Summary

This PR fixes 41+ bugs across the codebase, improving stability, accessibility, UX, and code quality.

CSS / UI (css/index.css)

• [Bug] css/index.css entire stylesheet is duplicated 3 times causing style conflicts and file bloat #689 — Remove 3x duplicated stylesheet (3280 to 1696 lines)
• bug: Right sidebar collapse causes content overflow and broken layout #617 — Right panel collapse overflow: hidden + max-width
• bug: Sidebar items jitter/shift abruptly on hover and selection #631 — Sidebar badge permanent transparent border (no jitter)
• bug: Hover effect on subject cards causes jarring layout resize #640 — Remove translateX from hover (no jarring resize)
• bug: Add Subject" button disappears after adding one subject #639 — Sidebar overflow-y: auto so "Add Subject" stays visible
• Light Mode Adding Task form CSS is not correct #647 — Modal CSS uses CSS variables for light/dark mode support

Authentication (index.html)

• bug: Smart Paste shortcut shows ⌘V (Mac) instead of Ctrl+V on Windows #683 — Smart Paste shortcut detects OS: Cmd+V on Mac, Ctrl+V on Windows
• bug: Email field persists when switching from Login to Signup modal #589 — Clear email/password fields when toggling Login/Signup
• Feature: Add Show/Hide Password Toggle to Authentication Forms #719 — Password visibility toggle button
• bug: Invalid Email Accepted During Login/Signup #668 — Client-side email regex validation (already on server)
• bug: Navigation and Filter Controls Not Responding #667 — Add missing id attributes to Week/Profile buttons
• Dashboard layout renders in the background of the landing page before user login #673 — Dashboard hidden (display:none) until authentication success
• bug: Authentication modal lacks proper keyboard accessibility and focus management #594 — Auth modal: ARIA role=dialog / aria-modal, Tab focus trap, ESC refocus email, duplicate id=auth-error removed
• bug: newer clock and Past Dates and Times Cannot Be Selected in Scheduler #576 — Task deadline picker min attribute prevents past date selection

Core App (js/app.js)\n- #763 — Signup form includes password confirmation field with match validation

• [Bug] app.js - Duplicate clearBtn variable declaration causes variable shadowing and potential event listener conflicts #693 — Rename inner clearBtn variable to avoid shadowing conflict
• [Bug] Study Timer - timePassed not reset when duration is changed causing wrong remaining time #696 — Reset timePassed when duration changes (wrong remaining time)
• bug: Fix Daily & Weekly Task Summary Count Not Updating #709 / bug: Today's and weekly task lists do not refresh after task updates #591 / bug: Clearly stats calculation isn't updating. #613 — Daily & Weekly summary subscribes to store changes; normalized date comparison
• bug: Navigation and Filter Controls Not Responding #667 — Week/Profile sidebar click handlers
• Bug: Application crashes during "Extract with AI" when fewer than 4 subjects exist #663 — Extract with AI falls back to subjects[0] when fewer than 4 subjects exist (prevents crash)
• bug: archived task counter not updating when task is marked done #568 — Archived counter ignores tasks with status Done
• bug: Clicking subjects in sidebar does not show associated tasks #649 — Subject sidebar click filters tasks by subject
• bug: [UI/UX] Replace Browser Alert with Custom On‑Screen Toast/Modal for Task Addition #658 — Replaced all browser alert() calls with Toast.show() / Toast.confirm()
• feat: Logout Confirmation #641 — Logout requires confirmation dialog
• bug: non-functional top navigation bar buttons for Tasks and Calendar #767 — Header navbar Tasks/Calendar/Dashboard links trigger sidebar navigation
• [Bug]: Smart Paste "Extract with AI" fails on large multi-line input streams and formatted text blobs #757 — Smart Paste input sanitized (strip control chars, normalize newlines) with 10K char limit + live counter

State Management (js/store.js)

• [Bug] store.js - toggleTaskStatus reverts to wrong status on network error #698 — toggleTaskStatus checks res.ok before updating local state
• bug: Duplicate Subject Entries in Sidebar #598 / bug: Duplicate subjects can be created, breaking task associations #546 — Client-side duplicate subject check before POST; backend returns 400 for duplicates

Backend (server.js)

• bug: Email Validation Allows Invalid Addresses #535 — Backend email regex validation
• Bug: "end of year" phrase not handled in server-side NLP fallback #675 — end of year returns Dec 31 in NLP fallback
• bug: /api/tasks may not finalize prepared statement on validation errors #727 — stmt.finalize() called before early return on validation errors (prevents DB lock)
• bug: Race condition in initDb schema migration causes flaky queries #701 — Race condition in initDb: refactored to async/await with Promise wrappers
• bug: Race condition and duplicate insertion issue in POST /api/tasks #602 — POST /api/tasks refactored with Promise.all for reliable concurrent task creation
• fix: CSV Injection vulnerability in task export endpoint #633 — CSV injection prevention: cells starting with =,+,-,@ are prefixed with single quote
• bug: Security: In-memory plaintext user credential storage in auth endpoints #754 — Passwords hashed with crypto.scryptSync (no dependency), users persisted to SQLite (was in-memory plaintext)
• Bug: Login API returns 405 Method Not Allowed during authentication #760 — Users table automatically created for existing databases (migration in initDb)

Database (database.js)

• bug: Race condition in initDb schema migration causes flaky queries #701 — InitDb migration rewritten with async/await; app.listen deferred until DB ready
• bug: Security: In-memory plaintext user credential storage in auth endpoints #754 — Added users table (email, password_hash, salt) with CREATE TABLE IF NOT EXISTS

Package

• bug: package.json main points to non-existent index.js #726 — package.json main field points to server.js (was non-existent index.js)

Utilities

• bug: NLP Date Parser Misinterprets DD/MM/YYYY Input Formats #525 (nlpDateExtractor.js) — DD/MM/YYYY: if first number > 12 then day, else first number is day
• bug: CSV Export functionality causes column shifting/misalignment when task fields contain commas #629 (csvDownload.controller.js) — escapeCsv handles commas, quotes, and formula injection chars

Support Page

• bug: Redundant footer navigation links on support page create unnecessary UX duplication #619 — Removed redundant footer privacy/terms/support links (already in-page content)