fix: PostgreSQL + TanStack Start migration (merge-ready)

.env.example

@@ -1,5 +1,12 @@
+# PostgreSQL (docker compose up -d)
+DATABASE_URL=postgresql://postgres:seer@localhost:5432/seer
+
 # Glean API key (unified — needs chat + search + agents + documents scopes)
 # Create at: Glean Settings > API > REST API tokens
 GLEAN_API_KEY=your_api_key_here
-GLEAN_BACKEND=https://scio-prod-be.glean.com
-GLEAN_INSTANCE=scio-prod
+GLEAN_BACKEND=https://your-instance-be.glean.com
+GLEAN_INSTANCE=your-instance
+
+# If corporate TLS inspection breaks Node's default CA store (local dev only).
+# Put this in repo-root .env or web/.env.local — both are loaded before the dev server runs.
+# SEER_GLEAN_TLS_INSECURE=1

.githooks/post-merge

@@ -6,13 +6,12 @@ cd "$REPO_ROOT"
 
 changed_files="$(git diff --name-only ORIG_HEAD..HEAD 2>/dev/null || true)"
 
-if printf '%s\n' "$changed_files" | grep -Eq '^(package\.json|bun\.lock)$'; then
-  echo "Root dependencies changed; running bun install..."
-  bun install
+if printf '%s\n' "$changed_files" | grep -Eq '^(package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)$'; then
+  echo "Workspace dependencies changed; running pnpm install..."
+  pnpm install
 fi
 
-if printf '%s\n' "$changed_files" | grep -Eq '^web/(package\.json|bun\.lock)$'; then
-  echo "Web dependencies changed; running bun install in web/..."
-  cd "$REPO_ROOT/web"
-  bun install
+if printf '%s\n' "$changed_files" | grep -Eq '^web/package\.json$'; then
+  echo "Web dependencies changed; running pnpm install..."
+  pnpm install
 fi

.githooks/pre-commit

@@ -10,12 +10,12 @@ echo "==> Git whitespace checks"
 git diff --cached --check
 
 echo "==> Biome staged-file checks"
-bunx biome check --staged --files-ignore-unknown=true --no-errors-on-unmatched
+pnpm exec biome check --staged --files-ignore-unknown=true --no-errors-on-unmatched
 
 echo "==> TypeScript typecheck"
-bun run typecheck
+pnpm typecheck
 
 echo "==> Unit tests"
-bun test
+pnpm test
 
 echo "All pre-commit checks passed."

.githooks/pre-push

@@ -38,13 +38,11 @@ if [ -z "$(printf '%s' "$changed_files" | tr -d '[:space:]')" ]; then
 fi
 
 echo "==> Root checks"
-bun run check
+pnpm check
 
 if printf '%s\n' "$changed_files" | grep -q '^web/'; then
   echo "==> Web build"
-  cd "$REPO_ROOT/web"
-  bun install
-  bun run build
+  pnpm --filter web build
 else
   echo "No web changes detected; skipping web build."
 fi

.github/workflows/check.yml

@@ -8,18 +8,49 @@ on:
 jobs:
   checks:
     runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_DB: seer
+          POSTGRES_USER: postgres
+          POSTGRES_PASSWORD: seer
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    env:
+      DATABASE_URL: postgresql://postgres:seer@localhost:5432/seer
     strategy:
       fail-fast: false
       matrix:
-        task: [typecheck, lint, test]
+        task:
+          - pnpm typecheck
+          - pnpm lint
+          - pnpm test
+          - pnpm --filter seer-cli build
+          - pnpm --filter web typecheck
+          - pnpm --filter web build
+          - pnpm test:web-api-smoke
     steps:
       - uses: actions/checkout@v4
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: pnpm/action-setup@v4
         with:
-          bun-version: latest
+          version: 11.1.1
 
-      - run: bun install
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Push DB schema
+        run: pnpm db:push
 
       - name: Run ${{ matrix.task }}
-        run: bun run ${{ matrix.task }}
+        run: ${{ matrix.task }}

.gitignore

@@ -1,5 +1,6 @@
 # Dependencies
 node_modules/
+.pnpm-store/
 
 # Environment
 .env
@@ -14,6 +15,10 @@ node_modules/
 # Build
 dist/
 build/
+.nitro/
+.output/
+web/.nitro/
+web/.output/
 
 # IDE
 .vscode/

CHANGELOG.md

@@ -2,6 +2,31 @@
 
 All notable changes to Seer are documented here.
 
+## [0.3.0] - 2026-05-29 — Customer Readiness
+
+### Changed
+- **PostgreSQL migration**: Replaced SQLite (better-sqlite3) with PostgreSQL (node-postgres) across CLI and web. Schema uses `pgTable` with typed `jsonb` columns via `.$type<T>()`, eliminating ~25 manual `JSON.stringify`/`JSON.parse` calls. Local dev via `docker compose up -d`.
+- **TLS resilience**: All outbound Glean API calls route through `gleanFetch` (undici). `SEER_GLEAN_TLS_INSECURE=1` bypasses cert verification for local dev behind corporate proxies. TLS errors fail fast with actionable messages.
+- **TanStack Start migration**: Web UI migrated from Next.js to TanStack Start with Vite, feature slices, and server functions.
+- **Public API only**: Workflow agents now use `POST /rest/api/v1/agents/runs/wait` (public) instead of internal `runworkflow` endpoint
+- Workflow agent evals return response text only — trace data (reasoning chain, tool calls, trace IDs) available for autonomous agents only via Chat API
+- All `scio-prod` references replaced with configurable placeholders
+- Settings page password field now properly masked
+
+### Removed
+- `@gleanwork/api-client` dependency (unused)
+- Internal documentation: `gko-eval-presentation.md`, `harness-engineering-plan.md`, `issues.md`, `glean-api-needs.md`
+- Internal Google Doc link from eval set creation modal
+- `alert()` calls in CaseEditor (error logging only)
+
+### Added
+- UI refresh: new header, modal-based eval set creation, app shell layout
+
+### Documentation
+- Rewrote `docs/TRACE_API_LIMITATIONS.md` — now documents trace availability per agent type
+- Updated `docs/architecture.md` — correct table count (7), current API endpoints
+- Updated all docs to reference public APIs only
+
 ## [0.2.0-alpha] - 2026-05-15
 
 ### Added

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md