Changeset 0.37.19 (#232)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

CHANGELOG.md

@@ -1,5 +1,55 @@
 # Changelog
 
+## [0.37.19.0] — 2026-03-24
+
+### Summary
+
+Tag release — "UI Complete." Closes all remaining code review items from
+FE-REWRITE-REVIEW-0.37.14.md. Adds client-side RBAC gates (`sw.can()`) to
+surface action buttons, migrates settings policy reads from `__PAGE_DATA__`
+to `sw.auth.policies`, removes dead `__USER__` / `__PAGE_DATA__` template
+injections, and moves shell-coupled `_getScale()` into the SDK. Light mode
+CSS audit and dead code sweep confirm no outstanding issues.
+
+### Changed
+
+- **sw.can() RBAC gates (CR P2-1):** Channel/group creation buttons in chat
+  dashboard and sidebar gated behind `sw.can('channel.create')`. Persona
+  create/edit/delete gated behind `sw.can('persona.create')` /
+  `sw.can('persona.manage')`. Knowledge base create/upload/delete gated
+  behind `sw.can('kb.create')` / `sw.can('kb.write')`.
+  (`chat-workspace.js`, `sidebar.js`, `personas.js`, `knowledge.js`)
+- **Settings → sw.auth.policies (CR P2-4):** Settings surface reads BYOK and
+  persona policies from `sw.auth.policies` (populated at SDK boot via
+  `/api/v1/profile/permissions`) instead of `window.__PAGE_DATA__`. Listens
+  for `auth.permissions.changed` event to react to policy updates.
+  (`settings/index.js`)
+- **_getScale → sw.shell.getScale() (CR P3-3):** Scale detection for CSS zoom
+  compensation moved from sidebar-chats.js local function into SDK shell
+  namespace. Explicit coupling replaces implicit `#surfaceInner` DOM reach.
+  (`sdk/index.js`, `sidebar-chats.js`)
+- **SDK version:** `sw._sdk` updated to `'0.37.19'`.
+
+### Removed
+
+- **__USER__ / __PAGE_DATA__ injection (CR P2-4):** Removed `window.__USER__`
+  and `window.__PAGE_DATA__` global injections from `base.html`. SDK boot
+  populates `sw.auth.user` and `sw.auth.policies` from API. Extension packages
+  updated to use SDK (`editor`, `hello-dashboard`, `icd-test-runner`).
+  (`base.html`, `loaders.go`, `EXTENSION-SURFACES.md`)
+- **SettingsPageData policy fields:** `BYOKEnabled` and `UserPersonasEnabled`
+  removed from Go struct (no longer injected via template). (`loaders.go`)
+
+### Documentation
+
+- **CR P3-17:** Added comment documenting intentional raw DOM usage in notes
+  markdown wikilink processing (`markdown.js`).
+- **CR P3-19:** Added comment documenting keyboard shortcut DOM presence check
+  pattern with future guidance (`use-notes.js`).
+- **EXTENSION-SURFACES.md:** Updated `__USER__` references to `sw.auth.user`.
+
+---
+
 ## [0.37.18.0] — 2026-03-24
 
 ### Summary