Phase 5 closed: /admin a11y test reactivated and clean, top-10
friction audit filed at docs/audit/v15-ux-friction.md, three v1.4.6
deferred items shipped (trend-arrow metric-aware, remove saved AI
key, semantic mood/feedback tokens), plus two inline friction fixes
(dashboard quick-add disambiguation, /admin nav landmark).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Result: 41/41 active specs green locally (Node 22, fresh DB);
3 skipped — the mobile-only viewport spec on the desktop project
(× 2) and the /admin a11y test parked as test.fixme until Phase 4b
ships.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Captured Playwright+PerformanceObserver perf metrics against prod
(/api/version=1.4.13) at 2026-05-09T14:14Z. Top 2 wins shipped
inline (Recharts deferred-import on /insights, checklist queries
gated on post-onboarding state); Recharts replacement deferred to
v1.5.1 because v1.5 forbids new deps.
Wins: bb2b1de + 519e36e. Audit doc: 41fa203.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Picks up the prettier line-wraps the v1.5 phase-1 planning docs and
codex-protocol-spec.md missed, and brings the redact.ts + insights
generate route test into the project's standard form. No behaviour
change — pnpm format:check now passes clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Default model slug fix (gpt-5 → gpt-5.3-codex) on commit 5df74f7
makes the chatgpt.com backend accept HealthLog's Codex requests on
Marc's ChatGPT-Plus account; spec §7a updated.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reset .planning/STATE.md and .planning/ROADMAP.md for the v1.5
overnight marathon. STATE.md tracks 12 phases (0–11) with empty
checkboxes; phase 0 marked done. Capture phase-0 sanity report at
.planning/phase-0-report.md (git status clean, recent commits, CI
status, /api/version=1.4.12 — one tag behind HEAD because the
v1.4.13 GHCR build is still in_progress; phase 1 owns the force-pull
verification). ROADMAP.md condenses the 12-phase plan with the
time-runs-short minimum (1+2+7+8) for shipping v1.5.0.
Previous milestone (v1.4.6) summary preserved as a one-line link to
docs/audit/v146-summary.md at the top of STATE.md.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The "Connect with ChatGPT" button never actually completed an OAuth
flow. The implementation hit `chatgpt.com/authorize` and
`chatgpt.com/oauth/token`, which are not OAuth endpoints — ChatGPT
silently rendered its normal web app, dropped our params on the
floor, and the user landed on a regular logged-in chat session with
nothing else happening. There was no error and no callback, which is
why the regression survived multiple releases.
The canonical issuer for ChatGPT-OAuth is `auth.openai.com`. The
official `openai/codex` CLI confirms this in
`codex-rs/login/src/auth/manager.rs` and `codex-rs/login/src/server.rs`.
The flow is also slightly more involved than a vanilla PKCE
authorisation:
1. PKCE authorize against `auth.openai.com/oauth/authorize` with the
`openid profile email offline_access api.connectors.read
api.connectors.invoke` scope set, plus `id_token_add_organizations`
and `codex_cli_simplified_flow` flags so the resulting `id_token`
carries the ChatGPT-subscription claims.
2. Token exchange against `auth.openai.com/oauth/token` (form-
urlencoded body, NOT JSON) yields `{ id_token, access_token,
refresh_token }`.
3. **Second token exchange** with grant
`urn:ietf:params:oauth:grant-type:token-exchange`, swapping the
`id_token` for an OpenAI API key (`requested_token=openai-api-key`).
This key bills against the ChatGPT subscription rather than a
separate API plan — exactly what the v1.2/v1.3 design intended.
4. HealthLog stores the API key in `codexAccessTokenEncrypted`
(re-purposing the existing column to avoid a migration) and the
OAuth refresh token in `codexRefreshTokenEncrypted`. When the
key is about to age out we refresh + re-exchange transparently
before the next request.
The downstream provider is now a regular `OpenAIClient` tagged with
`providerType: "codex"` so logs and analytics still distinguish
ChatGPT-subscription billing from plain BYOK. The bespoke
`codex-client.ts` (which hit the chatgpt.com/backend-api/codex/responses
endpoint with the OAuth access token) is still on disk for now so the
prisma columns and the provider tag stay stable, but is unreferenced
by the active path.
The public Codex CLI client ID `app_EMoamEEZ73f0CkXaXp7hrann` is
shipped as a default; operators who registered a private OAuth app
with OpenAI can override via `CODEX_OAUTH_CLIENT_ID`. The
`isCodexOAuthConfigured()` gate is a no-op now because the default
always has a value, so the UI surface no longer silently hides the
"Connect with ChatGPT" button.
Tests cover the new shape end-to-end: PKCE generation, the
authorize-URL parameters, the form-encoded token exchange, the
api-key exchange, the refresh path, and the encrypt/decrypt
round-trip. The provider integration test is updated to expect a
`providerType: "codex"` OpenAIClient instead of the legacy
`CodexClient`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Marc-facing morning brief at the top, full per-finding list,
deferred-to-v1.5 backlog, production state, docs/landing sync log,
and the multi-agent QA reconciliation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Long-overdue prettier sweep; prettier had drifted vs. checked-in code
across ~130 files (mostly long-argument line-break wrapping in TS and
table-padding in markdown). Pure formatting — no semantic changes —
and required to clear the v1.4.6 release gate's `pnpm format:check`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add .planning state files and check in the v1.4.6 findings spec so
the workstream and the source-of-truth audit live in git from here on.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
