Skip to content

Changelog

What we've added and improved in the shop, your account, and personal-agent shopping. This history brings together completed Codex and Cursor work, checked against the project's code. Dates record the work, not guaranteed production release dates.

Filter updates by area

61 updates · 10–12 October 2026

Workspace changes

Latest work

Implemented in the current workspace, listed separately from the committed history below.

  • Behind the scenes

    Find sign-in callback failures safely

    Added bounded diagnostics identifying which sign-in callback stage failed, with recognized error codes, HTTP status and known missing database objects. Request details, credentials, error messages and queries stay out of these logs. Sign-in behavior is unchanged. Implemented locally; activation requires a shop deployment.

  • Agents

    Keep agent discovery and API links usable

    Fixed the shop’s discovery redirect, MCP metadata, OpenAPI links and conversation session checks when the authorization server’s issuer ends with a slash. MCP metadata also supports the explicitly configured public API host when resources retain their address after an issuer change; unconfigured hosts remain rejected. Tokens retain their exact issuer. Implemented locally; activation requires a shop deployment.

  • Account

    Bring more of Fernhollow into account emails

    Added the webshop’s camping and trail photography to verification, welcome, invitation and account-protection email designs, with a warmer welcome and clear actions that remain usable when images are blocked. Saved the revised templates in Auth0; delivered custom designs still require an external email provider.

  • Account

    Restore account emails and prepare Fernhollow designs

    Restored Auth0’s default email provider and confirmed verification email delivery. Enabled the shop’s custom login domain for email links. Created twelve Fernhollow email designs and saved eleven supported templates in Auth0; the default provider still sends Auth0’s standard design. Custom designs require an external email provider, and sign-in approval additionally requires tenant support.

  • Account

    Check email verification without restarting sign-in

    The email verification Form can check your account again after you open the link in your inbox. Verified accounts continue the same sign-in; otherwise, the Form stays open and says your email is still not verified. Deployed through Terraform on 12 October 2026. Existing completed error callbacks need one fresh sign-in to enter the new Form.

  • Agents

    Keep logged-out agent sessions closed

    Prepared local checks that prevent a delayed agent sign-in from restoring a logged-out session. Agent sessions use verified authentication time, and logout records their cutoff and revocation together. Requires the database migration and shop deployment.

  • Agents

    Check access again during browser sign-in transfer

    Prepared expiry and access checks around optional browser sign-in transfers, including checks after provider responses. Ended or replaced sessions are rejected, and permanent provider denials retain cleanup. The optional feature remains disabled in the current configuration and requires gateway deployment before use.

  • Account

    A clearer next step for unverified email

    The shop now shows a check-your-email page with a fresh sign-in link when email verification blocks a callback, replacing the raw JSON error. This recovery was deployed on 12 October 2026. A matching Auth0 Form, with the normal login’s photo carousel, and denied token refresh handling are prepared locally and still require deployment. Email verification remains required.

  • Account

    Fix identity verification before account deletion

    Fixed security verification rejecting ordinary website sign-ins because Auth0 assigns them its UserInfo audience. Both verification Actions now allow the configured tenant UserInfo audience while continuing to check the signed account operation and fresh authentication. Deployed to the live Auth0 verification Actions on 12 October 2026; final deletion still requires explicit confirmation after identity verification.

  • Account

    Session cleanup uses the standard Auth0 APIs

    Removed the session enable switch and legacy refresh-token cleanup. Account deletion always revokes Auth0 sessions and refresh tokens before identity removal; failed cleanup stays pending for retry. Terraform includes the required permissions by default.

  • Account

    Restore sign-in method controls

    Disabled the tenant’s unconfigured Duo factor after approval, restoring factor discovery during the live check. Configure its integration before enabling it again; later transient provider errors can still require a retry.

  • Behind the scenes

    Correct My Account permissions on custom login domains

    Auth0 grants and refresh-token policies now use the registered tenant API identifier while sign-in requests use the custom login domain, allowing the configured permissions to apply correctly.

  • Account

    Passkeys are part of the standard sign-in setup

    The database connection always offers passkeys alongside passwords, including browser autofill and enrollment. Eligible database accounts can add passkeys when the shop and login share a secure relying-party domain.

  • Account

    Identity verification follows the configured safeguards

    Sensitive account verification becomes available from the dedicated signing secret, website client, session encryption and secure shop address. Completed signed proof still authorizes each account change.

  • Account

    Account deletion follows its security prerequisites

    Account holders can delete their account without an enable switch when provider permissions and signed verification are configured. Fresh verification and exact DELETE confirmation remain required.

  • Account

    Restore passkeys and registered sign-in methods

    Fixed the account profile lookup so Auth0 accepts its requested fields. The deployed Security page shows Add passkey and registered methods for an eligible account; verified after a fresh signed-in browser reload.

  • Behind the scenes

    Trace signed-agent registration

    Added correlated gateway logs showing missing signatures, verification and public-key lookup results, and Auth0 Agent creation or registration failures. Sensitive request values stay out of the logs. These diagnostics are prepared locally for deployment.

  • Agents

    Invite an agent with its own account

    Added invitations with permissions you approve after verifying your identity. Agents sign in with their own verified mailbox, explicitly accept, and shop for an approved account; disconnect ends that account’s access without changing other approvals. Pending delivery, resend, cancellation and agent-instance attribution are included. Direct agent sign-ins cannot become customer sessions, and approval history records the accepting agent and permission revisions. Implemented locally: activation requires the database migration, email delivery, separate Auth0 login domains, configured delegation clients and live tenant/browser checks. Nothing was deployed by this change.

  • Account

    Keep shop sign-out connected to Auth0

    The website setup now requires Auth0 sign-out notifications and rejects empty receiver addresses. Applied to the Auth0 website application with all supported logout initiators. The shop receiver and database migration must be deployed; end-to-end notification delivery has not yet been verified.

  • Account

    Verify your email before signing in

    Added an email verification requirement for shop and agent sign-ins, including token refreshes. Follow the verification link in your inbox, then sign in again; verified social accounts continue normally. Activation requires applying the Auth0 configuration with email delivery enabled. Existing sessions are not automatically signed out.

  • Account

    Clearer Google and Facebook sign-in

    Google and Facebook now have recognizable logos, friendly names, and distinct buttons on login and signup. Enterprise sign-in buttons and their remembered-method hints are hidden from the retail experience. Deployed to the branded Auth0 screens; verified on the live login and signup pages.

  • Account

    A shorter security sign-in and optional passkey setup

    Database-account reauthentication carries your email into the password step. Both passkey enrollment screens now offer “Not now”. The session history records these changes as deployed.

  • Account

    Respond to sign-out notifications from Auth0

    Added a verified backchannel-logout endpoint so Auth0 can end the matching shop sign-in or the affected account’s older sign-ins. Activation requires deploying the shop and database migration, then configuring the Auth0 receiver.

  • Behind the scenes

    Fewer database reads for signed-in browsing

    Website session checks can reuse a short-lived edge cache for up to 60 seconds. Writes still check the database directly; a revoked browsing session may remain visible until its cached check expires.

  • Behind the scenes

    A simpler playground

    Removed the separate demo-company application and its playground shortcuts so the tools focus on connecting to actual company endpoints.

Account activity and a more familiar sign-in

New account visibility, login refinements, and broader automated checks.

  • Agents

    Identify agents from signed requests

    Deployed Web Bot Auth verification for every verified signer, with Auth0 Agent records, useful signer metadata, and the namespaced /agent claim. Live Agent creation and Session Token attribution are verified; authenticated sign-in and refresh acceptance checks remain.

  • Account

    Your account activity, in one place

    Added a private timeline of sign-ins, account changes, cart actions, payments, orders, cancellations, and returns. Filter by person or agent and event type, with 30 entries per page. History begins when logging is enabled by the database migration.

  • Account

    Remember your last-used sign-in method

    Password, Google, and explicit passkey choices can show a “Last used” hint on the login screen. The preference stays in your browser, and “Forget this hint” clears it. It records the method chosen, rather than confirming that a login succeeded.

  • Account

    Refreshed login forms

    Updated the sign-in layout, field focus, password visibility control, and passkey behavior to make the login experience easier to use.

  • Account

    Sign-in methods follow your Auth0 configuration

    Account security components become available automatically when Auth0 is configured, without a separate enable switch. The tenant still needs the My Account API and the appropriate permissions.

  • Account

    Email changes follow the available capabilities

    Eligible database accounts can change their email when provider permissions and identity-verification prerequisites are present. Social and enterprise accounts continue using their identity provider.

  • Behind the scenes

    A floating session debugger

    The Debug button opens Session, ID token, and Access tokens views on any shop page. Raw tokens require an explicit reveal action; inspecting the stored session does not request or renew tokens.

  • Account

    More reliable verification screens

    Repaired CAPTCHA loading, email challenge addresses and choices, resend handling, and the restart page. Password Show/Hide keeps its own keyboard focus.

  • Behind the scenes

    More predictable work during sign-out

    Simplified request and conversation handling around the session that admitted the work. New requests qualify again, and ordinary website sign-out preserves independent personal-agent approvals.

  • Behind the scenes

    Repeatable browser and agent-protocol checks

    Migrated account, contact, security, recovery, payment, order, and conversation walkthroughs into automated end-to-end suites. Added local gateway and Poppy company checks and a model-free pull-request test job.

  • Agents

    A hosted protocol playground

    Added Cloudflare deployment for the playground and repaired its hosted request proxy so agents can test discovery, sign-in, API, MCP, and conversation flows against the shop.

  • Behind the scenes

    Clearer deployment and conversation ownership

    Grouped Terraform and deployment code under infra, separated gateway account storage from grants, and moved conversation reply completion behind a named domain operation.

A fuller account and a smoother storefront

Customer self-service, branded authentication, and storefront usability improvements.

  • Account

    Manage your profile and verified contacts

    Added profile updates, verified email changes, and phone contact verification with resend cooldowns and pending-operation status. Phone contact proof stays separate from sign-in and two-step verification.

  • Account

    More complete order management

    Browse paginated order history, cancel eligible processing orders, and request refunds or exchanges. Pending payment and refund work stays visible while provider confirmation is outstanding.

  • Account

    Edit addresses and saved-card details

    Edit shipping addresses, choose a default address or saved card, and update supported billing details. Address storage uses Auth0 when configured, with a local fallback.

  • Account

    Safer security and recovery controls

    Added fresh identity checks for sensitive credential changes, supported factor removal, hosted enrollment, and recovery-code controls. Available methods depend on the Auth0 tenant’s capabilities.

  • Account

    Delete your account with recoverable cleanup

    Account deletion blocks further account access first, then retries provider and shop cleanup if a service is unavailable. Required order and financial records follow their retention rules.

  • Account

    Control devices and connected agents separately

    Sign out one session, other devices, or all devices. A separate freshly verified action also disconnects personal-agent approvals, and pending cleanup remains visible.

  • Account

    Fernhollow-branded Universal Login

    Added custom login, signup, password, verification, and passkey screens that match the shop, with versioned assets and a repeatable publishing process.

  • Shop

    Accurate stock badges across the shop

    Product cards in featured and catalog grids show sold-out status from current inventory. Photos and product details render while the stock badge loads.

  • Shop

    Clearer guest checkout and receipts

    Revisited receipts show the order’s current state, explain pending payments, and link to order lookup. Account signup appears only when sign-in is available, and checkout messaging and navigation were refined.

  • Shop

    Small storefront usability improvements

    Improved search, product grids, account access panels, checkout controls, status presentation, and formatting so the same information stays understandable across pages.

  • Behind the scenes

    Shared business operations with clearer ownership

    Extracted catalog, identity, accounts, cart, orders, payments, conversations, and shop workflows into focused workspace packages. Added package-boundary checks and kept tests beside their implementation.

Guest shopping, account foundations, and agent safeguards

The first integrated shop improvements recovered and verified from the session history.

  • Shop

    Checkout without an account

    Guests can enter an email and shipping address and complete checkout on one page. Stripe test-mode payments are supported when configured; otherwise the shop uses simulated payments.

  • Shop

    Private guest-order tracking

    Added private receipt links and order lookup by order number and email. Signing in with the same provider-verified email brings eligible guest orders into your account.

  • Account

    An account overview and sign-in sessions

    Added account summaries and session listings with sign-out controls. Auth0 session information is used when available, with recorded shop sign-ins as a fallback.

  • Account

    Manage passkeys and two-step verification

    Added an account security page using Auth0’s account components. The shop keeps the account API token on the server while presenting supported security methods in the browser.

  • Shop

    More reliable checkout and refunds

    Checkout binds the approved cart to the order, protects inventory reservations, and keeps processing payments pending until confirmation. Uncertain cancellation refunds can recover without blindly repeating the charge or refund.

  • Shop

    Consistent carts when guests sign in

    Repaired cart merging and cleanup when a guest pays after signing in. Guest order lookup also gained request limits and more careful verified-email ownership checks.

  • Agents

    Stronger personal-agent sign-in flows

    Completed per-agent Auth0 provisioning and repaired approval, token renewal, resource access, and browser-session safeguards across the gateway and playground.

  • Agents

    Keep agent conversations with the right account

    Strengthened account ownership and lifecycle handling for conversations, staff handoff, and agent commerce operations, including retries and concurrent sign-in changes.

  • Behind the scenes

    The shop moves to TanStack Start

    Migrated the storefront and server routes to TanStack Start on Cloudflare Workers. Visitor and cart data stream into the page shell, and conversation callbacks stay within the shop Worker.

  • Behind the scenes

    An integrated deployment and stronger request boundaries

    Added coordinated shop and gateway deployment, tightened server-only imports and request protections, and validated private account responses and protocol boundaries.

Reviewed through 12 October 2026. Repeated fixes and review rounds are grouped into one update. Research and proposed features are included only once they have an implementation in the shop or its supporting apps.