The Global Command Palette Search uses the shortcut badge ⌘K on macOS and Ctrl+K on other OSes.
The backend endpoint /api/search?q= enforces RBAC, showing Developers only their tasks, Project Managers tasks in their projects plus managed projects and team members, and Admins everything.
Real‑Time Layer uses Socket.io for bidirectional low‑latency events.
The Notification Drawer provides a dismissal flow via a right‑side X button on each card.
A background scheduler runs an in‑process node‑cron job every 10 minutes scanning uncompleted tasks past dueDate and atomically setting isOverdue = true.
Short‑lived JWT access tokens (~15 min) are kept in memory, and refresh tokens (~7 days) are cryptographically hashed and stored in HttpOnly, SameSite=Strict cookies.
When a role changes the server broadcasts force_permission_refresh over WebSockets to revoke permissions in real time.
The default visual mode is a clean, high‑contrast White Mode defined by :root tokens in index.css.
Full dark‑mode support is toggleable via the header theme switch.
Socket.io rooms are multiplexed with identifiers like project:<id>, role:admin, and user:<id> to target updates efficiently.