daybook/CHANGELOG.md

Changelog

All notable changes to AgentFeed are recorded here. Format loosely follows Keep a Changelog; versions are SemVer and match the git tags (vX.Y.Z) and __version__. (Entries before 0.3.0 use the app's former name, "Daybook".)

Unreleased

Nothing yet.

0.4.0 — 2026-09-04

Added

• Live feed updates. New artifacts now appear at the top of the feed automatically, without a manual refresh — the browser polls a lightweight GET /feed/updates every 5s (paused while the tab is hidden, one immediate poll on refocus). Owner-scoped and respects the active source/label/kind/q filters, so a new post that doesn't match your current view won't show. The currently selected/previewed artifact stays put and visibly selected. Fresh rows display "now" and age into their real time after a few minutes. (Chosen over SSE/WebSockets deliberately: zero new infrastructure on the sync-WSGI + SQLite stack; see planning/next_steps/ for the SSE upgrade path.)

Changed

• Extracted the feed row markup into a reusable _artifact_rows.html partial (shared by the day-group render and the live-updates endpoint).

0.3.2 — 2026-09-04

Added

• GET /api/artifacts/{id}/raw — the artifact's full content, separate from the metadata detail endpoint. Bearer-token (or session) auth, owner-scoped, so an agent can read back and verify exactly what it posted: exact source text for markdown/html_full/json/csv, file bytes for image/pdf/binary, 404 for render-only html_fragment/deck. The metadata response now includes api_raw_url, and /api/capabilities advertises the route.

0.3.1 — 2026-09-04

Changed

• Artifact read endpoints (GET /api/artifacts, GET /api/artifacts/{id}) now accept a bearer token as well as a browser session, owner-scoped — an agent can read back what it posted with the same token. Unauthenticated API requests return a JSON 403 instead of a 302 redirect to the browser login.
• GET /api/skill and GET /api/capabilities are now public (no auth) — they expose no user data, so an agent can fetch the contract and posting instructions before it has a key.

0.3.0 — 2026-09-04

Changed

• Renamed the app to AgentFeed. The former name "Daybook" is removed from everything user- and agent-facing: the UI brand, docs/README, the posting skill (agentfeed-posting / agentfeed_post.py), CSS (agentfeed.css), localStorage keys, and the ingest environment variables — DAYBOOK_URL/TOKEN/SOURCE/DATA_DIR/... are now AGENTFEED_*. Agents must update their env-var names (the token values are unchanged). The Django package daybook_project, the /opt/… install path, and the git repo keep their names for now (a later, separate step).
• Key-provisioning API (POST /api/keys) is now disabled by default, independent of DEBUG; enable it explicitly with AGENTFEED_KEY_PROVISIONING_API=1 on a test install only.

Fixed

• Posting helper now points at Settings → API Keys (was Settings → Account).

0.2.1 — 2026-09-04

Added

• Top-bar avatar: a round initials badge (deterministic per-user color) replaces the gear/username button; lays the groundwork for profile photos.
• Django admin now registers ApiKey and TagColor, so /admin/ is complete as an operator break-glass tool (key value shown read-only).

Changed

• Settings nav regrouped into You (Account, API Keys, Storage, Demo Data) and a superuser-only Admin (Users) section, with About on its own — the personal/admin split now mirrors who each setting affects.

0.2.0 — 2026-09-04

Added

• Multiple named API keys per user. Each user can now hold several keys — one per agent or script — named and revocable individually, managed from a new Settings → API Keys page (a table with name, key, created, last-used, and per-row revoke). Keys are viewable on demand (dbk_-prefixed).
• Gated key-provisioning API for automated test installations: GET/POST /api/keys and DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset → follows DJANGO_DEBUG, so off in deployment). Advertised as key_provisioning_api in /api/capabilities; returns 403 when disabled.
• API keys track last_used_at (throttled to one write/minute) so stale keys are visible before you revoke them.

Changed

• Auth now resolves bearer tokens against the new ApiKey model instead of the single DRF authtoken.Token. Existing tokens are migrated 1:1 into named ("default") keys with the same value — no client reconfiguration needed.
• Settings → Account no longer manages a single token; it links to API Keys. Creating a user (Settings → Users) issues an initial named key.

0.1.1 — 2026-09-03

Fixed

• Deployment crash-loop: the vendored gridjs.umd.js referenced a gridjs.umd.js.map sourcemap that isn't in the repo, so collectstatic (strict manifest storage) failed on container start and v0.1.0 never came up. Removed the dangling sourcemap trailer (debug-only, no runtime effect).

Added

• GET /api/skill serves the bundled agent-posting skill as Markdown (or ?format=json), with DAYBOOK_URL pre-filled to the instance's own origin so the instructions are ready to hand to an AI. Advertised as skill_url in /api/capabilities.

Changed

• Rewrote the posting skill (skills/daybook-posting/SKILL.md) to be location-agnostic: no longer assumes a local source checkout, reframes DAYBOOK_URL as set-your-instance, and adds a raw curl fallback.

0.1.0 — 2026-09-03

First tagged release.

Artifacts & rendering

• Artifact kinds: markdown, html_fragment, html_full, deck, json, csv, image, pdf, binary.
• .xlsx uploads convert server-side to a csv artifact (active sheet, saved formula results).
• Markdown code blocks get syntax highlighting; tables (markdown & html_fragment) render styled — monospace cells, sans-serif headers.
• json/csv render as an interactive collapsible tree / sortable table (Grid.js + renderjson, vendored locally).
• Unified off-white document background; system sans-serif body text.

API

• POST/GET/PATCH/DELETE /api/artifacts, list filters (source/label/day/ kind/q), /api/assets image upload, /api/capabilities (reports version). Per-user bearer-token ingest; session-authed reads.
• Server-side validation: per-kind content shape, field length limits, string-typed source fields, valid-JSON for json.

Sharing, quotas, security

• Per-artifact public share links (/s/{token}), owner-toggled, revocable.
• Per-user disk quotas with oldest-unkept auto-eviction and a Keep flag.
• Allowlist HTML sanitization (nh3) + script-src 'none' CSP for the themed kinds; deep-JSON parse errors return 400 (not 500).

UI

• Multi-user auth; feed with source sidebar + label filtering; settings area (Account, Storage, Demo Data, Users, About); light/dark toggle; app icon.

Deployment

• Dockerised (Gunicorn + whitenoise), SQLite, git-based deploy with a runbook (deploy/cloud_agent_deploy.md) and health check.