PATCH bump for the bug fix in #143 (closes#136). Surfaces the
required migration (013_whatsapp_config_phone_number_id_unique.sql)
and the diagnostic SQL self-hosters should run before applying it,
plus a note that wacrm is single-tenant per WhatsApp number by
design.
Versions the prior `## Unreleased` chat-actions block as 0.1.1 (it
shipped with migration 009 a few days back) and adds 0.2.0 covering
the Flows feature, color themes, and the various engine + UX work
that landed alongside.
Also bumps package.json: 0.1.0 → 0.2.0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Patches 11 open Dependabot alerts in dependencies pulled in through
the shadcn CLI tree (shadcn → @modelcontextprotocol/sdk →
@hono/node-server, express-rate-limit, ajv-formats, …). These aren't
loaded by the running Next.js app — they only execute when you invoke
the shadcn CLI — but the alerts still surface in GitHub's UI, so it's
cleaner to pin them.
Uses npm `overrides` to force the patched version regardless of what
the upstream MCP SDK happens to request:
postcss ^8.5.10 — XSS via unescaped </style>
(GHSA-qx2v-qp2m-jg93, medium)
ip-address ^10.1.1 — XSS in Address6 HTML-emitting methods
(GHSA-v2v4-37r5-5v8g, medium)
fast-uri ^3.1.2 — path traversal + host confusion via
percent-encoded segments / authority
delimiters (GHSA-q3j6-qgpj-74h6 high,
GHSA-v39h-62p7-jpjc high)
hono ^4.12.18 — JSX HTML injection, bodyLimit bypass,
Cache middleware Vary leak, CSS injection
via style objects, JWT NumericDate
validation (GHSA-69xw-7hcm-h432 / 9vqf-7f2p-gf9v
/ p77w-8qqv-26rm / qp7p-654g-cw7p /
hm8q-7f3q-5f36, low–medium)
After overrides:
postcss 8.5.14 (was nested 8.4.31 inside next + top 8.5.14)
ip-address 10.2.0 (was 10.1.0)
fast-uri 3.1.2 (was 3.1.0)
hono 4.12.19 (was 4.12.14)
Verified locally:
npm run lint — 0 errors (23 pre-existing warnings)
npm run typecheck — clean
npm test — 89/89 passed
npm run build — succeeded
Pair this with #93 (next 16.2.6 bump) to clear all 22 alerts. Each PR
is independently revertible.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Patches 11 open Dependabot alerts on Next.js — 10 High + 1 Low:
- SSRF in WebSocket upgrades (GHSA-c4j6-fc7j-m34r)
- DoS in Server Components (GHSA-8h8q-6873-q5fj)
- DoS in Cache Components via connection exhaustion (GHSA-mg66-mrh9-m8jx)
- DoS in Image Optimization API (GHSA-h64f-5h5j-jqjh)
- Middleware/Proxy bypass via segment-prefetch routes
(GHSA-267c-6grr-h53f, GHSA-26hh-7cqf-hhc6 follow-up)
- Middleware/Proxy bypass via i18n in Pages Router
(GHSA-36qx-fr4f-26g5)
- Middleware/Proxy bypass via dynamic route param injection
(GHSA-492v-c6pp-mqqv)
- XSS in beforeInteractive scripts (GHSA-gx5p-jg67-6x7h)
- XSS in CSP-nonce App Router apps (GHSA-ffhc-5mcf-pf4q)
- Cache poisoning in RSC responses (GHSA-wfc6-r584-vfw7)
- Cache-busting collision in RSC (GHSA-vfv6-92ff-j949, Low)
- Cache-poisoned Middleware redirects (GHSA-3g8h-86w9-wvmq, Low)
Also bumps eslint-config-next to 16.2.6 to keep major/minor lockstep
with next, per Vercel's docs.
Verified locally:
npm run lint — 0 errors (23 pre-existing warnings)
npm run typecheck — clean
npm test — 89 passed, 7 files
npm run build — succeeded
The remaining 11 alerts (postcss/ip-address/fast-uri/hono) are
transitive and ship via the shadcn CLI's tree; they'll be patched
separately via npm overrides.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the first test layer to the repo. Vitest is wired into the
existing CI workflow between typecheck and build so every PR gets the
same gating before merge. No source code under test was modified; this
PR only adds the test framework + tests.
Coverage focuses on the highest-impact pure modules — security-critical
crypto/HMAC, the phone-number pipeline every outbound message touches,
the rate-limiter that protects send/broadcast, automation activation
validation, and dashboard date math. 89 tests across 7 files; full run
is ~300ms.
Modules covered:
- lib/whatsapp/encryption — GCM round-trip, tamper detection (auth tag,
ciphertext, IV length, auth-tag length), legacy CBC compat, format
detection, malformed input
- lib/whatsapp/webhook-signature — valid/invalid HMAC, missing header,
wrong prefix, length-mismatch guard, fail-closed when secret unset
- lib/whatsapp/phone-utils — sanitize, normalize, phonesMatch with
trunk-prefix tail fallback, isValidE164 boundaries (7–15 digits,
non-zero start), phoneVariants insert/remove with dedupe,
isRecipientNotAllowedError detection
- lib/rate-limit — first-request math, exact-limit boundary, per-key
isolation, window expiry with fake timers, 429 response shape,
Retry-After clamp
- lib/automations/validate — every step type's required fields, wait
amount/unit boundaries, webhook URL validation (missing / non-http /
malformed), assign_conversation mode branching, recursive condition
walking with stable dot-paths, unknown step types
- lib/broadcast-status — known status lookups, pulse flag, dark-theme
class shape, fallback for unknown strings
- lib/dashboard/date-utils — startOfLocalDay, daysAgoStart, localDayKey
zero-padding, lastNDayKeys (1, N, month crossing), Monday-first DOW
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Forks of this repo no longer inherit the wacrm.tech landing page
and docs — those move to the dedicated marketing-site repo at
https://github.com/ArnasDon/wacrm-site (deployed to wacrm.tech).
Changes here:
- Replace src/app/page.tsx with a redirect to /dashboard.
Middleware already handles the unauth → /login bounce, so this
works for both auth states.
- Drop src/app/{docs,opengraph-image.tsx,robots.ts,sitemap.ts}.
- Drop src/components/{landing,docs,seo} and src/lib/{seo,docs}.
- Drop the top-level docs/ markdown — moved to wacrm-site/docs.
- Slim src/app/layout.tsx metadata down to product chrome
(no public OG cards, robots: noindex).
- Drop `marked` from dependencies; refresh package-lock.
- Refocus README on self-hosting; point readers at wacrm.tech/docs.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Drops the "WaCRM" branded name across user-facing surfaces in favour
of a descriptive name. Branded names that imply WhatsApp ownership or
sponsorship are a trademark fair-use risk; a relationship-based name
("CRM Template for WhatsApp") sidesteps that.
Scope:
- Brand text in nav, sidebar, footer, docs shell, mock window chrome.
- SITE_NAME / SITE_DESCRIPTION / legalName in src/lib/seo/site-config.ts.
- README, CONTRIBUTING, docs/, .github/ templates and policies.
- package.json description.
- Auth pages, settings copy, FAQ, code comments.
Out of scope (intentionally — these are infra renames the project
owner should drive separately so links and the package lockfile stay
consistent):
- The github.com/ArnasDon/wacrm repo URL.
- The wacrm.tech domain / homepage field.
- The package.json "name" field.
- The Hostinger application name and Meta system-user name in deploy
docs (existing-deployment instructions).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Nine paperwork files + one devDep. All support work for a repo that's
about to be public; zero runtime behaviour change.
- CONTRIBUTING.md at root. Dev loop, script reference, PR style, code
style, review process. Short on prose, long on specifics.
- .github/CODE_OF_CONDUCT.md adopts Contributor Covenant 2.1 by
reference (no inlined text). Points reports to the maintainer's
email and GitHub's private flow.
- .github/ISSUE_TEMPLATE/ — structured YAML forms for bug and feature
reports, plus config.yml that disables blank issues and surfaces
the security-disclosure + docs links. The bug form asks for
version, runtime, and logs up front so triage doesn't start with
a round of "where is it running?".
- .github/pull_request_template.md — short checklist; nudges toward
typecheck / lint / build before submit without being long enough
to skip.
- .github/dependabot.yml — weekly npm + github-actions scans,
grouped so Supabase / @types / dev-only patches batch into single
PRs instead of six per week. Next / React / Tailwind / eslint-
config-next are ignored so majors stay manual.
- .editorconfig — LF, UTF-8, 2 spaces, final newline, strip trailing
whitespace (except in Markdown where trailing spaces are line
breaks).
- .prettierrc — single quotes + trailing-comma es5, matches the
plurality quote style in the codebase (336 single vs 236 double
in imports). Tailwind plugin sorts class names.
- .prettierignore — node_modules, build output, lockfile, migrations.
- package.json adds "format" / "format:check" scripts and pins
prettier + prettier-plugin-tailwindcss as devDeps.
- package-lock.json refreshed for the new devDeps.
Important: existing source files are NOT reformatted in this PR. 153
files would change if we ran `npm run format`, which would balloon
the diff and make review impossible. The reformat pass is a separate,
deliberate PR.
Typecheck clean; `npx prettier --check` on the new config files
passes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Prep work so the repo is ready to be public. None of this is runtime
code; it's the governance a forker expects on day one.
- LICENSE: MIT at repo root. README already claimed MIT; this makes
GitHub actually recognise it and show the license badge.
- .github/SECURITY.md: private disclosure path via GitHub Security
Advisories or email. Spells out scope, safe harbour, and what the
reporter should expect — so a researcher finds it before they try
to file a public issue.
- .env.local.example: fleshed out with the three vars it was missing
— META_APP_SECRET (required, from PR 1), NEXT_PUBLIC_SITE_URL
(recommended), and AUTOMATION_CRON_SECRET (optional). Grouped as
Required / Recommended / Optional with a one-line comment per
entry. Includes the openssl/node generators for the secrets.
- package.json: description, repository, bugs, homepage, keywords,
license, author, engines.node >=20. No runtime impact; feeds npm
registry metadata, GitHub's repo sidebar, and prevents forkers from
silently installing on Node <20 (Next 16's floor).
Typecheck clean; npm install run to refresh the lockfile for the
package.json metadata additions (no dependency changes).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds .github/workflows/ci.yml running lint, typecheck, and build on
pull_request + push to main. Node 20 (matches the engines we'll pin
in the metadata PR), npm cache keyed on package-lock.json,
concurrency cancel so force-pushes don't queue runs.
Also adds a `typecheck` script to package.json — `tsc --noEmit`. Next
runs its own typecheck during `build`, but exposing it as a script
means editors and pre-commit hooks can invoke it cheaply, and CI can
surface type errors separately from build errors.
Build passes with dummy env vars (tested locally with .env.local
moved aside); NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_ANON_KEY,
and ENCRYPTION_KEY are set to placeholder values inside the workflow.
Lint is wired up but marked continue-on-error for now: the repo has
14 pre-existing errors from React 19's new react-hooks/set-state-in-
effect rule, across 8 files, that are out of scope for this PR. They
still show up in the CI logs so regressions are visible; a follow-up
PR will fix them and drop the non-blocking flag.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Renders every file in docs/*.md as a proper documentation site styled
like Stripe / Vercel / Linear docs: sticky header, grouped left sidebar
(Setup / Deploy / Operate), dark prose with inline code pills, syntax
-ready code blocks, responsive table styling, and prev/next pagination.
- src/lib/docs/content.ts — parses md with marked and decorates the
HTML with Tailwind utility classes via post-processing regex. Also
rewrites inter-doc `./other.md` links to `/docs/other` and extracts
an h2/h3 TOC for future use.
- src/app/docs/layout.tsx + src/components/docs/shell.tsx — shared
frame with docs-scoped header (GitHub, Home, Get started), collapsing
sidebar on mobile.
- src/app/docs/page.tsx — grouped index cards per section.
- src/app/docs/[slug]/page.tsx — individual doc + prev/next nav.
- Adds "Docs" to landing nav, footer, and a "Read the full
documentation" CTA under the open-source cards.
- Adds `marked` dependency.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Rebuild the Pipelines page to match spec.
Highlights:
- Drag-and-drop deal cards between stages via @dnd-kit (200ms drop animation,
emerald dashed drop zone, opacity fade while dragging)
- First-visit seed: auto-creates "Sales Pipeline" with spec-defined stages
(New Lead / Qualified / Proposal Sent / Negotiation / Won)
- Top bar: always-visible pipeline dropdown with "Manage Pipelines" option,
plus "Add Pipeline" and emerald "Add Deal" buttons
- Deal form converted from Dialog to right-side Sheet, adds assigned_to
(profile FK), "Link to Conversation" shortcut, "Mark as Won/Lost" status
buttons, and "Delete Deal"
- Pipeline settings modal: drag-to-reorder stages (@dnd-kit sortable),
per-stage color picker, "Create new pipeline" shortcut, archive
confirmation copy
- Analytics bar below board: total deals, pipeline value, avg deal size,
weighted pipeline value (probability interpolated across stages),
won/lost this month
- Contact detail sheet gains a "Deals" tab showing all deals for that
contact (value + stage badge + status)
- Migration 002: adds deals.assigned_to FK→profiles, normalizes status
CHECK to ('open','won','lost')
Note: spec called for light-gray Kanban columns (#f9fafb) + white cards
inside an otherwise-dark app. Followed spec literally; easy to retheme.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
