Changelog

All notable changes to GridWork HQ are documented here.

[1.2.0] — 2026-04-14

Added

• SQLite database via Drizzle ORM (replaces Vercel KV dependency)
• Full CSS token system (gw-* custom properties) with dark/light mode support
• Docker support (Dockerfile + docker-compose.yml)
• WelcomeBanner onboarding flow with demo data seeding
• EmptyState components on all dashboard pages
• Database migration support via drizzle-kit
• 12 automated cron jobs (up from 4 documented)
• Pipeline-server SSE rate limiting (20 connections/min per IP)
• CHANGELOG.md and expanded ADVANCED_EXTENSIONS.md

Changed

• Marketing copy: accurate pipeline count (17 + compiler), cron count (12)
• Knowledge vault: all branding replaced with {{AGENCY_*}} placeholders
• Setup wizard: collects PIPELINE_SERVER_URL, runs health check, substitutes knowledge placeholders
• All docs: correct directory names, correct commands, SQLite references
• Chat panel: responsive on mobile (full-width overlay)
• 92 icon-only buttons now have aria-label attributes

Fixed

• spawner.ts: undefined/.output bug in findOutput()
• worktree-manager.ts: shell injection via execSync replaced with execFileSync
• system-routes.ts: shell injection via TRACKED_REPOS
• 59 silent error catches replaced with proper logging
• 8 API routes: added try/catch for external calls
• 5 API routes: no longer return 200 on error

Security

• Cron command allowlist prevents arbitrary shell execution
• CSP nonce extended to style-src
• Pipeline-server SSE rate limiting

Upgrade Path (from v1.1)

After pulling v1.2 updates, run bun run migrate in gridwork-hq/ to apply schema changes.

---

[1.1.0] — 2026-03-22

Added

• Full pipeline-server TypeScript migration
• Prettier + Husky + lint-staged
• Vitest test suite (22 tests)
• Nonce-based CSP implementation
• Security headers on pipeline-server

Changed

• Bearer token moved from query string to Authorization header
• All pipeline traffic routed through HQ API proxy
• Metric cards upgraded to premium tier
• textMuted contrast fixed for WCAG AA

Removed

• Zep Cloud integration (moved to ADVANCED_EXTENSIONS.md)
• @hello-pangea/dnd (replaced by @dnd-kit)
• NEXT_PUBLIC_PIPELINE_URL

---

[1.0.0] — 2026-03-15

Added

• Initial release
• Next.js dashboard with 9 pages
• Pipeline server with 17 pipeline definitions
• GitHub OAuth authentication
• Notion, Stripe, Vercel, GitHub integrations
• Setup wizard (5-phase guided configuration)
• Knowledge vault template system