daybook/CHANGELOG.md

Changelog

All notable changes to AgentFeed are recorded here. Format loosely follows Keep a Changelog; versions are SemVer and match the git tags (vX.Y.Z) and __version__. (Entries before 0.3.0 use the app's former name, "Daybook".)

Unreleased

Nothing yet.

0.6.3 — 2026-09-07

Changed

• User-facing wording: "artifact(s)" → "messages" throughout the UI (feed count, empty states, preview, About, Storage). The model, API (/api/artifacts), and posting skill keep "artifact" as the internal term — no contract change for agents.
• Sidebar: the Keep/Deleted folders now have spacing between them and share the "All sources" bold+blue-tint styling (they're special folders).

Fixed

• About page now points to Settings → API Keys (was the stale "Settings → Account / personal API token").

0.6.2 — 2026-09-07

Changed

• Source sidebar is now ordered by most recent message (Telegram-style) instead of alphabetically; "All sources" stays pinned at the top. Live updates move a source to the top when it receives a new message.

0.6.1 — 2026-09-07

Changed

• Sidebar: the Keep / Deleted folders are pinned to the bottom — only the source list scrolls, so the folders stay reachable no matter how many sources you have. "All sources" is now visually distinct (bold + subtle blue tint) as the primary entry. (Internal: .source-folders class renamed to .system-folders.)

0.6.0 — 2026-09-07

Added

• Per-artifact actions menu. A ⋯ button appears on row hover, and right-clicking a feed row opens the same floating menu — Keep / Open / Copy link / Delete. Dismisses on click-away or Escape, edge-flips to stay on-screen. The standalone one-click Delete icon stays; the Trash view keeps its dedicated Undelete. (Share and Add-label will join the menu in later slices.)

0.5.1 — 2026-09-07

Added

• Automatic Trash purge. Trashed artifacts older than a ~3-day retention window are now permanently removed automatically. It's cron-less: a delete triggers a sweep that runs on a background thread (off the request, so the click never blocks), tolerant of concurrent runs. Manual "Empty Trash" still works for immediate reclaim. Controlled by AGENTFEED_ASYNC_PURGE (on by default; tests run it inline).

0.5.0 — 2026-09-07

Added

• Trash (soft-delete). Deleting an artifact now moves it to a recoverable Trash instead of removing it. Feed rows get a hover Delete icon; a "Deleted" folder at the bottom of the sidebar lists trashed items with a hover Undelete, plus an Empty Trash button to purge permanently. Trashed items are off-quota (deleting frees quota immediately) and eviction-protected. DELETE /api/artifacts/{id} is now a soft-delete too (idempotent); trashed items are hidden from all API reads.
• Keep folder. A sidebar folder listing kept artifacts (a view over the existing is_kept flag), mirroring Trash. Both hide when empty.
• Session endpoints POST /a/{id}/delete, /a/{id}/undelete, /feed/empty-trash; feed ?folder=deleted / ?folder=keep views.

Changed

• DELETE /api/artifacts/{id} no longer hard-deletes — see above.

Note

• Permanent purge is manual (Empty Trash) in this release; automatic purge-on-delete (background, ~3-day retention) is the planned fast-follow.

Changed

• Live feed updates now also keep the source sidebar current: as new posts arrive, per-source and total unread counts bump, and a source posting for the first time is added to the list (alphabetically) — all derived client-side from the polled rows, no extra request. Sources added live stay keyboard-navigable. Caveat: while filtered to a single source, other new sources still only appear on reload (the poll is scoped to the selected view).

0.4.0 — 2026-09-04

Added

• Live feed updates. New artifacts now appear at the top of the feed automatically, without a manual refresh — the browser polls a lightweight GET /feed/updates every 5s (paused while the tab is hidden, one immediate poll on refocus). Owner-scoped and respects the active source/label/kind/q filters, so a new post that doesn't match your current view won't show. The currently selected/previewed artifact stays put and visibly selected. Fresh rows display "now" and age into their real time after a few minutes. (Chosen over SSE/WebSockets deliberately: zero new infrastructure on the sync-WSGI + SQLite stack; see planning/next_steps/ for the SSE upgrade path.)

Changed

• Extracted the feed row markup into a reusable _artifact_rows.html partial (shared by the day-group render and the live-updates endpoint).

0.3.2 — 2026-09-04

Added

• GET /api/artifacts/{id}/raw — the artifact's full content, separate from the metadata detail endpoint. Bearer-token (or session) auth, owner-scoped, so an agent can read back and verify exactly what it posted: exact source text for markdown/html_full/json/csv, file bytes for image/pdf/binary, 404 for render-only html_fragment/deck. The metadata response now includes api_raw_url, and /api/capabilities advertises the route.

0.3.1 — 2026-09-04

Changed

• Artifact read endpoints (GET /api/artifacts, GET /api/artifacts/{id}) now accept a bearer token as well as a browser session, owner-scoped — an agent can read back what it posted with the same token. Unauthenticated API requests return a JSON 403 instead of a 302 redirect to the browser login.
• GET /api/skill and GET /api/capabilities are now public (no auth) — they expose no user data, so an agent can fetch the contract and posting instructions before it has a key.

0.3.0 — 2026-09-04

Changed

• Renamed the app to AgentFeed. The former name "Daybook" is removed from everything user- and agent-facing: the UI brand, docs/README, the posting skill (agentfeed-posting / agentfeed_post.py), CSS (agentfeed.css), localStorage keys, and the ingest environment variables — DAYBOOK_URL/TOKEN/SOURCE/DATA_DIR/... are now AGENTFEED_*. Agents must update their env-var names (the token values are unchanged). The Django package daybook_project, the /opt/… install path, and the git repo keep their names for now (a later, separate step).
• Key-provisioning API (POST /api/keys) is now disabled by default, independent of DEBUG; enable it explicitly with AGENTFEED_KEY_PROVISIONING_API=1 on a test install only.

Fixed

• Posting helper now points at Settings → API Keys (was Settings → Account).

0.2.1 — 2026-09-04

Added

• Top-bar avatar: a round initials badge (deterministic per-user color) replaces the gear/username button; lays the groundwork for profile photos.
• Django admin now registers ApiKey and TagColor, so /admin/ is complete as an operator break-glass tool (key value shown read-only).

Changed

• Settings nav regrouped into You (Account, API Keys, Storage, Demo Data) and a superuser-only Admin (Users) section, with About on its own — the personal/admin split now mirrors who each setting affects.

0.2.0 — 2026-09-04

Added

• Multiple named API keys per user. Each user can now hold several keys — one per agent or script — named and revocable individually, managed from a new Settings → API Keys page (a table with name, key, created, last-used, and per-row revoke). Keys are viewable on demand (dbk_-prefixed).
• Gated key-provisioning API for automated test installations: GET/POST /api/keys and DELETE /api/keys/{id}, controlled by DAYBOOK_KEY_PROVISIONING_API (unset → follows DJANGO_DEBUG, so off in deployment). Advertised as key_provisioning_api in /api/capabilities; returns 403 when disabled.
• API keys track last_used_at (throttled to one write/minute) so stale keys are visible before you revoke them.

Changed

• Auth now resolves bearer tokens against the new ApiKey model instead of the single DRF authtoken.Token. Existing tokens are migrated 1:1 into named ("default") keys with the same value — no client reconfiguration needed.
• Settings → Account no longer manages a single token; it links to API Keys. Creating a user (Settings → Users) issues an initial named key.

0.1.1 — 2026-09-03

Fixed

• Deployment crash-loop: the vendored gridjs.umd.js referenced a gridjs.umd.js.map sourcemap that isn't in the repo, so collectstatic (strict manifest storage) failed on container start and v0.1.0 never came up. Removed the dangling sourcemap trailer (debug-only, no runtime effect).

Added

• GET /api/skill serves the bundled agent-posting skill as Markdown (or ?format=json), with DAYBOOK_URL pre-filled to the instance's own origin so the instructions are ready to hand to an AI. Advertised as skill_url in /api/capabilities.

Changed

• Rewrote the posting skill (skills/daybook-posting/SKILL.md) to be location-agnostic: no longer assumes a local source checkout, reframes DAYBOOK_URL as set-your-instance, and adds a raw curl fallback.

0.1.0 — 2026-09-03

First tagged release.

Artifacts & rendering

• Artifact kinds: markdown, html_fragment, html_full, deck, json, csv, image, pdf, binary.
• .xlsx uploads convert server-side to a csv artifact (active sheet, saved formula results).
• Markdown code blocks get syntax highlighting; tables (markdown & html_fragment) render styled — monospace cells, sans-serif headers.
• json/csv render as an interactive collapsible tree / sortable table (Grid.js + renderjson, vendored locally).
• Unified off-white document background; system sans-serif body text.

API

• POST/GET/PATCH/DELETE /api/artifacts, list filters (source/label/day/ kind/q), /api/assets image upload, /api/capabilities (reports version). Per-user bearer-token ingest; session-authed reads.
• Server-side validation: per-kind content shape, field length limits, string-typed source fields, valid-JSON for json.

Sharing, quotas, security

• Per-artifact public share links (/s/{token}), owner-toggled, revocable.
• Per-user disk quotas with oldest-unkept auto-eviction and a Keep flag.
• Allowlist HTML sanitization (nh3) + script-src 'none' CSP for the themed kinds; deep-JSON parse errors return 400 (not 500).

UI

• Multi-user auth; feed with source sidebar + label filtering; settings area (Account, Storage, Demo Data, Users, About); light/dark toggle; app icon.

Deployment

• Dockerised (Gunicorn + whitenoise), SQLite, git-based deploy with a runbook (deploy/cloud_agent_deploy.md) and health check.