Changelog

Pre-driver safety hardening

• Closed 11 ban-class bugs flagged ahead of the first live driver test
• Added an ops heartbeat verification script for the production worker
• Deployed the first live worker to a dedicated VPS

FlexShark feature parity

• OAuth + PKCE Amazon Flex connect — sign in directly on amazon.com.au / .com / .co.uk / .ca
• REJECTED offer logging on /blocks so drivers can see filter behaviour in real time
• SMS notifications via Twilio alongside email + Telegram
• Multi-window-per-day schedules (e.g. 5–7am plus 6–8pm in one schedule)
• Admin profile page; admin accounts redirected away from user-only routes

Operational backlog clearance

• Bot status streamed live via Server-Sent Events on the dashboard
• TOTP 2FA + danger zone (account delete) on settings
• Public system-status indicator on the marketing site
• Driver leaderboard, daily-goal tracker, and promo-code redemption
• Worker health monitoring + per-user notification dispatcher
• Setup wizard now persists step state server-side so drop-outs resume cleanly

Admin tooling + money safety

• Real /admin/proxies and /admin/bots control surfaces wired to the DB
• Mobile tap targets enlarged across admin and dashboard surfaces
• API rate limits applied to every public endpoint that touches state
• Referral reward system + cleanup of orphan endpoints
• Webhook idempotency; soft-deleted users can re-register the same email
• Stripe secret pulled out of the DB — env-only from here on
• Closed 4 functional / ban-class gaps in the worker before deploy

Admin panel + impersonation + filters CRUD

• Real users list backed by the production DB
• Admin user impersonation flow with full audit logging
• Block filters CRUD + first end-to-end Playwright tests
• Admin login redirects straight to /admin
• Account suspension is honoured at sign-in
• Marketing rename from FlexGrab to FlexGuru completed

Full dashboard + marketing redesign

• Redesigned dashboard shell — all 14 dashboard pages and all 13 admin pages
• All 5 marketing pages ported from the design handoff
• JSON-LD schemas added across marketing surfaces for rich results
• Live-stats API + Geist typography across the public site

Seven-layer bot safety stack

• Phase A — persistent device fingerprint, sticky proxy, proxy-based health checks
• Phase B — token refresh through proxy, distributed lock, honour expires_in
• Phase C — 307 redirects hard-stop the bot end-to-end; sticky CAPTCHA detection
• Phase D — HTTP/2 fingerprint match, gzip-only Accept-Encoding, drop H2-illegal headers
• Phase E — daily request cap (Redis), schedule enforcement, account ramp-up
• Phase F–I — 50+ device pool, IP reputation, state persistence, behavioural realism
• Final polish — dead code removal, fingerprint test suite, env audit, JA3 documentation

Mobile-first responsive overhaul

• Public + auth pages reflowed to mobile-first breakpoints down to 340px
• All dashboard pages reflowed for one-hand operation
• Fixed announcement banner spacing and three admin alignment issues
• 13 production-readiness bugs closed in the same sprint

Real Amazon Flex integration plumbing

• CycleTLS integration for matching Amazon Flex's TLS fingerprint
• Proxy provider abstraction with DirectProvider and IPRoyalProvider
• BullMQ queue manager backed by Redis
• Background token health monitoring worker
• Bot engine wired to BullMQ workers for true background execution
• Worker startup entry point so the bot runs outside Next.js
• Tokens encrypted at connect time; CAPTCHA_DETECTED status surfaced
• Token validated via a real Amazon API call on first connect

Commission-only pricing + admin foundation

• Commission-only payment model (no monthly fee) with admin user-edit panel
• Referral page redesigned
• OTP email verification with a refreshed UI
• Admin can soft-delete users from the admin panel
• CMS seed script for testimonials and announcements

Auth redesign + CAPTCHA + live chat

• Auth flow redesigned end-to-end
• CAPTCHA enforcement on registration
• CMS surface for testimonials and announcements
• Live chat widget on the dashboard for logged-in drivers
• Support ticket system (replacing ad-hoc email)

Everything wired to real Postgres

• All pages wired to real PostgreSQL — every mock data hook removed
• Dashboard functionality aligned to the FlexShark feature spec
• Mobile responsiveness fixed at the 340px tier
• Middleware rewritten to use NextAuth's auth() wrapper
• Custom login API route to work around an auth redirect cookie quirk

Initial rebuild — Next.js 15 + Prisma 7

• Phase 1–9 of the rebuild plan delivered across this window
• Auth (NextAuth v5), dashboard, bot engine with anti-detection layers
• Stripe subscriptions + wallet + commission usage metering
• Calendar, block history, earnings dashboard
• Settings, referrals, help, toast notifications
• Marketing pages, public layout, legal pages
• Admin panel with dark theme; user / bot / proxy management
• PWA support, offline indicator, final pre-launch polish