Item #6: replace 'docker push --all-tags' in release.yml with an explicit push of only the two tags built and scanned in the current run ( + sha-), so the registry never receives tags this run did not produce or Trivy did not scan.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

docs(plans): add logout UI + resizable inspector to v1.0.1 backlog

release / build + scan + publish (push) Successful in 46s

Details

CI / pnpm gate (typecheck, lint, build, test) (push) Successful in 1m16s

Details

a15b846780

Item #7: no user-facing logout control exists, though logout() is implemented and spec'd (auth-session.md L36/L87) — only the auto-expiry guard calls it. With 'remember on this device' on, refresh won't clear localStorage, so users must wipe site data to log out. Security-adjacent wiring gap; flagged highest priority. Must verify logout() broadcasts 'session-changed' cross-tab (ADR #03).

Item #8: inspector rail is a fixed 22rem grid column (AppLayout.tsx L36); long metadata values break-words (Inspector.tsx L203). Make it user-resizable, persisted like the theme pref, bounded, keyboard-operable, desktop-only, token-styled. Distinct from the row-density toggle candidate in ui-shell.md.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

v1.0.1: bulk delete, logout, selection fix, and UX polish

release / build + scan + publish (push) Successful in 1m4s

Details

CI / pnpm gate (typecheck, lint, build, test) (push) Successful in 1m24s

Details

19c0aee9ee

Implements the eight v1.0.1 backlog items (docs/plans/v1.0.1.md). Bug
fixes + quality-of-life; no v1.1 features.

- #6 release.yml: push only the two built+scanned tags (:,
  :sha-${SHA}) instead of --all-tags (ADRs #21/#22).
- #7 TopBar: Logout control -> logout() + navigate('/login'); ADR #03
  verified (logout already broadcasts session-changed).
- #2 selection-store: removeSelected(keys[]) prunes deleted keys from
  the bulk selection; wired into the single-delete success path.
- #1 bulk delete: 'Delete selected' action + new delete-bulk dialog
  body (sequential best-effort loop, between-keys cancel); selection
  reconciles on full/partial/cancel via removeSelected.
- #5 ack-store: persist the destructive-op 'I understand' checkbox per
  type (delete-object/-folder/-bulk, rename, copy); survives logout.
- #8 resizable inspector: width store (clamp-in-store) + drag/keyboard
  splitter + CSS-variable grid; persisted, desktop-only, a11y.
- #3 ObjectRow: checked checkbox -> bg-accent (was invisible in light);
  selected row -> accent-2/20 highlight. Both themes verified.
- #4 RowActionsMenu: portal to document.body to escape the virtualized
  row's transform stacking context (was bleeding list text through).

Verified: typecheck + lint + 1751 unit tests + 98-test redact harness +
7 integration tests all green. E2E deferred to release gate.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

auth-session: record cross-tab session sharing as a v2 candidate

CI / pnpm gate (typecheck, lint, build, test) (pull_request) Successful in 1m23s

Details

CI / pnpm gate (typecheck, lint, build, test) (push) Successful in 2m33s

Details

release / build + scan + publish (push) Successful in 40s

Details

b89a12cc97

Adds the 'Cross-tab session sharing' nice-to-have to the functional
requirements: the desired experience of being logged in by default in a
new tab without the 'Remember on this device' disk-exposure cost. The
right mechanism and its trade-offs are undecided — recorded for v2.

Co-Authored-By: Xavier's assistant <assistant@gijoe88.com>

xavier merged commit b89a12cc97 into main

2026-08-11 18:58:50 +02:00

xavier referenced this pull request from a commit

2026-08-11 18:58:52 +02:00

v1.0.1: bulk delete, logout, selection fix, and UX polish