release: v1.3.0 - #111
Merged
Merged
Conversation
chore(release): sync v1.2.1 version bump back to staging
… read Synced from agent-hub-init kit (usage audit 2026-09-02): verifier now audits the implementer's evidence note by default instead of independently re-running npm test/npm ci from scratch. Re-run is reserved for suspicious notes, outward-facing/release nodes (this repo already shipped one real production bug via v1.2.0 -> v1.2.1), or project-declared exceptions. Also fixed manifest.yaml reads: NORTHSTAR.md (unused by the recipe) -> doctrine/MEMORY.md (actually used in step 4, was undeclared). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
chore(agent-hub): tighten verifier re-run scope, drop stale NORTHSTAR read
Adds POST /api/v1/auth/logout-all so a candidate can invalidate every access/refresh token issued to them at once, not just the current one (as /logout already does). Design differs from the issue's tokenVersion-on-Candidate-model proposal: instead of adding a Mongo field + an extra DB lookup per authenticated request, this reuses the exact Redis-with-in-memory- fallback shape already used by tokenBlacklist.ts. A per-candidate 'invalidated before' timestamp is stored in Redis/mem (sessionRevocation.ts) and compared against each JWT's standard iat claim in verifyToken.middleware.ts and authRefreshToken — one more Redis/mem lookup alongside the blacklist check that already runs on every request, no schema change, no new DB round trip. - src/utils/sessionRevocation.ts: invalidateAllSessions / getSessionsInvalidatedAt / isSessionRevoked - verifyToken.middleware.ts: reject tokens issued before the last logout-all - auth.controller.ts: authLogoutAll controller + same check in authRefreshToken - auth.route.ts: POST /logout-all (authenticated via verifyToken) - locales: logoutAllSuccess (en/vi) - tests updated/added for verifyToken middleware, authRefreshToken, authLogoutAll Closes #74
…ndpoints (#73) GET /api/v1/{education|experience|award|certificate|project|reference} now accept optional `page`, `limit`, `sort` query params. Backward compatible by design: omitting `limit` returns the exact same response as before (`data` is the full, unpaginated array). Passing a valid `limit` switches `data` to `{ items, pagination: { page, limit, total, totalPages } }`. `limit` is capped at 100 regardless of what's requested. `sort` accepts a Mongoose sort expression (e.g. `-createdAt`) validated against an allowlist regex (no $, can't smuggle an operator); an invalid value is silently ignored rather than erroring. - services/index.ts: baseFindDocument gains page/limit/sort, applies .sort()/.skip()/.limit() + a parallel countDocuments() only when a valid limit is given - candidate_profile/BaseController.ts: baseGetAll parses page/limit/sort from req.query, validates sort against an allowlist - swagger.config.ts: shared PageParam/LimitParam/SortParam + Pagination schema - 6 CV-section routers (education/experience/award/certificate/project/ reference): wired the new query params into their GET / swagger docs. generalInformation excluded — its GET / returns a single per-candidate document, not a list, so pagination doesn't apply. - tests: baseFindDocument.test.ts, BaseController.test.ts Closes #73
- src/services/createDocx.ts (new): buildDocxContent()/renderDocxDocument()
content-model + renderer using the `docx` package; createCVDocx() packs
and streams the response with the correct OOXML content-type/filename.
- src/candidate_me/index.ts: fnExportPDF gains a `format === 'docx'` branch,
same shape/position as the existing `format === 'json'` branch, right
before the PDF fallback — reuses the same handlerGetAboutMe() call, no
duplicate data-fetch.
- src/routers/api/v1/index.ts: Swagger doc only — `/download-pdf`'s format
enum [pdf, json] -> [pdf, json, docx], added the docx response content
entry. No route/logic change.
- package.json/package-lock.json: added docx ^9.7.1 (MIT, no native deps).
- src/__tests__/services/createDocx.test.ts (new, 6 tests).
- agent-hub/haven/diagrams/dev-loop.prime-mermaid.md: add-docx-export-format
node PENDING -> SEALED.
npx tsc --noEmit: clean.
npm test: Test Suites: 11 passed, 11 total / Tests: 60 passed, 60 total /
Time: 4.611 s.
npm run build: clean.
Live-verified: GET /download-pdf?format=docx returns a real .docx (file(1)
confirms "Microsoft Word 2007+", document.xml contains the candidate's
real data); ?format=json and no-format (PDF) paths unaffected.
Node: add-docx-export-format (SEALED)
Evidence: agent-hub/evidence/implementer/2026-09-02/add-docx-export-format-{plan,diff}.md
agent-hub/evidence/verifier/2026-09-02/add-docx-export-format-seal.md
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
feat(candidate-me): add DOCX export format
feat(auth): add logout-all endpoint to revoke all sessions (#74)
feat(candidate_profile): add pagination and sort to CV section list endpoints (#73)
…ommand Patches the 2026-09-02 kit feature (hub_bytes_before/after + worker-runs.log logging) into pick_next.md/implement.md/verify_seal.md/evidence/README.md/ hub-tokens/SKILL.md — this hub was missing it entirely. Adds .claude/commands/browser-debugger.md (spec existed in agent-hub-init's kit/custom-commands/, wasn't generated here yet). Left untouched (flagged for operator decision, not auto-applied): - dev-loop.prime-mermaid.md is 19598B, over the 15KB /hub-tokens threshold — an archive pass is due but the diagram is a PROTECTED file, not something /sys edits on its own. - kit/custom-commands/release.md was NOT generated as .claude/commands/release.md — this project already has a more capable .claude/skills/release/SKILL.md (worktree-isolated build gate, real GitHub required_status_checks polling, first-release handling) that would collide with the generic spec under the same /release name. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0183N1xtARurw92SWfHL6cL9
chore(agent-hub): sync worker-runs.log tracking + /browser-debugger
/hub-tokens had flagged dev-loop.prime-mermaid.md at 19,598B, over the 15KB threshold. Moved the 4 remaining full-content SEALED rows (add-docx-export-format, agent-hub-token-cleanup-20260830, add-visit-tracking, fix-visit-model-missing-id — dated 2026-08-30 through 2026-09-02) verbatim into dev-loop-archive.md's new '3rd pass' section, replaced each with a compact pointer row — same convention as the file's own 1st/2nd archive passes. Nothing deleted, nothing reworded. Result: 19,598B -> 10,143B (-48%), comfortably back under the 15KB threshold. Every SEALED row is now a pointer; only the 10 PENDING nodes stay full-content (never archived, they're not SEALED yet). npm test: 13 suites / 77 tests passed. npm run build: tsc clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0183N1xtARurw92SWfHL6cL9
chore(agent-hub): archive pass 3 — dev-loop diagram 19.6KB -> 10.1KB
… sync Seals two nodes that had real, merged src/ code (PR #105, PR #106) but no diagram node or evidence note at the time: - add-logout-all-sessions (#74) - add-pagination-filtering-cv-sections (#73) Both verified independently via subagent (SEAL, zero src/ diff — pure documentation catch-up). Also carries forward pre-existing uncommitted changes: hub-tokens/SKILL.md's doctrine/domains/PROJECT.md threshold check, and the issues-ls command file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hdp892ahsFcZfmM5g2yDBA
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hdp892ahsFcZfmM5g2yDBA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
3bad45f chore(release): bump version to v1.3.0
6fd970f Merge pull request #110 from datvt243/chore/agent-hub-sync-20260905
22650b2 chore(agent-hub): backfill #74/#73 bookkeeping + hub-tokens/issues-ls sync
30a7644 Merge pull request #109 from datvt243/chore/archive-diagram-pass-3
1eecc71 chore(agent-hub): archive pass 3 — dev-loop diagram 19.6KB -> 10.1KB
d256e39 Merge pull request #108 from datvt243/chore/agent-hub-sync
5d92927 chore(agent-hub): sync worker-runs.log tracking + /browser-debugger command
33bade6 Merge pull request #106 from datvt243/feat/issue-73-pagination-filtering
4cde424 Merge pull request #105 from datvt243/feat/issue-74-logout-all-sessions
737f76c Merge pull request #107 from datvt243/feat/export-docx
2c6e071 feat(candidate-me): add DOCX export format
1133f1b feat(candidate_profile): add pagination and sort to CV section list endpoints (#73)
03bcb66 feat(auth): add logout-all endpoint to revoke all sessions (#74)
06a441a Merge pull request #104 from datvt243/chore/sync-verifier-rerun-scope
d7223d5 chore(agent-hub): tighten verifier re-run scope, drop stale NORTHSTAR read
62f126f Merge pull request #103 from datvt243/release/v1.2.1
Closes #74.
Closes #73.
Closes #76.