Security fix (Gemini key) + productivity features (notes, DnD, Pomodoro, palette)

[Rupesh4604]

Summary

Audit-driven batch: one security fix (Gemini API key no longer shipped to the browser) plus a set of UX/feature improvements, several from the project's own waiting_Updates.md roadmap. Every commit builds clean (npm run build).

🔒 Security

• Gemini key moved server-side. The key previously shipped in the client bundle. AI calls now route through a free Cloudflare Worker (gemini-proxy/) that verifies the user's Firebase ID token and forwards to Gemini with the key held as a Worker secret. CORS locked to app origin (prod + localhost). Verified the key is absent from the production bundle.
  • Keeps Firebase on the free Spark plan (Cloud Functions would require Blaze).
  • Client: geminiService.js attaches the ID token; direct-key path kept only as a local-dev fallback. Clear error when the secret is missing.

✨ Features

• Project deadlines — fixes a dead feature: deadlines never rendered on the Schedule because no UI ever set them. Added date inputs to add/edit-project forms + a header badge.
• Project Notes & Resources — per-project Notes tab + validated links list. (roadmap)
• Drag-and-drop task reordering — "Manual" sort mode via @dnd-kit, order persisted to a order field. (roadmap)
• Bulk task actions — select mode in All Tasks: complete / reopen / delete multiple (batched writes).
• Pomodoro timer — floating widget on every view: Focus/Short/Long modes, dial, chime, daily session counter. (roadmap)
• Command palette — Ctrl/Cmd+K to search projects/tasks and quick-add a task; mobile search button.
• Daily Reminder — reworked from a static, unrendered banner into a data-driven Dashboard card.

🛠 Quality

• handleDeleteProject now uses an atomic writeBatch instead of a serial await loop.
• Extracted shared habit-card logic into a useHabit hook (~90 lines of duplication removed).
• Added aria-labels to icon-only buttons across the app.

Follow-up (not in this PR)

• Deploy: npm run build + firebase deploy to push to production.
• Rotate the old Gemini key (it was public); set the new one via wrangler secret put.
• Remaining roadmap: recurring tasks, persist calendar sync, notifications, light theme, tests.

🤖 Generated with Claude Code

[github-actions]

Visit the preview URL for this PR (updated for commit e5ce655):

https://my-productivity-hub-5a3ba--pr8-fix-audit-recommenda-fz789pzs.web.app

_{(expires Sun, 07 Jun 2026 18:42:05 GMT)}

_{🔥 via Firebase Hosting GitHub Action 🌎}

_{Sign: 4ef75aef15076a8cc05555b91f31935d9a13db8e}

[gemini-code-assist]

Code Review

This pull request introduces a Cloudflare Worker proxy to securely handle Gemini API calls, keeping the API key off the client. It also adds several new features, including a Pomodoro Timer, a Ctrl/Cmd+K Command Palette, drag-and-drop task reordering via @dnd-kit, project notes/resources, and bulk task actions. Refactoring was done to share habit-card logic through a custom hook. Feedback on these changes includes adding configuration checks for FIREBASE_PROJECT_ID in the worker, defaulting entries to an empty array in useHabit to prevent crashes, wrapping localStorage and Firestore addDoc operations in try-catch blocks for robustness, and avoiding invalid HTML nesting of interactive elements inside <label> tags in AllTasksView.

[gemini-code-assist]

The worker verifies the Firebase ID token against env.FIREBASE_PROJECT_ID, but there is no check to ensure this environment variable is actually configured. If it is missing, the verification will fail with a generic or confusing error. Adding a configuration check (similar to GEMINI_API_KEY) will improve debuggability.

    if (!env.FIREBASE_PROJECT_ID) {
      return json(
        { error: { message: 'Server misconfigured: missing FIREBASE_PROJECT_ID.' } },
        500,
        origin
      );
    }
    try {
      await verifyFirebaseToken(token, env.FIREBASE_PROJECT_ID);
    } catch (e) {
      return json({ error: { message: `Invalid token: ${e.message}` } }, 401, origin);
    }

[gemini-code-assist]

If entries is undefined or null (e.g., during initial load or if not passed by the parent component), calling entries.find will throw a TypeError. Defaulting entries to an empty array in the function signature prevents potential crashes.

Suggested change

	export default function useHabit(habit, entries) {
	export default function useHabit(habit, entries = []) {

[gemini-code-assist]

In environments where localStorage is disabled or full, calling localStorage.setItem can throw a SecurityError or QuotaExceededError. Wrapping this call in a try-catch block ensures the application does not crash when a Pomodoro session completes.

const writeFocusCount = (count) => {
  try {
    localStorage.setItem('prodhub_pomodoro_focus', JSON.stringify({ date: todayKey(), count }));
  } catch (e) {
    console.warn('Failed to save Pomodoro focus count to localStorage:', e);
  }
};

[gemini-code-assist]

Nesting interactive elements (like the buttons inside TaskItem) inside a <label> is invalid HTML according to the HTML specification and can cause unexpected behavior with screen readers and keyboard navigation. Using a div with an onClick handler is semantically valid and safer.

            selectMode ? (
              <div
                key={task.id}
                onClick={() => toggleSelect(task.id)}
                className="flex items-center gap-2.5 cursor-pointer rounded-2xl"
              >
                <input
                  type="checkbox"
                  checked={selectedIds.has(task.id)}
                  readOnly
                  className="w-4 h-4 flex-shrink-0 rounded accent-blue-500"
                />
                <div className="flex-grow min-w-0 pointer-events-none">
                  <TaskItem task={task} projects={projects} />
                </div>
              </div>
            ) : (

[gemini-code-assist]

The asynchronous addDoc call is not wrapped in a try-catch block. If the Firestore write fails (e.g., due to permission issues or network offline), it will result in an unhandled promise rejection. Wrapping it in a try-catch block improves robustness.

    } else if (item.type === 'add') {
      const targetProject = addProjectId || projects[0]?.id;
      if (!userId || !db || !targetProject || !item.label) return;
      try {
        await addDoc(collection(db, `artifacts/${appId}/users/${userId}/tasks`), {
          title: item.label,
          priority: 'Medium',
          projectId: targetProject,
          completed: false,
          createdAt: new Date(),
          dueDate: '',
        });
        onNavigate('project', targetProject);
        onClose();
      } catch (error) {
        console.error('Failed to add task:', error);
      }
    }