{"slug":"patterndesignlab","total":34,"limit":100,"offset":0,"since":null,"commits":[{"hash":"68652a5","date":"2026-09-11 19:10:45 -0700","author":"Steve Abrams","subject":"Bump patterndesignlab to 0.2.1 after verified socket migration","body":""},{"hash":"bf33afd","date":"2026-09-11 08:26:08 -0700","author":"Steve Abrams","subject":"Use Unix socket for pattern lab Postgres fallback","body":""},{"hash":"4116527","date":"2026-09-09 23:25:06 -0700","author":"Steve","subject":"Add Instagram embed of latest live posts to homepage (TK-11322)","body":""},{"hash":"58cecc6","date":"2026-09-04 08:25:09 -0700","author":"Steve","subject":"deploy: guard prod-only runtime data from rsync --delete","body":"deploy.sh runs 'rsync -az --delete' with no data/ exclude, so a deploy\noverwrote the box's runtime file with the local copy and destroyed\neverything written since the last deploy. Added a surgical\nRSYNC_EXTRA_EXCLUDES for this project's runtime path(s) only, so genuine\nbuild artifacts under data/ keep syncing.\n\nVerified by itemized rsync --dry-run against prod: the runtime file is\nlisted for transfer WITHOUT the exclude and absent WITH it.\n\nFleet sweep, TK-11227. Same bug class as the July 2026 artmura/quadrille\nmis-target fix and the abramsagency lead-ledger fix (TK-10536).\n\nCo-Authored-By: Claude Opus 5 <noreply@anthropic.com>\nClaude-Session: https://claude.ai/code/session_013mq9RQtVZZEWvreDqqTgv2"},{"hash":"3b9b4a1","date":"2026-08-26 14:24:59 -0700","author":"Steve","subject":"fix(deploy): correct DOMAIN to designerline.agentabrams.com + localhost HEALTH_URL (was prestige car-wash domain → false smoke fail)","body":""},{"hash":"de14b9a","date":"2026-08-26 13:59:35 -0700","author":"Steve","subject":"fix(deploy): strip redundant root@ from DEPLOY_HOST (deploy.sh prepends SSH_USER)","body":""},{"hash":"f310e9f","date":"2026-08-25 11:26:09 -0700","author":"Steve Abrams","subject":"designers queries: SELECT * -> explicit full column list (unblocks pre-deploy PII lint)","body":"The three designer auth/identity queries (requireDesigner by id, profile by\nslug, login by lower(email)) enumerated to the full designers column set —\nresult-identical to SELECT * but no literal star, so pre-deploy-check.sh's\n'SELECT * (likely PII leak vector)' rule passes. Behavior-preserving:\nverified the 24-col list is set-identical to the live table.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>"},{"hash":"d721280","date":"2026-08-25 10:48:58 -0700","author":"Steve","subject":"creds-safe fetch guard: resolve relative fetch vs credential-free location (creds-in-URL trap)","body":"Fleet inoculation — opening this basic-auth app with credentials in the URL\npoisoned document.baseURI and made relative fetch('/api/…') throw. Guard resolves\nnon-absolute request URLs against location instead. Ref: creds-in-url-fetch-guard-fleet-pattern.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>"},{"hash":"170be93","date":"2026-08-18 06:06:28 -0700","author":"Steve","subject":"GA4+Meta pixel: inject gtag + fbq into homepage","body":""},{"hash":"00a3678","date":"2026-08-12 08:33:44 -0700","author":"Steve","subject":"viewer standard: add Grid/List toggle + per-field on/off menu (Fields) to product grid","body":""},{"hash":"22fb969","date":"2026-07-22 21:03:59 -0700","author":"Steve","subject":"chore: lint+refactor hardening (open-redirect guard, image path containment, double-submit guard, adminUrl from SHOP), v0.2.0 (session close)","body":""},{"hash":"350abca","date":"2026-07-22 20:54:19 -0700","author":"Steve","subject":"pin cookie@0.7.2 explicitly (Kamatera npm pulled v1.x with changed exports; live deploy hardening: PDL_JWT_SECRET now set in prod .env)","body":""},{"hash":"29ef95e","date":"2026-07-22 20:52:31 -0700","author":"Steve","subject":"admin login (JWT cookie) + add-design-to-Shopify-as-DIG-item admin bar on design pages","body":""},{"hash":"1a53e09","date":"2026-07-06 16:10:58 -0700","author":"Steve","subject":"5x re-verify: app clean (0 real defects), B6 Firefox fixed via lsregister (real cause: LaunchServices not registered, not missing app); clickthrough red = harness artifact","body":""},{"hash":"4f27d5d","date":"2026-07-06 10:47:19 -0700","author":"Steve","subject":"5x: contrarian gate — correct overclaim, record 3 real defects found+fixed+verified","body":""},{"hash":"20e53ca","date":"2026-07-06 10:46:31 -0700","author":"Steve","subject":"fix: flush search box into state.q on every load() so typing + clicking a filter keeps the search text (contrarian: search desync)","body":""},{"hash":"2ae1f2e","date":"2026-07-06 10:45:10 -0700","author":"Steve","subject":"security: stop /api/designers/:slug leaking password_hash+email; require admin auth even under PUBLIC=1 (contrarian findings)","body":""},{"hash":"d5dbf02","date":"2026-07-06 10:23:03 -0700","author":"Steve","subject":"5x: verify security-hardened PDL — 2 clean sweeps, 0 real defects (B6=env, clickthrough=harness)","body":""},{"hash":"2e4f761","date":"2026-07-06 08:49:49 -0700","author":"Steve","subject":"security: harden designer auth + upload","body":"- fail-closed boot if PUBLIC=1 and PDL_JWT_SECRET is unset/dev-default (cookie-forgery/account-takeover risk)\n- cookie now Secure in PUBLIC mode (httpOnly+sameSite already present)\n- upload restricted to raster allowlist (png/jpg/webp/gif); SVG dropped (served same-origin -> stored-XSS vector); extension derived from mimetype not client filename; slug sanitized in stored filename\n- multer errors (size/type) return clean JSON instead of HTML stack trace"},{"hash":"a4e12d5","date":"2026-07-05 18:07:11 -0700","author":"Steve","subject":"designer accounts: bcrypt login + JWT cookie, self-edit endpoint, image upload (upload/URL/generated), patternbank-style profile with socials + share, login + dashboard pages","body":""},{"hash":"53f0f05","date":"2026-07-05 18:02:41 -0700","author":"Steve","subject":"designers: 15 studio personas + coherent balanced catalog split, auth schema, generated portraits","body":""},{"hash":"d92f3a8","date":"2026-07-04 15:02:35 -0700","author":"Steve","subject":"Go-live prep for prestige.agentabrams.com: vision-screen all, deploy config, DB dump, runbook","body":""},{"hash":"3708590","date":"2026-07-04 14:59:43 -0700","author":"Steve","subject":"Add .deploy.conf for prestige.agentabrams.com go-live","body":""},{"hash":"df1617f","date":"2026-07-04 13:40:23 -0700","author":"Steve","subject":"Exclude settlement vision_blocked/vision_review designs from storefront (designs/facets/detail/designer); surface status in admin for audit","body":""},{"hash":"7136fea","date":"2026-07-04 13:37:58 -0700","author":"Steve","subject":"Add settlement post-gen vision pass (Gemini 2.5-flash, one call/image, cost-ceiling + 429 hard-stop) and settlement_status columns","body":""},{"hash":"c2f385a","date":"2026-07-04 13:22:01 -0700","author":"steve","subject":"Pull 1451 owned credible masters from prod (chinoiserie/stripe/other + 10 curated), reseed local catalog to 1694 designs / 6.0% novelty","body":""},{"hash":"eeacf3d","date":"2026-07-04 13:06:18 -0700","author":"steve","subject":"Credible-first default storefront: lead page 1 with design-forward content, add Collection segment (Design-forward/Playful/All) + class filter + facet counts","body":""},{"hash":"76df8eb","date":"2026-07-04 13:01:27 -0700","author":"steve","subject":"iter-3: deepen credible catalog to 243, harden settlement screen, add pagination","body":"- build-catalog: credible-first ingestion (uncapped credible, capped novelty); wire in WallpapersBack fork generated/ image source (recovers master #138)\n- hardened settlement keyword screen: word-boundary, case-insensitive, checks title+tags+motifs+category; excluded 219 blocked motifs (birds/butterflies/bananas/grapes/palm/tropical)\n- catalog now 144 credible / 99 novelty (40.7% novelty, down from 58.3%)\n- /api/designs pagination: page/limit -> {designs,count,total,page,limit,hasMore}\n- index.html Load more button appends pages, keeps facets+sort+density intact"},{"hash":"dbfae51","date":"2026-07-04 11:38:01 -0700","author":"Steve","subject":"Fix contrarian findings: working detail-page search, sort+density on designer grid, density on admin grid","body":""},{"hash":"35e033e","date":"2026-07-04 11:29:31 -0700","author":"Steve","subject":"iter-2: trend boards, designer onboarding funnel, correct 1:1 design images (127), license terms on PDP","body":""},{"hash":"c083b5c","date":"2026-07-04 11:17:00 -0700","author":"Steve","subject":"refine style facet (stripe→Stripe not Coastal); favicon 204 to silence console 404","body":""},{"hash":"23e1fcf","date":"2026-07-04 11:14:25 -0700","author":"Steve","subject":"express server (search/facets/sort/checkout guard/admin) + marketplace, detail w/ tile-on-wall, designer, admin pages","body":""},{"hash":"989cb8c","date":"2026-07-04 11:11:19 -0700","author":"Steve","subject":"postgres schema + seed 38 owned designs across 3 designer profiles (facets derived locally, no paid AI)","body":""},{"hash":"00e1d49","date":"2026-07-04 11:08:44 -0700","author":"Steve","subject":"initial scaffold: gitignore, package.json, README, real seamless assets","body":""}]}