Matthew Meszaros 0ae4db2c41 feat: make self-hosted auth work without a mail relay by rewriting the platform SMTP transport with real AUTH and TLS (it did neither, so SMTP_USERNAME/SMTP_PASSWORD were dead and every documented relay was unreachable), adding MAIL_TRANSPORT=smtp|log|ses with a log transport that prints codes so a fresh install can sign in with no relay, demoting the emailed login code to AUTH_LOGIN_CODE=always|new_device|off (off on self-host, per NIST SP 800-63B and OWASP ASVS), claiming the first owner through a single-use setup link or WARMBLY_BOOTSTRAP_* instead of register-then-psql, deriving every emailed URL from APP_URL rather than a hardcoded app.warmbly.com that leaked live reset tokens to the vendor, fixing the confirm hooks that read path params against paramless routes and broke login, register and reset confirmation in the dashboard everywhere, adding generic OIDC with PKCE, one-time state, verified nonce and (issuer,subject) identity binding, enforcing 2FA on the social paths that skipped it, adding a per-IP limiter and trusted-proxy handling to the unthrottled auth group, refusing boot on the published default secrets, and dropping mailpit from the default stack (#99)

2026-08-14 14:57:09 +02:00

..

Analytics

feat: iOS analytics becomes an air-hero drawer browser cover - the sky hero stays (circular hamburger and close, translucent 7d/30d/90d period chips, glass stat chips) while the web-style tab strip and card grids give way to a section drawer (overview/deliverability/warmup/accounts with issue-tinted counts) over flat native lists; Home now opens analytics and mailboxes as covers instead of pushes

2026-07-11 10:13:44 +02:00

Assistant

feat: port the AI assistant to the iOS app: a sparkles button on the Home hero opens a full-screen chat that streams answers over SSE with live text deltas and tool-step chips, pauses on approval_required with Approve/Always allow/Deny, rehydrates persisted transcripts, and shows remaining credits or the free-model note; the history sheet groups conversations into Today/Yesterday/This week/Earlier with title search, swipe delete, clear-all behind a confirm, live refresh off the ai_session spine, and owner attribution when shared history is on

2026-07-19 15:04:50 +02:00

Auth

feat: make self-hosted auth work without a mail relay by rewriting the platform SMTP transport with real AUTH and TLS (it did neither, so SMTP_USERNAME/SMTP_PASSWORD were dead and every documented relay was unreachable), adding MAIL_TRANSPORT=smtp|log|ses with a log transport that prints codes so a fresh install can sign in with no relay, demoting the emailed login code to AUTH_LOGIN_CODE=always|new_device|off (off on self-host, per NIST SP 800-63B and OWASP ASVS), claiming the first owner through a single-use setup link or WARMBLY_BOOTSTRAP_* instead of register-then-psql, deriving every emailed URL from APP_URL rather than a hardcoded app.warmbly.com that leaked live reset tokens to the vendor, fixing the confirm hooks that read path params against paramless routes and broke login, register and reset confirmation in the dashboard everywhere, adding generic OIDC with PKCE, one-time state, verified nonce and (issuer,subject) identity binding, enforcing 2FA on the social paths that skipped it, adding a per-IP limiter and trusted-proxy handling to the unthrottled auth group, refusing boot on the published default secrets, and dropping mailpit from the default stack (#99)

2026-08-14 14:57:09 +02:00

Campaigns

feat: kind-aware campaign sequence preview in the iOS app - decode the conditions/action jsonb the steps endpoint already returns and render wait/action nodes with plain-language summaries plus per-step branch routes (if opened within 3 days, goes to step 4), keeping the read-only edit-on-web handoff

2026-07-13 16:11:00 +02:00

Compose

feat: iOS From picker parity + tag-scoped Auto: the tag chip row becomes a native Menu filter offering every user tag (not just in-use ones) with color dots and checkmarks, filtering turns the Auto row into Auto in <tag> previewing the best in-tag candidate and picking it carries autoTagID into the compose send as from_tag_id (cleared by explicit picks), the From row reads Auto in <tag> with the best member email via account tags lifted into ComposeStore, and ContactPickerSheet swaps its category chips for the same compact menu idiom

2026-07-20 05:33:06 +02:00

Contacts

feat: iOS campaign leads becomes a full drawer browser matching contacts - status scopes (all/processing/replied/bounced/queued/unsubscribed) with live counts in a sky-hero sidebar, advanced contact filters, multi-select bulk edit/remove with optimistic count bumps, an add-leads picker that locks rows already in the campaign, live detail re-derived from the store with presence claims, plus shared contact browser pieces (filters sheet, CSV import, bulk actions, sidebar) and keyboard-safe create-flow sheets

2026-07-11 10:12:09 +02:00

CRM

feat: iOS More tab and CRM rebuilt in the flat browser language - the hub is one full-bleed list with a workspace header and cover rows, Deals/Tasks/Meetings become full drawer browsers (scope sidebars with sliding tone capsules, search pills, end markers), and billing/notifications/profile/security/team pages drop grouped cards for eyebrow-captioned hairline rows

2026-07-11 10:12:41 +02:00

Home

feat: port the AI assistant to the iOS app: a sparkles button on the Home hero opens a full-screen chat that streams answers over SSE with live text deltas and tool-step chips, pauses on approval_required with Approve/Always allow/Deny, rehydrates persisted transcripts, and shows remaining credits or the free-model note; the history sheet groups conversations into Today/Yesterday/This week/Earlier with title search, swipe delete, clear-all behind a confirm, live refresh off the ai_session spine, and owner attribution when shared history is on

2026-07-19 15:04:50 +02:00

Mailboxes

feat: iOS mailbox tag management: a reusable tag picker sheet (search, colored-dot rows, multi-select, inline Create-tag that POSTs /tags cycling the palette and refreshes the session), a Tags section on the mailbox detail Setup tab editing via the optimistic PATCH /emails/:id path, and bulk Add/Remove tags in the list's selection capsule driving the new PATCH /emails/tags endpoint with reload, select-mode exit, and a light haptic on apply

2026-07-19 16:14:17 +02:00

More

feat: replace the notification email cadence enum with a configurable bundling window and drop the instant mode entirely: email_digest_minutes (30 minute floor, 30 default, 1440 max, constants in config) replaces email_digest with no per-event option or NOTIFICATION_EMAIL_ALLOW_INSTANT escape hatch, the handler validates the range and email_delivery now returns min/max minutes so clients render the bounds, the web settings page offers window presets (30m/1h/3h/daily) plus a Custom minutes NumberInput and iOS swaps the cadence menu for window presets including the server value when it matches none, the repo clamps stored values on read, and the guide plus deployment guide describe the window and keep only the NOTIFICATION_EMAIL_DAILY_CAP env

2026-07-20 08:01:22 +02:00

Unibox

feat: undo send in the iOS app: instant compose and reply sends swap the sent toast for a dark UndoSendBanner capsule counting down to the server's scheduled_at with an Undo button that cancels via DELETE unibox/scheduled/:task_id, compose undo reopens the sheet through the draft-resume path with the full payload and reply undo re-presents UniboxComposer prefilled from a UniboxReplySnapshot, 404 collapses to an Already sent toast, expiry flips the capsule to Sent briefly, and the User model gains undo_send_seconds (default 30 when absent)

2026-07-19 18:53:21 +02:00