{"slug":"patterndesignlab","total":24,"limit":100,"offset":0,"since":null,"commits":[{"hash":"22fb969","date":"2026-07-22 21:03:59 -0700","author":"Steve","subject":"chore: lint+refactor hardening (open-redirect guard, image path containment, double-submit guard, adminUrl from SHOP), v0.2.0 (session close)","body":""},{"hash":"350abca","date":"2026-07-22 20:54:19 -0700","author":"Steve","subject":"pin cookie@0.7.2 explicitly (Kamatera npm pulled v1.x with changed exports; live deploy hardening: PDL_JWT_SECRET now set in prod .env)","body":""},{"hash":"29ef95e","date":"2026-07-22 20:52:31 -0700","author":"Steve","subject":"admin login (JWT cookie) + add-design-to-Shopify-as-DIG-item admin bar on design pages","body":""},{"hash":"1a53e09","date":"2026-07-06 16:10:58 -0700","author":"Steve","subject":"5x re-verify: app clean (0 real defects), B6 Firefox fixed via lsregister (real cause: LaunchServices not registered, not missing app); clickthrough red = harness artifact","body":""},{"hash":"4f27d5d","date":"2026-07-06 10:47:19 -0700","author":"Steve","subject":"5x: contrarian gate — correct overclaim, record 3 real defects found+fixed+verified","body":""},{"hash":"20e53ca","date":"2026-07-06 10:46:31 -0700","author":"Steve","subject":"fix: flush search box into state.q on every load() so typing + clicking a filter keeps the search text (contrarian: search desync)","body":""},{"hash":"2ae1f2e","date":"2026-07-06 10:45:10 -0700","author":"Steve","subject":"security: stop /api/designers/:slug leaking password_hash+email; require admin auth even under PUBLIC=1 (contrarian findings)","body":""},{"hash":"d5dbf02","date":"2026-07-06 10:23:03 -0700","author":"Steve","subject":"5x: verify security-hardened PDL — 2 clean sweeps, 0 real defects (B6=env, clickthrough=harness)","body":""},{"hash":"2e4f761","date":"2026-07-06 08:49:49 -0700","author":"Steve","subject":"security: harden designer auth + upload","body":"- fail-closed boot if PUBLIC=1 and PDL_JWT_SECRET is unset/dev-default (cookie-forgery/account-takeover risk)\n- cookie now Secure in PUBLIC mode (httpOnly+sameSite already present)\n- upload restricted to raster allowlist (png/jpg/webp/gif); SVG dropped (served same-origin -> stored-XSS vector); extension derived from mimetype not client filename; slug sanitized in stored filename\n- multer errors (size/type) return clean JSON instead of HTML stack trace"},{"hash":"a4e12d5","date":"2026-07-05 18:07:11 -0700","author":"Steve","subject":"designer accounts: bcrypt login + JWT cookie, self-edit endpoint, image upload (upload/URL/generated), patternbank-style profile with socials + share, login + dashboard pages","body":""},{"hash":"53f0f05","date":"2026-07-05 18:02:41 -0700","author":"Steve","subject":"designers: 15 studio personas + coherent balanced catalog split, auth schema, generated portraits","body":""},{"hash":"d92f3a8","date":"2026-07-04 15:02:35 -0700","author":"Steve","subject":"Go-live prep for prestige.agentabrams.com: vision-screen all, deploy config, DB dump, runbook","body":""},{"hash":"3708590","date":"2026-07-04 14:59:43 -0700","author":"Steve","subject":"Add .deploy.conf for prestige.agentabrams.com go-live","body":""},{"hash":"df1617f","date":"2026-07-04 13:40:23 -0700","author":"Steve","subject":"Exclude settlement vision_blocked/vision_review designs from storefront (designs/facets/detail/designer); surface status in admin for audit","body":""},{"hash":"7136fea","date":"2026-07-04 13:37:58 -0700","author":"Steve","subject":"Add settlement post-gen vision pass (Gemini 2.5-flash, one call/image, cost-ceiling + 429 hard-stop) and settlement_status columns","body":""},{"hash":"c2f385a","date":"2026-07-04 13:22:01 -0700","author":"steve","subject":"Pull 1451 owned credible masters from prod (chinoiserie/stripe/other + 10 curated), reseed local catalog to 1694 designs / 6.0% novelty","body":""},{"hash":"eeacf3d","date":"2026-07-04 13:06:18 -0700","author":"steve","subject":"Credible-first default storefront: lead page 1 with design-forward content, add Collection segment (Design-forward/Playful/All) + class filter + facet counts","body":""},{"hash":"76df8eb","date":"2026-07-04 13:01:27 -0700","author":"steve","subject":"iter-3: deepen credible catalog to 243, harden settlement screen, add pagination","body":"- build-catalog: credible-first ingestion (uncapped credible, capped novelty); wire in WallpapersBack fork generated/ image source (recovers master #138)\n- hardened settlement keyword screen: word-boundary, case-insensitive, checks title+tags+motifs+category; excluded 219 blocked motifs (birds/butterflies/bananas/grapes/palm/tropical)\n- catalog now 144 credible / 99 novelty (40.7% novelty, down from 58.3%)\n- /api/designs pagination: page/limit -> {designs,count,total,page,limit,hasMore}\n- index.html Load more button appends pages, keeps facets+sort+density intact"},{"hash":"dbfae51","date":"2026-07-04 11:38:01 -0700","author":"Steve","subject":"Fix contrarian findings: working detail-page search, sort+density on designer grid, density on admin grid","body":""},{"hash":"35e033e","date":"2026-07-04 11:29:31 -0700","author":"Steve","subject":"iter-2: trend boards, designer onboarding funnel, correct 1:1 design images (127), license terms on PDP","body":""},{"hash":"c083b5c","date":"2026-07-04 11:17:00 -0700","author":"Steve","subject":"refine style facet (stripe→Stripe not Coastal); favicon 204 to silence console 404","body":""},{"hash":"23e1fcf","date":"2026-07-04 11:14:25 -0700","author":"Steve","subject":"express server (search/facets/sort/checkout guard/admin) + marketplace, detail w/ tile-on-wall, designer, admin pages","body":""},{"hash":"989cb8c","date":"2026-07-04 11:11:19 -0700","author":"Steve","subject":"postgres schema + seed 38 owned designs across 3 designer profiles (facets derived locally, no paid AI)","body":""},{"hash":"00e1d49","date":"2026-07-04 11:08:44 -0700","author":"Steve","subject":"initial scaffold: gitignore, package.json, README, real seamless assets","body":""}]}