* refactor(repo): move OpenWork apps into apps and ee layout
Rebase the monorepo layout migration onto the latest dev changes so the moved app, desktop, share, and cloud surfaces keep working from their new paths. Carry the latest deeplink, token persistence, build, Vercel, and docs updates forward to avoid stale references and broken deploy tooling.
* chore(repo): drop generated desktop artifacts
Ignore the moved Tauri target and sidecar paths so local cargo checks do not pollute the branch. Remove the accidentally committed outputs from the repo while keeping the layout migration intact.
* fix(release): drop built server cli artifact
Stop tracking the locally built apps/server/cli binary so generated server outputs do not leak into commits. Also update the release workflow to check the published scoped package name for @openwork/server before deciding whether npm publish is needed.
* fix(workspace): add stable CLI bin wrappers
Point the server and router package bins at committed wrapper scripts so workspace installs can create shims before dist outputs exist. Keep the wrappers compatible with built binaries and source checkouts to avoid Vercel install warnings without changing runtime behavior.
* feat(den): add daytona-backed docker dev flow
* fix(den): allow multiple cloud workers in dev
* fix(den): use Daytona snapshots for sandbox runtime
Use a prebuilt Daytona snapshot for the dev worker runtime so sandboxes start with openwork and opencode already installed. Pass the snapshot through the local Docker flow and add a helper to build the snapshot image for repeatable setup.
* chore(den): lower Daytona snapshot defaults
Reduce the default snapshot footprint to 1 CPU and 2GB RAM so local Daytona worker testing fits smaller org limits more easily.
* Omar is comfortable
Make Daytona-backed cloud workers stable enough to reconnect through a dedicated proxy instead of persisting expiring signed preview URLs. Split the proxy into its own deployable service, share Den schema access through a common package, and fix the web badge so healthy workers show ready.
* chore(den-db): add Drizzle package scripts
Move the shared schema package toward owning its own migration workflow by adding generate and migrate commands plus a local Drizzle config.
* chore: update lockfile
Refresh the workspace lockfile so the new den-db Drizzle tooling is captured in pnpm-lock.yaml.
* feat(den-worker-proxy): make Vercel deployment-ready
Align the proxy service with Vercel's Hono runtime entry pattern and keep a separate Node server entry for Docker/local runs. Also scaffold the Vercel project/env setup and wire Render deploy sync to pass Daytona variables needed for daytona mode.
* feat(den-db): add db mode switch for PlanetScale
Support DB_MODE=planetscale with Drizzle's PlanetScale serverless driver while keeping mysql2 as the local default. This lets Vercel-hosted services use HTTP database access without changing local development workflows.
* refactor(den-db): adopt shared TypeID ids
Move the Den TypeID system into a shared utils package and use it across auth, org, worker, and sandbox records so fresh databases get one consistent internal ID format. Wire Better Auth into the same generator and update Den request boundaries to normalize typed ids cleanly.
* fix(den): restore docker dev stack after refactor
Include the shared utils package in the Den Docker images, expose MySQL to the host for local inspection, and fix the remaining Den build/runtime issues surfaced by the Docker path after the shared package and TypeID changes.
* docs(den): document Daytona snapshot setup
Add README guidance for building and publishing the prebuilt Daytona runtime snapshot, including the helper script, required env, and how to point Den at the snapshot for local Daytona mode.
* refactor(den-db): reset migrations and load env files
Replace the old Den SQL migration history with a fresh baseline for the current schema, and let Drizzle commands load database credentials from env files. Default to mysql when DATABASE_URL is present and otherwise use PlanetScale credentials so local Docker and hosted environments can share the same DB package cleanly.
* fix(den): prepare manual PlanetScale deploys
Update the Render workflow and Docker build path for the shared workspace packages, support PlanetScale credentials in the manual SQL migration runner, and stop auto-running DB migrations on Den startup so schema changes stay manual.
* feat(den-v2): add Daytona-first control plane
Create a new den-v2 service from the current Daytona-enabled control plane, default it to Daytona provisioning, and add a dedicated Render deployment workflow targeting the new v2 Render service.
* feat(den-worker-proxy): redirect root to landing
Send root proxy traffic to openworklabs.com so direct visits to the worker proxy domain do not hit worker-resolution errors.
---------
Co-authored-by: OmarMcAdam <gh@mcadam.io>
Use the configured larger-runner label for both Linux release matrix targets so x86_64 and aarch64 builds share the same faster GitHub-hosted runner path and logging.
Allow release and desktop workflows to target the new GitHub-hosted larger runner without hard-coding it, while keeping ubuntu-22.04 as a fallback and logging the effective runner selection.
* feat(den): add google auth provider
* feat(web): add social signup buttons for den
---------
Co-authored-by: jcllobet <jcllobet@users.noreply.github.com>
The triage-issue job interpolated $ISSUE_TITLE and $ISSUE_BODY unquoted
inside a double-quoted shell string, allowing any GitHub user to execute
arbitrary commands by opening an issue with shell metacharacters.
The duplicate-prs job similarly interpolated $COMMENT unquoted into a
gh pr comment --body argument.
Fix both by using printf with %s (prevents shell interpretation) and
--body-file (avoids inline interpolation entirely).
Co-authored-by: xj <gh-xj@users.noreply.github.com>
* fix(session): improve local file-open fallback and diagnostics
* fix(session): normalize file URI local path resolution
* test(session): cover file URI normalization edge cases
* test(app): include local file-path regression in e2e flow
* fix(ci): run app e2e script and normalize file:/ URIs
* test(app): run local file-path regression without bun
---------
Co-authored-by: xj <gh-xj@users.noreply.github.com>
