HollaHoop
Sign in
Feedback

What should we build next?

Browse boards, vote on ideas, share your own.

New post
TopNew
All typesFeatureBugTweak

Sentry integration: error monitoring, releases, and performance

Wire up Sentry on both the Next.js front-end and the Node/Edge server side. Capture client errors with source maps, server runtime errors, slow API spans, and Web Vitals. Tag every event with org_id and project_id so support can filter by tenant. Tie commits to releases via the Sentry CLI in deploy/deploy.sh, enable Cron monitoring for scheduled jobs (digest emails, AI background jobs), and add a Report this link in the global error boundary. Optional PR comments for new errors introduced by a change.

FeatureShippedGeneral·5 months ago·1

Three-way theme switcher: light / dark / system

Theme used to be a binary toggle (light or dark). Many users want their dashboard to follow OS preference, so the system option is now first-class. - New shared module `src/lib/theme/theme.ts` with `readSavedTheme`, `setTheme`, `applyTheme`, `subscribeToSystemTheme` - All four entry points use it and stay in sync: top-bar `ThemeToggle`, sidebar account popover, public user-menu submenu, and `/app/account/appearance` - `system` resolves `prefers-color-scheme` at apply time and live-listens for OS changes via `matchMedia` - Pre-paint inline script in the root layout pins the resolved theme on `<html>` before hydration, so there's no FOUC Closes the related "Theme toggle flickers on first paint (FOUC)" card.

FeatureShippedGeneral·5 months ago·0

Customisable docs sections (create / rename / reorder / delete)

Docs sections were previously hard-coded to the seed values (Getting started / Guides / Reference) — there was no admin UI to add or rename them. You can now manage your docs taxonomy entirely from the docs admin page: - **Add** any header you want — Cookbook, FAQ, API reference, Tutorials, Migration guides, … - **Rename** existing sections inline (header + slug) - **Reorder** with up/down arrows (`position` swap) - **Delete** safely — pages are orphaned (`section_id = null`) rather than dropped, so it's reversible Behind the scenes: - New server actions: `createDocSectionAction`, `updateDocSectionAction`, `moveDocSectionAction`, `deleteDocSectionAction` - Slug uniqueness via the existing `(project_id, slug)` constraint, with a friendly error when collisions happen - Confirmation prompt warns when a delete will orphan pages

FeatureShippedGeneral·5 months ago·0

Collapsible portal sidebar with full lockup expanded and icon-only when narrow

Both portal sidebars (admin project rail + workspace org rail) are now **collapsible**. The full Hollahoop lockup (mark + wordmark) shows when expanded; just the icon mark renders in the 56px-wide collapsed rail. - New `useSidebarCollapsed` hook persists state to `hollahoop-sidebar-collapsed`, syncs across instances via custom event + storage event - `SidebarCollapseToggle` button (PanelLeftClose / PanelLeftOpen) - Pre-paint script in root layout pins `<html data-sidebar-collapsed>` before hydration so the rail never flashes the wrong width - Keyboard shortcut: **Ctrl/Cmd + B** (skipped if focus is in an input) - Search switches to icon variant, nav rows become icon-only with `title` tooltips, workspace org tree collapses to clickable org glyphs - User card in collapsed mode is an avatar pill; popover floats out to the right (`left-full ml-2 w-60`) so it isn't clipped - Width animates with `transition-[width] duration-200` Also fixed the previously-broken `BrandLockup` component: it referenced PNG assets that didn't exist on disk, so it now renders the existing SVG mark + a typographic wordmark that inherits theme foreground colour.

FeatureShippedGeneral·5 months ago·0

Avatar upload to object storage (replaces URL text input)

The profile screen used to ask users to paste a public image URL into an "Avatar URL" field — fine for tech-savvy folks, awkward for everyone else. Now the avatar field is a **proper upload control**: - Click, drag-and-drop, or paste-from-clipboard a PNG / JPG / WebP / AVIF / GIF / SVG (≤ 10 MB) - Files go through `/api/uploads` with `kind=avatar`, which authenticates, validates MIME + size, and stores under `avatar/<user_id>/<uuid>.ext` in the public Supabase Storage bucket (S3-compatible) - Each user's avatars are namespaced to their own user-id folder, with the storage path derived server-side from `auth.uid()` so it's unforgeable - "Replace" + "Remove" actions inline; persists immediately on upload so the sidebar widget refreshes via `router.refresh()` without forcing the user to click Save The DB column is unchanged — `profiles.avatar_url` still holds the public URL, just now pointing at a Hollahoop-owned storage object instead of an arbitrary external URL.

FeatureShippedGeneral·5 months ago·0

Accessibility pass: WCAG 2.2 AA across portal, public hubs, widget, and API

Bring the entire product up to WCAG 2.2 AA. Front-end: keyboard reachability, focus-visible states, semantic landmarks, ARIA only where native semantics fall short, color contrast tokens audited in both themes, prefers-reduced-motion respect, captions and transcripts on demo videos, screen-reader pass on every primary flow (post create, comment, vote, status change, billing). Back-end: API errors return human-readable messages, error responses include WCAG-compliant status text for downstream renderers, server-rendered pages ship correct lang attributes, transactional emails use accessible HTML structure. Add an automated axe-core run to CI so regressions fail PRs.

FeatureShippedGeneral·5 months ago·3

Storage hardening: signed direct uploads, image resizing, and malware scanning

Context: Uploads currently route bytes through the Node server with service-role writes (src/app/api/uploads). Migration 0022 flagged signed upload URLs, image resizing, and virus scanning as a follow-up. Scope: - Signed direct-to-Storage upload URLs so large files skip the app server. - Server-side image resizing and thumbnails for avatars and inline media. - A malware/content scanning step before a file becomes public. Done when: large media uploads do not pass through the Node process; resized variants are served; unsafe files are rejected.

FeatureShippedFeature requests·5 months ago·0

Edge caching and CDN headers for public pages and media (/m/*)

Context: Public pages (board, roadmap, changelog, docs) render with full SSR and no revalidation; the media resolver /m/* has no documented cache or CDN strategy. Scope: - Add ISR/revalidate to public pages with tag-based invalidation on writes. - Set long-lived cache-control plus immutable on /m/* responses and front with Cloudflare. - Ensure authed and admin pages stay uncached. Done when: anonymous public pages and media are served largely from cache/edge, cutting origin load during spikes.

FeatureShippedFeature requests·5 months ago·1

Verify and tune Postgres connection pooling for traffic spikes

Context: Each Next.js instance opens DB connections via Supabase. Under a spike, unpooled connections can exhaust Postgres. Scope: - Confirm whether Supavisor or PgBouncer fronts Postgres on the Supabase host. - Point the app at the pooled endpoint (transaction mode) where appropriate. - Set sane pool sizes versus Postgres max_connections, accounting for 2 pm2 instances. - Load test to validate headroom. Done when: connection counts stay bounded under load and the app uses the pooler.

FeatureShippedFeature requests·5 months ago·1

[Agent] Add error.tsx and loading.tsx route boundaries

## Agent brief **Category:** ux | **Severity:** high | **Effort:** M ### Problem No `error.tsx` or `loading.tsx` anywhere under `src/app/`. Server errors show generic Next.js page; navigations have no skeleton feedback. ### Repro 1. Trigger server error on any project route 2. Observe bare Next error boundary 3. Navigate between heavy pages — blank flash ### Files - Add `src/app/[projectSlug]/error.tsx`, `loading.tsx` - Add `src/app/admin/error.tsx`, `loading.tsx` ### Acceptance criteria - [ ] Branded error UI with retry + home link - [ ] Loading skeletons on feedback, roadmap, docs, changelog ### Suggested approach Start with `[projectSlug]` segment; reuse PageHeader + Card patterns.

FeatureFeature requests·4 months ago·0

[Agent EPIC] Portal visibility gating — single source of truth

## Agent brief — EPIC **Category:** architecture | **Severity:** high | **Effort:** L ### Problem Portal feature flags inconsistently enforced across nav, search, sitemap, hub. ### Goal Single helper: `getProjectPortalSurfaces(project)` ### Files - New `src/lib/portal/surfaces.ts` - Wire: project-tabs, search route, sitemap, hub ### Acceptance criteria - [ ] Helper unit-tested - [ ] No 404 links from in-app nav

FeatureFeature requests·4 months ago·0

[Agent META] Deep audit wave 2 — Jun 17 2026 (32 cards)

## Agent brief — META **Wave 2 deep audit — Jun 17 2026** 32 agent-ready cards filed with `[Agent]` prefix. Each card includes: category, severity, effort, repro, files, acceptance criteria. ### Pick up order (recommended) 1. **Critical:** Private project member access → auth_mode on /feedback/new 2. **High:** Embed auth race, widget private projects, viewer UI guards 3. **Portal gating EPIC:** nav + search + sitemap + hub toggles 4. **UX polish:** error/loading boundaries, search failures, error messages 5. **A11y/mobile:** focus traps, dark mode widget/embed 6. **Infra:** Playwright e2e, cron secret, oauth log cleanup ### Card format for agents Look for titles starting with `[Agent]`. Body has structured brief with checkboxes. ### Wave 1 cards Earlier audit (no prefix): embed 404, Updates tab, hub toggles, docs dual search, etc.

FeatureFeature requests·4 months ago·0

Widget: identified end users via a signed JWT

Split out of the Embeddable feedback widget card (whose MVP has shipped). Today the widget signs visitors in anonymously; this card lets a host site submit feedback as a known user. Proposed shape: - A signing endpoint: the customer's backend calls Hollahoop with their API key plus the end user's id/email/name and gets back a short-lived JWT we sign. - The host passes that token to the widget via a data-user attribute or window.__hollahoop.identify(token). - /embed verifies the token (it is our own JWT), and submitPostAction associates the post with that identity instead of an anonymous user. - Anti-spoofing: verify signature + expiry server side; never trust client-supplied identity without a valid token. Out of scope: full SSO, per-user notification routing. Needs a decision on the JWT signing secret / key management before build.

FeatureShippedFeature requests·5 months ago·0

MCP server hardening: redundancy, rate limits, abuse and threat review

Audit the public MCP surface against the latest model-context-protocol best practices. Revisit per-key and per-IP rate limits, add a circuit breaker for sustained abuse, instrument health and response-time SLOs with auto-failover to a warm replica, redact secrets from error responses, threat-model the tool surface (prompt injection via tool descriptions, scope escalation), and document the security posture publicly. Roll the resulting controls into the existing API rate limiting and abuse hardening card rather than duplicating that work.

FeatureShippedGeneral·5 months ago·4

RabbitMQ durable job queue for email outbox, webhooks, and AI tasks

Context: The email outbox drains inline in the request path, and outbound Slack/Discord webhooks fire synchronously. Under a traffic spike this adds latency and risks lost work. Scope: - Stand up a RabbitMQ producer/consumer with ack, retry, and a dead-letter queue. - Move email_outbox processing to a worker. - Move outbound webhook delivery to the queue with retries and idempotency (webhook_events). - Reserve a queue for future AI tasks (drafts, moderation). Infra: RabbitMQ is already available on the LAN. Add the AMQP URL to /opt/hollahoop/.env. Done when: emails and webhooks are enqueued and delivered by a worker, with retries and visibility into failures.

FeatureShippedFeature requests·5 months ago·0

UX audit batch — Jun 2026 (public portal + admin chrome)

# Hollahoop UX audit — Jun 16, 2026 Full pass as an anonymous user across localhost + production (`hollahoop.app`). ## Shipped this session - **P0** Fixed UTF-16 corrupted admin chrome (`workspace-top-bar`, `admin-top-bar`, `language-switcher`) — changelog/docs/app were 500ing - **Support inbox** Full-height collapsible filter rail (previous session) - **Roadmap list a11y** Vote/comment counts now have proper `aria-label`s - **Theme toggle** Names the *next* theme in the cycle for screen readers - **Post detail** "View on roadmap" link when status is on roadmap; softer comment composer; fewer duplicate Sign in links - **Login** Explains why sign-in is required when redirected from `/feedback/new` - **i18n** Pre-paint `document.documentElement.lang` from saved UI locale ## Still on the roadmap (planned) - Docs article layout: persistent sidebar TOC on desktop - Roadmap kanban: horizontal scroll affordance on mobile + column collapse memory - Public project hub: search trigger should show keyboard hint (`/`) - Guest posting: enable on demo project OR guest form with email-only - Full string i18n (next-intl extraction) — switcher is UI-only today - WCAG 2.2 AA pass (focus order, contrast audit widget) - Cookie consent: remember dismiss across sessions without re-prompt on every subdomain - Admin support desk: keyboard shortcuts (j/k navigate tickets, r reply) - Changelog: sticky tag filter bar while scrolling long feeds ## What felt great - Feedback board density and vote buttons - Roadmap kanban + prioritize flow - Login split panel design - Changelog tag filters

FeatureShippedGeneral·4 months ago·2

Automatic custom domain DNS setup (Cloudflare API and friends)

First-party setup flow for connecting a custom domain to a Hollahoop project. When the user pastes a domain and a provider token (Cloudflare to start, then Vercel DNS, Route53, GoDaddy, Namecheap), Hollahoop creates the CNAME / TXT / ALIAS records automatically. For providers without a public API, fall back to a generated step-by-step guide with the exact records to add manually. Includes propagation polling, TLS issuance status, and a reusable verification API so multiple Hollahoop features (project hubs, widget script CDN, support email) can hang off the same domain config. Makes the existing Custom domain for the widget script and Custom domains for public project hubs cards much faster to onboard onto.

FeatureShippedGeneral·5 months ago·0

Inbound issue update sync (Linear, Jira, GitLab, Bitbucket, Azure DevOps, generic git)

Keep linked Hollahoop cards in sync when the remote issue/MR/PR title or body changes. Shipped overnight: - Linear `action: update` and Jira `jira:issue_updated` - GitLab Issue/MR `update` - Bitbucket `issue:updated` / `pullrequest:updated` - Azure DevOps `workitem.updated` / `git.pullrequest.updated` - Generic git webhook `action: "update"` (upsert when not linked) Also: public status page, leaderboard, and Updates chrome localized en/es/de/fr/pt/ja/ar. See Updates: inbound-sync-issue-updates-across-linear-jira-gitlab-bitbucket-and-azure-devops

FeatureShippedFeature requests·8 days ago·2

Search upgrade: Postgres full-text (tsvector) and pgvector semantic search

Context: Search is ILIKE-based today (src/lib/mcp/tools.ts). pgvector is enabled but unused; pg_trgm powers duplicate suggestions only. Scope: - Add tsvector columns and GIN indexes for posts, docs, and changelog; rank results. - Add an embeddings pipeline and pgvector index for semantic search and better duplicate detection. - Blend lexical and semantic results in the search UI and the MCP search tool. Done when: search returns ranked, relevant results across posts, docs, and changelog with semantic recall.

FeaturePlannedFeature requests·5 months ago·7

Self-hosted Supabase backups and PITR: verify and run a restore drill

Context: Backup and point-in-time-recovery posture for the self-hosted Supabase Postgres is not visible from the app repo. This is a priority before marketing traffic. Scope: - Confirm automated Postgres backups exist (frequency, retention, offsite copy). - Confirm WAL archiving / PITR is configured. - Document and rehearse a full restore into a scratch environment. - Include Garage S3 bucket backup or replication for uploaded media. Done when: a restore drill succeeds and the runbook is written.

FeaturePlannedFeature requests·5 months ago·4

Auto-create GitHub issues from backlog / roadmap posts

## Problem Creating Hollahoop backlog or roadmap posts does not open GitHub issues. Agents and eng still need a second manual step. Link-to-existing-issue + auto-ship on close exist, but post → issue creation does not. ## Goal When a post is created (or moved) into a configured board/status (e.g. Backlog, Roadmap, Planned), Hollahoop optionally creates a GitHub issue in a linked repo and stores the github_post_links row automatically. ## Acceptance criteria - Per-project (or per-board) setting: target repo, label(s), issue template, which statuses trigger create - On create/move into trigger status: open GitHub issue with title + body from the post; link it back - Idempotent: never open a second issue if one is already linked - Toggle default off so existing projects are unchanged - Agents/MCP: create_post with `create_github_issue: true` (or project default) should return the issue URL - Failures surface in the post UI; retry safe ## Why Bizni (and other LAFU products) plan work in Hollahoop. Without auto-issues, Cursor/other agents cannot pick up engineering work from GitHub alone. This closes the loop for multi-agent workflows. ## Out of scope Full body sync both ways; comment mirroring.

FeatureOpenFeature requests·7 days ago·1
HollahoopGet yours