Tom Qiao b9602adabe fix(handler): validate skill id UUID at request boundary (#3025) ...

loadSkillForUser was passing chi.URLParam(r, "id") directly into
parseUUID, the panic-on-invalid helper reserved for trusted UUID
round-trips. A malformed `/api/skills/{notuuid}` request panicked
in util.MustParseUUID; chi's middleware.Recoverer turned it into a
500 instead of a 400.

This violates the documented convention (CLAUDE.md → "Backend Handler
UUID Parsing Convention"): pure-UUID request inputs must use
parseUUIDOrBadRequest, which writes a 400 and short-circuits.

Switch loadSkillForUser to parseUUIDOrBadRequest. Behaviour for valid
UUIDs is unchanged; malformed input now returns 400 with a clear
"invalid skill id" message.

Test:
- TestGetSkill_MalformedUUIDReturns400 asserts GET /api/skills/not-a-uuid
  returns 400.

Co-authored-by: Tom Qiao <tomqiaozc@users.noreply.github.com>

2026-05-22 12:22:07 +08:00

..

activity_test.go

refactor(timeline): drop server-side comment + timeline pagination (#2322)

2026-05-09 16:11:58 +08:00

activity.go

refactor(timeline): drop server-side comment + timeline pagination (#2322)

2026-05-09 16:11:58 +08:00

agent_access_test.go

feat(agents): gate private-agent surfaces with allowed_principals predicate (#2359)

2026-05-11 12:39:45 +08:00

agent_access.go

feat(agents): gate private-agent surfaces with allowed_principals predicate (#2359)

2026-05-11 12:39:45 +08:00

agent_template.go

feat(agents): one-click create from curated templates (Phase 1) (#2520)

2026-05-13 18:26:04 +08:00

agent_test.go

Agent runtime status redesign: split presence into availability + last-task (#1794)

2026-04-28 19:21:13 +08:00

agent_thinking_test.go

feat(agent): per-agent thinking_level for claude + codex (MUL-2339) (#2865)

2026-05-20 12:30:10 +08:00

agent.go

feat(agent): per-agent thinking_level for claude + codex (MUL-2339) (#2865)

2026-05-20 12:30:10 +08:00

auth_signup_test.go

feat(analytics): full PostHog pipeline + 6 funnel events (MUL-1122) (#1367)

2026-04-21 14:42:52 +08:00

auth.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

autopilot_webhook_handler_test.go

feat(autopilots): webhook triggers (server + CLI + UI + docs) MUL-2049 (#2348)

2026-05-18 12:17:39 +08:00

autopilot_webhook_iprl_test.go

feat(autopilots): webhook triggers (server + CLI + UI + docs) MUL-2049 (#2348)

2026-05-18 12:17:39 +08:00

autopilot_webhook_test.go

feat(autopilots): webhook triggers (server + CLI + UI + docs) MUL-2049 (#2348)

2026-05-18 12:17:39 +08:00

autopilot_webhook.go

feat(autopilots): webhook delivery layer + idempotency/signature/replay (MUL-2334) [PR1] (#2774)

2026-05-18 14:59:40 +08:00

autopilot.go

feat(autopilot): link created issues to projects (#2908)

2026-05-20 15:37:23 +08:00

chat_test.go

feat(chat): support renaming chat sessions inline (#2522)

2026-05-13 16:57:34 +08:00

chat.go

feat(chat): support renaming chat sessions inline (#2522)

2026-05-13 16:57:34 +08:00

cloud_runtime_test.go

feat: server auto-generates PAT for cloud runtime bootstrap (#3002)

2026-05-21 17:07:44 +08:00

cloud_runtime.go

feat: server auto-generates PAT for cloud runtime bootstrap (#3002)

2026-05-21 17:07:44 +08:00

comment_list_test.go

feat(comments): thread-internal --tail pagination + reply cursor (MUL-2421) (#2846)

2026-05-21 13:43:15 +08:00

comment.go

feat(comments): thread-internal --tail pagination + reply cursor (MUL-2421) (#2846)

2026-05-21 13:43:15 +08:00

config_test.go

Add canonical PostHog core metrics events (#2302)

2026-05-09 13:12:00 +08:00

config.go

Add canonical PostHog core metrics events (#2302)

2026-05-09 13:12:00 +08:00

daemon_test.go

fix(daemon): reclaim stale dispatched claims (MUL-2485) (#2872)

2026-05-21 17:06:55 +08:00

daemon_ws.go

feat: add daemon websocket task wakeups (#1772)

2026-04-28 16:07:24 +08:00

daemon.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

dashboard_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

dashboard.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

feedback_test.go

feat(feedback): in-app feedback flow + Help launcher (#1546)

2026-04-23 10:35:55 +08:00

feedback.go

refactor(server): error-returning ParseUUID to prevent silent data loss

2026-04-28 14:50:28 +08:00

file_test.go

feat: in-app preview for non-image attachments (#2528)

2026-05-13 18:24:15 +08:00

file.go

feat: in-app preview for non-image attachments (#2528)

2026-05-13 18:24:15 +08:00

github_test.go

feat(github): expose read-only installation list to workspace members (MUL-2413) (#2886)

2026-05-20 04:17:45 +02:00

github.go

feat(github): expose read-only installation list to workspace members (MUL-2413) (#2886)

2026-05-20 04:17:45 +02:00

handler_test.go

feat(autopilot): link created issues to projects (#2908)

2026-05-20 15:37:23 +08:00

handler.go

feat(issues): per-issue metadata KV (MUL-2017) (#2845)

2026-05-21 16:35:45 +08:00

heartbeat_scheduler_test.go

perf(heartbeat): batch runtime last_seen_at writes (#2213)

2026-05-07 15:50:27 +08:00

heartbeat_scheduler.go

perf(heartbeat): batch runtime last_seen_at writes (#2213)

2026-05-07 15:50:27 +08:00

heartbeat_test.go

feat(server): redis-backed runtime liveness with DB fallback (#2121)

2026-05-06 14:31:33 +08:00

inbox.go

refactor(server): error-returning ParseUUID to prevent silent data loss

2026-04-28 14:50:28 +08:00

invitation_test.go

fix(server): allow re-inviting after invitation expires (#2059)

2026-05-04 21:24:56 +08:00

invitation.go

feat(onboarding): v3 — thin server, frontend-orchestrated welcome (#3008)

2026-05-21 19:00:26 +08:00

issue_batch_test.go

fix(api): batch-update no-op responses report updated=0 (#1660) (#1759)

2026-04-30 15:35:12 +08:00

issue_grouped_test.go

Add assignee grouping for issue boards (#2693)

2026-05-15 18:44:08 +08:00

issue_involves_test.go

feat(my-issues): cover squad assignees via involves_user_id (MUL-2397) (#2829)

2026-05-19 10:37:38 +08:00

issue_metadata_test.go

feat(issues): per-issue metadata KV (MUL-2017) (#2845)

2026-05-21 16:35:45 +08:00

issue_metadata.go

feat(issues): per-issue metadata KV (MUL-2017) (#2845)

2026-05-21 16:35:45 +08:00

issue_reaction.go

…

issue_scheduled_test.go

feat(projects): scheduled-only Gantt data source + WS reactivity (MUL-1881) (#2856)

2026-05-19 17:04:16 +08:00

issue.go

feat(issues): per-issue metadata KV (MUL-2017) (#2845)

2026-05-21 16:35:45 +08:00

label_test.go

feat(labels): ship issue labels (closes #1191) (#1233)

2026-04-27 14:23:42 +08:00

label.go

refactor(server): error-returning ParseUUID to prevent silent data loss

2026-04-28 14:50:28 +08:00

mention_self_trigger_test.go

MUL-2338 fix(comments): allow agent self-mention to enqueue cross-issue handoff (#2928)

2026-05-20 17:18:41 +08:00

notification_preference.go

feat(notifications): add system notifications toggle in settings (#2132)

2026-05-06 11:01:22 +02:00

onboarding_shim.go

feat(onboarding): v3 — thin server, frontend-orchestrated welcome (#3008)

2026-05-21 19:00:26 +08:00

onboarding_test.go

feat(onboarding): v3 — thin server, frontend-orchestrated welcome (#3008)

2026-05-21 19:00:26 +08:00

onboarding.go

feat(onboarding): v3 — thin server, frontend-orchestrated welcome (#3008)

2026-05-21 19:00:26 +08:00

parse_since_param_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

personal_access_token.go

feat(server/auth): cache auth token lookups in Redis with 10m TTL

2026-04-29 17:07:54 +08:00

pin.go

refactor(server): error-returning ParseUUID to prevent silent data loss

2026-04-28 14:50:28 +08:00

project_resource_test.go

fix(projects): accept SSH repo URLs for github_repo resources MUL-2112 (#2492)

2026-05-15 12:47:38 +08:00

project_resource.go

fix(projects): accept SSH repo URLs for github_repo resources MUL-2112 (#2492)

2026-05-15 12:47:38 +08:00

project.go

fix(projects): add resource_count breadcrumb instead of inlining resources (#2118)

2026-05-06 14:09:35 +08:00

reaction.go

refactor(server): error-returning ParseUUID to prevent silent data loss

2026-04-28 14:50:28 +08:00

reserved_slugs.json

feat: implement Squad feature MVP (#2505)

2026-05-13 18:46:20 +08:00

runtime_liveness_store_test.go

feat(server): redis-backed runtime liveness with DB fallback (#2121)

2026-05-06 14:31:33 +08:00

runtime_liveness_store.go

feat(server): redis-backed runtime liveness with DB fallback (#2121)

2026-05-06 14:31:33 +08:00

runtime_local_skills_redis_store_test.go

feat(skills): support multi-select bulk import in Copy from runtime (#2686)

2026-05-18 16:56:27 +08:00

runtime_local_skills_redis_store.go

feat(skills): support multi-select bulk import in Copy from runtime (#2686)

2026-05-18 16:56:27 +08:00

runtime_local_skills_test.go

feat(skills): support multi-select bulk import in Copy from runtime (#2686)

2026-05-18 16:56:27 +08:00

runtime_local_skills.go

feat(skills): support multi-select bulk import in Copy from runtime (#2686)

2026-05-18 16:56:27 +08:00

runtime_models_redis_store_test.go

fix(server): persist ModelListStore across replicas via Redis (#2022)

2026-05-03 11:13:34 +08:00

runtime_models_redis_store.go

fix(server): persist ModelListStore across replicas via Redis (#2022)

2026-05-03 11:13:34 +08:00

runtime_models_test.go

fix(server): persist ModelListStore across replicas via Redis (#2022)

2026-05-03 11:13:34 +08:00

runtime_models.go

feat(agent): per-agent thinking_level for claude + codex (MUL-2339) (#2865)

2026-05-20 12:30:10 +08:00

runtime_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

runtime_update_redis_store_test.go

fix(runtime): persist CLI update requests in Redis (#2113)

2026-05-06 13:00:11 +08:00

runtime_update_redis_store.go

fix(runtime): persist CLI update requests in Redis (#2113)

2026-05-06 13:00:11 +08:00

runtime_update_test.go

fix(runtime): persist CLI update requests in Redis (#2113)

2026-05-06 13:00:11 +08:00

runtime_update.go

fix(runtime): persist CLI update requests in Redis (#2113)

2026-05-06 13:00:11 +08:00

runtime_visibility_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

runtime.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

search_test.go

fix: improve search ranking and snippet support (MUL-2329)

2026-05-18 15:45:06 +08:00

skill_create.go

feat(agents): one-click create from curated templates (Phase 1) (#2520)

2026-05-13 18:26:04 +08:00

skill_list_test.go

fix(handler): validate skill id UUID at request boundary (#3025)

2026-05-22 12:22:07 +08:00

skill_test.go

feat(agents): one-click create from curated templates (Phase 1) (#2520)

2026-05-13 18:26:04 +08:00

skill.go

fix(handler): validate skill id UUID at request boundary (#3025)

2026-05-22 12:22:07 +08:00

squad_assign_trigger_test.go

feat: implement Squad feature MVP (#2505)

2026-05-13 18:46:20 +08:00

squad_briefing_test.go

feat: implement Squad feature MVP (#2505)

2026-05-13 18:46:20 +08:00

squad_briefing.go

squad_briefing: add hard rule requiring mention link for every delegation (#2663)

2026-05-15 13:17:08 +08:00

squad_comment_trigger_test.go

fix(squad): wake leader when dual-role agent posts as worker (MUL-2218) (#2626)

2026-05-14 15:23:36 +02:00

squad_member_status_test.go

feat(squads): show member working status on squad detail page (#2768)

2026-05-18 10:35:18 +02:00

squad_no_action_test.go

fix(squad): suppress no-action leader comments (#2583)

2026-05-14 14:07:26 +08:00

squad.go

feat(autopilot): support assigning to a squad (MUL-2429) (#2888)

2026-05-20 05:30:13 +02:00

subscriber_test.go

feat(agents): gate private-agent surfaces with allowed_principals predicate (#2359)

2026-05-11 12:39:45 +08:00

subscriber.go

feat(cli): add issue subscriber commands (#1265)

2026-04-17 16:26:00 +08:00

task_lifecycle.go

fix(issues): retry button targets the row's agent (MUL-2457) (#2921)

2026-05-20 15:30:03 +08:00

trigger_test.go

fix(comment): don't inherit parent @mentions from agent-authored roots (#1833)

2026-04-29 15:54:24 +08:00

user_language_test.go

feat(i18n): full rollout — 21 namespaces translated (en + zh-Hans) (#1853)

2026-05-06 16:16:12 +08:00

user_timezone_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

webhook_delivery_test.go

feat(autopilots): webhook delivery layer + idempotency/signature/replay (MUL-2334) [PR1] (#2774)

2026-05-18 14:59:40 +08:00

webhook_delivery.go

feat(autopilots): webhook delivery layer + idempotency/signature/replay (MUL-2334) [PR1] (#2774)

2026-05-18 14:59:40 +08:00

webhook_rate_limiter_test.go

feat(autopilots): webhook triggers (server + CLI + UI + docs) MUL-2049 (#2348)

2026-05-18 12:17:39 +08:00

webhook_rate_limiter.go

feat(autopilots): webhook triggers (server + CLI + UI + docs) MUL-2049 (#2348)

2026-05-18 12:17:39 +08:00

workspace_reserved_slugs.go

refactor(reserved-slugs): single JSON source for backend + frontend (#2148)

2026-05-08 19:14:12 +08:00

workspace_revoke.go

feat(workspace): revoke a member's runtimes when they leave or are removed (#2401)

2026-05-11 15:06:50 +08:00

workspace_test.go

feat(onboarding): v3 — thin server, frontend-orchestrated welcome (#3008)

2026-05-21 19:00:26 +08:00

workspace.go

feat(onboarding): v3 — thin server, frontend-orchestrated welcome (#3008)

2026-05-21 19:00:26 +08:00