📦 SDK v0.4.0 (@reprojs/core)

📦 Repro SDK — @reprojs/core@0.4.0 on npm

compare changes

🚀 Enhancements

• shared: Add AdminOverviewDTO for admin overview dashboard (f76efdb)
• api: GET /api/admin/overview aggregates across all projects (b17e400)
• ui: /admin overview page with tiles, activity, per-project list (8719c9b)
• ui: Add Overview to admin sidebar section (5603c5c)
• shared: Add 'manager' to ProjectRole enum (2996a41)
• perms: Slot manager between viewer and developer in rank (c355fdf)
• api: Lower triage-endpoint minimum from developer to manager (bc76e5e)
• ui: Surface manager role in members page and invite default (4bd7dc1)
• shared: Add source discriminator and mobile device fields to ReportContext/SystemInfo (2f6effc)
• shared: Add source and devicePlatform to ReportSummaryDTO (95ed429)
• dashboard: Add source, device_platform, idempotency_key to reports (d863a1a)
• dashboard: Idempotency key + source/device persistence in intake (f98d672)
• dashboard: Populate source and devicePlatform in report DTOs (36c5774)
• dashboard: Source filter and facets on reports list (50ac717)
• dashboard: Inbox query supports source facet (fe4fde3)
• dashboard: Source facet in the inbox sidebar (b0d6c55)
• dashboard: Platform pill in the inbox row (8c9cf5f)
• dashboard: Mobile-aware detail drawer (hide replay, show device card) (119a8f8)
• expo: Config normalizer and internal context shape (50e2018)
• expo: Console collector with sentinel-guarded patching (9da4569)
• expo: Fetch network collector with header redaction (13b44f1)
• expo: System info collector assembling mobile device context (b139522)
• expo: Persistent queue storage with size + count caps (beb368a)
• expo: Intake client with idempotency-key header (5f89742)
• expo: Queue flusher and netinfo connectivity listener (921c4e3)
• expo: View-shot capture and SVG-based annotation flatten (46c1073)
• expo: Annotation store and gesture-based canvas (pen tool v1) (715e63f)
• expo: Wizard sheet with form, annotate, and submit steps (a8c898c)
• expo: Provider, useRepro hook, launcher, and module singleton (2c84d23)
• expo: Mobile-polished annotation UX — icons, color+stroke pickers, live previews, text input (6551cc2)
• expo: Attach logs (console + network + breadcrumbs) to intake (2a89ada)
• expo: Redesign wizard UI + match dashboard flame palette + fix annotation submission (9688803)
• expo: Draggable launcher snaps to nearest of 4 corners with persisted choice (674c638)
• expo: Silent-disable when projectKey or intakeUrl is empty (1ae196a)
• ✨ Add two way sync for github issue labels (89d3d9e)
• webhook: Add size cap helper for github webhooks (8886440)
• db: Add github_webhook_deliveries table for replay protection (f210471)
• webhook: Add delivery dedupe for replay protection (f91987b)
• webhook: Check installation id against known integrations (f1ad47e)
• webhook: Enforce size cap, replay dedupe, installation allowlist (3865559)
• db: Add user_identities table (github provider) (63cd11d)
• db: Add github_write_locks table for loop avoidance (e16f5c5)
• db: Add report_comments table (not yet wired) (80cb4d4)
• db: Add milestone, sync timestamps, and toggle columns (964601e)
• db: Extend report_event_kind enum for assignees/comments/milestone (fcc4a8b)
• identities: Signed oauth state helper for link flow (e416b4d)
• identities: Resolver + upsert + unlink helpers (c5796b2)
• identities: GET /api/me/identities (3d1211b)
• identities: POST start endpoint generates signed oauth url (dddb5f9)
• identities: Callback exchanges code and upserts identity (2d1527e)
• identities: DELETE endpoint unlinks the identity (855bcc5)
• identities: Backfill user_identities from better-auth account rows (c511746)
• identities: /settings/identities page with connect/disconnect (c52520f)
• db: Report_assignees schema + backfill migration (unapplied) (44299e0)
• shared: ReportSummaryDTO.assignees (array); TriagePatchInput.assigneeIds (572ae66)
• github-cache: Generic per-repo cache with TTL + SWR + single-flight (4ad1071)
• github-adapter: List labels, assignees, milestones (367f0aa)
• api: GET repo labels for a project (2e615b4)
• api: GET assignable users with linkedUser resolution (fb19d2c)
• api: GET repo milestones (091d610)
• webhook: Invalidate picker caches on label/milestone/member events (69cfba2)
• ui: Composable exposing github integration state per project (fbc29c3)
• shared: Add milestone + githubAssigneeLogins to reports DTOs (4c64078)
• triage: PATCH + read endpoints support milestone + github-only assignees (a278a30)
• ui: Labels picker backed by repo label set (9374bcc)
• ui: Assignees picker — dashboard-linked and github-only in one list (52269e7)
• ui: Milestone picker (db4f968)
• triage: Wire live pickers into drawer for linked projects (56848b0)
• github-adapter: Issue-write helpers (title, milestone, assignees, state) (0e3f571)
• github-diff: Signature + assignee-diff helpers for write-locks (09da9bc)
• write-locks: Record/consume/cleanup helpers (c94dd5d)
• tasks: Daily cleanup of expired github_write_locks (57190e1)
• reconcile: Diff + push title, labels, state, assignees, milestone with write-locks (91e4768)
• triage: Enqueue github sync on qualifying PATCH when push_on_edit=true (a673712)
• webhook: Assigned/milestoned/edited branches + write-lock echo skip (9cfddd6)
• integrations: PushOnEdit UI toggle for GitHub integration (dfd32b2)
• integration-api: Expose autoCreateOnIntake toggle (1574a7d)
• integration-ui: AutoCreateOnIntake toggle (51fc8b7)
• intake: Auto-create github issue on new report when toggle is on (30b7674)
• github-adapter: Issue-comment wrappers (create/update/delete/list) (f395f3d)
• comments: Bot-footer serialize/strip/detect helpers (9364473)
• github-diff: SignCommentUpsert + signCommentDelete (e664a1d)
• sync-jobs: Carry comment-sync payloads (021a0f7)
• api: GET/POST/PATCH/DELETE report comment endpoints (76e6fb1)
• shared: Comment DTOs (2485a18)
• reconcile: Handle comment_upsert and comment_delete job kinds + backfill on first link (7514d3c)
• webhook: Issue_comment branches with write-lock echo skip (2ce422e)
• dashboard: Add marked dependency and use-markdown composable (aa39cf9)
• dashboard: Add Comments tab to report detail page (1b8a7a2)
• dashboard: Live report stream via SSE with memory-safe lifecycle (92e6a2f)
• security: XSS-safe markdown rendering with DOMPurify (d43df70)
• dashboard: Render reporter description in overview tab (4f621a3)
• sync: In-process trigger + shared outbox runner (4b59420)
• github: Create custom labels in linked repo from the picker (18ad810)
• sdk-utils: Add canonical theme tokens shared by web and expo SDKs (989d8e3)
• sdk-utils: Add Attachment shape and validateAttachments helper (a6c8159)
• ui: Add themeToCssVars helper that emits flame/mist tokens as CSS vars (1a2e692)
• ui: Inject flame/mist CSS vars into shadow root at mount (91a883b)
• ui: Add PrimaryButton, SecondaryButton, FieldLabel, StepIndicator, WizardHeader (61404b5)
• ui: Add StepDetails (replaces step-describe in 3-step wizard) (1077c55)
• ui: Add StepReview with 'Included in this report' summary (da15040)
• ui: Replace 2-step wizard with annotate → details → review flow (25c916f)
• db: Add report_attachments.filename and user-file kind (9fd59b1)
• env: Add user-file intake size budgets (01c0f9e)
• server: Add sanitizeFilename + rollbackPuts helpers (f4bc566)
• intake: Accept attachment[N] parts as user-file attachments (bceae0b)
• ui: Add AttachmentList with hybrid thumbnail + chip rendering (b8070d6)
• sdk-web: Add user attachments end-to-end (46af0bb)
• shared: Add user-file kind and filename field to AttachmentDTO (dd715e5)
• dashboard: Include user-file filename in report detail response (4242d52)
• dashboard: Add AttachmentsTab for user-file attachments (f046de2)
• dashboard: Expose user-file attachments tab in report drawer (125760a)
• expo: Add pickFiles wrapper over expo-document-picker (d664505)
• expo: Add AttachmentList for the mobile wizard (b2162d3)
• expo: Add attachments to the wizard's Details step (9e64cea)
• expo: Submit user-file attachments as attachment[N] multipart parts (716d4b6)
• ui: Side-by-side details layout + paste-to-attach screenshots (4452729)
• intake: Virus-scan user attachments via ClamAV sidecar (53f97a3)
• ui: Inflight toast + clamav scan visibility (23b9349)
• dashboard: Show clamav scan report on user-file attachments (368d63b)
• expo: Pick attachments from Photos / Files / Clipboard (0cc0bf5)
• extension: Retheme popup + options to flame/mist tokens (2708f72)
• deploy: Add clamav sidecar to production compose.yaml (3690065)

🩹 Fixes

• docs: Update URLs after repo rename to ReproJs (ee6ff03)
• dashboard: Signup gate deletes existing users on sign-in (6ae40df)
• dashboard: Stop auto-promoting invited members to admin on first sign-in (28d3e71)
• dashboard: Stop domain-allowlist tightening from deleting existing users (60a7199)
• dashboard: Lowercase email in admin invite endpoint (60c8550)
• dashboard: Fail-closed when app_settings row is missing (d9b952c)
• dashboard: Remove non-null assertion in source filter clause (90a31b6)
• expo: Typecheck cleanup across network, intake, flush tests (97a0ae9)
• expo: Align build output extensions with package.json and plugin shim (50db4a0)
• expo: Export "./app.plugin.js" with extension so Expo plugin resolver works (ab2df64)
• expo: KeyboardAvoidingView uses "height" on Android so modal stays above keyboard (aaf83b5)
• expo: Render screenshot in annotate step + fall back when capture fails (80efaae)
• expo: RunOnJS gesture callbacks + compact toolbar row 2 (20143b2)
• sdk-utils: Hermes-safe newShapeId — fall back when crypto.randomUUID missing (a3c218b)
• expo: Annotate step fills available space + flatten uses measured canvas size (84b3e59)
• expo: Send report as string multipart part — RN FormData drops Blob bodies (f18a7a6)
• expo: Drop expo-file-system getInfoAsync call — threw on SDK 54 legacy deprecation (04d2db5)
• expo: Send _dwellMs (wizard-open-to-submit) to satisfy intake anti-abuse gate (243ffce)
• expo: Render arrow with actual arrowhead, not just a line (9b1d986)
• dashboard: Cap report screenshot at 60vh with letterbox so tall portrait screenshots don't dominate the page (e26dbbc)
• expo: Flatten view uses resizeMode=contain to match preview aspect (45d1e82)
• expo: Flatten PNG uses transparent letterbox bars (alpha preserved) (9174b49)
• docs: Taller phone frames (240x480) + unsquish review card labels (14d06fb)
• dashboard: Copy new workspace packages (sdk-utils, expo) in Dockerfile (e4bf0b4)
• ci,docs: Fix broken paths + bump SDK build heap to 6 GB (a72fbc5)
• sdk:build: Bake in --max-old-space-size=6144 so local + CI both succeed (795bbc1)
• ci/expo: Gate npm publish on tag push so workflow_dispatch is a clean smoke test (8a02e4f)
• expo: Resolve @reprojs/* at build time so published package installs (428a937)
• Update paths for drizzle-kit commands in package.json (893bfdf)
• reports: Use drizzle exists/notExists for assignee filter subqueries (00c9fb7)
• dashboard: Test suite fixes for Phase 3 comment sync (f91f617)
• github-app: Drop in-process credentials cache for cross-process consistency (9b77abf)
• github-app: Mark webhook active in manifest when baseUrl is public (5a159e0)
• github: Subscribe to issue_comment/label/milestone/member events + activity feed tag rendering (40e160c)
• webhook+ui: Label sync publishes SSE events + assignee avatars render (a8f8672)
• csp: Allow https: in img-src so github avatars render (67f569a)
• github: HMAC-sign bot footer, consolidate cache, extract test shims (854089e)
• api: SSE cleanup-before-subscribe + defer post-commit side effects (7c174fa)
• test: Seed github_app row for cross-process webhook-signing tests (0731805)
• github-app: Require OAuth pair in envComplete + CI-safe state secret read (4214368)
• github: Warn when GitHub silently drops assignees (7c6f178)
• docker: Bundle SDK iife in the published image (cb9f80c)
• api: Cache-Control private, no-store on /api/** (65d5309)
• github: Pre-flight check before assigning users to an issue (c6393f7)
• github: Gate test-only reconcile shim on __hasClientOverride (cc3b0e8)
• dashboard: Reject ?id= when authed via signed token (2485200)
• docker: Pin clamav sidecar to linux/amd64 (7971214)
• expo: Make clipboard paste actually work (641faad)
• intake: Scan user-files BEFORE inserting the report row (67f0dbf)
• ci: Isolate SDK tests per-package to prevent globalThis pollution (d829cc2)

💅 Refactors

• api: Drop role-specific wording from triage-guard comments (b83a359)
• manager: Widen stale role casts + cover github-sync/unlink (1768002)
• sdk-utils: Extract ring-buffer from @reprojs/ui (998a4e1)
• sdk-utils: Extract redact from @reprojs/ui (0b1406b)
• sdk-utils: Extract breadcrumbs from @reprojs/ui (eceb072)
• sdk-utils: Extract annotation tool geometry from @reprojs/ui (bac4449)
• reports: List endpoint reads assignees from report_assignees (f32fec0)
• reports: Detail endpoint reads assignees from report_assignees (81bb184)
• triage: Write assignees to report_assignees with diff + events (dfa9ee3)
• bulk-update: Write assignees via diff into report_assignees (058a6c1)
• ui: Bind assignee UI to assignees[0] (single-select preserved) (4e4fa9b)
• dev: Move hardcoded tunnel host + demo endpoint out of tracked files (17ae31c)
• github: Per-signature sync-job dedup with composite PK (6eca61c)
• assignees: Github-only, drop dashboard-user linking (557d2d6)
• ui: Switch styles to CSS custom properties from sdk-utils tokens (ede8899)
• expo: Re-export shared theme tokens from sdk-utils (9ddc528)

📖 Documentation

• spec: Admin overview + manager role design (32f8851)
• plans: Manager role + admin overview implementation plans (656f630)
• Add manager to CLAUDE.md project-roles list (2da9a21)
• Add Expo SDK design spec (fdbef8c)
• Add Expo SDK implementation plan (5ab2dc1)
• @reprojs/expo release notes and repo docs (75b9101)
• Add Buy Me a Coffee link to README and docs site (4b8bd1e)
• spec: Deeper github integration design (76b241a)
• plan: Deeper github integration — phase 0 (backbone) (233a93f)
• Webhook rotation + reserved phase-N toggle columns (e541088)
• plan: Deeper github integration — phase 1 (live pickers) (2322dba)
• plan: Deeper github integration — phase 2 (push-on-edit) (8f88ec3)
• plan: Deeper github integration — phase 3 (comments two-way) (2207954)
• env: Document test-friendly GitHub App + rate-limiter env defaults (b496fd4)
• sdk: Fix the <script async> init race (10a3dc3)
• specs: Add SDK wizard redesign + user attachments design (d8a9b2e)
• plans: Add SDK wizard redesign + user attachments implementation plan (6327f12)

🏡 Chore

• release: Extension changelog config + fix SDK repo casing (34aa3bc)
• release: Extension-v0.1.1 (36b1ee3)
• release: V0.1.15 (4a08dff)
• release: V0.1.16 (7d31498)
• release: V0.1.17 (701f9a7)
• release: V0.1.18 (da1e43c)
• sdk-utils: Scaffold package (abd9d08)
• expo: Scaffold @reprojs/expo package (6676e8a)
• Root script to build @reprojs/expo (f5c05b7)
• Sync bun.lock with expo workspace (af81274)
• Expo:pack script — bundle @reprojs/expo for local install (a4aeb15)
• intake: Log zod validation issues on 400 to aid SDK debugging (7dbc389)
• release: V0.2.0 (48f078e)
• expo: Silence intentional no-await-in-loop in FIFO queue test (b39575c)
• expo: Add changelogen config so release:expo tags as expo-v* (a6dce39)
• release: Expo-v0.1.1 (14ea5dd)
• Fixups from phase-0 verification (0dbf409)
• github-app: Manifest default_events: add sub_issues, drop member (7d9a90c)
• github-app: Default auto_create_on_intake to true for new installs (a7fbab1)
• sse: Strip diagnostics + revert to useEventSource from vueuse (5d78dbd)
• repo: Drop stray top-level server/ migration artifacts (0fdd5a0)
• security: Gate nuxt-security rate-limiter opt-out on non-production (f91164e)
• release: V0.3.0 (8f8d95a)
• release: V0.4.0 (e7dbedb)
• release: V0.4.1 (46de4a5)
• release: V0.4.2 (36d5cef)
• Refresh bun.lock after clamav + expo peer-dep churn (50c4cec)

✅ Tests

• dashboard: Verify /magic-link/verify rate limit (token-probe defense) (e029ae0)
• api: Failing tests for GET /api/admin/overview (5a18a17)
• api: Manager role permission boundary coverage (1b27ac2)
• api: Defense-in-depth beforeAll in viewer regression describe (508043e)
• api: Seed reports via db.insert instead of intake (d967f9d)
• ci: Relax rate limits in test env to unblock full-suite runs (31f2812)
• webhook: Integration tests for hardened auth stack (688bb19)
• Rewrite assignee assertions for report_assignees shape (0917b75)
• assignees: Multi-assignee persistence, clearing, role guard, cap (ed2ed59)
• webhook: Raise timeout for oversized-body transfer (b077006)
• api: Github picker endpoints (0e3ecf1)
• github: End-to-end push-on-edit roundtrip integration test (8fe5b60)
• github: Align webhook secret across tests with env config (45eb032)
• intake: Auto-create on intake respects toggle (049b233)
• comments: API endpoint coverage (8dc9ee8)
• dashboard: Add comment roundtrip integration tests (e837753)
• shared: Align ReportSummaryDTO test with new assignees/milestone shape (9dca620)
• dashboard: Route setup() through local no-op shim + env-agnostic safeHref (216c5e6)
• extension: Rename Playwright e2e spec to .e2e.ts so bun test skips it (11149b5)
• Wait for in-process sync trigger to settle before asserting (29489d0)

🎨 Styles

• triage: Redesign sidebar with divided sections + cleaner chips (03661ae)

🤖 CI

• docker: Don't fail release on flaky GHA cache export (76221d2)

❤️ Contributors

• JJ teohjjteoh@gmail.com
• Jer-tan (@jer-tan)