* main: (30 commits)
Update useragent to recognize twitterbot/facebot
Add defensive styles for non-square avatar images
Update test for copy changes
Missed commit
AI: standardize on https://agents.md
Make it clear this is just notifications, not comprehensive activity
AI: configure MCP servers for Chrome, Grafana, and Sentry (#1727)
Allow requests from Google Image Proxy
Update to basecamp's useragent fork
Clean up a little bit the CSRF reporting code
Claude: production observability guidance (#1725)
Prevent autoscroll to the root columns container to prevent jump on page load
Include full name string so you can type your name to filter
Prioritize current user and assigned users in assignment dropdown
Check and report on Sec-Fetch-Site header for forgery protection
bundle update
Bump bootsnap from 1.18.6 to 1.19.0
Bump rails from `077c3ad` to `17f6e00`
Fix cards getting stuck in edit mode
Don't report ConcurrentMigrationError to Sentry
...
This is a great, solid alternative to CSRF tokens for CSRF protection
when we aren't worried about older browsers or other kind of actors
doing modifying requests in our app, and could be a good test for future
upstreaming to Rails (although there we'd need to continue using CSRF
tokens or at least letting people opt out manually).
Let's start checking the header and reporting on it when CSRF fails or
when it doesn't match the other checks Rails does, and then promote this
to be the only way to defend from CSRF.
* main: (35 commits)
Replace the whole card on update
Include bottom inset on the modal and footer, too
Attempt to fix expanded search input
Lose the second close button
This seems to have caused the unwanted effect of not focusing the field in Mobile Safari
Always display the cancel button, `esc` isn't obvious
Nothing should cover the bar, trays or search results
Dark theme color isn't black
Add env constaints for mobile layout
Smaller on mobile
Reasonalbe max heights
Remove top orientation (it doesn't work well), make right and left classes exclusive
This is too fancy, remove it
Set reasonable maxes
Restore bubble to Maybe
Restore structured logging of `queenbee_id`
Add a kamal pre-build hook with some safety checks
Configure beta to use production blob store
Configure beta load balancer
Update beta deployment and secrets config
...
Usually, `<b>`, `<i>`, etc are enough but when you attempt a combo like
bold-italic, Lexxy applies two classes to a single element instead of
rendering tags like in the output
Instead of writer pinning, we'll track the last transaction ID of each
write in the session. Then on each read we'll wait for the replica to
report that this transaction is available.
If it doesn't become available within a reasonable timeout, we'll
proceed anyway, and accept the possibility of a stale read.
The hope here is that most of the time, the replica is caught up in the
time between a write request and the following read request. If it's
not, we now have a little tolerance to wait for it, which hopefully
proves enough to stale reads are not encountered in normal use.
We also disable the writer affinity opt-out mechanism that we had
before, since we will no longer be using writer affinity at the load
balancer.
Adrien Maston