From 26a8fb5c5158c54e6a1320d5bad5e8d9cb484a79 Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Thu, 26 Mar 2026 22:24:37 -0400
Subject: [PATCH 1/6] fix: load API keys and MCP info on mount when tab is
 pre-selected
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fetchApiKeys() and loadMcpInfo() were only wired to the activeTab watcher,
which fires on changes but not on initial mount. If localStorage had
'apikeys' as the last tab, both calls were skipped entirely — causing
an empty key list and no whl download button.
---
 frontend/src/views/SettingsView.vue | 1 +
 1 file changed, 1 insertion(+)

diff --git a/frontend/src/views/SettingsView.vue b/frontend/src/views/SettingsView.vue
index 0b011e3..1245690 100644
--- a/frontend/src/views/SettingsView.vue
+++ b/frontend/src/views/SettingsView.vue
@@ -524,6 +524,7 @@ onMounted(async () => {
     if (activeTab.value === "groups") loadGroupsPanel();
     if (activeTab.value === "briefing") loadBriefingTab();
   }
+  if (activeTab.value === "apikeys") { fetchApiKeys(); loadMcpInfo(); }
 });
 
 async function changeEmail() {

From 2b2e5c666a29545782fdb1fbaec2d34e4c2adf57 Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Thu, 26 Mar 2026 22:32:28 -0400
Subject: [PATCH 2/6] fix: load all pre-selected settings tabs correctly on
 mount
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The watch(activeTab) handler loads tab data on navigation, but not on
initial mount when localStorage restores a tab. Three more gaps:

- briefing: was inside the isAdmin guard — non-admin users who last
  visited the Briefing tab would see an empty form
- users: no onMounted equivalent — admin user list never loaded
- logs: no onMounted equivalent — admin log viewer never loaded

Moves briefing outside the admin guard and adds users/logs inside it.
---
 frontend/src/views/SettingsView.vue | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/frontend/src/views/SettingsView.vue b/frontend/src/views/SettingsView.vue
index 1245690..878ae8e 100644
--- a/frontend/src/views/SettingsView.vue
+++ b/frontend/src/views/SettingsView.vue
@@ -522,8 +522,10 @@ onMounted(async () => {
       // base URL not configured yet
     }
     if (activeTab.value === "groups") loadGroupsPanel();
-    if (activeTab.value === "briefing") loadBriefingTab();
+    if (activeTab.value === "users") loadUsersPanel();
+    if (activeTab.value === "logs") loadLogsPanel();
   }
+  if (activeTab.value === "briefing") loadBriefingTab();
   if (activeTab.value === "apikeys") { fetchApiKeys(); loadMcpInfo(); }
 });
 

From 699e525cb9e3cde2c1fa29560227bff5816e3fbc Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Thu, 26 Mar 2026 22:43:59 -0400
Subject: [PATCH 3/6] =?UTF-8?q?refactor:=20DRY=20pass=20on=20frontend=20?=
 =?UTF-8?q?=E2=80=94=20shared=20palette,=20composable,=20and=20tab=20loade?=
 =?UTF-8?q?r?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Extract milestoneColor to utils/palette.ts; remove duplicate in HomeView + ProjectListView
- Create useBackgroundRefresh composable; wire into HomeView + BriefingView (removes manual setInterval/clearInterval boilerplate)
- Extract _loadTabContent() in SettingsView so watch and onMounted share one tab→loader mapping
- Move raw fetch() api-key calls to typed helpers in api/client.ts (listApiKeys, createApiKey, revokeApiKey)
- Drop unused onUnmounted import from BriefingView

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 frontend/src/api/client.ts                    | 18 +++++++
 .../src/composables/useBackgroundRefresh.ts   | 29 +++++++++++
 frontend/src/utils/palette.ts                 | 13 +++++
 frontend/src/views/BriefingView.vue           | 17 +++----
 frontend/src/views/HomeView.vue               | 24 ++-------
 frontend/src/views/ProjectListView.vue        | 12 +----
 frontend/src/views/SettingsView.vue           | 51 ++++++++-----------
 7 files changed, 95 insertions(+), 69 deletions(-)
 create mode 100644 frontend/src/composables/useBackgroundRefresh.ts
 create mode 100644 frontend/src/utils/palette.ts

diff --git a/frontend/src/api/client.ts b/frontend/src/api/client.ts
index 5ae97d0..78e565a 100644
--- a/frontend/src/api/client.ts
+++ b/frontend/src/api/client.ts
@@ -580,3 +580,21 @@ export async function updateEvent(id: number, payload: EventUpdatePayload): Prom
 export async function deleteEvent(id: number): Promise<void> {
   return apiDelete(`/api/events/${id}`);
 }
+
+// ─── API Keys ─────────────────────────────────────────────────────────────────
+
+export interface ApiKeyEntry {
+  id: number
+  name: string
+  scope: string
+  key_prefix: string
+  last_used_at: string | null
+}
+
+export const listApiKeys = () =>
+  apiGet<{ api_keys: ApiKeyEntry[] }>('/api/api-keys').then(r => r.api_keys)
+
+export const createApiKey = (name: string, scope: 'read' | 'write') =>
+  apiPost<{ key: string; api_key: ApiKeyEntry }>('/api/api-keys', { name, scope })
+
+export const revokeApiKey = (id: number) => apiDelete(`/api/api-keys/${id}`)
diff --git a/frontend/src/composables/useBackgroundRefresh.ts b/frontend/src/composables/useBackgroundRefresh.ts
new file mode 100644
index 0000000..9aa2912
--- /dev/null
+++ b/frontend/src/composables/useBackgroundRefresh.ts
@@ -0,0 +1,29 @@
+import { onMounted, onUnmounted } from 'vue'
+
+/**
+ * Runs `refreshFn` on a recurring interval while the page is visible.
+ * Safe to use in any component — timer is cleared on unmount.
+ *
+ * @param refreshFn   Called each tick. Should be silent (no loading state changes).
+ * @param intervalMs  Polling interval in milliseconds.
+ * @param canRun      Optional guard — refresh is skipped when this returns false.
+ */
+export function useBackgroundRefresh(
+  refreshFn: () => void,
+  intervalMs: number,
+  canRun?: () => boolean,
+): void {
+  let timer: ReturnType<typeof setInterval> | null = null
+
+  onMounted(() => {
+    timer = setInterval(() => {
+      if (document.hidden) return
+      if (canRun && !canRun()) return
+      refreshFn()
+    }, intervalMs)
+  })
+
+  onUnmounted(() => {
+    if (timer !== null) clearInterval(timer)
+  })
+}
diff --git a/frontend/src/utils/palette.ts b/frontend/src/utils/palette.ts
new file mode 100644
index 0000000..e04101d
--- /dev/null
+++ b/frontend/src/utils/palette.ts
@@ -0,0 +1,13 @@
+/** Cyclic color palette for milestone progress bars. */
+export const MILESTONE_PALETTE = [
+  'var(--color-primary)',
+  'var(--color-success, #22c55e)',
+  '#c98a00',
+  '#8b5cf6',
+  'var(--color-danger, #ef4444)',
+  '#06b6d4',
+]
+
+export function milestoneColor(index: number): string {
+  return MILESTONE_PALETTE[index % MILESTONE_PALETTE.length]
+}
diff --git a/frontend/src/views/BriefingView.vue b/frontend/src/views/BriefingView.vue
index 63c236d..d3c0fce 100644
--- a/frontend/src/views/BriefingView.vue
+++ b/frontend/src/views/BriefingView.vue
@@ -1,5 +1,6 @@
 <script setup lang="ts">
-import { ref, computed, onMounted, onUnmounted, watch } from 'vue'
+import { ref, computed, onMounted, watch } from 'vue'
+import { useBackgroundRefresh } from '@/composables/useBackgroundRefresh'
 import { useChatStore } from '@/stores/chat'
 import ChatMessage from '@/components/ChatMessage.vue'
 import WeatherCard from '@/components/WeatherCard.vue'
@@ -190,10 +191,7 @@ function toMsg(m: BriefingMessage): Message {
 }
 
 // ─── Background refresh (no-flicker) ─────────────────────────────────────────
-let _refreshTimer: ReturnType<typeof setInterval> | null = null
-
 async function _backgroundRefreshMessages() {
-  if (document.hidden || chatStore.streaming || !isToday.value || !todayConvId.value) return
   try {
     const today = await getBriefingToday()
     if (!today) return
@@ -206,14 +204,15 @@ async function _backgroundRefreshMessages() {
   } catch { /* silent — don't disturb the UI on network hiccup */ }
 }
 
+useBackgroundRefresh(
+  _backgroundRefreshMessages,
+  60_000,
+  () => !chatStore.streaming && isToday.value && !!todayConvId.value,
+)
+
 onMounted(async () => {
   await checkSetup()
   if (!showWizard.value) await loadAll()
-  _refreshTimer = setInterval(_backgroundRefreshMessages, 60_000)
-})
-
-onUnmounted(() => {
-  if (_refreshTimer !== null) clearInterval(_refreshTimer)
 })
 </script>
 
diff --git a/frontend/src/views/HomeView.vue b/frontend/src/views/HomeView.vue
index 40664c3..ca79eda 100644
--- a/frontend/src/views/HomeView.vue
+++ b/frontend/src/views/HomeView.vue
@@ -1,6 +1,8 @@
 <script setup lang="ts">
 import { ref, computed, onMounted, onUnmounted } from "vue";
 import { apiGet, listEvents } from "@/api/client";
+import { useBackgroundRefresh } from "@/composables/useBackgroundRefresh";
+import { milestoneColor } from "@/utils/palette";
 import type { Note } from "@/types/note";
 import type { Task, TaskListResponse, TaskStatus } from "@/types/task";
 import type { ToolCallRecord, Message } from "@/types/chat";
@@ -69,24 +71,8 @@ const upcomingEvents = ref<EventEntry[]>([]);
 const eventSlideOverOpen = ref(false);
 const editingEvent = ref<EventEntry | null>(null);
 
-// ─── Milestone color palette ──────────────────────────────────────────────────
-
-function milestoneColor(index: number): string {
-  const palette = [
-    "var(--color-primary)",
-    "var(--color-success, #22c55e)",
-    "#c98a00",
-    "var(--color-danger, #e74c3c)",
-    "#8b5cf6",
-  ];
-  return palette[index % palette.length];
-}
-
 // ─── Background refresh (no-flicker) ─────────────────────────────────────────
-// Runs on a timer while the page is visible. Never touches `loading` so
-// existing content stays on screen while the fetch is in flight.
-
-let _refreshTimer: ReturnType<typeof setInterval> | null = null
+// Never touches `loading` so existing content stays on screen while fetching.
 
 function _dateRange() {
   const today = new Date()
@@ -173,9 +159,10 @@ onMounted(async () => {
   chatInputRef.value?.focus();
   loadProjects();
 
-  _refreshTimer = setInterval(_backgroundRefresh, 90_000)
 });
 
+useBackgroundRefresh(_backgroundRefresh, 90_000, () => !loading.value);
+
 async function loadProjects() {
   if (!heroProject.value) return;
   const hid = heroProject.value.id;
@@ -239,7 +226,6 @@ onMounted(() => {
 });
 onUnmounted(() => {
   document.removeEventListener("shortcut:focus-chat", onFocusChatShortcut);
-  if (_refreshTimer !== null) clearInterval(_refreshTimer)
 });
 
 const chatStore = useChatStore();
diff --git a/frontend/src/views/ProjectListView.vue b/frontend/src/views/ProjectListView.vue
index 639cfc0..27c1ebb 100644
--- a/frontend/src/views/ProjectListView.vue
+++ b/frontend/src/views/ProjectListView.vue
@@ -3,6 +3,7 @@ import { ref, computed, onMounted } from "vue";
 import { useRouter } from "vue-router";
 import { apiGet, apiPost } from "@/api/client";
 import { useToastStore } from "@/stores/toast";
+import { milestoneColor } from "@/utils/palette";
 
 interface MilestoneSummary {
   id: number;
@@ -73,17 +74,6 @@ async function loadProjects() {
   }
 }
 
-function milestoneColor(index: number): string {
-  const palette = [
-    "var(--color-primary)",
-    "var(--color-success)",
-    "#c98a00",
-    "#8b5cf6",
-    "#ef4444",
-    "#06b6d4",
-  ];
-  return palette[index % palette.length];
-}
 
 onMounted(loadProjects);
 
diff --git a/frontend/src/views/SettingsView.vue b/frontend/src/views/SettingsView.vue
index 878ae8e..8e99572 100644
--- a/frontend/src/views/SettingsView.vue
+++ b/frontend/src/views/SettingsView.vue
@@ -3,7 +3,7 @@ import { ref, watch, onMounted } from "vue";
 import { useSettingsStore } from "@/stores/settings";
 import { useAuthStore } from "@/stores/auth";
 import { useToastStore } from "@/stores/toast";
-import { apiGet, apiPost, apiPut, apiDelete, listGroups, createGroup, deleteGroup, listGroupMembers, addGroupMember, removeGroupMember, searchUsers, getBriefingConfig, saveBriefingConfig, getBriefingFeeds, createBriefingFeed, deleteBriefingFeed, refreshBriefingFeeds, geocodeAddress, getFableMcpInfo, type GroupEntry, type GroupMember, type UserSearchResult, type BriefingConfig, type BriefingFeed } from "@/api/client";
+import { apiGet, apiPost, apiPut, apiDelete, listGroups, createGroup, deleteGroup, listGroupMembers, addGroupMember, removeGroupMember, searchUsers, getBriefingConfig, saveBriefingConfig, getBriefingFeeds, createBriefingFeed, deleteBriefingFeed, refreshBriefingFeeds, geocodeAddress, getFableMcpInfo, listApiKeys, createApiKey as apiCreateApiKey, revokeApiKey as apiRevokeApiKey, type ApiKeyEntry, type GroupEntry, type GroupMember, type UserSearchResult, type BriefingConfig, type BriefingFeed } from "@/api/client";
 import { usePushStore } from "@/stores/push";
 import type { User } from "@/types/auth";
 import PaginationBar from "@/components/PaginationBar.vue";
@@ -43,17 +43,24 @@ const restoreFileInput = ref<HTMLInputElement | null>(null);
 const VALID_TABS = new Set(["general", "account", "notifications", "integrations", "data", "briefing", "apikeys", "config", "users", "logs", "groups"]);
 const _stored = localStorage.getItem("settings_tab") ?? "general";
 const activeTab = ref(VALID_TABS.has(_stored) ? (_stored === "admin" ? "config" : _stored) : "general");
+
+function _loadTabContent(tab: string) {
+  if (authStore.isAdmin) {
+    if (tab === "users") loadUsersPanel();
+    else if (tab === "logs") loadLogsPanel();
+    else if (tab === "groups") loadGroupsPanel();
+  }
+  if (tab === "briefing") loadBriefingTab();
+  if (tab === "apikeys") { fetchApiKeys(); loadMcpInfo(); }
+}
+
 watch(activeTab, (v) => {
   localStorage.setItem("settings_tab", v === "admin" ? "config" : v);
-  if (v === "users" && authStore.isAdmin) loadUsersPanel();
-  if (v === "logs" && authStore.isAdmin) loadLogsPanel();
-  if (v === "groups" && authStore.isAdmin) loadGroupsPanel();
-  if (v === "briefing") loadBriefingTab();
-  if (v === "apikeys") { fetchApiKeys(); loadMcpInfo(); }
+  _loadTabContent(v);
 });
 
 // API Keys
-const apiKeys = ref<Array<{id: number, name: string, scope: string, key_prefix: string, last_used_at: string | null}>>([]);
+const apiKeys = ref<ApiKeyEntry[]>([]);
 const newKeyName = ref('');
 const newKeyScope = ref<'read' | 'write'>('write');
 const newKeyValue = ref('');
@@ -89,36 +96,24 @@ async function loadMcpInfo() {
 }
 
 async function fetchApiKeys() {
-  const res = await fetch('/api/api-keys', { credentials: 'include' });
-  if (res.ok) {
-    const data = await res.json();
-    apiKeys.value = data.api_keys;
-  }
+  apiKeys.value = await listApiKeys();
 }
 
 async function createApiKey() {
   if (!newKeyName.value) return;
   creatingApiKey.value = true;
   try {
-    const res = await fetch('/api/api-keys', {
-      method: 'POST',
-      credentials: 'include',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ name: newKeyName.value, scope: newKeyScope.value }),
-    });
-    if (res.ok) {
-      const data = await res.json();
-      newKeyValue.value = data.key;
-      newKeyName.value = '';
-      await fetchApiKeys();
-    }
+    const data = await apiCreateApiKey(newKeyName.value, newKeyScope.value);
+    newKeyValue.value = data.key;
+    newKeyName.value = '';
+    await fetchApiKeys();
   } finally {
     creatingApiKey.value = false;
   }
 }
 
 async function revokeApiKey(id: number) {
-  await fetch(`/api/api-keys/${id}`, { method: 'DELETE', credentials: 'include' });
+  await apiRevokeApiKey(id);
   revokeConfirmId.value = null;
   await fetchApiKeys();
 }
@@ -521,12 +516,8 @@ onMounted(async () => {
     } catch {
       // base URL not configured yet
     }
-    if (activeTab.value === "groups") loadGroupsPanel();
-    if (activeTab.value === "users") loadUsersPanel();
-    if (activeTab.value === "logs") loadLogsPanel();
   }
-  if (activeTab.value === "briefing") loadBriefingTab();
-  if (activeTab.value === "apikeys") { fetchApiKeys(); loadMcpInfo(); }
+  _loadTabContent(activeTab.value);
 });
 
 async function changeEmail() {

From 22634aa0c9023923041ddf4237fed8a2f28c3fdc Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Thu, 26 Mar 2026 22:52:39 -0400
Subject: [PATCH 4/6] =?UTF-8?q?refactor:=20DRY=20pass=20on=20backend=20?=
 =?UTF-8?q?=E2=80=94=20pagination=20helper=20and=20sharing=20utilities?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add parse_pagination() to routes/utils.py; replace 6 duplicate limit/offset extractions in notes, tasks, chat, projects, milestones routes
- Extract _enrich_shares() in sharing.py; eliminates identical 12-line loop in list_project_shares and list_note_shares
- Extract _deduplicate_by_permission() in sharing.py; eliminates identical deduplication blocks in list_shared_with_me for projects and notes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/fabledassistant/routes/chat.py       |  5 +-
 src/fabledassistant/routes/milestones.py |  5 +-
 src/fabledassistant/routes/notes.py      |  5 +-
 src/fabledassistant/routes/projects.py   |  5 +-
 src/fabledassistant/routes/tasks.py      |  5 +-
 src/fabledassistant/routes/utils.py      |  9 +++-
 src/fabledassistant/services/sharing.py  | 65 +++++++++++-------------
 7 files changed, 49 insertions(+), 50 deletions(-)

diff --git a/src/fabledassistant/routes/chat.py b/src/fabledassistant/routes/chat.py
index e5b3328..8c69c41 100644
--- a/src/fabledassistant/routes/chat.py
+++ b/src/fabledassistant/routes/chat.py
@@ -6,7 +6,7 @@ import httpx
 from quart import Blueprint, Response, jsonify, request
 
 from fabledassistant.auth import login_required, get_current_user_id
-from fabledassistant.routes.utils import not_found
+from fabledassistant.routes.utils import not_found, parse_pagination
 from fabledassistant.config import Config
 from fabledassistant.services.chat import (
     add_message,
@@ -38,8 +38,7 @@ chat_bp = Blueprint("chat", __name__, url_prefix="/api/chat")
 @login_required
 async def list_conversations_route():
     uid = get_current_user_id()
-    limit = min(request.args.get("limit", 50, type=int), 500)
-    offset = request.args.get("offset", 0, type=int)
+    limit, offset = parse_pagination()
     conv_type = request.args.get("type", "chat")
     # Apply retention policy before returning list
     retention_str = await get_setting(uid, "chat_retention_days", "90")
diff --git a/src/fabledassistant/routes/milestones.py b/src/fabledassistant/routes/milestones.py
index d8471ce..565a0e8 100644
--- a/src/fabledassistant/routes/milestones.py
+++ b/src/fabledassistant/routes/milestones.py
@@ -4,7 +4,7 @@ import logging
 from quart import Blueprint, jsonify, request
 
 from fabledassistant.auth import login_required, get_current_user_id
-from fabledassistant.routes.utils import not_found
+from fabledassistant.routes.utils import not_found, parse_pagination
 from fabledassistant.services.milestones import (
     create_milestone,
     delete_milestone,
@@ -107,8 +107,7 @@ async def get_milestone_tasks_route(project_id: int, milestone_id: int):
     if milestone is None or milestone.project_id != project_id:
         return not_found("Milestone")
     status_filter = request.args.get("status")
-    limit = min(request.args.get("limit", 100, type=int), 500)
-    offset = request.args.get("offset", 0, type=int)
+    limit, offset = parse_pagination(default_limit=100)
     notes, total = await list_notes(
         uid,
         is_task=True,
diff --git a/src/fabledassistant/routes/notes.py b/src/fabledassistant/routes/notes.py
index 0c1ab39..0a237ea 100644
--- a/src/fabledassistant/routes/notes.py
+++ b/src/fabledassistant/routes/notes.py
@@ -7,7 +7,7 @@ from fabledassistant.services.embeddings import upsert_note_embedding
 from quart import Blueprint, Response, jsonify, request
 
 from fabledassistant.auth import login_required, get_current_user_id
-from fabledassistant.routes.utils import not_found, parse_iso_date
+from fabledassistant.routes.utils import not_found, parse_iso_date, parse_pagination
 from fabledassistant.config import Config
 from fabledassistant.services.assist import build_assist_messages
 from fabledassistant.services.generation_buffer import (
@@ -49,8 +49,7 @@ async def list_notes_route():
     tag = request.args.getlist("tag")
     sort = request.args.get("sort", "updated_at")
     order = request.args.get("order", "desc")
-    limit = min(request.args.get("limit", 50, type=int), 500)
-    offset = request.args.get("offset", 0, type=int)
+    limit, offset = parse_pagination()
 
     # Default to non-task notes only; ?is_task=true for tasks, ?all=true for everything
     is_task: bool | None = False
diff --git a/src/fabledassistant/routes/projects.py b/src/fabledassistant/routes/projects.py
index daa4fe3..60dd547 100644
--- a/src/fabledassistant/routes/projects.py
+++ b/src/fabledassistant/routes/projects.py
@@ -4,7 +4,7 @@ import logging
 from quart import Blueprint, jsonify, request
 
 from fabledassistant.auth import login_required, get_current_user_id
-from fabledassistant.routes.utils import not_found
+from fabledassistant.routes.utils import not_found, parse_pagination
 from fabledassistant.services.milestones import list_milestones
 from fabledassistant.services.notes import list_notes
 from fabledassistant.services.projects import (
@@ -100,8 +100,7 @@ async def get_project_notes_route(project_id: int):
     # type filter: "note", "task", or None (both)
     type_filter = request.args.get("type")
     status_filter = request.args.get("status")
-    limit = min(request.args.get("limit", 100, type=int), 500)
-    offset = request.args.get("offset", 0, type=int)
+    limit, offset = parse_pagination(default_limit=100)
 
     is_task: bool | None = None
     if type_filter == "task":
diff --git a/src/fabledassistant/routes/tasks.py b/src/fabledassistant/routes/tasks.py
index 03b6309..3c639ed 100644
--- a/src/fabledassistant/routes/tasks.py
+++ b/src/fabledassistant/routes/tasks.py
@@ -4,7 +4,7 @@ from quart import Blueprint, jsonify, request
 
 from fabledassistant.auth import login_required, get_current_user_id
 from fabledassistant.models.note import TaskPriority, TaskStatus
-from fabledassistant.routes.utils import not_found, parse_iso_date
+from fabledassistant.routes.utils import not_found, parse_iso_date, parse_pagination
 from fabledassistant.services.embeddings import upsert_note_embedding
 from fabledassistant.services.notes import (
     create_note,
@@ -28,8 +28,7 @@ async def list_tasks_route():
     priority = request.args.get("priority")
     sort = request.args.get("sort", "updated_at")
     order = request.args.get("order", "desc")
-    limit = min(request.args.get("limit", 50, type=int), 500)
-    offset = request.args.get("offset", 0, type=int)
+    limit, offset = parse_pagination()
 
     project_id = request.args.get("project_id", type=int)
     no_project = request.args.get("no_project", "").lower() == "true"
diff --git a/src/fabledassistant/routes/utils.py b/src/fabledassistant/routes/utils.py
index f3aa475..c6efc9e 100644
--- a/src/fabledassistant/routes/utils.py
+++ b/src/fabledassistant/routes/utils.py
@@ -1,6 +1,6 @@
 from datetime import date
 
-from quart import jsonify
+from quart import jsonify, request
 
 
 def not_found(resource: str = "Item"):
@@ -15,3 +15,10 @@ def parse_iso_date(value: str | None, field: str = "date"):
         return date.fromisoformat(value)
     except ValueError:
         return jsonify({"error": f"Invalid {field} format. Use YYYY-MM-DD."}), 400
+
+
+def parse_pagination(default_limit: int = 50, max_limit: int = 500) -> tuple[int, int]:
+    """Extract and clamp ``limit`` / ``offset`` from the current request's query string."""
+    limit = min(request.args.get("limit", default_limit, type=int), max_limit)
+    offset = request.args.get("offset", 0, type=int)
+    return limit, offset
diff --git a/src/fabledassistant/services/sharing.py b/src/fabledassistant/services/sharing.py
index 95254d7..5d7a8bf 100644
--- a/src/fabledassistant/services/sharing.py
+++ b/src/fabledassistant/services/sharing.py
@@ -16,6 +16,33 @@ logger = logging.getLogger(__name__)
 VALID_PERMISSIONS = {"viewer", "editor", "admin"}
 
 
+async def _enrich_shares(session, shares) -> list[dict]:
+    """Attach username / group_name to a list of share rows (ProjectShare or NoteShare)."""
+    result = []
+    for s in shares:
+        d = s.to_dict()
+        if s.shared_with_user_id:
+            user = await session.get(User, s.shared_with_user_id)
+            d["username"] = user.username if user else None
+        if s.shared_with_group_id:
+            group = await session.get(Group, s.shared_with_group_id)
+            d["group_name"] = group.name if group else None
+        result.append(d)
+    return result
+
+
+def _deduplicate_by_permission(shares, id_attr: str) -> dict[int, str]:
+    """Return {resource_id: best_permission} keeping the highest-ranked permission per resource."""
+    from fabledassistant.services.access import PERMISSION_RANK
+    seen: dict[int, str] = {}
+    for share in shares:
+        rid = getattr(share, id_attr)
+        prev = seen.get(rid)
+        if prev is None or PERMISSION_RANK[share.permission] > PERMISSION_RANK[prev]:
+            seen[rid] = share.permission
+    return seen
+
+
 # ---------------------------------------------------------------------------
 # Project shares
 # ---------------------------------------------------------------------------
@@ -83,17 +110,7 @@ async def list_project_shares(project_id: int) -> list[dict]:
         shares = (await session.execute(
             select(ProjectShare).where(ProjectShare.project_id == project_id)
         )).scalars().all()
-        result = []
-        for s in shares:
-            d = s.to_dict()
-            if s.shared_with_user_id:
-                user = await session.get(User, s.shared_with_user_id)
-                d["username"] = user.username if user else None
-            if s.shared_with_group_id:
-                group = await session.get(Group, s.shared_with_group_id)
-                d["group_name"] = group.name if group else None
-            result.append(d)
-        return result
+        return await _enrich_shares(session, shares)
 
 
 # ---------------------------------------------------------------------------
@@ -166,17 +183,7 @@ async def list_note_shares(note_id: int) -> list[dict]:
         shares = (await session.execute(
             select(NoteShare).where(NoteShare.note_id == note_id)
         )).scalars().all()
-        result = []
-        for s in shares:
-            d = s.to_dict()
-            if s.shared_with_user_id:
-                user = await session.get(User, s.shared_with_user_id)
-                d["username"] = user.username if user else None
-            if s.shared_with_group_id:
-                group = await session.get(Group, s.shared_with_group_id)
-                d["group_name"] = group.name if group else None
-            result.append(d)
-        return result
+        return await _enrich_shares(session, shares)
 
 
 # ---------------------------------------------------------------------------
@@ -203,12 +210,7 @@ async def list_shared_with_me(user_id: int) -> dict:
                 )
             )).scalars().all()
 
-        seen_projects: dict[int, str] = {}
-        for share in list(proj_direct) + list(proj_group):
-            prev = seen_projects.get(share.project_id)
-            from fabledassistant.services.access import PERMISSION_RANK
-            if prev is None or PERMISSION_RANK[share.permission] > PERMISSION_RANK[prev]:
-                seen_projects[share.project_id] = share.permission
+        seen_projects = _deduplicate_by_permission(list(proj_direct) + list(proj_group), "project_id")
 
         projects = []
         for pid, perm in seen_projects.items():
@@ -239,12 +241,7 @@ async def list_shared_with_me(user_id: int) -> dict:
                 )
             )).scalars().all()
 
-        seen_notes: dict[int, str] = {}
-        for share in list(note_direct) + list(note_group):
-            prev = seen_notes.get(share.note_id)
-            from fabledassistant.services.access import PERMISSION_RANK
-            if prev is None or PERMISSION_RANK[share.permission] > PERMISSION_RANK[prev]:
-                seen_notes[share.note_id] = share.permission
+        seen_notes = _deduplicate_by_permission(list(note_direct) + list(note_group), "note_id")
 
         notes = []
         for nid, perm in seen_notes.items():

From bc5f1679d5bb7b749762a722a5bb3d97f0704ffd Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Thu, 26 Mar 2026 23:44:20 -0400
Subject: [PATCH 5/6] fix: accept PATCH on /api/tasks/:id (MCP update_task
 compatibility)

The MCP fable_update_task tool calls PATCH /api/tasks/{id} but the route
only declared PUT. Adding PATCH to the same handler fixes the 405.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 src/fabledassistant/routes/tasks.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/fabledassistant/routes/tasks.py b/src/fabledassistant/routes/tasks.py
index 3c639ed..c5b7a0d 100644
--- a/src/fabledassistant/routes/tasks.py
+++ b/src/fabledassistant/routes/tasks.py
@@ -117,7 +117,7 @@ async def get_task_route(task_id: int):
     return jsonify(data)
 
 
-@tasks_bp.route("/<int:task_id>", methods=["PUT"])
+@tasks_bp.route("/<int:task_id>", methods=["PUT", "PATCH"])
 @login_required
 async def update_task_route(task_id: int):
     uid = get_current_user_id()

From 2a1644e571499620016f839d21fdba8c701d325c Mon Sep 17 00:00:00 2001
From: Bryan Van Deusen <bryan.vandeusen@fabledsword.com>
Date: Fri, 27 Mar 2026 00:08:21 -0400
Subject: [PATCH 6/6] =?UTF-8?q?feat:=20news=20story=20cards=20in=20briefin?=
 =?UTF-8?q?g=20=E2=80=94=20backend=20embeds=20structured=20RSS=20items=20i?=
 =?UTF-8?q?n=20metadata?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously metadata only stored rss_item_ids (integers); the full item data
was discarded after LLM synthesis. Now rss_items (id, title, url, source,
snippet, published_at) is also stored so clients can render per-story cards
without additional API calls.

Web BriefingView: replaces bare reaction-row buttons with news cards showing
source, headline (linked), 2-line snippet, and 👍/👎 per card.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 frontend/src/views/BriefingView.vue           | 137 ++++++++++++++----
 .../services/briefing_pipeline.py             |  14 +-
 2 files changed, 121 insertions(+), 30 deletions(-)

diff --git a/frontend/src/views/BriefingView.vue b/frontend/src/views/BriefingView.vue
index d3c0fce..894a868 100644
--- a/frontend/src/views/BriefingView.vue
+++ b/frontend/src/views/BriefingView.vue
@@ -18,6 +18,15 @@ import {
 } from '@/api/client'
 import type { Message } from '@/types/chat'
 
+interface RssItemMeta {
+  id: number
+  title: string
+  url: string
+  source: string
+  snippet: string
+  published_at: string | null
+}
+
 interface MessageMetadata {
   weather?: {
     location: string
@@ -31,6 +40,7 @@ interface MessageMetadata {
     forecast: { day: string; condition: string; high: number; low: number }[]
   } | null
   rss_item_ids?: number[]
+  rss_items?: RssItemMeta[]
 }
 
 const chatStore = useChatStore()
@@ -154,6 +164,16 @@ function msgMetadata(msg: BriefingMessage): MessageMetadata | null {
   return (msg.metadata as MessageMetadata | null | undefined) ?? null
 }
 
+function formatRelativeDate(iso: string | null): string {
+  if (!iso) return ''
+  const d = new Date(iso)
+  const now = new Date()
+  const diffH = (now.getTime() - d.getTime()) / 3_600_000
+  if (diffH < 24) return `${Math.round(diffH)}h ago`
+  if (diffH < 48) return 'Yesterday'
+  return d.toLocaleDateString(undefined, { month: 'short', day: 'numeric' })
+}
+
 // Manual trigger
 const triggering = ref(false)
 async function triggerNow() {
@@ -262,29 +282,43 @@ onMounted(async () => {
                 :message="toMsg(msg)"
                 :is-streaming="false"
               />
-              <!-- Reaction buttons below assistant messages with rss_item_ids -->
+              <!-- News cards below assistant messages with rss_items -->
               <div
-                v-if="msg.role === 'assistant' && (msgMetadata(msg)?.rss_item_ids?.length ?? 0) > 0"
-                class="rss-reactions"
+                v-if="msg.role === 'assistant' && (msgMetadata(msg)?.rss_items?.length ?? 0) > 0"
+                class="news-cards"
               >
                 <div
-                  v-for="(itemId, index) in msgMetadata(msg)!.rss_item_ids"
-                  :key="itemId"
-                  class="rss-reaction-row"
+                  v-for="item in msgMetadata(msg)!.rss_items"
+                  :key="item.id"
+                  class="news-card"
                 >
-                  <span class="reaction-label">Story {{ index + 1 }}</span>
-                  <button
-                    class="reaction-btn"
-                    :class="{ active: reactions[itemId] === 'up' }"
-                    @click="handleReaction(itemId, 'up')"
-                    title="Interested"
-                  >👍</button>
-                  <button
-                    class="reaction-btn"
-                    :class="{ active: reactions[itemId] === 'down' }"
-                    @click="handleReaction(itemId, 'down')"
-                    title="Not interested"
-                  >👎</button>
+                  <div class="news-card-meta">
+                    <span class="news-source">{{ item.source }}</span>
+                    <span v-if="item.published_at" class="news-date">{{ formatRelativeDate(item.published_at) }}</span>
+                  </div>
+                  <a
+                    v-if="item.url"
+                    :href="item.url"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    class="news-title"
+                  >{{ item.title }}</a>
+                  <p v-else class="news-title news-title--plain">{{ item.title }}</p>
+                  <p v-if="item.snippet" class="news-snippet">{{ item.snippet }}</p>
+                  <div class="news-reactions">
+                    <button
+                      class="reaction-btn"
+                      :class="{ active: reactions[item.id] === 'up' }"
+                      @click="handleReaction(item.id, 'up')"
+                      title="Interested"
+                    >👍</button>
+                    <button
+                      class="reaction-btn"
+                      :class="{ active: reactions[item.id] === 'down' }"
+                      @click="handleReaction(item.id, 'down')"
+                      title="Not interested"
+                    >👎</button>
+                  </div>
                 </div>
               </div>
             </template>
@@ -483,33 +517,78 @@ onMounted(async () => {
 .btn-send:disabled { opacity: 0.4; cursor: not-allowed; }
 .btn-send:hover:not(:disabled) { opacity: 0.9; }
 
-.rss-reactions {
+.news-cards {
   display: flex;
   flex-direction: column;
-  gap: 0.35rem;
-  padding: 0.5rem 0.75rem;
+  gap: 0.5rem;
+  margin-top: 0.25rem;
   margin-bottom: 0.25rem;
 }
 
-.rss-reaction-row {
+.news-card {
+  background: var(--color-bg-card);
+  border: 1px solid var(--color-border);
+  border-radius: 10px;
+  padding: 0.65rem 0.85rem;
   display: flex;
-  align-items: center;
-  gap: 0.4rem;
+  flex-direction: column;
+  gap: 0.25rem;
 }
 
-.reaction-label {
+.news-card-meta {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+.news-source {
+  font-size: 0.72rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--color-primary);
+}
+
+.news-date {
+  font-size: 0.72rem;
+  color: var(--color-text-muted);
+}
+
+.news-title {
+  font-size: 0.88rem;
+  font-weight: 600;
+  color: var(--color-text);
+  line-height: 1.35;
+  text-decoration: none;
+  margin: 0;
+}
+
+a.news-title:hover { text-decoration: underline; color: var(--color-primary); }
+
+.news-snippet {
   font-size: 0.78rem;
   color: var(--color-text-muted);
-  min-width: 4rem;
+  line-height: 1.45;
+  margin: 0;
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+}
+
+.news-reactions {
+  display: flex;
+  gap: 0.3rem;
+  margin-top: 0.15rem;
 }
 
 .reaction-btn {
   background: none;
   border: 1px solid var(--color-border);
   border-radius: 6px;
-  padding: 0.15rem 0.4rem;
+  padding: 0.1rem 0.35rem;
   cursor: pointer;
-  font-size: 0.85rem;
+  font-size: 0.82rem;
   line-height: 1.4;
   opacity: 0.55;
   transition: opacity 0.15s, border-color 0.15s;
diff --git a/src/fabledassistant/services/briefing_pipeline.py b/src/fabledassistant/services/briefing_pipeline.py
index 0fa741a..ebc3526 100644
--- a/src/fabledassistant/services/briefing_pipeline.py
+++ b/src/fabledassistant/services/briefing_pipeline.py
@@ -416,6 +416,18 @@ async def run_compilation(
         max_items=10,
     )
     rss_item_ids = [item["id"] for item in filtered_rss if item.get("id")]
+    rss_items_meta = [
+        {
+            "id": item["id"],
+            "title": item.get("title", ""),
+            "url": item.get("url", ""),
+            "source": item.get("feed_title", ""),
+            "snippet": (item.get("content") or "")[:300],
+            "published_at": item.get("published_at"),
+        }
+        for item in filtered_rss
+        if item.get("id")
+    ]
 
     # Weather staleness gate — returns None if data is >24h old
     weather_card = parse_weather_card_data(weather_rows[0], temp_unit) if weather_rows else None
@@ -449,7 +461,7 @@ async def run_compilation(
     # ── Post-processing ─────────────────────────────────────────────────────────
     await upsert_task_snapshots(user_id, all_tasks)
 
-    metadata: dict = {"rss_item_ids": rss_item_ids, "weather": weather_card}
+    metadata: dict = {"rss_item_ids": rss_item_ids, "rss_items": rss_items_meta, "weather": weather_card}
 
     if not internal_text and not external_text:
         logger.warning("Briefing compilation produced no content for user %d slot %s", user_id, slot)