Deploy: include Trello webhook error body

.cascade/env

@@ -1,5 +1,5 @@
 CI=true
 DATABASE_URL=postgresql://postgres:postgres@localhost:5432/cascade
 DATABASE_SSL=false
-TEST_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/cascade_test
 REDIS_URL=redis://localhost:6379
+TEST_DATABASE_URL=postgresql://postgres:postgres@localhost:5432/cascade_test

.cascade/setup.sh

@@ -293,6 +293,17 @@ if pg_isready -q 2>/dev/null; then
   log_info "Running migrations on cascade_test..."
   DATABASE_URL="$TEST_DB_URL" DATABASE_SSL=false npm run db:migrate 2>&1 || \
     log_warn "Migration failed on cascade_test - may need manual intervention"
+
+  # Write TEST_DATABASE_URL to .cascade/env so resolveTestDbUrl() picks up the
+  # local postgres in worker containers where Docker is unavailable.
+  touch .cascade/env
+  if [ "$OS" = "macos" ]; then
+    sed -i '' '/^TEST_DATABASE_URL=/d' .cascade/env
+  else
+    sed -i '/^TEST_DATABASE_URL=/d' .cascade/env
+  fi
+  echo "TEST_DATABASE_URL=${TEST_DB_URL}" >> .cascade/env
+  log_info "Wrote TEST_DATABASE_URL to .cascade/env: ${TEST_DB_URL}"
 else
   log_warn "PostgreSQL not ready, skipping migrations"
 fi

.env.docker.example

@@ -15,7 +15,7 @@ WORKER_TIMEOUT_MS=1800000
 
 # --- Security (optional) ---
 # CREDENTIAL_MASTER_KEY=  # Generate: openssl rand -hex 32
-# CORS_ORIGIN=            # e.g. https://cascade.yourdomain.com
+# CORS_ORIGIN=            # comma-separated origins, e.g. https://cascade.yourdomain.com,https://dev.cascade.yourdomain.com
 # COOKIE_DOMAIN=          # e.g. yourdomain.com
 
 # --- Claude Code Backend (optional) ---

.github/workflows/deploy-dev.yml

@@ -98,6 +98,14 @@ jobs:
             cascade-migrator:dev \
             npx tsx tools/migrate-hooks.ts --apply
 
+      - name: Re-encrypt project credentials with project-scoped AAD (dev)
+        run: |
+          docker run --rm \
+            --env-file /opt/services/cascade-dev.env \
+            -e DATABASE_URL="${{ secrets.DEV_DATABASE_URL }}" \
+            cascade-migrator:dev \
+            npx tsx tools/migrate-project-credentials-reencrypt.ts
+
       - name: Pull and restart cascade-router-dev
         run: |
           cd /opt/services

.github/workflows/deploy.yml

@@ -92,6 +92,14 @@ jobs:
             cascade-migrator:latest \
             npx tsx tools/migrate-hooks.ts --apply
 
+      - name: Re-encrypt project credentials with project-scoped AAD
+        run: |
+          docker run --rm \
+            --env-file /opt/services/cascade.env \
+            -e DATABASE_URL="${{ secrets.DATABASE_URL }}" \
+            cascade-migrator:latest \
+            npx tsx tools/migrate-project-credentials-reencrypt.ts
+
       - name: Pull latest worker image
         run: docker pull ${{ env.WORKER_IMAGE }}:latest
 

CONTRIBUTING.md

@@ -23,7 +23,7 @@ Thank you for your interest in contributing to CASCADE! This guide will help you
    cd web && npm install && cd ..
    ```
 
-3. **Configure environment**: Copy `.env.example` to `.env` and fill in the required values. See [GETTING_STARTED.md](./GETTING_STARTED.md) for detailed setup instructions.
+3. **Configure environment**: Copy `.env.example` to `.env` and fill in the required values. See [Getting Started](./docs/getting-started.md) for detailed setup instructions.
 
 4. **Set up the database**:
    ```bash
@@ -125,6 +125,12 @@ See [CLAUDE.md](./CLAUDE.md) for a detailed architecture overview. Key directori
 2. Define its system prompt in `src/agents/prompts/`
 3. Register it in the agent registry
 
+## The `.cascade/` Directory
+
+When CASCADE works on a repository, it looks for a `.cascade/` directory at the root of that repo. This directory lets you customize agent behavior — setup scripts, post-edit hooks, test runners, and environment variables.
+
+See **[`.cascade/` Directory Guide](./docs/cascade-directory.md)** for the full reference.
+
 ## Getting Help
 
 - Open an [issue](https://github.com/zbigniewsobiecki/cascade/issues) for bugs or feature requests