## What changed
- Added a chat-shell-level file drag/drop target so the whole chat area, including the conversation area, shows the drop overlay and accepts files.
- Disabled the nested composer drop handler for the sidebar chat path to avoid duplicate drops or stuck overlay state.
- Kept the existing local input drop behavior available for other ChatInput usages like the home composer.
Adds .html/.htm extensions and text/html MIME to the upload accept list and validation. The API already ingests HTML files; the uploader was rejecting them client-side.
## Summary
- Replace the memory graph page's top-left package loading indicator with a centered Supermemory loader overlay.
- Reuse the same SuperLoader animation in the graph preview card loading state.
## Summary
- Allow logged-out users to load `/?view=integrations` without being redirected to login
- Add a public integrations header with Supermemory branding and a login CTA
- Run IntegrationsView in guest mode with static catalog data only, no auth-backed queries
- Route all guest Connect actions to login with a redirect back to the integrations page
<img width="1680" height="1009" alt="Screenshot 2026-06-09 at 9 32 33 PM" src="https://github.com/user-attachments/assets/111f2b1a-5224-47ae-8152-e1349c05842d" />
feat(web): make brain onboarding the default flow
- Replace legacy /onboarding with the brain onboarding flow (about -> sources -> ingest -> team -> done)
- Add brain-home dashboard page and widgets
- Old /onboarding/brain deep links fall through to the existing catch-all redirect
feat(onboarding): create org on About step + remove skip
- Create the organization on About -> Continue (authClient.organization.create + setActiveOrg), persisting brain context to org metadata; fixes the no-org redirect loop
- Show a Creating… state on Continue while the org is created
- Remove Skip on the required About step (name + workspace)
- Add generateOrgSlug/generateUsername helpers to onboarding-brain/types
- New Poke card in Apps & extensions linking to the Poke recipe (OAuth, no manual MCP URL)
- Featured hero slot for Poke with palm-tree emoji
- Reusable NEW badge, applied to Poke
- Poke logo asset, full-cover icon styling
- POKE_RECIPE_URL constant; guard Chrome-only analytics on external cards
- Added attachment draft/shared types and validation in components/chat/attachments.ts.
- Added paperclip upload UI to Nova composer with file chips, size/status, remove, retry, and per-file Save / Chat only toggle.
- Wired uploads before send to /chat/attachments, then sends returned attachment references in chat message metadata.
- Preserved attachment metadata when loading threads and rendered attachment chips on user messages.
- Added attachment support from the home composer into the full chat view.
- Extended chat analytics with attachment counts.
<img width="1905" height="900" alt="image" src="https://github.com/user-attachments/assets/631001b8-7c68-4015-b36b-06c69cdad271" />
<img width="1323" height="1600" alt="image" src="https://github.com/user-attachments/assets/77eee08a-b235-41eb-b03a-f406b81b46e7" />
- ensured responsiveness
End-to-end tests that drive the deployed Supermemory MCP over streamable HTTP (no mocks):
- discovery: handshake + tool/resource/prompt listing
- identity: whoAmI, listProjects
- memory: save -> recall round-trip, profile variants, forget, container scoping
- graph/resources/prompts: memory-graph, fetch-graph-data, profile/projects, context
- oauth: protected-resource discovery chain, dynamic client registration,
token-endpoint negatives, and a real refresh -> access token round-trip
- auth: GET / info, 401 on missing/invalid token
- root-scope: x-sm-project scoping behavior
Tests skip without SUPERMEMORY_API_KEY (OAuth tier-D skips without its token env vars) so CI is safe without secrets. Adds vitest + a test:e2e script and documents running + the OAuth flow in apps/mcp/README.md.
Clicking stop before the first assistant token streamed in deleted the triggering user message: handleStop unconditionally sliced off a trailing user message, which during the submitted/thinking window is the user's own
message. Drop the slice so the message is preserved on stop.
ENG-732
Add a Current/All scope toggle (default Current) to Nova chat history; All fetches threads across every space via the new scope=all API, with each row showing its space.
Redesign the sheet to fit the design system: cap width at 380px (was ~92vw), add search, date-grouped rows (Today/Yesterday/Previous 7/30 days/Older), hover-reveal delete, header space chip, solid primary New Conversation button.
Part of ENG-728: https://linear.app/supermemory/issue/ENG-728
Integrate the new api_max plan ($100/mo, $130 credits) from mono into the
nova web app, mirroring mono's tier semantics.
- Tiers: insert api_max between pro and scale; resolves to Pro-tier for feature gates while displaying as "Max" (queries.ts, use-token-usage)
- Billing page: Max plan card ("Most Popular"), checkout/cancel/invoice wiring; advanced carousel page now 3-up (Max/Scale/Enterprise); Scale builds on Max
- Carousel auto-opens to the page holding the current plan (Max/Scale/ Enterprise users land on their own card instead of Free+Pro)
- Cancel: retention dialog listing what you lose + type-to-confirm "CANCEL"
- Cancel/resume state mirroring console: detect canceledAt-scheduled cancellation, show "Cancelling" pill + "Cancels on {date} · N days left", and a "Resume plan" (uncancel) action
## What
Fixes two bugs reported by a customer (Plain T-1289) using the Supermemory browser extension.
### Bug 1 — extension sign-in loop
When a user logs out of the _extension_ but is still authenticated in the _web app_, the extension's Sign-in button opens `/login`, which short-circuited via a bare `router.replace("/")`. That path never carried the `extension-auth-success` flag the dashboard waits on before `postMessage`\-ing the session token to the extension content script — so the extension never received a token and stayed stuck on "Sign in" indefinitely.
Now the already-authenticated redirect carries `?extension-auth-success=true`, matching the existing fresh-login callback behavior (no new token exposure).
### Bug 2 — stale / deleted spaces
The extension's stored default space (`local:sm-default-project`) was only set when none existed, never reconciled. After renaming/deleting spaces in the web app, the popup kept showing save buttons pointing at dead spaces. Now the popup reconciles the stored default against the freshly-fetched live list: resets to the first space if the stored one was deleted, and refreshes the cached copy (label/containerTag) if it was renamed.
The onboarding rework moved the flow to app/(app)/onboarding and dropped the funnel tracking, so onboarding_completed stopped firing on 2026-05-02.
- Wire onboarding_step_viewed across idle/processing/done/error transitions
- Fire onboarding_completed on real completion (status=done) with source + memories_count
- onboarding_profile_submitted now carries { source }
- Add onboarding_skipped { from_step }
- Remove dead onboardingCompleted() from InitialHeader and unused name/relatable helpers
