* fix(den): validate TypeIDs in API schemas
Use the shared TypeID utility in den-api request and response schemas so invalid IDs are rejected consistently and Swagger documents the expected prefixes. Keep the API docs aligned with the live validation rules used by the app.
* docs(den): refine OpenAPI route visibility
Hide internal and sensitive Den routes from Swagger so the published docs stay focused on public workflows. Clarify route tags and permission descriptions so ownership and workspace-admin requirements are easier to understand.
---------
Co-authored-by: src-opn <src-opn@users.noreply.github.com>
Generate an OpenAPI spec and Swagger UI from den-api's existing Hono and zod validators so the API stays self-describing. Add route metadata, typed responses, and hide API key creation endpoints from production docs.
Co-authored-by: src-opn <src-opn@users.noreply.github.com>
* feat(den): add org API key auth and management
Let org owners and admins manage named API keys while keeping keys scoped to the issuing member and org. Reuse existing org middleware so API-key-backed requests behave like normal user actions across Den routes.
* fix(den): polish API key creation flow
Avoid duplicating the visible key prefix in the table preview and make key creation an explicit one-time reveal flow. Show the create form only after the user asks for a new key, then replace it with the copyable secret after issuance.
* fix(den): simplify API key table UI
Remove rate-limit details from the Den web API keys screen and keep the page focused on naming, reveal, and deletion. Leave the generated next-env types file out of the commit.
---------
Co-authored-by: src-opn <src-opn@users.noreply.github.com>
* feat(app): add React markdown and transcript parity
Render React session messages with a proper markdown stack, Solid-style user and assistant layouts, and structured tool-call cards so the React path matches the existing transcript experience more closely.
* feat(app): drive React sessions through useChat streaming
Move the React session path to a custom useChat transport backed by the existing OpenCode event stream so transcript state, sending, and streaming are owned by React instead of snapshot polling.
* fix(app): remount React session island per chat
Reset the React session surface when the workspace or session changes so an in-flight useChat stream from one chat cannot continue writing into another chat after a switch.
* fix(app): scope React stream deltas to one session
Reject message.part.delta updates that do not belong to the active session so concurrent OpenCode event streams cannot interleave transcript text across chats in the React session surface.
* fix(app): cache React transcript state per session
Persist streamed UI messages in TanStack query cache per workspace/session so revisiting a running chat shows the last known partial transcript instead of starting empty on remount.
* feat(app): keep React session state in shared sync cache
Move React session transcript ownership out of the mounted chat view by sharing one query client across islands and applying workspace event updates into per-session query cache, mirroring the global sync pattern used by OpenCode.
* fix(app): keep React session sync alive across chat switches
Mount the workspace-scoped React session sync above the per-chat session island so switching chats no longer tears down the event subscription that keeps transcript state updating in the background.
* Revert "fix(app): keep React session sync alive across chat switches"
This reverts commit 15f37a09c1.
* Revert "feat(app): keep React session state in shared sync cache"
This reverts commit 49df59d6ef.
* fix(app): keep React session streams alive across switches
Move React session streaming state into a shared app-level runtime backed by one query client and a workspace-scoped event sync reducer so leaving and returning to a running session restores the current transcript instead of showing an empty pane or leaking between chats.
* fix(app): preserve beginning of streamed text across session switches
Create text parts on first delta arrival instead of silently dropping deltas that arrive before the part shell exists, and ensure the message shell is present before appending any delta. This fixes the bug where switching away from a streaming session and coming back would show only later lines, missing the beginning of the response.
* fix(app): preserve streamed text when re-selecting a busy session
When switching back to a session that is still streaming, the server snapshot returns empty text for in-progress parts. The reconcile call in selectSession was overwriting the locally accumulated text with that empty snapshot. Now both the Solid and React paths preserve the longer local text when the session status is busy.
* feat(server): add workspace session read APIs
Expose workspace-scoped session list, detail, message, and snapshot reads so the client can fetch session data without depending on activation choreography.
* feat(app): route mounted session reads through OpenWork APIs
Use the new workspace-scoped session read endpoints for mounted OpenWork clients so the current frontend stops depending on direct session proxy reads for list, detail, message, and todo loading.
* feat(app): add React read-only session transcript
Introduce a feature-gated React island for the session transcript so we can replace the session surface incrementally while keeping the Solid shell intact.
* feat(app): add React session composer surface
Extend the feature-gated React session island to own its draft, prompt send, stop flow, and snapshot polling so the session body can evolve independently from the Solid composer.
* feat(app): add React session transition model
Keep the React session surface stable during session switches by tracking rendered vs intended session state and exposing a developer debug panel for render-source and transition inspection.
* docs(prd): add React migration plan to repo
Copy the incremental React adoption PRD into the OpenWork repo so the migration plan lives next to the implementation and PR branch.
* docs(prd): sync full React migration plan
Replace the shortened repo copy with the full incremental React adoption PRD so the implementation branch and product plan stay in sync.
* feat(desktop): add React session launch modes
Add dedicated Tauri dev and debug-build entrypoints for the React session path and honor a build-time React session flag before local storage so the alternate shell is easy to launch and reproduce.
* fix(app): fall back to legacy mounted session reads
Keep the new app working against older OpenWork servers by falling back to the original mounted OpenCode session reads when the workspace-scoped session read APIs are unavailable.
Updated dependencies to fix Next.js and React CVE vulnerabilities.
The fix-react2shell-next tool automatically updated the following packages to their secure versions:
- next
- react-server-dom-webpack
- react-server-dom-parcel
- react-server-dom-turbopack
All package.json files have been scanned and vulnerable versions have been patched to the correct fixed versions based on the official React advisory.
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
- Add solid-devtools Vite plugin with locator (jsx/component locations) and
@solid-devtools/overlay, loaded before render in dev only.
- Treat baseline message fetch as complete for empty transcripts so
ensureSessionLoaded does not refetch on every prefetch/subagent ensure.
- When streaming delivers the first rows while non-idle, sync the batched
message list immediately so the blueprint empty state does not flash.
Made-with: Cursor
* fix(den): parse skill frontmatter when saving skills
Keep the full SKILL.md payload in the database, derive title and description from frontmatter, and require a frontmatter name in the API. Also include shared packages in the Den web Docker image so the upload flow can be verified end to end.
* fix(den-web): transpile shared utils package
Include @openwork-ee/utils in Next's transpilePackages list so the client skill editor resolves the shared frontmatter helpers during production builds.
* fix(den-web): keep skill parsing local to the app
Move the client-side skill markdown parser into the Den web app so production builds do not depend on resolving a workspace package boundary from a client component.
* refactor(den): share skill frontmatter parsing via utils
Make Den web and Den API both depend on @openwork-ee/utils for skill frontmatter parsing, refresh the workspace lockfile, and keep the Den web build wiring explicit for CI and Docker.
* fix(den-web): build Den from the monorepo root on Vercel
Keep the shared utils package setup, but make Vercel install and build from the repo root so workspace dependencies like @openwork-ee/utils are always available when Den web deploys from its app subdirectory.
* docs(den-web): keep Vercel workspace settings in the dashboard
Remove the app-level Vercel command override from the repo and document the monorepo install/build settings for the dashboard instead.
---------
Co-authored-by: src-opn <src-opn@users.noreply.github.com>
* feat(ui): add shared seeded paper gradients
Centralize the Paper mesh and grain wrappers so React and Solid apps can reuse the same deterministic seed-based visuals without repeating shader config. Add a standalone demo surface and update existing consumers so the shared package is easier to validate and evolve.
* fix(ui): resolve shared package from source
Point the shared UI package exports at source files so Next builds do not depend on a prebuilt dist directory. Add Next transpilation for @openwork/ui in Landing and Den Web so monorepo and Vercel builds resolve the package consistently.
---------
Co-authored-by: src-opn <src-opn@users.noreply.github.com>
Break assistant text into stable blocks so streaming stays responsive and tool-created files surface as openable transcript cards instead of getting buried in prose.
Break the Den DB schema into domain entrypoints and switch EE package builds to tsup so workspace development can resolve TypeScript sources directly without typeid proxy shims.
Co-authored-by: src-opn <src-opn@users.noreply.github.com>
Run Den controller, web, and worker proxy through a root dev:den-local workflow backed by Turbo and auto-managed local MySQL. Restore the background agents tab to show real sandboxes, add manual sandbox creation, stop auto-launching sandboxes on signup, and move Billing lower in the sidebar.
Co-authored-by: src-opn <src-opn@users.noreply.github.com>
* Add Den org auth model and template APIs
Wire Better Auth organizations with TypeId-backed schema and migrations, enforce owner/admin org permissions, and add org-scoped template create/list/delete endpoints. Simplify the Den org dashboard UX and update Docker dev packaging paths for the ee apps/packages layout.
* Add manual-safe org migration SQL
Provide a Vitess-compatible version of the organization migration without statement-breakpoint markers or unsupported IF NOT EXISTS column syntax so operators can run it directly in SQL consoles.
---------
Co-authored-by: src-opn <src-opn@users.noreply.github.com>
* feat(ui): add story-book playground app for mocked UI development
* refactor(ui): slim story-book down to a thin wrapper
* feat(ui): add mocked story-book design gallery
* refactor(story-book): use real session shell panels
