Changeset 0.37.5 (#217)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

CHANGELOG.md

@@ -1,5 +1,106 @@
 # Changelog
 
+## [0.37.5] — 2026-03-21
+
+### Summary
+
+Login + Settings surface rebuild (Phase 3 begins). First surfaces
+converted from server-rendered Go templates + imperative DOM JS to
+Preact component trees consuming the v0.37.3 SDK (`sw.api.*`,
+`sw.auth.*`, `sw.theme.*`).
+
+### New
+
+- **Login surface** (`src/js/sw/surfaces/login/`) — 5 Preact components:
+  - `LoginSurface` — root, auth mode switching (builtin/oidc/mtls),
+    OIDC callback hash handler
+  - `Hero` — left panel with branding, feature pills, version display
+  - `LoginForm` — username/password, calls `sw.api.auth.login()`
+  - `RegisterForm` — registration flow with validation, pending approval
+  - `SSOPanel` — OIDC redirect + mTLS continue button
+- **Settings surface** (`src/js/sw/surfaces/settings/`) — 12 files:
+  - `SettingsSurface` — left nav + section routing via `__SECTION__`
+  - `GeneralSection` — model select, system prompt, max tokens,
+    temperature slider, thinking toggle. Uses `sw.api.models.enabled()`
+    + `sw.api.profile.settings()`
+  - `AppearanceSection` — theme toggle (light/dark/system) via
+    `sw.theme.set()`, UI scale + message font size sliders
+  - `ProfileSection` — avatar (upload/remove), display name, email,
+    password change. Uses `sw.api.profile.*`
+  - `ModelsSection` — searchable model table with visibility toggles.
+    Uses `sw.api.models.enabled()` + `sw.api.models.setPref()`
+  - `TeamsSection` — read-only team membership list via
+    `sw.api.teams.mine()`
+  - `BridgeSection` — thin Preact wrapper for deferred sections that
+    call old JS loaders (Tasks, Git Keys, Workflows, Data & Privacy)
+- **`sw.toast()`** — imperative toast API on the SDK. Dynamic import
+  from primitives. `sw.emit('toast', { message, variant })` event
+  listener for surface-agnostic toast firing.
+- **Nav gating** — Personas tab hidden when `allow_user_personas`
+  policy is false. BYOK section (Providers, Roles, Usage) hidden when
+  `allow_user_byok` is false. Fetched from `sw.api.admin.settings.public()`.
+- **ToastContainer + DialogStack** mounted in settings surface root
+  (not via shell `<App>`, since surfaces render standalone).
+- **`sw-login.css`** — login-specific styles extracted from inline
+  `<style>` in old Go template.
+
+### Changed
+
+- `server/version.go` — version `0.36.0` → `0.37.5`
+- `VERSION` — `0.36.0` → `0.37.5`
+- `server/pages/templates/login.html` — stripped all inline CSS/JS,
+  minimal shell with `<div id="login-mount">`, vendor + SDK + surface
+  boot script chain. Injects `__AUTH_MODE__`, `__REGISTRATION_OPEN__`,
+  `__BANNER__`, `__VERSION__`, `__ENVIRONMENT__`.
+- `server/pages/templates/surfaces/settings.html` — server-rendered DOM
+  replaced with `<div id="settings-mount">`. Bridge section old JS
+  script tags retained for deferred sections. Injects `__SECTION__`,
+  `__PAGE_DATA__`.
+- `src/js/sw/sdk/index.js` — `sw.toast` wiring (dynamic import),
+  `sw._sdk` bumped to `'0.37.5'`. `?v={{.Version}}` on SDK + surface
+  imports for cache busting (vendor imports stay bare to avoid
+  dual-instance).
+
+### Known Issues (must resolve before tag)
+
+These are tracked for future changesets — every feature must work by
+the time we reach v0.37.# tag.
+
+1. **Bridge sections stuck on "Loading..."** — Workflows and Git Keys
+   bridge sections render their mount `<div>` but the old JS loaders
+   (`loadTeamWorkflows`, `_loadSettingsGitKeys`) depend on globals
+   (`UI`, `API`, `App`) from `base.html`'s old script chain that aren't
+   loaded on the new Preact settings surface. **Resolution:** rewrite
+   these as full Preact components in a future changeset, or ensure the
+   old globals are available via a compatibility shim.
+
+2. **Tasks bridge works, Data & Privacy bridge works** — these old JS
+   files load successfully because their loaders use the `sw.*` SDK or
+   simpler DOM patterns that don't depend on the old `UI`/`API` globals.
+
+3. **Personas section** — nav gating works (hidden when policy disabled).
+   The section component itself is thin (list + create stub). Full
+   persona CRUD with KB bindings deferred.
+
+4. **BYOK sections** — Providers, Roles, Usage nav items correctly
+   hidden when `allow_user_byok` is false. Not yet tested with BYOK
+   enabled (requires admin enabling the policy + configuring a provider).
+
+5. **`pages.js` not deleted** — still contains admin surface functions
+   (`Pages.saveRole`, `Pages.saveProvider`, etc.) used by the admin
+   surface (v0.37.6). Login/settings functions in `pages.js` are now
+   dead code but kept until admin surface rewrite.
+
+6. **`ui-settings.js` + `settings-handlers.js` not yet deleted** — the
+   old code is superseded by the Preact surface but some bridge sections
+   may still reference helpers from these files. Will delete after
+   confirming no remaining references in a dedicated cleanup pass.
+
+### Deleted
+
+- (Deferred — old settings JS files retained until bridge sections are
+  fully replaced. See Known Issues #6.)
+
 ## [0.36.0] — 2026-03-20
 
 ### Summary