Show unseen Server commits after login.

Bake first-parent git log at Server build and remember the SHA in a browser cookie. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-20 11:43:36 +03:00
parent 1e7014cabd
commit 449be4e0ea
20 changed files with 751 additions and 1 deletions
@@ -68,6 +68,26 @@ closes the connection with a policy violation and never sends Welcome. A second
 that already has a live connection is closed the same way; `POST /api/session` for that name
 returns `409` `name-online`. Hello is unchanged (version + locale only).

+### `GET /api/changelog`
+
+What landed in the running Server build since an earlier commit. Requires a session cookie.
+`current` is the SHA baked at compile time (`git rev-parse HEAD` during that build), not the live
+working tree. `commits` is `git log --first-parent` after `since`, oldest first, subjects that
+match `Mark phase <digits>` omitted. Without `since`, with an unknown SHA, or when `since` equals
+`current`, `commits` is empty — a first visit must not dump the whole history.
+
+```json
+{
+  "current": "0123456789abcdef0123456789abcdef01234567",
+  "commits": [
+    { "sha": "89abcdef0123456789abcdef0123456789abcdef", "date": "2026-08-20T08:21:00+00:00", "subject": "Merge branch 'phase/53-weather-commute'" }
+  ]
+}
+```
+
+Optional `?since=` is a 40-character hex SHA from the client's `hschool.seen-rev` cookie. That
+cookie is not HttpOnly and is not the session cookie. Protocol version is unchanged.
+
 ### `GET /api/schools`

 Everything the main menu needs in one request. `schoolWeekDays` is 5–7 working days counted