Commit graph

127 commits

Author SHA1 Message Date
DJP
697b015675 Dynamic tool selection for Ollama based on user intent
Instead of sending all 12 tools every request, match the user's message
against keyword groups (status, workload, assign, create, advance, revision)
and only send relevant tools. search_entities always included for name
resolution. Falls back to basic query tools if no keywords match.

This cuts the tool definitions from ~12 to ~2-6 per request, significantly
reducing context size for gemma4.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 15:55:07 -04:00
DJP
e99391b824 Reduce Ollama context size for gemma4 reliability
- Filter tools to 12 (from 17) via OLLAMA_TOOL_ALLOWLIST
- Shorten tool descriptions to first sentence only
- Trim system prompt: drop pipeline details and suggestion format, keep Rules
- Reduce num_predict from 4096 to 2048
- Fix system prompt trimming to preserve Rules section (name resolution, mutation flow)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 15:52:48 -04:00
DJP
660caeeafc Add response logging for Ollama to diagnose timeout
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 15:42:32 -04:00
DJP
2c7f85bca3 Flatten Ollama conversation to plain text to fix JSON parse error
Ollama's parser chokes on deeply nested JSON in tool_use/tool_result
structured content blocks. Instead of sending OpenAI-format tool
messages, flatten everything to simple role/content text messages.
Tool results are truncated to 2KB to keep context manageable.

The model still receives tool definitions and can make new tool calls,
but prior tool interactions are shown as plain text in the history.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 15:28:18 -04:00
DJP
ddbd0a3fd3 Fix Ollama JSON parse error by sending Content-Length header
Ollama was receiving chunked transfer encoding from Node.js fetch and
failing to parse the JSON body ("can't find closing '}' symbol").
Sending a Buffer with explicit Content-Length forces a single complete
body write.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 15:21:21 -04:00
DJP
b55b652c55 Add detailed Ollama logging and increase timeout to 180s
Logs request size, message count, and detailed error info to help
diagnose the "can't find closing '}'" JSON parsing error from Ollama.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 15:20:44 -04:00
DJP
d4fa69957e Switch Ollama chat model to gemma4:latest
Gemma 4 loads successfully, supports tool calling with proper
structured output, and responds in ~100ms after initial load.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 15:11:59 -04:00
DJP
49f301f6f4 Use mistral:latest (7B) for Ollama chat — only model that loads on server
Larger models (mistral-large 122B, qwen3-coder 30B, gpt-oss 20B) all
fail to load due to resource limits. mistral:latest (7.2B) loads and
responds successfully.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 14:40:58 -04:00
DJP
93ab4a0947 Switch Ollama chat model to qwen3-coder:30b (mistral-large too large for server)
mistral-large:latest requires 420GB RAM, server only has 345GB.
qwen3-coder:30b is a 30.5B MoE model that fits in ~20GB with good
tool calling and reasoning capabilities.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 14:38:34 -04:00
DJP
83ce802264 Make Ollama primary AI provider, Claude as paid fallback
- Ollama (internal GPU server) is tried first — free
- If Ollama is down, falls back to Claude API with a browser toast:
  "Ollama unavailable — using Claude (paid API)"
- Provider badge shows which one is active (orange/purple)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 14:06:35 -04:00
DJP
6e19c1f046 Add Ollama as fallback AI provider, remove local Ollama container
- Claude is primary, Ollama (internal GPU server) is automatic fallback
- Provider auto-selects: Claude if API key set, else Ollama if reachable
- Ollama uses mistral-large:latest for chat with full tool calling support
- Removed local Ollama Docker service — uses remote at 10.24.42.219
- Chat panel badge shows "Claude" (purple) or "Ollama" (orange)
- OLLAMA_CHAT_HOST and OLLAMA_CHAT_MODEL env vars for configuration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 12:30:13 -04:00
DJP
3209a5dbee Prevent chat from exceeding Claude context limit
- Cap conversation history to last 20 messages
- Truncate tool results over 8KB before sending back to Claude
- Trim long assistant messages in client-side history to 2KB

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 12:17:27 -04:00
DJP
2f1afed855 Pass ANTHROPIC_API_KEY through to Docker container
The env var was in .env but not listed in docker-compose environment
block, so the container never received it.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 12:11:18 -04:00
DJP
38bd8ac63d Add safety guardrails to AI chat assistant
- Mutation confirmation: all write operations (create, update, assign)
  now pause and show a confirmation card before executing. Users must
  click Confirm or Cancel.
- RBAC enforcement: Artists blocked from mutations via chat, Producers
  blocked from bulk operations. Only Admins get full access.
- Rate limiting: 20 requests/minute per user on the chat endpoint.
- System prompt updated to not instruct Claude to execute directly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 12:05:14 -04:00
DJP
277ad85073 Prepend basePath to stored media URLs so assets load under /hp-prod-tracker
upload-service.ts and annotation-service.ts were storing URLs like
/api/uploads/revisions/... in the database. When the app is served at
/hp-prod-tracker, the browser needs /hp-prod-tracker/api/uploads/...
to hit the correct route.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 07:47:08 -04:00
DJP
5785f142fd Fix upload/delete/annotation fetch calls to use apiUrl() for basePath
Three files had hardcoded /api/ URLs that bypassed the basePath prefix,
causing 404s when the app is served under /hp-prod-tracker.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-07 22:19:41 -04:00
DJP
c1a003570e Fix fetchJson in 17 hooks to use basePath prefix
All hook files had local fetchJson() helpers calling fetch(url) directly,
bypassing the basePath. Now wrapped with apiUrl() so API calls work
under /hp-prod-tracker path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-07 22:09:41 -04:00
DJP
60ec707814 Add /hp-prod-tracker basePath for path-based hosting
- Set basePath in next.config.ts for serving under /hp-prod-tracker
- Create apiUrl() helper to prepend basePath to fetch calls
- Update all 28 fetch("/api/...") calls across 16 files
- Add GCS storage migration plan doc

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-07 21:47:30 -04:00
DJP
26c766cf43 Security hardening: fix critical auth, RBAC, and injection vulnerabilities
- C1: Add authentication to file serving route + canonical path traversal check + nosniff header
- C2: DEV_BYPASS_AUTH now only works when Entra ID credentials are not configured
- H1: Add requireAuth() + assertOrgAccess() to 9 unprotected routes (upload, feedback, annotations, color-probes, reviews)
- H2: Add org-scoping to 4 routes (automations, users, skills)
- H3: SSRF protection on webhook URLs — HTTPS only, private/internal IPs blocked
- H6: API key uses timingSafeEqual, phantom fallback removed, supports X-Org-Id header
- M1: CRON_SECRET moved from query string to Authorization Bearer header
- Extend assertOrgAccess() to support 10 model types (was 3)
- npm audit fix: 17 vulnerabilities reduced to 4
- Add SECURITY-REVIEW.md with full findings report

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-07 20:48:05 -04:00
DJP
4c0e9d32df Dev server deployment: port conflicts, auth bypass, API key, UI fixes
- Remap ports (3001, 5491) to avoid conflicts on shared server
- Remove NODE_ENV guard from DEV_BYPASS_AUTH in middleware, api-utils, layout
- Add API key authentication for external integrations
- Comment out Ollama dependency (optional for dev)
- Fix pipeline graph: topological depth layout for parallel branches
- Fix uploads: move to /data/uploads volume, serve via /api/uploads
- Fix wipe comparison: correct A/B layering, transformOrigin, ResizeObserver fit
- Fix Dockerfile: create /app/public directory for standalone build

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-07 17:17:54 -04:00
Leivur Djurhuus
010d29656c Clean up deployment config: remove Docker Hub refs, Cloudflare Tunnel
Source code is now on Bitbucket — IT builds from source directly.
Docker Hub and Cloudflare Tunnel are no longer needed. Removed
profiles gate from app service so docker compose up -d works without
flags. Updated .env.example with organized sections and comments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-07 13:44:09 -05:00
Leivur Djurhuus
005a7acbe2 Fix Docker image: add prisma + dotenv to runner stage
The standalone Next.js output doesn't include prisma (devDependency)
or dotenv (only used by prisma.config.ts, not app runtime). Install
them explicitly in the runner stage for prisma migrate deploy.
Pin prisma@7.4.2 to avoid npx downloading a non-existent version.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-07 13:34:48 -05:00
Leivur Djurhuus
449b248323 Document SSO seed-user linking pattern for next-auth v5
Captures the allowDangerousEmailAccountLinking pattern for linking
pre-seeded users to SSO accounts, org auto-assignment via signIn
event, limbo page for unprovisioned users, and DEV_BYPASS_AUTH
production guard.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 17:25:58 -05:00
Leivur Djurhuus
ffbc5a2e31 Add standalone output for Docker deployment, gitignore deploy dir
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 16:49:58 -05:00
Leivur Djurhuus
fa55dfc25f Add deployment infrastructure: health endpoint, Docker Compose fixes, tunnel
- Add /api/health endpoint checking DB, pgvector, org, templates,
  dev bypass safety, and AUTH_SECRET presence
- Fix Docker Compose app service: AUTH_SECRET, Entra ID env vars,
  AUTH_TRUST_HOST, app health check
- Add Cloudflare Tunnel service for zero-config HTTPS access
- Exclude health endpoint from auth middleware

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 14:54:15 -05:00
Leivur Djurhuus
0eaf809bc6 Add SSO bridge: Microsoft Entra ID auth with seed user linking
Configure Microsoft Entra ID as the sole SSO provider with
allowDangerousEmailAccountLinking to link SSO accounts to existing
seeded user records by email match. Add signIn event for automatic
org assignment by domain. Guard DEV_BYPASS_AUTH against production
use. Add branded pending page for authenticated users without org
membership. Remove Google provider for initial rollout simplicity.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 14:52:13 -05:00
Leivur Djurhuus
4149b2cf40 Switch from db push to versioned Prisma migrations
Replace 2 stale migration files with a single baseline migration
capturing the full 40+ model schema. The database was freshly reset
via clean-slate, making this the ideal time to establish migration
history. Dockerfile now runs prisma migrate deploy before app start.
Updated SETUP.md and ROADMAP.md to reference prisma migrate dev
instead of db push.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 14:45:36 -05:00
Leivur Djurhuus
29657aeefd Gitignore database backup files
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 14:40:53 -05:00
Leivur Djurhuus
aa20767035 Add clean slate toolkit solution documentation
Documents the purge-and-reseed pattern for transitioning from dev to
production data, including FK-safe deletion order, self-referential FK
handling, and backup/restore procedures.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-06 14:39:37 -05:00
Leivur Djurhuus
dfa067e95f Database cleanup pre rollout 2026-04-06 14:35:56 -05:00
Leivur Djurhuus
d5c250277c markup bug fixes 2026-04-06 09:01:53 -05:00
Leivur Djurhuus
9a10cd8063 Markup bug fixes 2026-04-06 08:53:28 -05:00
Leivur Djurhuus
e3332c5dc5 Merge feature/video-review: timestamped video annotations with timeline markers 2026-04-03 14:58:22 -05:00
Leivur Djurhuus
16052aec9a compound ui fix 2026-04-03 14:39:18 -05:00
Leivur Djurhuus
c0652ae119 Review UI bug fixes 2026-04-03 14:27:13 -05:00
Leivur Djurhuus
3520e3fc9b Fix video review bugs: playback, annotations, coordinates, timeline markers
- Fix video-only revisions not showing (activeRevisionId fallback)
- Fix SVG coordinate system with viewBox for native→screen mapping
- Fix annotations visible at all times (timestampSeconds dropped in mapping)
- Fix timeline markers missing (use browser duration when DB has 0)
- Fix setState-during-render in duration tracking (ref+interval pattern)
- Fix click propagation toggling play during annotation drawing
- Fix concurrent attachment update race condition (Prisma transaction)
- Fix file handle leaks in uploads streaming route
- Add click-to-seek from feedback sidebar timestamp badges
- Use annotation drawing color for timeline markers
- Add solution documentation for video review bugs
- Add docs/solutions/ discoverability to CLAUDE.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-03 12:44:02 -05:00
Leivur Djurhuus
be146160ab Merge branch 'main' of https://github.com/packman86/hp_prod_tracker 2026-03-18 16:26:12 -05:00
Leivur Djurhuus
dd7db58c2f Update ROADMAP: lawn reference learnings, A7.3 in progress, infrastructure status
- Fix lawn reference URL to https://github.com/pingdotgg/lawn
- Document lawn architecture analysis and adopted/not-adopted patterns
- Mark A7.3 (Timestamped Video Annotations) as in progress
- Update infrastructure built section with video annotation layer details
- Mark Annotation schema fields as complete in data model status

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 15:00:34 -05:00
Leivur Djurhuus
95dbaef318 Add timestamped video annotations with timeline markers (A7.3)
- Add timestampSeconds and frameThumbnailUrl fields to Annotation model
- New VideoAnnotationLayer component: auto-pause on draw tool activation,
  SVG annotation overlay on paused video, time-filtered visibility,
  All/Timed toggle, timecode display in toolbar
- New VideoTimelineMarkers: orange=unresolved, green=resolved, clustered
  markers on scrub bar with click-to-seek and hover scale
- Thread timestampSeconds through validator, service, and API layers
- Feedback item cards show timestamp badges for video annotations
- VideoPlayer gains renderOverlay, timelineMarkers, pause/seek in state
- Fix "Processing" overlay shown when MP4 is available (FFmpeg fallback)
- Add revision polling when video status is "processing"
- Configure proxyClientMaxBodySize: 500mb for large video uploads
- Fix pre-existing Prisma JSON type error in upload-service.ts
- Update ROADMAP with lawn reference learnings and A7.3 progress

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 15:00:23 -05:00
Leivur R. Djurhuus
35c19f0cfd
Merge pull request #3 from packman86/feature/video-review
Feature/video review
2026-03-18 12:20:14 -05:00
Leivur Djurhuus
ec420f79d6 Fix dynamic pipeline stages: form submissions, unique constraint, and stage name resolution
Three related bugs fixed:

1. Form save buttons silently failing — valueAsNumber on empty number inputs
   produced NaN, which Zod rejected without visible errors on hidden tabs.
   Replaced with setValueAs that converts empty strings to undefined.

2. Unique constraint violation on deliverable stage creation — dynamic pipeline
   stages without matching global template slugs all fell back to
   globalTemplates[0], creating duplicate (deliverableId, templateId) pairs.
   Changed constraint from @@unique([deliverableId, templateId]) to
   @@unique([deliverableId, stageDefinitionId]).

3. Stage names showing wrong template — all UI components read
   stage.template.name exclusively, ignoring stageDefinition from the dynamic
   pipeline system. Updated 13 components, 6 services, and all relevant Prisma
   queries to prefer stageDefinition over template for display.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-18 12:19:00 -05:00
Leivur Djurhuus
77f69757e1 Graceful FFmpeg fallback for local dev without FFmpeg installed
Video upload now works without FFmpeg on PATH — metadata extraction
returns defaults, thumbnail is skipped, HLS transcoding is skipped,
and video is marked as ready with raw MP4 serving only. A one-time
warning is logged. Full HLS pipeline activates when FFmpeg is present
(Docker or local install).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-17 23:56:21 -05:00
Leivur Djurhuus
4d78655ce2 Add video player component with HLS streaming and review page integration (A7.2)
Custom video player with hls.js for instant HLS playback with MP4
fallback. Full keyboard-driven controls matching NLE conventions:
Space/K play/pause, J/L skip 5s, arrow/comma/period frame step,
[/] speed, F fullscreen, M mute. Timecode display in HH:MM:SS:FF.

Components:
- video-player.tsx: Core player with HLS/MP4 source loading
- video-controls.tsx: Play, seek, speed, volume, fullscreen, loop
- video-timeline.tsx: Scrub bar with hover time preview + marker slots
- video-frame-display.tsx: Timecode display (HH:MM:SS:FF)
- video-upload-zone.tsx: Drag-drop upload with progress bar (XHR)
- use-video-player.ts: Player state hook with keyboard shortcuts

Review page integration:
- Auto-detects video vs image attachments per revision
- Image/Video toggle when both exist on same revision
- Upload panel extended with video + reference video zones
- VideoPlayer renders in place of ImageViewer when in video mode

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-17 23:52:40 -05:00
Leivur Djurhuus
2e87a5ff4d Add video upload with HLS streaming infrastructure (A7.1)
FFmpeg in Docker for transcoding, thumbnail extraction, and metadata
parsing. Videos stored in /data/uploads (mounted volume), served via
streaming API route with Range headers and HLS segment caching. Upload
flow: stream-write MP4 → ffprobe metadata → thumbnail → async HLS
transcode → update revision status to ready.

New files:
- video-service.ts: FFmpeg/ffprobe wrapper (HLS, thumbnails, metadata)
- /api/uploads/[...path]: streaming file server with Range support
Modified:
- upload-service.ts: video handling, 500MB limit, async HLS pipeline
- upload route: accepts video/referenceVideo types
- Dockerfile: ffmpeg + /data/uploads directory
- docker-compose.yml: uploads_data volume

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-17 23:52:40 -05:00
Leivur Djurhuus
4e654b6fed Update ROADMAP: mark D1.1-D1.3 and A7.1-A7.2 as complete
Add progress checkboxes to A7 sub-stages. D1 automation engine
(all 3 phases) and A7.1 (video upload + HLS) + A7.2 (video player)
are done. Next: A7.3 (timestamped video annotations).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-17 23:52:34 -05:00
Leivur Djurhuus
f579dd2b43 Update A7.1 roadmap: HLS streaming architecture for video review
Revised A7.1 spec based on lawn-video-reviewer learnings — HLS-first
streaming for instant playback and smooth seeking instead of raw MP4
serving. Key changes: async HLS transcoding on upload, mounted volume
storage (/data/uploads), streaming API route with Range headers, and
processing status tracking on revision attachments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-17 23:32:44 -05:00
Leivur Djurhuus
72d09b95ce automation rules added to settings 2026-03-17 23:07:44 -05:00
Leivur R. Djurhuus
082b91b09e
Merge pull request #2 from packman86/feature/visual-review-tool
Feature/visual review tool
2026-03-17 22:25:59 -05:00
Leivur Djurhuus
c38875d8cd eyedropper fixes. 2026-03-17 22:21:10 -05:00
Leivur Djurhuus
36cbd997f7 eyedropper tweaks 2026-03-17 22:21:10 -05:00