- anim(): guarantee final frame shows exact target value (not target-1)
- API: /api/* catch-all returns 404 JSON instead of SPA fallback HTML
- Server: SIGTERM handler closes pool + server gracefully
- renderTeamBar: null-check allBtn before DOM manipulation
Extension:
- SQL injection fix: dollar-quoting instead of single-quote escaping
- Cache team.json + resolved member (no re-reads every call)
- System prompt: removed forceful 'Always use member=X', now says auto-detected
- Member name sanitisation: strip non-alphanumeric chars
API (server.js):
- Auth middleware: requireAuth on POST/PATCH/DELETE endpoints (SHIPS_API_KEY env)
- Member normalisation: cleanMember() strips special chars, lowercases
- Case-insensitive queries: LOWER() on all member WHERE/GROUP BY clauses
- XSS prevention: member values sanitised on insert
Frontend (index.html):
- renderFilters: clear old pills before appending (fixes duplication bug)
- filterByMember: hero count stays fixed to total (not filtered count)
- filterByMember: fetches global stats separately for hero + team bar
- filterByMember: loading state (opacity transition during fetch)
- filterByMember: resets project filter when switching members
- renderTeamBar: hidden when ≤1 member (removes redundant UI)
- renderTeamBar: properly manages Everyone pill active state
- renderTeamBar: esc() on member names to prevent XSS
- API: all endpoints support ?member= filtering
- API: POST /ships and /oops now accept member field
- API: new GET /api/team endpoint with per-member ship counts
- Frontend: team filter pill bar on /live page
- Frontend: click member to filter timeline, stats, incidents
- Frontend: Everyone pill shows master view across all members
omair