MindSift becomes the OAuth authorization server for its own MCP
endpoint: discovery (RFC 9728/8414), dynamic client registration,
authorization code with PKCE (S256), rotating refresh tokens with reuse
detection. The consent page lives in the app at /oauth/authorize. A
grant is an api_keys entry (kind 'oauth'), so scopes, origin badges,
renaming and revoking work as for keys; tokens are valid for /mcp only.
Unused connections expire after OAUTH_IDLE_DAYS (default 90). Requires
BASE_URL; off in demo mode. Release 0.51.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
thoughts.completed_at is set by triggers on every way a task is completed (migration 14; tasks
completed earlier count from the update). Users choose the delay (7/30/90/365 days or never,
users.done_retention_days); for tasks in a list the owner's delay counts. An hourly job deletes
expired completed tasks (not in the demo) and tells their viewers. POST /tasks/clear-done clears
completed tasks the user may edit. The done tab shows the setting and the button. v0.35.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>