DireWork v2.0.0

Why 2.0.0: deploying this release needs a new required secret (PROXY_SECRET) and moves the
deploy job into a production GitHub environment, so every fork's deploy setup changes. Nothing
changes for viewers, and your tasks, settings and bot connection carry over.

Upgrade notes

• New required GitHub secret PROXY_SECRET (min 32 characters,
  openssl rand -base64 32). Add it before syncing your fork — the deploy fails
  validation without it. It lets the API rate limiter tell browsers apart behind the web
  worker's proxy.
• Recommended: move your deploy secrets into a production environment. The deploy
  job now runs in the GitHub environment production. Create it under Settings →
  Environments, add the seven deploy secrets there, then delete the repository-level
  copies so no other workflow can read them. Nothing breaks if you wait: until you move
  them, the deploy keeps reading the repository secrets.
• Database migrations 0012–0017 apply automatically on the next deploy. 0012–0016 only
  add tables, columns and indexes, plus a one-time scrub of data DireWork no longer keeps (see
  Security). 0017 drops one index, task_status_idx, which 0015's task_status_completed_idx
  already covers; no shipped build relies on it, so rolling the workers back after this deploy
  stays safe.
• After updating, reload the bot page (or refresh its OBS browser source) so it runs the
  new bot code.

Security

• Resetting the bot page URL now also kills the Twitch chat login that page was
  given, so a leaked bot link stops working in chat too, not just on DireWork. The bot
  keeps running with a freshly issued login once you open the new URL. If Twitch can't be
  reached, the reset still goes through and the dashboard tells you the old chat login
  couldn't be confirmed dead (it expires on its own within a few hours).
• Cloudflare invocation logs are turned off on both workers. They stored every
  request's full URL, and bot and overlay links carry their secret token in the URL.
  DireWork's own redacted logs and error metrics are still collected.
• DireWork stores less about you: owner sign-in asks Twitch only for your identity (no
  email), your own Twitch login tokens are never saved, and sessions no longer record your
  IP address or browser. Data saved by earlier versions is scrubbed on deploy.
• Anyone else who tries to sign in to a claimed instance gets a clear "already belongs to a
  different Twitch account" message, and the deployment guide explains how to recover an
  instance someone else claimed first.
• Hardened the API: dashboard changes must be sent as JSON (blocks cross-site form
  posts), batched requests are capped, the local development login needs a per-run secret,
  and every call to Twitch has a timeout.
• New CodeQL security scanning and a daily dependency audit; patched vulnerable
  dependencies, including Next.js.

Changed

• Bot settings page redesigned. The bot console and bot account cards sit side by side,
  with a numbered "How to run it in OBS" guide. Each command tab shows a compact command
  legend next to the reply editor; every reply has a live preview with sample values, a
  "Reset to default" once you have changed it, and variable chips that explain themselves
  on hover.
• Default bot replies reworded in plain language ("Nice work, {user}. "{task}" is done." instead of "Alpha work! You finished "{task}" {user}!"), and the default !help reply now lists !focus, !check, !today and !next. If you never edited a reply, your bot picks the new wording up on its own, including instances set up before 1.1 that still had the original 2025 text. Replies you customized are untouched.
• !today shows each task's number (Now: #2 … · Next: #1 …), the number !done, !edit, !remove and !focus take.
• The footer shows the deployed commit hash on its own, without a version number. Every deploy is one commit, so the hash is the version that matters.
• The product name is spelled "DireWork" everywhere in the dashboard, overlays and docs.
• An overlay with an old or reset URL now shows nothing instead of a fake 00:00 timer or
  "No tasks yet", so a stale OBS source can never put placeholder junk on stream. Copy the
  current URL from the dashboard to bring it back.
• "Username color" is now "Fallback username color", with a hint: it only applies to
  viewers who have no Twitch chat color.
• Theme presets meet text contrast guidelines (4.5:1) for done tasks, usernames and the
  Cozy Cottage header. Done rows no longer fade to 60% opacity, so the done color you pick is
  the color viewers see.
• The bot page only forwards real DireWork commands. Lines whose first word isn't a
  DireWork command or one of your aliases — like other bots' !lurk or !so — never leave
  the page, saving a Cloudflare request each. An open bot page picks up new aliases within
  an hour; reload it to use them right away.
• Completed tasks are deleted automatically 24 hours after they're marked done, and the
  task overlay and dashboard read at most the 50 most recent done tasks per poll (the
  done/total counters, including each viewer's, still count every done task) — keeps D1
  reads within the free tier.
• The dashboard stops polling while its tab is hidden and slows down after two minutes
  without input, so an idle dashboard no longer eats into the daily request budget.
• The API rate limiter keys signed-in traffic by session and proxied traffic by the
  browser's real IP, so other visitors can no longer exhaust the owner's buckets.
• Deploys no longer fail on a newly published dependency advisory; they show a warning.
  Pull requests still fail on high-severity advisories.
• Every deploy ends with a smoke check (the API must reach the database and the web app
  must serve the new version), so a broken deploy shows red instead of green.
• Clearer error messages: bot connection failures, rejected settings fields and lost API
  connections each get specific, readable copy, and editors never open over default values
  when loading failed.
• Accessibility fixes for keyboard focus and color contrast across the dashboard.
• Contributor docs: AGENTS.md now has a Code Review Rules checklist (free-tier cost
  budget and invariants) used for every pull request review.

Added

• Browser end-to-end tests in CI (packages/e2e, Playwright): both workers run in local workerd over a fresh database, the suite signs in through the development bypass, and it exercises the dashboard, task list and overlay, Theme Center and Bot settings before anything can deploy.
• Dashboard pages show their loading skeleton the instant you click a nav link, instead of
  the previous page sitting still until the new one arrives. The clicked nav icon pulses
  while the page loads, and skeletons sweep a soft highlight instead of pulsing.
• !today chat command. A viewer gets their plan in one line: the task they're on
  now, the next two, and how many more are queued. It can be aliased like any other
  command (reload the bot page after updating so it relays !today).
• Undo for removing a task. Removing a task is still one click; a "Task removed" toast
  offers Undo for a few seconds and puts it back exactly where it was.
• Rolling back section in the deployment guide: how to roll each worker back from the
  Cloudflare dashboard, wrangler rollback, or a re-run of an earlier GitHub deploy, and
  why the database itself should not be rolled back.
• Deployment guide sections on monitoring (point uptime checks at /ready, which tests
  the database), updating your instance, and recovering an instance someone else claimed.

Fixed

• !remove and !focus without a number used to answer with one shared line that named both commands and sent viewers to !check for their numbers, which !check never shows. Each now explains its own usage and points at !today.
• A mod's !clear with no target did nothing. It now lists the targets: !clear done, !clear all, !clear @user.
• Two open bot pages no longer run each chat command twice.
• The bot reconnects on its own when the Twitch chat connection silently drops, re-sends a
  reply Twitch rejected as a duplicate, and explains chat-mode, ban and timeout errors.
• When the bot account's Twitch login can no longer be refreshed, the bot page shows a
  clear "reconnect the bot account" screen instead of retrying forever.
• The bot joins the right channel after you rename your Twitch account.
• The bot page no longer stalls when one API request hangs: requests time out after 30
  seconds and later chat commands keep processing.
• When a bot-login refresh fails, other waiting requests report the failure at once
  instead of reusing the rejected token; a reconnect also clears any stuck refresh lock.
• The bot page stops on a clear error for a malformed bot link or invalid IRC credentials
  instead of sitting on "Refreshing login".
• Disconnecting the bot account always finishes, even when Twitch is slow.
• A failed bot connection is reported as an error instead of "cancelled".
• Overlays keep showing their last good state through a failed poll or a page error
  instead of going blank on stream.
• Long task text from chat is cut without breaking an emoji in half.
• The "Retry" button on a failed-load toast works again.