## Summary\n- Show the hosted-demo budget card whenever demo mode is enabled, even if the user has added a personal Case.dev key.\n- Label the budget as bypassed when a personal key is active so users understand demo cre…
CaseMark/mikeoss-casedotdev
Full Case.dev platform integration on top of the willchen96/mike base, with a hosted public demo and BYOK escape hatches for LLM routing and Postgres.
kveton's fork replaces mike's original storage, model routing, and workspace primitives with Case.dev counterparts: Vault for document storage and RAG, Matters as the workspace primitive, a model gateway instead of single-provider assumptions, and Skills for workflow discovery. Better Auth handles user sessions with per-user encrypted Case.dev credentials. An optional BYOK path lets users supply their own Anthropic or Gemini keys for direct LLM routing without touching the document infrastructure.
The fork shipped a public demo at mike.casemark.dev with per-user lifetime budget metering ($5 default), a pause gate via MIKE_DEMO_MODE, and a /demo-status endpoint the frontend reads to show a landing page when the demo is paused. A substantial pre-launch hardening pass covered AI-route rate limiting, safe error sanitization on document routes, a jsonb column registry fixing silent write failures, and error propagation for streamed chat events. The document display and DOCX routes were moved from storage redirects to backend byte proxies to keep auth at a single boundary.
Password policy (minimum length 6 to 8), signup validation alignment, and a GitHub source link in the footer round out the smaller changes.
What's in it
- Hosted public demo A live Mike instance at mike.casemark.dev with a pause gate and status endpoint so operators can take it offline cleanly.
- Bring-your-own-key for AI providers Firms can plug in their own Anthropic, Gemini, or Case.dev credentials and route model calls through their own accounts.
- Demo budget, surfaced honestly When trial users hit the demo's spend cap, the app says so plainly instead of failing as a 404 or 500.
- Personal keys override the demo key Users who supply their own credentials bypass the shared demo budget, with the UI clearly showing when that's in effect.
- Backend-proxied document previews Privileged Case Vault documents are streamed through Mike's backend rather than handed to the browser as direct URLs.
- Pre-launch hardening pass Rate limits, sanitized error messages, tighter signup validation, and a quieter security posture across the public surface.
- Case.dev platform rebuild Mike's upstream plumbing has been swapped out for CaseMark's own Case.dev stack - this is the foundation everything else sits on.
Direction
infrastructuresecuritybranding
Activity
✅ #8 [codex] Handle streamed chat errors and harden document access +767 -196 3mo ago self by
kveton ↗ analysis ↗ GitHub ## Summary
CaseMark's fork now points visitors straight to its own source code from the page footer.
📝 CaseMark stops hiding the demo meter when you bring your own key 3 commits 3mo ago chat-uianalytics draft
Evaluators who plugged in their own credentials used to lose sight of their shared-trial credits - now the gauge stays put.
Bring your own API key and CaseMark's trial-credit card now tells you plainly that those free credits aren't being spent.
✅ #7 Surface demo budget errors for document loads +312 -58 3mo ago self by
kveton ↗ analysis ↗ GitHub ## Summary
## Summary
## Summary
A quiet seven-commit hardening pass turns this Mike fork from a working prototype into something safe to put in front of real users.
📝 CaseMark stops Mike's matter chat from quietly losing history 6 commits 3mo ago chat-uisecurity draft
A post-merge cleanup turns a handful of silent failure modes in the chat experience into honest, visible ones.
## Summary\n- Make hosted Demo Mode use the shared Case.dev key only when a user has not saved a personal Case.dev key.\n- Allow users to save or clear their own Case.dev key in Demo Mode; clearing falls back to the shar…
## Summary\n- Align signup form validation and copy with the backend's 8-character minimum password policy.\n- Surface Better Auth error messages from plain error objects instead of showing a generic signup failure.\n\n#…
## Summary
## Summary
When a trial account runs out of credit mid-download, CaseMark now says so plainly instead of throwing a broken-document error.
📝 CaseMark stops its demo from disguising spent budgets as broken documents 3 commits 3mo ago workflowchat-ui draft
Trial users who ran out of demo credit were seeing documents fail to load with no explanation - now the system says what's actually wrong and what to do about it.
📝 CaseMark keeps its document vault out of the browser's reach 3 commits 3mo ago securityinfrastructure draft
Two fixes close a gap where the keys to CaseMark's case-document store were briefly visible on the user's side.
📝 CaseMark pulls document previews back behind its own front door 2 commits 3mo ago securityinfrastructure draft
Client files now load through Mike's backend instead of sending the browser a signed link straight to storage.
The fork now documents, in plain terms, exactly how deeply it leans on its underlying AI platform - and how hard each piece would be to swap out.
📝 CaseMark opens its fork to a hosted demo - and shows you what's actually wired 2 commits 3mo ago integrationinfrastructure draft
You can now try CaseMark's take on Mike without standing anything up yourself, and read an honest map of which parts are real.
Show 7 more
📝 CaseMark unlocks the demo so users can bring their own key 1 commit 3mo ago multi-tenantinfrastructure draft
Hosted-demo users were trapped on a shared account with a tiny lifetime budget. Now they can plug in their own.
📝 Signup password minimum length 6 → 8 2 commits 3mo ago minor change
📝 Signup form minimum password length aligned with backend (6 -> 8 characters) 1 commit 3mo ago intakeinfrastructure draft
The signup page in CaseMark's fork was enforcing a 6-character minimum while the backend required 8. A user who entered a 7-character password passed the frontend gate, hit `PASSWORD_TOO_SHORT` from Better Auth, and got …
CaseMark's fork lets each person plug in their own Anthropic or Gemini credentials instead of riding on a shared, firm-wide key.
You can now wire Mike straight into your own Anthropic or Gemini account instead of routing everything through CaseMark's gateway.
📝 CaseMark rips out Supabase and runs Mike on its own platform 5 commits 3mo ago infrastructuresecurity draft
A clean-room re-platforming that makes CaseMark's own Case.dev the engine behind everything Mike does.
📝 CaseMark rebuilds Mike as a Case.dev reference implementation, in the open 4 commits 3mo ago integrationinfrastructure draft
A public fork that bets entirely on Case.dev's legal-AI platform - useful if you're building there, heavy lifting if you're not.
Threads of work (detailed view)
CaseMark signs its work in the footer
CaseMark's fork now points visitors straight to its own source code from the page footer.
CaseMark stops hiding the demo meter when you bring your own key
Evaluators who plugged in their own credentials used to lose sight of their shared-trial credits - now the gauge stays put.
CaseMark makes the demo meter honest about your own key
Bring your own API key and CaseMark's trial-credit card now tells you plainly that those free credits aren't being spent.
Demo budget card stays visible when a personal key overrides the shared demo key
The demo budget card was disappearing when a user saved their own Case.dev API key. Since the personal key only overrides the shared key rather than erasing the underlying budget, the card should still be visible - just labeled differently. This pair of commits makes that distinction visible in the UI.
CaseMark is locking the doors before launch
A quiet seven-commit hardening pass turns this Mike fork from a working prototype into something safe to put in front of real users.
Pre-launch sweep: AI rate limiter, error allowlist, jsonb column registry, missing workflow column
PR #8 worked through code-review findings accumulated before the public launch. Seven commits touch rate limiting, safe error sanitization, tabular access optimization, streamed chat error handling, and a jsonb serialization bug that was silently dropping chat history. The last one is the most consequential.
CaseMark stops Mike's matter chat from quietly losing history
A post-merge cleanup turns a handful of silent failure modes in the chat experience into honest, visible ones.
Post-merge hardening: expiring download tokens, AI rate limits, streamed chat error handling
kveton bundled a set of post-merge hardening commits that missed a review cycle on the previous branch, pairing them with one new fix for chat stream errors. The result is a PR that tightens several security-adjacent gaps and fixes the most visible user-facing failure mode: a chat that hangs mid-stream when the backend sends an error frame.
CaseMark makes its demo paywall stop lying to users
When a trial account runs out of credit mid-download, CaseMark now says so plainly instead of throwing a broken-document error.
Demo budget 402 errors propagated through all document load routes
Previously a demo user who hit their spending limit would see a generic 500 when trying to open a document - the budget error was being caught and swallowed inside the storage layer. This PR surfaces a typed `HTTP 402` with `code: "demo_budget_exceeded"` through every document-facing route, and retunes the demo cost model so only LLM calls actually count against the budget.
CaseMark stops its demo from disguising spent budgets as broken documents
Trial users who ran out of demo credit were seeing documents fail to load with no explanation - now the system says what's actually wrong and what to do about it.
Demo budget errors propagated through document preview and download routes
Document previews were returning 404s when the real failure was a `DemoBudgetExceededError` from Case Vault. kveton traced the masking to the storage helpers swallowing the error into null, then rewired the display, DOCX, URL, and download-token routes to surface a 402 instead.
CaseMark keeps its document vault out of the browser's reach
Two fixes close a gap where the keys to CaseMark's case-document store were briefly visible on the user's side.
Document display proxied through the backend; profile fetches parallelized
Two follow-up fixes after the Case.dev migration. The `GET /single-documents/:id/display` route stopped issuing a 302 redirect to a Case Vault signed URL and now proxies the bytes through the backend. Profile data for the Account > Models page shifted from sequential awaits to `Promise.all`, eliminating a false "missing key" flash on load.
CaseMark pulls document previews back behind its own front door
Client files now load through Mike's backend instead of sending the browser a signed link straight to storage.
Document display route proxies bytes instead of redirecting to Case Vault
kveton fixed a production "Failed to load document" error by replacing a 302 redirect to a Case Vault presigned URL with a backend byte proxy. The single-document display endpoint now downloads the file server-side and streams it to the browser with the correct content-type and `private, no-store` cache headers.
CaseMark hands you the exit map for Case.dev
The fork now documents, in plain terms, exactly how deeply it leans on its underlying AI platform - and how hard each piece would be to swap out.
Demo key priority inverted, /demo-status kill switch, integration depth docs
Three threads around launching the public demo at mike.casemark.dev. The first fixes a fundamental flaw in the demo key resolution: the shared key was taking priority over personal keys, making it impossible for users to save their own. The second adds a `/demo-status` endpoint and a client-side gate that swaps the app for a landing page without a redeploy. The third documents what Case.dev services are actually wired vs. candidates for later.
CaseMark opens its fork to a hosted demo - and shows you what's actually wired
You can now try CaseMark's take on Mike without standing anything up yourself, and read an honest map of which parts are real.
Pause gate, /demo-status endpoint, and Case.dev integration docs
kveton added a public `/demo-status` endpoint and a frontend landing page that activates when `MIKE_DEMO_CASE_API_KEY` is set but `MIKE_DEMO_MODE` is off -- a clean way to pause the hosted demo without taking the whole app down. This PR also doubled as the README for the fork's Case.dev integration, laying out the full primitive map and BYOK escape hatches.
CaseMark unlocks the demo so users can bring their own key
Hosted-demo users were trapped on a shared account with a tiny lifetime budget. Now they can plug in their own.
Personal Case.dev key takes priority over shared demo key
The CaseMark fork's demo mode previously gave the shared demo key unconditional priority, making it impossible for users to save their own Case.dev key within Demo Mode. kveton inverted that logic so the personal key wins when present, with the shared demo key as fallback.
Signup form minimum password length aligned with backend (6 -> 8 characters)
The signup page in CaseMark's fork was enforcing a 6-character minimum while the backend required 8. A user who entered a 7-character password passed the frontend gate, hit `PASSWORD_TOO_SHORT` from Better Auth, and got a generic error with no explanation. This commit fixes both sides.
CaseMark hands every user their own AI key
CaseMark's fork lets each person plug in their own Anthropic or Gemini credentials instead of riding on a shared, firm-wide key.
BYOK Anthropic and Gemini keys stored encrypted alongside Case.dev gateway
kveton added a second credential surface to the CaseMark fork. Users can now route Anthropic and Gemini calls directly with their own keys instead of going through the Case.dev model gateway. The credential management sits in a new `provider_api_credentials` Postgres table with encrypted storage, live validation, and soft-delete on removal.
CaseMark hands firms the keys to their own AI models
You can now wire Mike straight into your own Anthropic or Gemini account instead of routing everything through CaseMark's gateway.
kveton adds encrypted BYOK storage for Anthropic and Gemini provider keys
CaseMark's mikeoss-casedotdev fork now lets users save their own Anthropic or Gemini keys alongside (or instead of) the Case.dev model gateway. Keys are encrypted at rest using the same helpers already in place for Case credentials, validated against a live `/v1/models` call on save, and stored with verification metadata. The model catalog then reads from whatever credentials are configured to decide which providers are selectable.
CaseMark rips out Supabase and runs Mike on its own platform
A clean-room re-platforming that makes CaseMark's own Case.dev the engine behind everything Mike does.
CaseMark fork bring-up: Supabase/R2 replaced with Case.dev Vault and Better Auth
This is the fork's founding commit bundle. Two massive diffs (+9804 and +7335 lines across 78 and 74 files) replace Mike's upstream Supabase auth, Supabase Postgres client, and Cloudflare R2 storage with Case.dev Vault as the document store, Better Auth with encrypted per-user keys, and a new `postgresCompat.ts` shim for raw SQL access. A follow-up commit hardens the public release with rate limiting, expiring download tokens, and the removal of plaintext provider key columns.
CaseMark rebuilds Mike as a Case.dev reference implementation, in the open
A public fork that bets entirely on Case.dev's legal-AI platform - useful if you're building there, heavy lifting if you're not.
Case.dev public release: Vault, Matters, Skills, Demo Mode, Vercel deployment
kveton merged the closing batch of the Case.dev public release branch into `mikeoss-casedotdev`, bundling Matter and Vault integration polish, demo metering, Vercel deployment entrypoints, and a security hardening pass. This is the point where the fork shifts from internal work-in-progress to a deployable public artifact.
Pull requests (detailed view)
✅ Merged (9)
by
kveton · opened 3mo ago · merged 3mo ago by kveton by
kveton · opened 3mo ago · merged 3mo ago by kveton CaseMark/mikeoss-casedotdev ← CaseMark/mikeoss-casedotdev · +767 -196 · self · ↗ analysis · ↗ GitHub
by
kveton · opened 3mo ago · merged 3mo ago by kveton by
kveton · opened 3mo ago · merged 3mo ago by kveton by
kveton · opened 3mo ago · merged 3mo ago by kveton by
kveton · opened 3mo ago · merged 3mo ago by kveton by
kveton · opened 3mo ago · merged 3mo ago by kveton by
kveton · opened 3mo ago · merged 3mo ago by kveton CaseMark/mikeoss-casedotdev ← CaseMark/mikeoss-casedotdev · +995 -111 · self · ↗ analysis · ↗ GitHub
by
kveton · opened 3mo ago · merged 3mo ago by kveton CaseMark/mikeoss-casedotdev ← CaseMark/mikeoss-casedotdev · +17,162 -5,570 · self · ↗ analysis · ↗ GitHub