v6.7.0

What's New

User Guide Step-Through Wizard

• Added dual-mode support for the user guide with step-through wizard functionality
• Users can now navigate through the guide step-by-step or view all content at once

MCP Server v0.7.0

• Improved retry logic with exponential backoff for resilient API calls
• Added TTL caching for better performance
• Enhanced npm package configuration

Documentation

• Optimized CLAUDE.md for reduced token usage in AI-assisted development

Full Changelog

v6.6.2...v6.7.0

v6.1.0 - UI/UX Enhancements & Code Quality

GSD Task Manager v6.1.0

✨ New Features

UI/UX Enhancements (v5.10.0/v6.0.0)

• Command Palette — Global ⌘K/Ctrl+K shortcut for quick actions, navigation, and task search (#86)
• Quick Settings Panel — Slide-out panel for frequently-adjusted settings (theme, show completed, notifications, sync interval)
• Smart View Pinning — Pin up to 5 smart views to header for quick access (keyboard shortcuts 1-9, 0 to clear)
• iOS-style Settings Dialog — Completely redesigned settings with grouped layout (#94)

Backend Improvements

• Dedicated Stats Endpoint — New Worker endpoint for MCP task metadata (#92)
• Enhanced Task Sharing — App link and Web Share API integration (#82)
• Sync Notifications — Background synchronization notifications with configurable auto-sync (#86)

🔧 Refactoring & Code Quality

Coding Standards Compliance

• Comprehensive modularization of large files for 300-line limit compliance (#88, #89, #91)
• Extracted shared settings components for improved maintainability (#95)
• Constants and helpers extraction for better code organization

🐛 Bug Fixes

• Fixed OAuth error handling and defensive localStorage access (#93)
• Resolved TypeScript build error in MCP sync-status tool (#96)
• Integrated Quick Settings and Command Palette with Matrix Board (#87)
• Fixed 18 test failures with duplicate keys, missing mocks, and outdated assertions (#84)

🔒 Security

• Comprehensive security improvements v5.6.1 (#78, #79)
• Enhanced input validation and sanitization

📦 Dependencies

• Updated dependencies across the board (#81)
• Modularized codebase structure

---

Full Changelog: v5.5.0...v6.1.0

v5.5.0 - Security, Testing & Documentation

GSD Task Manager v5.5.0

🔒 Security Improvements

• Comprehensive OWASP Top 10 security review and hardening (#74, #75)
• Enhanced input validation and sanitization
• Improved authentication flow security

📚 Documentation

• Added comprehensive database architecture documentation with ER diagrams (#73)
• Updated GSD features guide
• Enhanced README with npm package links

🧪 Testing & Quality

• Achieved 80% test coverage across codebase (#68, #72)
• Added comprehensive tests for sync and data layers
• Improved test coverage script
• Fixed test failures for OAuth and task deletion (#57)

🐛 Bug Fixes

• Fixed OAuth state management for PWA flows (#62, #64, #65)
• Resolved PWA sync authentication errors on iPad (#61)
• Fixed bulk tag dialog functionality (#56)
• Guarded sync history writes against IndexedDB failures (#71)
• Resolved archive route type errors (#67)
• Fixed duplicate variable declarations in OAuth callback (#63)

✨ Features & Enhancements

• Added sync history logging and UI (#69, #70)
• Implemented logout button in settings menu (#58, #59)
• MCP server write operations support (v0.4.0-v0.5.1) (#46, #48, #49)
• Published MCP server to npm as @gsd/mcp-server (#45)

🔧 Refactoring & Code Quality

• Comprehensive coding standards compliance (#50)
• Split monolithic files into modular components (#51, #52, #53)
• Improved matrix-board with modular hooks and helpers (#53)
• MCP server modular architecture (#49)

📦 Dependencies

• Bumped MCP server to v0.5.1
• Synchronized version numbers with package.json (#60)

---

Full Changelog: v5.0.0...v5.5.0

v5.0.0 - MCP Server Integration & Enhanced Cloud Sync

GSD Task Manager v5.0.0 🚀

Major feature release introducing MCP Server integration for AI-powered task management and enhanced cloud sync capabilities.

🌟 New Features

MCP Server for Claude Desktop

• Natural Language Task Access - Query tasks with plain English through Claude Desktop
  • "What are my urgent tasks this week?"
  • "Find tasks about the quarterly report"
  • "How many tasks do I have in Q2?"
• 6 MCP Tools - Comprehensive task analysis capabilities:
  • list_tasks - Filter by quadrant, status, tags
  • get_task - Detailed task information
  • search_tasks - Search across titles, descriptions, tags, subtasks
  • get_sync_status - Sync health and storage usage
  • list_devices - Device management
  • get_task_stats - Task statistics and metadata
• Privacy-Preserved - End-to-end encryption maintained throughout
• Read-Only Access - Claude can explore but not modify tasks
• Local Decryption - Encryption passphrase stored only on your machine

Getting Started with MCP:

// Add to Claude Desktop config
{
  "mcpServers": {
    "gsd-taskmanager": {
      "command": "npx",
      "args": ["-y", "@gsd/mcp-server"],
      "env": {
        "GSD_API_BASE_URL": "https://gsd.vinny.dev",
        "GSD_AUTH_TOKEN": "your-jwt-token",
        "GSD_ENCRYPTION_PASSPHRASE": "your-passphrase"
      }
    }
  }
}

Enhanced Cloud Sync

• Zero-Knowledge Architecture - Worker stores only encrypted blobs; cannot decrypt task content
• End-to-End Encryption - AES-256-GCM with PBKDF2 key derivation (600k iterations, OWASP 2023)
• Multi-Device Sync - Vector clock-based synchronization across unlimited devices
• OAuth Authentication - Secure login with Google or Apple (OIDC-compliant)
• Conflict Resolution - Automatic cascade sync for concurrent edits
• Device Management - View, manage, and revoke access for specific devices
• Session Management - JWT tokens with 7-day expiration and refresh flow

Security Improvements

• Comprehensive security audit completed and addressed
• Enhanced credential management and .gitignore rules
• Rate limiting via Cloudflare KV (100 requests/minute per IP)
• CORS restrictions for production environment
• PBKDF2 with 600,000 iterations (OWASP 2023 recommendation)
• Nonce per encryption operation (96-bit random)

🐛 Bug Fixes

• Fixed sync initial setup and token expiration issues (v4.7.7 hotfixes)
• Corrected JSON formatting in CloudFront deployment scripts
• Enhanced error logging and categorization in sync engine
• Fixed infinite re-queue, race window, and delete conflicts in sync
• Resolved data loss bug when lastSyncAt is null
• Fixed Smart Views filtering and Safari PWA install prompt

🔧 Technical Improvements

• Multi-Environment Deployment - Separate dev, staging, and production environments
• Cloudflare Workers + D1 - Scalable backend with SQLite database
• Node.js 18+ MCP Server - Standalone npm package with TypeScript
• stdio Transport - JSON-RPC 2.0 communication with Claude Desktop
• Web Crypto API - Cross-platform encryption/decryption
• Enhanced test coverage for sync and encryption modules

📦 Migration Notes

If upgrading from v4.0.0:

• All existing sync functionality continues to work
• MCP Server is opt-in (requires Claude Desktop configuration)
• OAuth tokens remain valid (7-day expiration)
• No database migrations required for existing users
• Export your data before upgrading as a precaution

🔐 Security Model

• Encryption passphrase stored only in Claude Desktop config (never in cloud)
• End-to-end encryption maintained (Worker cannot decrypt tasks)
• Read-only MCP access (Claude cannot modify, create, or delete tasks)
• Opt-in feature (requires explicit passphrase configuration)

📚 Documentation

• Comprehensive MCP Server setup guide in packages/mcp-server/README.md
• OAuth OIDC implementation guide with Mermaid diagrams
• Enhanced CLAUDE.md with v5.0.0 architecture details
• Detailed API documentation for all MCP tools

🚀 Getting Started

Visit gsd.vinny.dev to try the new features, or self-host by following TECHNICAL.md.

Quick Start with MCP:

1. Deploy GSD Task Manager (or use hosted version)
2. Complete OAuth login and save your encryption passphrase
3. Get your JWT token from sync settings
4. Configure Claude Desktop with the MCP server
5. Ask Claude about your tasks!

---

Technology Stack: Next.js 16, TypeScript, Tailwind CSS, Dexie, Cloudflare Workers + D1, Node.js MCP Server

🤖 Generated with Claude Code

v4.0.0 - OAuth Security Overhaul & Multi-Environment Infrastructure

GSD Task Manager v4.0.0 🔒

Major security and infrastructure release focused on OAuth hardening, multi-environment deployment, and Next.js 15 compatibility.

🔒 Security Enhancements

Multi-Layer OAuth Security Validation (#27)

Implemented defense-in-depth approach with 4 comprehensive security layers:

Layer 1: Origin Validation

• Allowlist of trusted domains (production, dev, worker, localhost)
• Prevents XSS via postMessage attacks

Layer 2: Message Structure Validation

• Zod schema validation for all OAuth messages
• Type checking for authData payload with email/provider validation
• Prevents payload injection attacks

Layer 3: State Validation (CSRF Protection)

• Single-use state tokens with 10-minute expiry
• Timestamp tracking for each OAuth flow
• Automatic cleanup of expired states (runs every 60s)
• Prevents CSRF, replay, and session fixation attacks

Layer 4: Provider Validation

• Ensures provider matches initiated flow
• Prevents provider confusion attacks

Security Testing & Documentation

• 23 comprehensive security tests covering attack scenarios
• Complete documentation in OAUTH_SECURITY.md
• Comprehensive security logging for monitoring
• Backwards compatible with no breaking changes

Threats Mitigated:

• Cross-Site Request Forgery (CSRF)
• Cross-Site Scripting (XSS) via postMessage
• Replay attacks
• Man-in-the-Middle attacks
• Provider confusion attacks
• Payload injection

🔧 OAuth Fixes & Compatibility

Next.js 15 Compatibility (#28)

• Fixed ErrorBoundary component for Next.js 15
  • Wrapped class component in functional component wrapper
  • Resolves 'Cannot read properties of undefined' error
• Updated oauth-handshake.ts to fetch results from worker
  • Changed from relative URL to absolute worker URL
  • Development: http://localhost:8787
  • Production: Uses window.location.origin
  • Changed credentials mode from 'same-origin' to 'omit'
• Removed old OAuth callback Next.js route
  • Deleted app/(auth)/oauth-callback/page.tsx
  • Now using standalone public/oauth-callback.html

Worker OAuth Flow Fixes

• Fixed OAuth redirect URI construction
  • Worker now uses its own origin for redirect URI
  • Development: http://localhost:8787/api/auth/oauth/callback
  • Production: https://gsd-api.vinny.dev/api/auth/oauth/callback
  • Ensures Google OAuth redirects to correct endpoint
• Fixed OAuth redirect URI mismatch (Error 400)
• Fixed database schema missing (D1_ERROR: no such table)
• Fixed OAuth result fetch 404 error

🚀 Infrastructure & Deployment

Multi-Environment Worker Deployment (#27)

• Automated Setup & Deployment

  • New setup-all-envs.sh script for environment initialization
  • New deploy-all-envs.sh script for sequential deploys
  • npm scripts: setup:all, deploy:all, tail:staging, tail:production

• Environment-Specific Configurations

  • Development: localhost OAuth redirect
  • Staging: gsd-dev.vinny.dev domain
  • Production: gsd.vinny.dev domain
  • Separate D1 databases, KV namespaces, and R2 buckets per environment

• Bash 3.2 Compatibility

  • Scripts compatible with macOS default Bash 3.2
  • Removed Bash 4+ features (associative arrays, array expansion)
  • Use indexed variables and case statements

🐛 Critical Bug Fixes

Vector Clock Causality Logic Fix (#27)

CRITICAL: Fixed inverted comparison logic in vector clock causality

• Before: Larger counters incorrectly indicated "happened before"
• After: Larger counters correctly indicate "happened after"
• Impact: Prevents stale clients from missing updates and data overwrites

TypeScript Fixes (18 errors resolved)

• Added missing type exports: RegisterRequest, LoginRequest
• Fixed unused parameters by prefixing with underscore
• Added type assertions for unknown types in OAuth handlers
• Removed unused imports and schemas
• Fixed ArrayBuffer/Uint8Array type compatibility in crypto utils
• Fixed itty-router Request type with params support

PWA Error Handling

• Suppress NotAllowedError in periodic sync (occurs when PWA not installed)
• Suppress InvalidStateError (service worker state issues)
• Changed remaining errors to console.warn with explanatory comments
• Impact: Eliminates console error spam for non-PWA users

📚 Documentation Updates

• Added version tracking (v3.5.0) and recent updates section
• Reorganized features into 5 clear categories:
  • Task Management (dependencies, recurring, tags, subtasks, batch ops)
  • Analytics & Insights (dashboard, streaks, trends)
  • Privacy & Data (local-first, encryption, export/import)
  • PWA & Notifications (offline, reminders, auto-updates)
  • User Experience (dark mode, shortcuts, responsive)
• Documented optional cloud sync backend infrastructure
• Added multi-environment deployment table (dev/staging/prod)
• Included developer quick start guide and tech stack overview
• Added contributing guidelines and acknowledgments

📦 Migration Notes

If upgrading from v3.5.0 or earlier:

• OAuth security enhancements are transparent to users
• No data migration required
• Multi-environment infrastructure is for developers only
• All existing features continue to work as expected
• Export your data before upgrading as a precaution

🔄 Breaking Changes

None - This release is backwards compatible with v3.5.0

🚀 Getting Started

Visit gsd.vinny.dev to try the enhanced security features, or self-host by following the updated deployment guide in README.md.

---

Security Impact: 🟢 LOW risk deployment (backwards compatible, comprehensive testing)

Built with Next.js 15, TypeScript, Tailwind CSS, Dexie, Cloudflare Workers, and ❤️

🤖 Generated with Claude Code

v3.0.0 - Dashboard, Batch Operations & Task Dependencies

GSD Task Manager v3.0.0 🎯

Major feature release adding analytics dashboard, batch operations, task dependencies, and enhanced PWA experience.

🌟 New Features

Dashboard & Analytics

• Comprehensive Metrics Display
  • Completion statistics: today, this week, this month
  • Overall completion rate percentage
  • Current and longest streak tracking with flame indicators
  • Trend analysis for 7/30/90 day periods
• Interactive Visualizations (powered by Recharts)
  • Stats cards with trend indicators (up/down arrows)
  • Completion trend chart (toggleable line/bar view)
  • Quadrant distribution pie chart
  • Tag analytics table with progress bars and completion rates
  • Upcoming deadlines widget (overdue, due today, due this week)
• Seamless Navigation
  • ViewToggle component in header for Matrix ↔ Dashboard switching
  • Dedicated /dashboard route
  • Full analytics dashboard layout

Batch Operations

• Multi-Select Mode
  • Click anywhere on task card to select/deselect
  • Visual ring indicator on selected tasks
  • Auto-enables when first task is selected
• Bulk Actions Bar
  • Floating action bar fixed at bottom center with smooth animation
  • Shows selection count with clear button
  • Complete/Uncomplete buttons for batch status changes
  • Move to Quadrant dropdown menu
  • Add Tags button with bulk tag dialog
  • Delete button for batch deletion
• Bulk Tag Management
  • Tag autocomplete with existing tag suggestions
  • Add multiple tags at once to all selected tasks
  • Automatic tag deduplication
  • Shows selected task count in dialog

Task Dependencies

• Dependency System
  • Add blocking tasks that must be completed first
  • Circular dependency prevention with real-time validation
  • Visual dependency indicators on task cards
  • Dependency count badges
• Smart Dependency Logic
  • getBlockingTasks() - Find tasks that must be completed first
  • getBlockedTasks() - Find tasks waiting on this task
  • getReadyTasks() - Filter tasks with no blocking dependencies
  • Comprehensive validation with error messages
• Intuitive UI
  • Search and filter available tasks in dependency selector
  • Autocomplete dropdown with task title and description
  • Selected dependencies displayed as removable chips
  • Can't depend on self, completed tasks, or create circular refs

PWA Enhancements

• Install Prompt
  • Dedicated /install route with platform-specific instructions
  • Automatic install button for supported browsers
  • iOS, Android, and desktop Chrome guidance
• Update Notifications
  • Smart notification system with badge API support
  • Race condition fixes for reliable update detection
  • PWA update notification improvements

Additional Features

• Time Picker - Enhanced time selection for due dates
• Tag Autocomplete - Smarter tag suggestions and input
• Show/Hide Completed - Toggle completed tasks visibility with smart views integration
• Notification Settings - Configurable notification preferences with database persistence (v5 migration)

🐛 Bug Fixes

• Fixed TaskCard memoization to properly track dependency changes (#20)
• Resolved PWA update notification race condition (#17)
• Fixed static export configuration for proper PWA deployment (#19)
• Hardened notification system with better error handling
• Added delays to prevent timing flakiness in tests

🔧 Technical Improvements

• Database schema v6 with dependencies support and automatic migrations
• Added recharts@^3.2.1 and date-fns@^4.1.0 dependencies
• Enhanced test coverage for new features
• Refactored codebase to align with coding standards for better maintainability
• Improved error handling with structured patterns
• Performance optimizations for bulk operations using Set for O(1) lookups

📦 Migration Notes

If upgrading from v2.0:

• Database will auto-migrate to v6 (adds dependencies field)
• All existing tasks continue to work seamlessly
• New dependency field is optional with empty array default
• Export your data before upgrading as a precaution
• Dashboard route available at /dashboard

🚀 Getting Started

Visit gsd.vinny.dev to try the new features, or self-host by following TECHNICAL.md.

📊 Key Stats

• 20+ commits since v2.0
• 3 major feature areas (Dashboard, Batch Ops, Dependencies)
• 6 database schema versions with backward compatibility
• Enhanced PWA experience with install prompts and update notifications

---

Built with Next.js 15, TypeScript, Tailwind CSS, Dexie, Recharts, and ❤️

🤖 Generated with Claude Code

v2.0 - Advanced Filtering & Smart Views

GSD Task Manager v2.0 🎯

Major feature release adding advanced filtering, Smart Views, and enhanced UI organization.

🌟 New Features

Smart Views & Filtering System

• 7 Built-in Smart Views - Pre-configured filters for common workflows:
  • Today's Focus - Tasks due today across all quadrants
  • This Week - Tasks due within the next 7 days
  • Overdue Backlog - Past-due tasks requiring attention
  • No Deadline - Tasks without due dates
  • Recently Added - Tasks created in the last 7 days
  • Recently Completed - Completed tasks from the last 7 days
  • Recurring Tasks - All tasks with recurrence enabled
• Custom Smart Views - Save your own filter combinations for quick access
• Advanced Filtering - Filter by quadrants, status, tags, due dates, and recurrence
• Filter Chips - Visual display of active filters with easy removal
• Smart View Selector - Quick access dropdown in the header

Enhanced Task Management

• Recurring Tasks - Set tasks to repeat daily, weekly, or monthly
  • Auto-create new instances when completed
  • Subtasks reset in new instances
• Tags & Labels - Categorize tasks with multiple tags (#work, #personal, etc.)
• Subtasks & Checklists - Break down complex tasks into actionable steps
  • Visual progress bars showing completion
  • Toggle subtask completion in task form
• Enhanced Due Dates - Visual indicators for overdue and due-today tasks

Import/Export Improvements

• Import Mode Selection - Choose between merge and replace when importing
  • Merge mode: Safely add imported tasks to existing ones
  • Replace mode: Clear all tasks and import fresh data
• Duplicate Prevention - Auto-regenerate IDs to prevent conflicts

UI Improvements

• Settings Menu - Reorganized import/export into dedicated settings menu
• Streamlined Header - Cleaner layout with better visual hierarchy
• Dark Mode Support - Complete theme system with dark/light modes
• iPhone Optimizations - Enhanced mobile experience

🐛 Bug Fixes

• Fixed Smart View selector not resetting when "Clear All" is clicked
• Fixed timing flakiness in updateTask tests
• Fixed iOS caching issues with dynamic service worker
• Improved test coverage for filter system (99.23%)

🔧 Technical Improvements

• Database schema v4 with smartViews table
• Enhanced filter architecture with comprehensive test coverage
• Improved component organization and code maintainability
• Updated dependencies and security headers

📦 Migration Notes

If upgrading from v1.0:

• All existing tasks will continue to work
• New fields (recurrence, tags, subtasks) are optional with sensible defaults
• Export your data before upgrading as a precaution
• Smart Views are automatically initialized on first load

🚀 Getting Started

Visit gsd.vinny.dev to try the new features, or self-host by following TECHNICAL.md.

---

Built with Next.js 15, TypeScript, Tailwind CSS, Dexie, and ❤️

🤖 Generated with Claude Code

v1.0 - Initial Release

GSD Task Manager v1.0 🎉

First stable release of GSD Task Manager - a privacy-first Eisenhower Matrix task manager built with Next.js.

🌟 Key Features

• Eisenhower Matrix Implementation - Organize tasks by urgency and importance across four quadrants
• Privacy-First - All data stored locally in IndexedDB, nothing sent to servers
• Progressive Web App - Install on desktop and mobile for offline access
• Drag & Drop - Move tasks between quadrants with ease
• Keyboard Shortcuts - Fast task entry (n), search (/), and help (?)
• Export/Import - Backup and restore your tasks as JSON
• Enhanced Onboarding - Comprehensive welcome experience for new users
• Dark Mode Support - Easy on the eyes

📋 What's Included

• Complete task management (create, edit, delete, complete)
• Visual quadrant system with color-coded organization
• Real-time search and filtering
• Responsive design for all devices
• Comprehensive documentation (README.md, TECHNICAL.md, CLAUDE.md)

🚀 Quick Start

Visit gsd.vinny.dev to start using the app, or self-host by following the instructions in TECHNICAL.md.

📦 Recent Changes

• Enhanced onboarding experience with visual matrix guide
• Updated documentation with gsd-matrix.png visual
• Restructured README for end users
• Added comprehensive TECHNICAL.md for developers
• Drag-and-drop task movement between quadrants
• Open Graph social share image
• Lighthouse accessibility and SEO improvements

---

Built with Next.js 15, TypeScript, Tailwind CSS, Dexie, and ❤️