feat: Workspace Recent Changes Panel

.env.example

@@ -22,3 +22,26 @@ NEXUS_COLLAB_SERVER_PORT=1234
 
 # Public WebSocket URL that browsers use to connect to the collab server.
 NEXT_PUBLIC_COLLAB_SERVER_URL=ws://localhost:1234
+
+# ── Authentication (OIDC/OAuth2) ─────────────────────────────────────────────
+# When all four AUTH_* variables below are set, Nexus requires SSO login.
+# When absent, the app is open (no authentication).
+#
+# AUTH_ISSUER — OIDC issuer URL (auto-discovers endpoints via .well-known)
+#   Microsoft Entra ID: https://login.microsoftonline.com/{tenant-id}/v2.0
+#   Google:             https://accounts.google.com
+#   Okta:               https://{domain}.okta.com
+#
+# AUTH_ISSUER=https://login.microsoftonline.com/your-tenant-id/v2.0
+# AUTH_CLIENT_ID=your-client-id
+# AUTH_CLIENT_SECRET=your-client-secret
+# AUTH_SECRET=generate-with-openssl-rand-base64-33
+# AUTH_PROVIDER_NAME=Microsoft
+#
+# NEXTAUTH_URL — Canonical public URL of your deployment.
+# Not required in local dev (NextAuth auto-detects localhost:3000).
+# Required in any deployed environment, especially behind a reverse proxy or
+# load balancer, so NextAuth constructs correct OAuth callback URLs.
+# Must match exactly the redirect URI registered with your OAuth provider.
+#
+# NEXTAUTH_URL=https://nexus.example.com

.gitignore

@@ -71,7 +71,10 @@ storage.json
 /temp_examples/
 /test-results/
 _workspace
+/graphify-out
+_workspace*
 
 # Local runtime data stores (Brain / collab)
 /.nexus-brain/
 /.nexus-collab/
+

.husky/pre-commit

@@ -0,0 +1,36 @@
+if git diff --cached --quiet; then
+  echo "No staged changes. Skipping checks."
+  exit 0
+fi
+
+STASHED=0
+
+cleanup() {
+  if [ $STASHED -eq 1 ]; then
+    echo "Restoring unstaged changes..."
+    git stash pop -q
+    STASHED=0
+  fi
+}
+
+trap cleanup EXIT INT TERM
+
+echo "Stashing unstaged changes..."
+git stash push --keep-index --include-untracked -m "pre-commit-stash"
+STASHED=1
+
+echo "Running checks (typecheck + lint + tests)..."
+bun run check
+echo "Finished running checks."
+
+EXIT_CODE=$?
+
+cleanup
+
+if [ $EXIT_CODE -ne 0 ]; then
+  echo "Pre-commit checks failed. Commit blocked."
+else
+  echo "All checks passed. Proceeding with commit."
+fi
+
+exit $EXIT_CODE

Dockerfile

@@ -16,7 +16,7 @@ RUN --mount=type=cache,target=/root/.bun/install/cache \
     bun install --frozen-lockfile
 
 # ============================================
-# Stage 2: Build Next.js application in standalone mode
+# Stage 2: Build Next.js application
 # ============================================
 
 FROM oven/bun:${BUN_VERSION} AS builder
@@ -32,7 +32,7 @@ ENV NEXT_TELEMETRY_DISABLED=1
 RUN bun run build
 
 # ============================================
-# Stage 3: Run Next.js application
+# Stage 3: Run Next.js + Hocuspocus via custom server
 # ============================================
 
 FROM oven/bun:${BUN_VERSION} AS runner
@@ -51,31 +51,30 @@ ENV APP_BUILD_TIMESTAMP=${BUILD_TIMESTAMP}
 
 EXPOSE 3000
 
-COPY --from=builder --chown=bun:bun /app/public ./public
-
 # Install git for marketplace clone/pull operations at runtime.
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates \
     && rm -rf /var/lib/apt/lists/*
 
-RUN mkdir .next && chown bun:bun .next
-
-# Pre-create marketplace cache directory with correct ownership.
-RUN mkdir -p /tmp/nexus-marketplaces && chown bun:bun /tmp/nexus-marketplaces
+# Pre-create marketplace and collab data directories with correct ownership.
+RUN mkdir -p /tmp/nexus-marketplaces /data/brain /data/collab \
+    && chown -R bun:bun /tmp/nexus-marketplaces /data/brain /data/collab
 
-# Automatically leverage output traces to reduce image size.
-# https://nextjs.org/docs/advanced-features/output-file-tracing
-COPY --from=builder --chown=bun:bun /app/.next/standalone ./
-COPY --from=builder --chown=bun:bun /app/.next/static ./.next/static
-
-# Persist the fetch cache generated during the build for faster cold starts.
-COPY --from=builder --chown=bun:bun /app/.next/cache ./.next/cache
+# Full Next.js build + dependencies — the custom server imports `next` and
+# the compiled `.next/` output directly, so we need both.
 COPY --from=dependencies --chown=bun:bun /app/node_modules ./node_modules
+COPY --from=builder --chown=bun:bun /app/.next ./.next
+COPY --from=builder --chown=bun:bun /app/public ./public
+COPY --from=builder --chown=bun:bun /app/package.json ./package.json
+COPY --from=builder --chown=bun:bun /app/next.config.ts ./next.config.ts
+COPY --from=builder --chown=bun:bun /app/server.ts ./server.ts
 COPY --from=builder --chown=bun:bun /app/scripts ./scripts
-COPY --from=builder --chown=bun:bun /app/src/lib/collaboration/object-store.ts ./src/lib/collaboration/object-store.ts
+COPY --from=builder --chown=bun:bun /app/src/lib/collaboration/object-store.ts \
+    ./src/lib/collaboration/object-store.ts
+COPY --from=builder --chown=bun:bun /app/tsconfig.json ./tsconfig.json
 
 USER bun
 
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
   CMD bun --eval "fetch('http://localhost:3000/livez').then(r=>{if(!r.ok)throw 1})"
 
-CMD ["bun", "server.js"]
+CMD ["bun", "server.ts"]