# Focus Desk

A small, polished task manager built with vanilla HTML, CSS and JavaScript.
No frameworks, no build step, no network requests — everything runs from three local files.

## Run

```bash
cd <this directory>
python3 -m http.server 8000
```

Then open <http://localhost:8000/> and stop the server with `Ctrl+C` when done.

Files: `index.html` (markup), `style.css` (styling), `app.js` (logic).
Tasks are stored in `localStorage` under the key `focusdesk.tasks.v1`.
The app starts empty and never seeds demo data.

## Features

- **Create** — title is required (whitespace-only is rejected with an inline error); optional notes, priority (low/medium/high, default medium) and due date.
- **Edit** — inline editing of title, notes, priority and due date. `Esc` or *Cancel* discards changes; blank titles are refused.
- **Complete / delete** — the checkbox toggles completion both ways; delete asks for confirmation.
- **Search & filter** — case-insensitive substring search over titles *and* notes, combined with status (all/active/completed) and priority filters. Distinct empty states for "no tasks yet" vs. "nothing matches".
- **Counts** — total / active / completed in the header, each element containing only its number.
- **Ordering** — active tasks first, then by priority (high → low), then by nearest due date. Overdue dates are highlighted.
- **Resilience** — corrupt or non-array JSON in `localStorage` is discarded instead of crashing; individual malformed records are repaired (bad priority → medium) or dropped.
- **Safety** — all task text is inserted with `textContent`, so HTML in a title or note can never execute.
- **Accessibility** — semantic `<button>`/`<form>` elements, a label for every control, `aria-label` on per-task actions, `role="alert"` validation messages, a live region for result counts, a skip link and a visible 3px indigo focus ring.

## Manual verification

1. **Create** — submit with an empty or spaces-only title: nothing is added and an error appears. Add "Alpha report" with notes "quarterly numbers", priority High, a due date: it appears, counts read 1 / 1 / 0, and the form resets.
2. **Persistence** — reload the page: the task is still there with the same priority, notes and due date. Open DevTools → Application → Local Storage to see `focusdesk.tasks.v1`.
3. **Invalid JSON** — in the console run `localStorage.setItem('focusdesk.tasks.v1','{oops')` and reload: the app loads empty with a console warning, no exception.
4. **Toggle** — tick a task's checkbox: it dims with a strikethrough and counts move to completed. Untick it: everything reverts.
5. **Edit** — click *Edit*, clear the title and save (refused), then change the title/notes/priority/due and save: the card updates; reload to confirm the change persisted.
6. **Search + filters** — with a few tasks, type `ALPHA` in search: tasks matching in title *or* notes remain (case-insensitive). Add Status = Completed and Priority = High on top: results narrow correctly and the empty state reads "No matching tasks" when nothing fits. Reset both filters and clear search to see everything again.
7. **Delete** — click *Delete*, confirm, and the task disappears; with no tasks left the empty state reads "No tasks yet".
8. **XSS** — create a task titled `<img src=x onerror=alert(1)>`: the text is displayed literally and no alert fires.
9. **Responsive** — in the device toolbar check 390 × 844 (single column, full-width controls) and 1440 × 900 (sidebar form + task board). Scroll horizontally at both widths: there is no horizontal overflow.
10. **Keyboard** — `Tab` through the page: the skip link, every field, and every task button show a clear focus ring; `Space` toggles a checkbox and `Enter` submits either form.

### Automated check used during development

A temporary Node script with a minimal DOM shim executed `app.js` headlessly and asserted 69 behaviours (testid presence, select option values, creation/validation, XSS-safe rendering, toggle/edit/delete, combined search+filter matrices, counts, persistence across a simulated reload, corrupt-JSON recovery, and no remote assets). All 69 passed; the script was removed afterwards since it was not part of the deliverable.