feat: svelte xP

[szymeo]

Latest (this push) — dbc67dda

Slide-to-confirm handle alignment

• Centered the slide-to-confirm handle on the track by replacing vertical transform centering with an explicit top offset and horizontal-only drag transform.
• Verified apps/web with pnpm check and pnpm build.

No ticket number provided.

---

Previous — 1a2bf457

.gitignore — local agent tool directories

• Add .claude/ and .codex/ at the repo root so local-only agent directories are not committed.

No ticket number provided.

---

Previous — a24d772

Shared agent command configuration

• Added shared .agents/commands entries for PR babysitting, commit/push workflow, skill creation, multibuild execution, and stress-testing plans.
• Linked .opencode/commands and .opencode/skills to the shared command and skill directories.
• Replaced the old standalone .codex/commands/cm.md with the shared cm command. Local .claude / .codex trees are not part of the repository (use .gitignore for per-machine tooling).

No ticket number provided.

---

Previous — 0d7fe4a

Svelte migration parity — backend analytics, device-flow, invites, unsaved guard

• Backend PostHog — ProductAnalyticsService + global module; logged_in / identify on OAuth, local, CLI poll, refresh; project_created, secrets_saved, integration_created, installation_created; secrets_pushed via POST projects/:projectId/analytics/secrets-pushed (client ack after GitHub secret push).
• Web — Removed posthog-js and client captures; device-flow modules + UnlockBrowserDialog connected devices + approver dialog in layout.
• Members — Pending link + personal invitations with revoke (admin APIs).
• Editor — Unsaved navigation guard (beforeNavigate, beforeunload, Save & continue / Discard / Keep editing).
• QA — apps/web/e2e/MOBILE_QA_CHECKLIST.md.
• Tests — Bootstrap imports PosthogAnalyticsModule.

No ticket number provided.

---

Earlier — 895153c

CLI browser authorization on Svelte (pre-cutover parity with React)

• /app/cli-authorize — New route and CliAuthorizePage: loads pending session via auth/cli-flow API, passphrase unwrap + envelope encryption, approve POST. Same crypto patterns as the legacy React page; no server-side secrets.
• Return-through-login — cli-authorize-return.ts stores an allowlisted path (/app/cli-authorize?session=<32-hex public id>) in sessionStorage before redirecting unauthenticated users to login. gotoAfterLogin consumes it after invite (localStorage) so OAuth in the same tab returns to the approve screen. Open-redirect safe path allowlist.
• Cleanup — Removed unused apps/web/src/lib/device-flow/ placeholder tree.
• QA / parity — Visual parity spec adds /app/cli-authorize and /app/project (logged-out shell); apps/web/e2e/MANUAL_SMOKE.md for behavioral checks.
• Docs / env — docs/web-app-cutover-runbook.md (flip, rollback, WEB_APP_URL, retiring frontend/). README calls out SvelteKit + runbook. backend/.env.example and dev EnvConfigs.webAppUrl default to 9090 for local Svelte + CLI links.
• CI — .github/workflows/web-ci.yml runs pnpm --filter web check and pnpm --filter web build on relevant path changes.

No ticket number provided.

---

Earlier — da1ebe2

apps/web project flows (parity with main app behavior)

• loadUserData() now returns boolean so UIs can tell if /users/me succeeded before relying on userData / publicKey.
• Default PUBLIC_APP_URL when unset: http://127.0.0.1:9090 (matches vite dev --port 9090), not 5173.
• ProjectsApi: getProject, updateProjectContent (PATCH encrypted secrets) — same as the React client.
• ProjectsPage: load profile, then project list; profile error + Retry; empty state shows passphrase/setup hint if no publicKey; create errors surfaced (no silent failure).
• SecretsEditorPage: loads project from API, decrypts with keystore + master key (same path as projectLogic in frontend); debounced auto-save; explicit Save + ⌘S; states for locked browser, 404 (redirect to /app/project), read-only member.

---

Earlier — Cloudflare / CI

Cloudflare / CI build fixes

• daisyui — Added as a web devDependency and lockfile entry so Tailwind can resolve @plugin "daisyui" in app.css (fixes Can't resolve 'daisyui' on Cloudflare).
• Node — Root and apps/web engines.node (>=20.19.0) plus .nvmrc / apps/web/.nvmrc (22) so Pages uses a compatible Node for Vite 7.
• Wrangler — compatibility_flags now includes nodejs_als (SvelteKit) alongside nodejs_compat.

Tracked missing module

• apps/web/src/lib/auth/after-login.ts committed so CI can resolve imports from AcceptInvitationPage et al.

Ops note

Align PNPM_VERSION in Cloudflare with the repo (packageManager / lockfile). Consider turning off SKIP_DEPENDENCY_INSTALL unless you rely on a custom install only in the build command.