chore: add .gitattributes to normalize line endings to LF

.beads/issues.jsonl

@@ -214,6 +214,7 @@
 {"_type":"issue","id":"foreman-c9y","title":"Set up LibSQL + Drizzle ORM","description":"Single LibSQL database for app + Mastra data. Migrations runnable via script. AC: npm run db:migrate creates BetterAuth tables. Connection string in .env.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-17T18:25:48Z","created_by":"HamChowderr","updated_at":"2026-04-17T18:28:37Z","closed_at":"2026-04-17T18:28:37Z","close_reason":"Completed in Phase 1 and Phase 2 (T1-T31 done)","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-s46","title":"Install and configure BetterAuth","description":"Email/password auth. Session stored in LibSQL. AC: /sign-up and /sign-in pages work. Authenticated session persists across reloads.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-17T18:25:46Z","created_by":"HamChowderr","updated_at":"2026-04-17T18:28:37Z","closed_at":"2026-04-17T18:28:37Z","close_reason":"Completed in Phase 1 and Phase 2 (T1-T31 done)","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-5ld","title":"Initialize Next.js 15 project","description":"Scaffold Next.js 15 with App Router, TypeScript, Tailwind. AC: npm run dev serves a blank page at /. Project committed to git under C:\\Users\\HamCh\\code\\foreman.","status":"closed","priority":2,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-04-17T18:25:38Z","created_by":"HamChowderr","updated_at":"2026-04-17T18:28:37Z","closed_at":"2026-04-17T18:28:37Z","close_reason":"Completed in Phase 1 and Phase 2 (T1-T31 done)","dependency_count":0,"dependent_count":0,"comment_count":0}
+{"_type":"issue","id":"foreman-hflh","title":"Add .gitattributes to normalize line endings (kill CRLF phantom diffs)","description":"Repo has no .gitattributes; on Windows (autocrlf=true) the working tree is CRLF while git stores LF, producing ~170 phantom modified files each session and blocking clean fast-forwards. Add .gitattributes '* text=auto eol=lf' (+ binary markers).","status":"open","priority":3,"issue_type":"chore","owner":"admin@otakusolutions.io","created_at":"2026-06-12T19:11:26Z","created_by":"HamChowderr","updated_at":"2026-06-12T19:11:26Z","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-c8fo","title":"[zapier] Poll-trigger connection resolution: normalizeAppKey + numeric-id/alias vs SDK uuid mismatch","description":"Live e2e (foreman-ueep) surfaced this. A poll trigger config storing a raw Zapier app_key (e.g. 'GitHubCLIAPI') fails the real read: runAction does normalizeAppKey('GitHubCLIAPI')='github', then auto-discover findFirstConnection({app:'github'}) does NOT match the connection whose app_key is 'GitHubCLIAPI' -\u003e no connection -\u003e 'access_token missing'. Separately, resolveConnection expects a numeric connection_id or a registered connection_alias, but sdk.findFirstConnection returns a UUID id (e.g. 0206dbe8-...), so passing that id as config.connection throws 'Unknown connection alias'. Net: for a poll trigger to read for real, the app key must be the normalized form AND the user's connection must be discoverable/aliased under it. CONFIRMED WORKING in isolation: sdk.runAction({app:'GitHubCLIAPI', connection:'\u003cuuid\u003e'}) returns {data:[100 repos]} and the poll driver's extractRecords parses it. So this is connection-resolution plumbing, not poll-driver logic (logic proven by tests/live/poll-driver.test.ts). Decide: normalize app keys at attach time, store the resolved connection id, and/or make auto-discover tolerant of raw app_key suffixes.","notes":"RESOLVED / MISDIAGNOSED earlier. There is NO poll-driver or connection-model bug. Proven: the full real poll fire works end-to-end (real Postgres + real Zapier GitHub read) when the poll config uses the CATALOG app key 'github' — baseline sets cursor from the real read, a new record fires one workflow_run (status=success, fired_by=poll, trigger_id set), and dedup prevents a second. Earlier failures were entirely my test input: I used the raw Zapier app_key 'GitHubCLIAPI', and normalizeAppKey('GitHubCLIAPI')='git-hub' (dashed), which Zapier doesn't match. normalize/resolveConnection/findFirstConnection are all fine. RESIDUAL (latent, low priority, NOT poll-specific): normalizeAppKey turns the raw Zapier key 'GitHubCLIAPI' into 'git-hub' rather than 'github', so feeding a raw Zapier app_key into any runAction breaks. Only matters if a caller uses raw Zapier keys instead of catalog keys; the agent/catalog uses normalized keys. Reduce to P3 / hardening.","status":"closed","priority":3,"issue_type":"bug","owner":"admin@otakusolutions.io","created_at":"2026-06-12T06:29:32Z","created_by":"HamChowderr","updated_at":"2026-06-12T16:18:06Z","closed_at":"2026-06-12T16:18:06Z","close_reason":"FIXED (37e324d): added catalog-backed resolveAppSlug (app_key OR slug -\u003e canonical slug; pass-through unchanged when not in catalog), wired into runAction + workflow-step save, replacing the buggy normalizeAppKey at both call sites. Live-verified: the raw 'GitHubCLIAPI' key (previously broke with 'No current_implementation_id') now fires a real workflow_run (status=success) against real Zapier + real Postgres. 5 unit tests; full suite 308 green.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-m9f6","title":"[channels] Thread real platform message ids into ChannelMessage.dedupeKey","description":"ChannelTriggerSignalProvider dedup falls back to a content hash (channel|room|from|text) when ChannelMessage.dedupeKey is absent, which coalesces a user sending the exact same text back-to-back. Pass each adapter's stable message id as dedupeKey from the ~10 channel-bot call sites (slack/discord/telegram/teams/whatsapp/gchat/github/linear onDirectMessage + onNewMention) where the Chat SDK message exposes one. Removes the false-positive edge; true per-delivery idempotency.","status":"closed","priority":3,"issue_type":"task","assignee":"HamChowderr","owner":"admin@otakusolutions.io","created_at":"2026-06-12T03:31:07Z","created_by":"HamChowderr","updated_at":"2026-06-12T16:46:33Z","started_at":"2026-06-12T16:39:12Z","closed_at":"2026-06-12T16:46:33Z","close_reason":"Threaded normalized Chat SDK message.id into ChannelMessage.dedupeKey across all 8 channel bots (16 call-sites). Provider now dedupes on the real platform message id; content-hash is fallback only. Type-clean, 308 mocked tests green, committed c942a92.","dependencies":[{"issue_id":"foreman-m9f6","depends_on_id":"foreman-tv5p","type":"discovered-from","created_at":"2026-06-11T20:31:07Z","created_by":"HamChowderr","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"foreman-l8ev","title":"Document Zapier SDK auth model in README (client-creds vs userJwt per surface)","description":"Discovered during SDK exploration: the Zapier SDK surfaces need DIFFERENT auth. Trigger inboxes + discovery + runAction accept app-level client-credentials (ZAPIER_CLIENT_ID/SECRET). Durable-workflow endpoints (runDurable/publishWorkflowVersion) require a per-user userJwt (PKCE OAuth token), NOT client-creds. The new zapier-sdk-cli (0.54) login yields client-creds only; ~/.zapierrc deployKey is a legacy 32-char non-JWT (invalid as SDK creds). Document in README: which surfaces need which auth, how Foreman obtains each (env client-creds vs lib/zapier/sdk.ts PKCE per-user token), and the open question for Zapier (server-side path to per-user durable). Come back to this later. See docs/durable-workflow-spike.md + docs/trigger-inbox-spike.md.","status":"open","priority":3,"issue_type":"task","owner":"admin@otakusolutions.io","created_at":"2026-06-11T18:39:52Z","created_by":"HamChowderr","updated_at":"2026-06-11T18:39:52Z","dependency_count":0,"dependent_count":0,"comment_count":0}

.gitattributes

@@ -0,0 +1,30 @@
+# Normalize line endings across platforms.
+# Without this, Windows checkouts (core.autocrlf=true) leave the working tree in
+# CRLF while Git stores LF, producing hundreds of phantom "modified" files and
+# blocking clean fast-forwards. Force LF everywhere — in the repo and on checkout.
+* text=auto eol=lf
+
+# Shell scripts must stay LF regardless of platform.
+*.sh text eol=lf
+*.mjs text eol=lf
+*.cjs text eol=lf
+
+# Windows-only scripts keep CRLF (none today, but future-proof).
+*.bat text eol=crlf
+*.cmd text eol=crlf
+*.ps1 text eol=crlf
+
+# Binary assets: never normalize or diff as text.
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.ico binary
+*.webp binary
+*.woff binary
+*.woff2 binary
+*.ttf binary
+*.eot binary
+*.pdf binary
+*.zip binary
+*.gz binary