Track authenticated sessions per device (parsing user-agent for desktop
vs mobile via mileusna/useragent), enforce configurable concurrent device
limits (Auth.DeviceLimits), and surface device status and "remove other
devices" management in the account dialog. Adds device/session context to
the auth module stores and exposes limits through the API.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a public GET /api/ui/agent-starters endpoint returning localized
empty-state content (title, description, preview images, and starter
prompts) for the canvas Agent panel. Content is server-configurable via
AgentStarter config with built-in zh-CN/en-US fallbacks, and the route is
exempt from authentication so shared canvases render the same content.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a brand kit domain with memory and postgres stores, a BrandKitService
for CRUD and resolution, and REST endpoints to list, upsert, and delete
brand kits. Projects can bind a brand kit whose resolved context and
reference images feed into the agent's long-term memory and design prompts.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Authenticate requests solely from the Authorization: Bearer header on the
server; stop accepting the legacy `token` header and `usertoken` cookie.
The frontend no longer sets auth cookies (only clears legacy ones), omits
credentials on all requests, and drops the redundant `token` header. Project
event SSE now streams over fetch so it can carry the Authorization header,
which EventSource cannot.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add canva/canda-compatible routes for lightweight project open/save and
agent thread history:
- POST /canva/project/queryProject, saveProject
- POST /canva/agent/queryAgentLastThread, agentThreadList
- GET /canda/chat-history, /canda/thread/status
Canvas save now accepts a compressed SHAKKERDATA:// snapshot payload,
preserves connections, and returns a SaveProject response; blank
successful image nodes are backfilled from generated artifacts. Frontend
designGateway adopts the new save/query flow.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
root