> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase02-session06-settings-replay-notifications-and-scan-ux/tasks.md). # Task Checklist **Session ID**: `phase02-session06-settings-replay-notifications-and-scan-ux` **Total Tasks**: 21 **Estimated Duration**: 3-4 hours **Created**: 2026-05-29 *** ## Legend * `[x]` = Completed * `[ ]` = Pending * `[P]` = Parallelizable (can run with other \[P] tasks) * `[SNNMM]` = Session reference (NN=phase number, MM=session number) * `TNNN` = Task ID *** ## Progress Summary | Category | Total | Done | Remaining | | -------------- | ------ | ------ | --------- | | Setup | 3 | 3 | 0 | | Foundation | 5 | 5 | 0 | | Implementation | 9 | 9 | 0 | | Testing | 4 | 4 | 0 | | **Total** | **21** | **21** | **0** | *** ## Setup (3 tasks) Initial verification and baseline evidence capture. ### Cross-cutting * [x] T001 \[S0206] Verify Sessions 01-05 prerequisites, Session 06 gap-matrix rows, and current settings/replay/export/notification/scan test coverage (`.spec_system/PRD/phase_02/session_06_settings_replay_notifications_and_scan_ux.md`) * [x] T002 \[S0206] Create implementation notes with baseline commands, privacy-boundary decisions, validation plan, and deferred-erasure risk log (`.spec_system/specs/phase02-session06-settings-replay-notifications-and-scan-ux/implementation-notes.md`) * [x] T003 \[S0206] Audit stable web, server, API, privacy, and development docs before implementation (`apps/web/README_web.md`, `apps/server/README_server.md`, `docs/api/README_api.md`, `docs/privacy-and-security.md`, `docs/development.md`) *** ## Foundation (5 tasks) Testable helpers and state normalization before UI wiring. ### apps/web * [x] T004 \[S0206] \[P] Create scan-codebase UI helpers for request normalization, response summaries, approved-root failure copy, and sanitized error mapping with schema-validated input and explicit error mapping (`apps/web/src/lib/scanCodebase.ts`) * [x] T005 \[S0206] \[P] Harden settings localStorage hydration, partial-key migration tolerance, invalid enum fallback, storage-unavailable handling, and reset persistence with state reset or revalidation on re-entry (`apps/web/src/store/useSettingsStore.ts`) * [x] T006 \[S0206] \[P] Normalize notification outcome helpers for unsupported, default, denied, granted, throttled, blocked, delivered, and constructor-failure states with denied/restricted/revoked handling and fallback behavior (`apps/web/src/lib/notifications.ts`) * [x] T007 \[S0206] \[P] Tighten replay-link helper outcomes for malformed fragments, consumed hashes, payload caps, redacted local-only copy, and feedback-loop prevention with schema-validated input and explicit error mapping (`apps/web/src/lib/replayLink.ts`) * [x] T008 \[S0206] \[P] Bound export helper failure copy, privacy/schema header reporting, local-server offline handling, and download cleanup with timeout-safe failure-path handling (`apps/web/src/lib/exportSession.ts`) *** ## Implementation (9 tasks) Main web, server, and documentation work. ### apps/web * [x] T009 \[S0206] Wire SettingsDrawer preference controls, reset feedback, replay entry, local auth affordance, and accessible labels with platform-appropriate accessibility labels, focus management, and input support (`apps/web/src/components/SettingsDrawer.tsx`) * [x] T010 \[S0206] Wire SettingsDrawer scan UX through helper copy for explicit root, `FACTIONOS_SCAN_ROOTS`, invalid root, denied root, no symlink, file-cap, provider-transfer, success, issue-count, and offline states with duplicate-trigger prevention while in-flight (`apps/web/src/components/SettingsDrawer.tsx`) * [x] T011 \[S0206] Wire SettingsDrawer notification toggle and test action feedback for unsupported, default, denied, granted, throttled, blocked, delivered, and revoked states with denied/restricted/revoked handling and fallback behavior (`apps/web/src/components/SettingsDrawer.tsx`) * [x] T012 \[S0206] Update ReplayPanel status, local-only share copy, clear action, disabled states, and empty/malformed feedback with state reset or revalidation on re-entry (`apps/web/src/components/ReplayPanel.tsx`) * [x] T013 \[S0206] Preserve share-replay boot feedback, hash stripping, redacted event caps, malformed-token handling, and no feedback loops with schema-validated input and explicit error mapping (`apps/web/src/lib/replayLink.ts`) * [x] T014 \[S0206] Keep CSV/JSON export commands and toasts honest about local-server dependency, local auth, privacy headers, and in-flight/export failure states with duplicate-trigger prevention while in-flight (`apps/web/src/components/CommandPalette.tsx`) ### apps/server * [x] T015 \[S0206] Verify or tighten scan-root and export route failure envelopes so invalid formats, denied roots, filesystem roots, and malformed bodies do not echo sensitive paths or raw invalid values (`apps/server/tests/llm.test.ts`, `apps/server/tests/exportRoute.test.ts`) ### docs * [x] T016 \[S0206] Update package READMEs with shipped settings, replay, notification, export, scan-root, local auth, and deferred hosted/push/erasure boundaries (`apps/web/README_web.md`, `apps/server/README_server.md`) * [x] T017 \[S0206] Update stable API, privacy, and development docs with scan-root allowlists, replay-share/export privacy, notification opt-in, localStorage behavior, and Phase 08 erasure deferral (`docs/api/README_api.md`, `docs/privacy-and-security.md`, `docs/development.md`) *** ## Testing (4 tasks) Focused verification and quality gates. ### apps/web * [x] T018 \[S0206] \[P] Add settings and scan tests for malformed localStorage, stale partial settings, reset persistence, accessible controls, empty/invalid/denied/offline scan states, issue counts, and sanitized failure copy (`apps/web/tests/useSettingsStore.test.ts`, `apps/web/tests/SettingsScan.test.tsx`, `apps/web/tests/scanCodebase.test.ts`) * [x] T019 \[S0206] \[P] Extend notification tests for opt-in persistence, unsupported/default/denied/granted/throttled/delivered outcomes, hook baseline reset, and no retroactive delivery (`apps/web/tests/notifications.test.ts`, `apps/web/tests/settingsNotifications.test.ts`, `apps/web/tests/useNotifications.test.tsx`) * [x] T020 \[S0206] \[P] Extend replay/export privacy tests for malformed links, hash stripping, payload caps, local-only share feedback, privacy headers, offline export, bounded failure copy, and download cleanup (`apps/web/tests/replayLink.test.ts`, `apps/web/tests/replayShareButton.test.tsx`, `apps/web/tests/exportSession.test.ts`, `apps/web/tests/wsClientPrivacy.test.ts`) ### Cross-cutting * [x] T021 \[S0206] Run focused web/server tests, focused Biome checks, `git diff --check`, ASCII validation for spec outputs, LF validation, and record results (`.spec_system/specs/phase02-session06-settings-replay-notifications-and-scan-ux/implementation-notes.md`) *** ## Completion Checklist Before marking session complete: * [x] All tasks marked `[x]` * [x] All tests passing * [x] All files ASCII-encoded where required by spec-system output rules * [x] `implementation-notes.md` updated * [x] Ready for the validate workflow step *** ## Next Steps Run the validate workflow step to verify session completeness. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase02-session06-settings-replay-notifications-and-scan-ux/tasks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.