from the internal Verdaccio VIP, not the public route (5d372ea)
• mobile: pin Node on EAS builders and stop uploading VERDACCIO_TOKEN to Expo (f92fdda), closes #4199
• mobile: pin the MMKV pod to 1.3.x — an unbounded range absorbed a major bump (e496c5a)
• mobile: publish OTA to the channel the binaries actually listen on (fd36504)
• mobile: restate .gitignore in .easignore — it replaces it, it is not additive (808369c)
• mobile: ship no Sentry DSN in .env.template (bbe7062)
• mobile: stop EAS installing workspaces the mobile app does not need (daee8f8)
• mobile: submit the build the job just made, not "the newest one anywhere" (e2c99a5), closes #9
• mobile: unblock iOS EAS builds (Storybook's nested sharp) + supply the Apple Team ID (95e02d9)
• mobile: write the App Store Connect key after the EAS upload, not before (95304a8)
• performance: keep fast owners scope-safe (09010be)
• profile: honor shared activity access (018fe58)
• teams: keep deferred membership state current (b359c49)
• toolkit: make the SDK demo images configurable, and working (b43077d)
• web: "Create New Team" always failed with 400 and left an orphan project each attempt (a93f7e6)
• web: /reports/* bounced managers to "/" on hard load — MustBeAManager decided before membership was in state (79cef3e)
• web: accept-invite page looped forever (React #185) — no invitation could be accepted (53ea2dd)
• web: address build footer review feedback (d88d2cd)
• web: address final UI review findings (76b3cfa)
• web: align assistant translation typing (61b26f3)
• web: allow global admins into reports (82d9e4b)
• web: auth path could spin forever — generateToken infinite loop, blank captcha keys, 200-with-errors on register (a6cfcd7)
• web: branch on the normalised avatar src, never render an empty one (e3fb524), closes #4441
• web: broadcast silent token rotations (27f49d6)
• web: Calendar fixed header was 100vw wide but started after the sidebar — "Add Time" sat off-screen at every viewport width (5336a53)
• web: cap the x-user response header — an oversized one 502'd every authenticated page (ba8b0a7)
• web: carry the runtime env on , not in a script (ec4a3bc), closes #418
• web: complete settings review follow-ups (8bdb6a8)
• web: dashboard timer unreachable at 1280/1366px, projects query rejected by API, verify-email modal, auto-activate created task, Vercel analytics 404 (fed0fcb)
• web: dead navigation — sidebar Inbox (/inbox 404) gated behind NEXT_PUBLIC_INBOX_ENABLED; command palette and Team Tasks breadcrumb pointed at /teams/tasks and /team/task (both 404) instead of /team/tasks (628cf8a)
• web: declare startup comparison budget (0620df6)
• web: defer shell language ownership (4c8f35c)
• web: derive profile month synchronously (6042158)
• web: Employee Demo quick-login used the wrong seeded password (123456 vs 12345678) (e995833)
• web: forward a Blob avatar src untouched (59e1c0b)
• web: guard invitation manual refetch (e77c6c4)
• web: harden deferred forms and scoped task updates (f386270)
• web: harden localized assistant controls (a498cab)
• web: harden scoped feature data ownership (c792255)
• web: hydrate languages on early open (0b62f7d)
• web: icons and Microsoft sign-in stop depending on Ever's own hosts (f5227f2)
• web: isolate credential query ownership (1a9c7fb)
• web: isolate Cypress type globals (32b6b88)
• web: isolate scoped request state (87d77e6)
• web: Kanban dropped tasks whose taskStatusId is null (or foreign) — fall back to the status name, and land unplaceable tasks in the first column instead of hiding them (WEB-010) + tests (12b49a8)
• web: keep build info type internal (3fb0433)
• web: keep startup budget browser-safe (547bfca)
• web: make build link props readonly (03215a3)
• web: make clean image imports type-safe (286f1f9)
• web: make scoped lazy bootstrap permanent (fed998e)
• web: make startup timer state deterministic (51b2693)
• web: MustBeAManager — the teams atom lags the query by one effect too, so 'no teams yet' must keep waiting (bounded); every full-page load of /reports/* is a cold load and still bounced managers on stage (dab6db8)
• web: MustBeAManager — wait for the CURRENT USER'S membership row, not just 'some members'; a cold first load of /reports/weekly-limit still bounced a manager once on stage (06:30Z) after the previous fix (f4d269c)
• web: normalise route-relative avatar imageUrl before rendering (0770f25)
• web: normalize prefixed API versions (29d2bbb)
• web: only offer a social login when its client id is actually configured (a0b3f1e)
• web: owner answers Q15/Q17/Q22 — demo users count as email-verified, passcode confirm runs BEFORE the invite-code route, global daily-report preload bounded to the current month (813160c)
• web: preserve authenticated page scroll height (7aac22e)
• web: preserve deferred feature behavior (e6935ba)
• web: preserve scoped metadata fallback transport (e6d1cb3)
• web: project wizard defaulted End Date = Start Date, so step 1 always failed "End date must be after start date" — default to +7 days (0ff213c)
• web: protect locale-prefixed routes — /fr/settings was served to anonymous visitors (2b591f1)
• web: reown fast credential queries (7c8c5da)
• web: retry deferred language loading (8fb8897)
• web: safely roll profile activity month (e429615)
• require executable Git preservation candidates (99a9d0e)
• verify Git preservation candidates (1364eb6)
• web: read the remaining NEXT_PUBLIC_* settings at runtime (e38d7bc)
• web: resolve automated UI review findings (b4d8500)
• web: resolve build SHA from CI providers (b499a3b)
• web: scope assistant history by account (5a9ffe9)
• web: stage/dev talked to the PRODUCTION API from two client paths (weekly-limit report, proactive token refresh) (5bb7e64)
• web: task schema accepts description: null — one such task (any non-web client / bare POST /tasks) failed the STRICT team task-list validation and blanked the task list (WEB-032, seen on demo) (702a5d8)
• web: use typed footer translation keys (65b3e86)
• web: verify hCaptcha and Turnstile tokens with their own provider (2fb1361)
• address PR review (compose build secrets, AUTH_SECRET sample, captcha secret in body) (16dfe41)
• close preservation blind spots (6b8eb51)
• close preservation gate bypasses (f733036)
• close remaining preservation gaps (bf97a40)
• complete preservation surface coverage (252200a)
• harden feature preservation coverage (0c9bfbe)
• harden HTTP response provenance (37e0653)
• preserve deferred invite role selection (7f11bb2)
• preserve dynamic test config and service singletons (9646c58)
• preserve scoped API transport intent (50b837e)
• resolve preservation graph aliases (8a5090f)
• retain timer task status metadata (1078e59)
• second adversarial review (Sentry sampling, OAuth secret gate, AUTH_URL, logo origin) (fadc981)

Performance Improvements

• web: drop 4 unread relations from the team-wide daily-plan fetch (Q26) (490136f)
• web: stop per-task-card components subscribing to the 20Hz timer tick (Q26 item 1) (fe1d3f5)
• web: stop preloading the ENTIRE year of organization time logs (6 relations) on every app load — timeLogsState has no consumer; gated behind NEXT_PUBLIC_PRELOAD_YEAR_TIME_LOGS (WEB-008) (3bf1f44)

Build Systems

• keep web lint on source inputs (9fc3427)
• wire fast app bootstrap flag (fe74b6d)
• docker: stop baking deployment values into the published web image (c4459b4)

Documentation

• align modernization notes with markdown lint (374ac29)
• define Ever Teams UI modernization (39ac552)
• document runtime configuration of the self-hostable images (db99d1f)
• harden fast startup execution plan (a6faa2e)
• plan Ever Teams fast startup redesign (36cdf84)
• strengthen UI modernization test plan (aa43ce5)
• auth: document the Ever ID sign-in settings for self-hosting (c37c0ae)
• chatgpt: blank line before list (markdownlint MD032) (6751983)
• ci: state precisely when the examples build cache can hit (b858df9)
• toolkit: document the demo images in the existing examples README (59d3844)
• toolkit: wrap the new README at 80 columns and give it an H1 (72d7061)
• web: describe authenticated access boundaries (aaed568)

Code Refactoring

• auth: smaller Ever ID handlers, static-analysis findings (99e1036)
• web: hooks depend on the stable mutate/mutateAsync refs, not the whole useMutation object (Q23 sweep, 44 files) (c1f4da4)

Tests

• auth: build the JWT-shaped test strings at runtime (faeacf2)
• auth: cover the Ever ID sign-in, logout tokens and routes (2e88e69)
• auth: Ever ID gating, button, sign-up and provider-off guards (70c8544)
• auth: Ever ID sign-in spec for a deployed environment (ec2f05d)
• auth: leave the OAuth callback parameters out of the URL audit (c5a17ab)
• auth: provide fast owner query client (660e749)
• mobile: add AuthenticationStore unit tests; fix user nullability the tests exposed (461289f)
• mobile: render tests for the leaf UI components; make jest work on RN 0.86 / New Arch (4093ddc)
• web: allow requested full-width preference removal (4bb707e)
• web: calibrate startup budget for shared runners (a01522c)
• web: keep plan preload conditional (eceaf25)
• web: keep preservation policy implementation-neutral (9b06ed4)
• web: MustBeAManager regression tests for the membership race (WEB-009) — 3 of 5 fail against the pre-fix guard (7d2b5c6)
• web): lock the Q17 passcode order (confirm first, invite route as fallback); fix(web: useQueryCall no longer leaks an unhandled rejection per failed call (452674b)
• enforce Ever Teams feature preservation (ae5d8a4)
• gate fast startup browser parity (7a834b5)
• harden deterministic browser performance gate (8f506cc)
• satisfy invitation typecheck (c12789d)
• web: require build identity placeholders (c86aba7)

Continuous Integration

• mobile: let the mobile workflows re-run when their own definition changes (ae5dcae)
• mobile: rename the stage apps branch to stage-apps, matching ever-gauzy (0355d97)
• add external uptime monitoring (GitHub-hosted vantage point outside the homelab) (#4423) (f5d4f3b)
• fix the broken desktop server-web/server-api, browser-extension and SDK-publish builds (all chronic since the runner migration) (ae4e9eb)
• desktop: bound the shared yarn+.nx CI cache (it reached 9.5 GB and its save stalled past the 300-min job timeout) (db29914)
• desktop: Desktop App Build Apps — dead icon URLs saved 404 HTML as PNGs (all platforms aborted with "image: unknown format"), plus the same snapd / arm64 / Apple-ID / Spaces / pip fixes as the server apps (6d25ce2)
• desktop: retry yarn install — one transient codeload 429 was throwing away 40-minute builds (c8df281)
• desktop: self-hosted Windows jobs — prepend Git for Windows' bin to GITHUB_PATH so shell: bash resolves to Git Bash, not WSL's System32\bash.exe (EVERGR: "Running WSL as local system is not supported", run 32058756571) (5a9daa0)
• desktop: Ubuntu 24.04 ARC image refuses plain pip (PEP 668) — use --break-system-packages with fallback on the Linux desktop jobs; add squashfs-tools (83056a3)
• desktop: win-arm64 builds — drop the nested mobile-only sharp@0.32 before install-app-deps; server apps bundle default translations instead of 404-ing on a dead I18N_FILES_URL (44d031a)
• desktop: Windows jobs — discover the Python interpreter (python.exe → python3.exe → py.exe) instead of hard-coding python3 (EVERGR has no python3; run 32048487421) (30b8b26)
• desktop: Windows jobs — export npm_config_node_gyp to the globally installed node-gyp (yarn 1's default npm-bundled path is missing on EVERDESK4: 'Cannot find module …/npm/node_modules/node-gyp/bin/node-gyp.js' while rebuilding better-sqlite3, run 32087030551) (65a6c54)
• desktop: Windows jobs — restore the PowerShell-safe pip line (|| is a parse error in PowerShell 5.1 on the self-hosted x64 runners; run 32041777059) (44d38ba)
• bump configure-registry pin to aa4ee199 (errexit-guarded tracked-file probe) (eee7f23), closes ever-co/ever-gauzy#10029
• diff affected projects from PR base (819a07d)
• re-pin configure-registry to the .yarnrc-restore fix (48c4a05)
• re-pin configure-registry to the .yarnrc-restore fix (59bc194)
• re-pin configure-registry to the .yarnrc-restore fix (352c355)
• re-pin configure-registry to the .yarnrc-restore fix (18600ab)
• re-pin configure-registry to the .yarnrc-restore fix (74b413d)
• re-pin configure-registry to the .yarnrc-restore fix (fef99a0)
• re-pin configure-registry to the .yarnrc-restore fix (4a73f35)
• re-pin configure-registry to the .yarnrc-restore fix (0646db5)
• re-pin configure-registry to the .yarnrc-restore fix (fc1a669)
• re-pin configure-registry to the .yarnrc-restore fix (451bba9)
• route the SDK release install through the internal Verdaccio cache (7ec1140)
• sdk-release: move the release job to the -8 ARC pool (ENOSPC on -4) (4c90c40)
• re-pin configure-registry to the .yarnrc-restore fix (101bf1c)
• re-pin configure-registry to the .yarnrc-restore fix (5370edf)
• re-pin configure-registry to the .yarnrc-restore fix (043034d)
• re-pin configure-registry to the .yarnrc-restore fix (a9724d5)
• re-pin configure-registry to the .yarnrc-restore fix (0181f02)
• reword the build-record comment (cspell) (1dda585)
• route the self-hosted jobs through the shared configure-registry action (7a75a10)
• typecheck Cypress independently (bbca83d)
• use the shared configure-registry action on the self-hosted jobs (212d5b9)
• web: compare preservation refs immutably (349d196)
• web: enforce baseline-aware Knip review (e3f1bd3)
• web: install Cypress Linux prerequisites (5083658)
• web: keep Knip JSON output machine-readable (0217aac)
• web: keep verification scoped to the product (ab1325d)
• web: preserve Knip comparator exit status (9c4d54b)
• web: provision Cypress display server (4816e91)
• stop uploading Docker build records and summaries (2eefe3a)
  Full Changelog: v0.1.0...v0.2.0