Changelog

Flexible billing overrides for tickets and client reports

Billing

• Admins can now set a custom hourly rate on a single ticket without changing the client's default organization rate.
• Ticket history now records billing override changes so discounted or special-rate work remains auditable.

Reports

• Report Builder now supports one-off custom hourly rates, useful for discounted invoices, retainers, and client-specific summary exports.
• Duplicated, published, and public reports now keep the same effective rate instead of drifting back to stored entry pricing.

Rate Consistency

• Timers, manual time entries, API time logs, and admin time reports now inherit the correct effective ticket rate automatically.
• When an admin changes the company or ticket override, existing billable entries on that ticket are re-aligned to the current effective rate.

Notification scope, cleaner kanban, safer updates, and smoother attachments

Notifications

• Notification visibility now follows real ticket access across the bell, full notifications page, dashboard widgets, push alerts, and unread counters.
• Opening a ticket clears its action-required alerts, and older stored notifications now respect the same stricter visibility rules for agents and clients.

Kanban & Workflow

• Closed work now moves into a collapsed Closed section instead of stretching the active board, with optional auto-hide for older completed cards.
• Wide-screen kanban layout, drag and drop behavior, status counts, due date saves, and overdue refresh all received workflow fixes.

Updates & Attachments

• The in-app updater now applies packaged file changes correctly and handles malformed flat archives more safely instead of faking a successful update.
• Multi-file uploads now behave reliably, selecting files multiple times appends instead of replacing, and blocked attachments show a persistent inline validation error.

Stability

• Scheduled reports, organization updates, last-active-admin protection, and comment-notification rendering all received follow-up reliability fixes.
• Pasted inline images now render as compact previews with a full-size lightbox instead of cluttering the ticket thread.

Persistent sessions, email attachment support, and security hardening

Fixes

• Login sessions now persist across app and container restarts using database-backed session storage.
• Inbound email attachments are stored with ticket threads and open correctly from the UI.

Security

• Attachment downloads now enforce ticket permissions and public share-token access rules.
• Remember-me no longer bypasses TOTP 2FA-protected accounts.
• CSRF failure redirects are now limited to safe FoxDesk URLs.

Infrastructure

• Reverse-proxy HTTPS detection now generates correct app, mailer, and pseudo-cron URLs behind Cloudflare and similar proxies.

Inline ticket-list editing, Quick Add workflow, and API additions

Improvements

• Tickets list: inline editing of subject, type, due date, company, and assignee directly from the row.
• Tickets list: compact Quick Add toolbar button toggles a collapsible inline row for creating a ticket without leaving the page, including optional time logging in minutes.
• Tickets list: dropdowns now render with fixed positioning so they cannot be clipped by table or column overflow.

API

• New helper endpoints: quick-subject and quick-create-ticket.

Security hardening for the agent API and search fixes

Security

• Agent API ticket listing now respects agent ticket scope.
• Comment, status, and time endpoints now enforce ticket access permissions.

Improvements

• Agent ticket detail now returns comments and standard ticket codes.
• Public report language override applies correctly per report.
• Quick ticket search excludes archived tickets again.

Performance, security & new-ticket enhancements

Improvements

• Static caching and N+1 query fixes for faster page loads.
• LEFT JOIN attachment count replaces subquery — fewer DB round-trips.
• New ticket form — persistent timer via localStorage, status pill selector, auto-stop on submit.
• Sidebar running-timer indicator and long-timer notification.
• Keyboard-accessible filter pills and filter-preserving bulk actions.
• Dark mode visual fixes.

Bug Fixes

• Trusted proxy IP check added for correct client detection behind reverse proxies.
• Integer cast on recurring-task template IDs prevents type-juggling edge case.
• Dead code removal and constants cleanup.

Stability fixes — notifications, auth, timers

Bug Fixes

• Notifications — fixed mark-as-read persistence; badge now uses server count with keepalive fetch.
• Settings — fixed Security tab crash caused by MySQL strict mode.
• Auth — fixed remember-me session confusion between users.
• Time tracking — fixed midnight overflow (23:16 → 00:16 now correctly counts as 60 min).
• Tickets — kanban/list view preference persists via cookie; status change redirects back.

Improvements

• Dashboard 'My Time' widget now includes running and paused timers.
• New ticket — agents can set status and log manual time with start/end.

Timer & report fixes, merged reports menu

Bug Fixes

• Paused timer duration calculation fixed across all reports, ticket lists, and detail pages.
• Agents now see 'My time' label instead of misleading 'Total time'.
• DateTime validation guard for worklog inline edits.
• Query limit added to prevent memory exhaustion on large report datasets.
• Fatal error on public report page (APP_NAME constant) fixed.

Improvements

• Time Report and Client Reports merged into a single menu item.
• Removed hash prefix from client report task grouping.
• Hidden redundant Agents breakdown table for non-admin users.

Kanban board & ticket filters

New Features

• Kanban board — visual ticket overview with drag-and-drop status changes.
• Kanban board — animated ghost thumbnail, drop placeholder, micro-animations.
• Kanban board — sort cards within columns, List/Board toggle with persistence.
• Kanban board — mobile fallback with status dropdown.
• Tickets — user filter dropdown (creator, assignee, email).

Improvements

• Notifications — flat left border design, consistent with ticket list.

Bug Fixes

• Assigned users always have access to their tickets (scope filtering fix).

UX improvements, timer fix, report billing fix

Improvements

• Ticket detail — company dropdown moved to visible sidebar.
• Admin System — advanced settings (background tasks, manual update, backups, uploads) collapsed under Advanced section.
• Agent Connect — agent picker with empty state instead of error redirect.
• Install wizard — improved microcopy, friendlier error messages, and step descriptions.
• Background ops moved from header.php to index.php (before page render).

Bug Fixes

• Timer button — fixed height, no size jump between running/paused states.
• Shared report showing 0 USD — now falls back to organization billable rate.
• Assigned users always have access to their tickets (scope filtering fix).

Timers overhaul, ticket sorting, persistent sessions, and email notifications

Timers

• Sidebar stop button for active timers.
• Sidebar and ticket page stay in sync (pause/stop/resume).
• New ticket + timer flyout — opens blank form with timer running.
• Removed old instant Quick start.

Tickets

• Sort by last updated and ticket number.
• All tickets on single page, pagination removed.
• Comments update ticket timestamp for correct sorting.
• New ticket form — company field no longer auto-prefilled.

Other

• Persistent 30-day login sessions enabled by default.
• Assignee and participants receive comment email notifications.
• Fix: notifications table auto-created on fresh installs and upgrades.
• Fix: dashboard crash on missing notification columns.

Notifications upgrade, recurring tasks, reporting, TOTP 2FA, and full i18n

36 features across 4 areas. 42 files changed, +5 350 / −671 lines.

Notifications (11 features)

• Per-type notification preferences — 7 toggleable types on Profile page.
• Better unread indicators — blue tint, dot indicator, pulsing badge.
• Avatars in bell panel — photo or initials fallback per notification.
• Mark-as-read on mobile — always-visible checkmark button per item.
• Bell panel capped at 20 with "View all" link.
• Group dismiss — mark all notifications for same ticket as read.
• Due date reminders — cron-based overdue/due-soon alerts with dedup.
• Browser push notifications — VAPID Web Push, one-click enable, works with tab closed.
• Sound toggle — mute/unmute from panel header.
• Notifications page parity — same mark-read + group dismiss as panel.
• Empty state — "All caught up!" with illustration.

Recurring Tasks (10 features)

• Run history — last 5 runs with ticket link + timestamp.
• Run Now — manual trigger outside schedule.
• Preview ticket — modal with all fields, ID-to-name resolution, due date calc.
• Search & filter — text search + Active/Paused/Inactive tabs.
• Configurable due date — "Due in X days" on task form.
• Auto-tag — tags field, inherited by generated tickets.
• Pause/resume — with optional auto-resume date, orange badge.
• Failure notification — all admins notified on generation failure.
• Duplicate task — one-click clone with all settings.
• Next run inline — human-readable relative time in table.

Reporting (16 features)

• Separate Client Reports nav — dedicated sidebar link.
• Sparkline bar indicators — CSS-only proportion bars on Summary tab.
• CSV/Excel export — Summary, Detailed, Work Log with UTF-8 BOM.
• Column picker — toggle columns on Detailed tab, localStorage.
• Collapsible filter panel — auto-collapse with removable pills.
• Weekly tab improvements — date ranges, stacked bars, expandable.
• Searchable client dropdown — type-to-search in Report Builder.
• Edit published reports — builder opens pre-filled for editing.
• Report duplication — clone with auto-incremented dates.
• Scheduled auto-generated reports — weekly/monthly/quarterly via cron.
• Email delivery — HTML email with KPI summary + report link.
• Smart financial columns — Cost/Profit hidden when all zero.
• Tag filter — chip-select UI with filter pills.
• Filter persistence — date range saved in localStorage.
• Date range presets — Today, Last 7/30 days, This/Last quarter.
• Print-friendly — @media print, A4 landscape, Print button.

Security

• TOTP Two-Factor Authentication — Google Authenticator, Authy, 1Password.
• QR code setup + manual secret fallback, 8 one-time backup codes (SHA-256 hashed).
• 2-phase login with rate limiting (5 attempts / 5 min), admin can require 2FA per role.

Other improvements

• Security settings tab — dedicated tab with 2FA enforcement and impact warnings.
• Settings consequence hints — info on non-obvious settings across all tabs.
• Full i18n — all remaining hardcoded UI strings wrapped in t() for translation.

Notifications, AI agents, activity tracking, report builder, recurring tasks, and PWA

• Notifications: in-app notification center grouped by ticket, cross-view read state sync, dashboard widget, and consistent avatar colors.
• AI Agent Integration: Agent Connect with step-by-step guides, REST API endpoints, and token management.
• Activity Tracking: admin section with page view analytics and user activity logs.
• Report Builder: create, share, and export reports as PDF or CSV with sharing links.
• Recurring Tasks: set up recurrence options with automatic execution via cron or pseudo-cron.
• PWA support: install FoxDesk on desktop or mobile as a native-like app.
• Pseudo-cron for shared hosting without cron access (WordPress-style background tasks).
• Allowed senders and ticket sharing.
• Organizations with billing rates and multi-org support.
• Documentation: complete rewrite of README, INSTALL, and MANUAL.