diff --git a/Makefile b/Makefile
index 4ebcaaa..82ccc8e 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,10 @@
 deploy:
 	./hacks/deploy.sh
 
+.PHONY: test
+test:
+	node --test assets/workspace.test.js assets/crypto.test.js assets/integration.test.js
+
 
 # BEGIN: lint-install .
 # http://github.com/codeGROOVE-dev/lint-install
diff --git a/assets/README.tests.md b/assets/README.tests.md
new file mode 100644
index 0000000..cd1161a
--- /dev/null
+++ b/assets/README.tests.md
@@ -0,0 +1,90 @@
+# Automated Tests
+
+## Running Tests
+
+```bash
+make test
+```
+
+Or directly with Node.js:
+
+```bash
+node --test assets/workspace.test.js assets/crypto.test.js
+```
+
+## Test Coverage
+
+### `integration.test.js`
+Integration tests for app initialization and token handling:
+
+- **State initialization**: Validates null/undefined/non-string token handling
+  - Handles null accessToken gracefully (prevents TypeError)
+  - Detects PAT token type (ghp_ prefix)
+  - Detects OAuth token type (gho_ prefix)
+  - Handles undefined, empty string, and non-string tokens
+  - Validates OAuth warning check at user.js:325 (regression test)
+
+- **Async token loading**: Validates async token decryption flow
+  - Initializes with null token before async load completes
+  - Successfully sets token after async decryption
+
+### `crypto.test.js`
+Tests for the crypto module (`assets/crypto.js`):
+
+- **encryptToken() and decryptToken()**: Validates encryption/decryption
+  - Successfully encrypts and decrypts tokens
+  - Produces different ciphertext for same token (random IV)
+  - Fails to decrypt with wrong username
+  - Fails to decrypt with wrong domain
+  - Fails to decrypt with wrong timestamp
+  - Handles various GitHub token formats (PAT, OAuth, fine-grained)
+  - Requires all parameters for encryption/decryption
+  - Handles realistic login scenarios
+  - Different timestamps produce different encryption keys
+
+### `workspace.test.js`
+Tests for the workspace module (`assets/workspace.js`):
+
+- **currentWorkspace()**: Validates workspace detection from subdomain
+  - Base domain returns `null`
+  - Reserved subdomains (www, api, etc.) return `null`
+  - Org subdomains return the org name
+  - Localhost returns `null`
+
+- **hiddenOrgs()**: Validates reading hidden organizations from cookies
+  - Returns empty array when no preferences exist
+  - Reads from workspace-specific cookies
+  - Handles both personal and org workspaces
+
+- **setHiddenOrgs()**: Validates setting hidden organizations
+  - Creates workspace-specific cookies
+  - Handles empty arrays
+  - Works for both personal and org workspaces
+
+- **toggleOrgVisibility()**: Validates toggling org visibility
+  - Adds org when not present
+  - Removes org when present
+  - Works correctly across multiple toggles
+
+- **initializeDefaults()**: Validates default behavior for org workspaces
+  - Hides personal account PRs by default in org workspaces
+  - Does NOT set defaults in personal workspace
+  - Does NOT override existing preferences
+  - Requires username cookie to be set
+  - Maintains independent preferences per workspace
+
+- **Integration tests**: Validates full workflow scenarios
+  - Users can override defaults by toggling
+  - Preferences persist across page reloads
+  - Repeated toggles work correctly (idempotency)
+  - No duplicate orgs from rapid clicking (regression test)
+
+## Test Framework
+
+Tests use Node.js built-in test runner (available in Node.js 18+). No external dependencies required.
+
+The tests create a mock DOM environment with:
+- `MockDocument`: Simulates `document` with cookie storage
+- `MockWindow`: Simulates `window` with location/hostname
+
+This allows testing browser-specific code in a Node.js environment.
diff --git a/assets/app.js b/assets/app.js
index 8f434a6..b424c34 100644
--- a/assets/app.js
+++ b/assets/app.js
@@ -13,7 +13,7 @@ const App = (() => {
   const state = {
     currentUser: null,
     viewingUser: null,
-    accessToken: Auth.getStoredToken(),
+    accessToken: null, // Will be loaded async in init()
     organizations: [],
     pullRequests: {
       incoming: [],
@@ -380,7 +380,10 @@ const App = (() => {
   const setCookie = (name, value, days) => {
     const expires = new Date();
     expires.setTime(expires.getTime() + days * 24 * 60 * 60 * 1000);
-    document.cookie = `${name}=${value};expires=${expires.toUTCString()};path=/;SameSite=Strict`;
+    // Use domain cookie for cross-subdomain persistence
+    const isSecure = window.location.protocol === "https:";
+    const securePart = isSecure ? ";Secure" : "";
+    document.cookie = `${name}=${value};expires=${expires.toUTCString()};path=/;domain=.ready-to-review.dev;SameSite=Lax${securePart}`;
   };
 
   const handlePRAction = async (action, prId) => {
@@ -422,8 +425,29 @@ const App = (() => {
   // Load current user
   const loadCurrentUser = async () => {
     state.currentUser = await Auth.loadCurrentUser();
+    // Store username and login timestamp in cookies
+    if (state.currentUser && state.currentUser.login) {
+      // Only set if not already set (preserve original timestamp)
+      const existingUsername = getCookie("username");
+      if (!existingUsername) {
+        const timestamp = Date.now().toString();
+        setCookie("username", state.currentUser.login, 365);
+        setCookie("login_ts", timestamp, 365);
+      }
+    }
   };
 
+  function getCookie(name) {
+    const nameEQ = `${name}=`;
+    const ca = document.cookie.split(";");
+    for (let i = 0; i < ca.length; i++) {
+      let c = ca[i];
+      while (c.charAt(0) === " ") c = c.substring(1, c.length);
+      if (c.indexOf(nameEQ) === 0) return c.substring(nameEQ.length, c.length);
+    }
+    return null;
+  }
+
   // GitHub API wrapper that uses Auth module
   const githubAPI = async (endpoint, options = {}) => {
     try {
@@ -640,6 +664,9 @@ const App = (() => {
 
   // Initialize
   const init = async () => {
+    // Load access token first (async now due to encryption)
+    state.accessToken = await Auth.getStoredToken();
+
     const urlParams = new URLSearchParams(window.location.search);
     const demo = urlParams.get("demo");
     const urlContext = parseURL();
@@ -677,7 +704,7 @@ const App = (() => {
     // Handle changelog page routing
     if (urlContext && urlContext.isChangelog) {
       updateSearchInputVisibility();
-      const token = Auth.getStoredToken();
+      const token = await Auth.getStoredToken();
       if (token) {
         try {
           await loadCurrentUser();
@@ -721,7 +748,7 @@ const App = (() => {
     const path = window.location.pathname;
     if (path === "/notifications" || path.match(/^\/notifications\/gh\/[^/]+$/)) {
       updateSearchInputVisibility();
-      const token = Auth.getStoredToken();
+      const token = await Auth.getStoredToken();
       if (token) {
         try {
           await loadCurrentUser();
@@ -738,7 +765,7 @@ const App = (() => {
     // Handle robots page routing
     if (path === "/robots" || path.match(/^\/robots\/gh\/[^/]+$/)) {
       updateSearchInputVisibility();
-      const token = Auth.getStoredToken();
+      const token = await Auth.getStoredToken();
       if (!token) {
         showToast("Please login to configure Robot Army", "error");
         window.location.href = "/";
@@ -855,7 +882,7 @@ const App = (() => {
     const authCodeExchanged = await Auth.handleAuthCodeCallback();
 
     // Re-check for authentication token (it might have been set after module load or auth code exchange)
-    state.accessToken = Auth.getStoredToken();
+    state.accessToken = await Auth.getStoredToken();
     console.log("[App.init] Checked for access token:", state.accessToken ? "found" : "not found");
 
     // If we just exchanged an auth code successfully, reload to start with fresh state
@@ -906,6 +933,9 @@ const App = (() => {
       updateSearchInputVisibility();
       await loadCurrentUser();
 
+      // Initialize workspace defaults after user is loaded
+      Workspace.initializeDefaults();
+
       // If at root URL, redirect to user's page
       if (!urlContext && state.currentUser) {
         window.location.href = `/u/${state.currentUser.login}`;
diff --git a/assets/auth.js b/assets/auth.js
index 8c7b147..5f85830 100644
--- a/assets/auth.js
+++ b/assets/auth.js
@@ -1,6 +1,8 @@
 // Authentication Module for Ready To Review
 console.log("[Auth Module] Loading...");
 
+import { Crypto } from "./crypto.js";
+
 // Log URL parameters on page load for debugging OAuth flow (without exposing secrets)
 const urlParams = new URLSearchParams(window.location.search);
 if (urlParams.has("code") || urlParams.has("state") || urlParams.has("error")) {
@@ -18,8 +20,7 @@ export const Auth = (() => {
   const CONFIG = {
     CLIENT_ID: "Iv23liYmAKkBpvhHAnQQ",
     API_BASE: "https://api.github.com",
-    STORAGE_KEY: "github_token", // Legacy localStorage key (fallback)
-    COOKIE_KEY: "github_token", // Store all tokens in cookies for cross-subdomain support
+    COOKIE_KEY: "access_token", // Encrypted token in cookies
     OAUTH_REDIRECT_URI: "https://auth.ready-to-review.dev/oauth/callback",
   };
 
@@ -27,11 +28,21 @@ export const Auth = (() => {
   function setCookie(name, value, days) {
     const expires = new Date();
     expires.setTime(expires.getTime() + days * 24 * 60 * 60 * 1000);
+
+    // SECURITY: Always require HTTPS for cookies containing sensitive data
+    // Fail loudly on HTTP to catch development/deployment issues early
+    if (window.location.protocol !== "https:") {
+      console.error("[SECURITY] Cannot set cookie over insecure HTTP connection");
+      console.error("[SECURITY] Cookie name:", name);
+      console.error("[SECURITY] Current protocol:", window.location.protocol);
+      throw new Error("Cookies can only be set over HTTPS for security");
+    }
+
     // Use domain cookie to share across all subdomains of ready-to-review.dev
-    // SameSite=Lax allows cookies to be sent on top-level navigation (OAuth redirects)
-    const isSecure = window.location.protocol === "https:";
-    const securePart = isSecure ? ";Secure" : "";
-    document.cookie = `${name}=${value};expires=${expires.toUTCString()};path=/;domain=.ready-to-review.dev;SameSite=Lax${securePart}`;
+    // SameSite=Lax: Required for OAuth callback (cross-site navigation with state cookie)
+    // Secure: Always set - enforced by protocol check above
+    // HttpOnly: Cannot use - JavaScript needs to read/decrypt tokens
+    document.cookie = `${name}=${value};expires=${expires.toUTCString()};path=/;domain=.ready-to-review.dev;SameSite=Lax;Secure`;
   }
 
   function getCookie(name) {
@@ -50,35 +61,47 @@ export const Auth = (() => {
     document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 UTC;path=/;domain=.ready-to-review.dev;`;
   }
 
-  const getStoredToken = () => {
-    // Always check cookie first (works across subdomains)
-    const cookieToken = getCookie(CONFIG.COOKIE_KEY);
-    if (cookieToken) return cookieToken;
-
-    // Fallback to localStorage for legacy tokens, then migrate to cookie
-    const localToken = localStorage.getItem(CONFIG.STORAGE_KEY);
-    if (localToken) {
-      console.log("[Auth] Migrating token from localStorage to cookie for cross-subdomain support");
-      setCookie(CONFIG.COOKIE_KEY, localToken, 10);
-      localStorage.removeItem(CONFIG.STORAGE_KEY);
-      return localToken;
+  // Get encryption context (username, domain, and timestamp)
+  const getEncryptionContext = () => {
+    const username = getCookie("username");
+    const timestamp = getCookie("login_ts");
+    const domain = window.location.hostname.split(".").slice(-2).join("."); // Get base domain
+
+    return { username, domain, timestamp };
+  };
+
+  const getStoredToken = async () => {
+    const { username, domain, timestamp } = getEncryptionContext();
+
+    const encryptedToken = getCookie(CONFIG.COOKIE_KEY);
+    if (!encryptedToken || !username || !domain || !timestamp) {
+      return null;
     }
 
-    return null;
+    try {
+      console.log("[Auth] Decrypting stored token");
+      return await Crypto.decryptToken(encryptedToken, username, domain, timestamp);
+    } catch (error) {
+      console.error("[Auth] Failed to decrypt token, clearing invalid token:", error);
+      deleteCookie(CONFIG.COOKIE_KEY);
+      return null;
+    }
   };
 
-  const storeToken = (token) => {
-    // Always store in cookie for cross-subdomain support (10 days)
-    setCookie(CONFIG.COOKIE_KEY, token, 10);
-    // Clean up any legacy localStorage token
-    localStorage.removeItem(CONFIG.STORAGE_KEY);
+  const storeToken = async (token) => {
+    const { username, domain, timestamp } = getEncryptionContext();
+
+    if (!username || !domain || !timestamp) {
+      throw new Error("Cannot encrypt token: username, domain, or timestamp missing");
+    }
+
+    console.log("[Auth] Encrypting token for storage");
+    const encrypted = await Crypto.encryptToken(token, username, domain, timestamp);
+    setCookie(CONFIG.COOKIE_KEY, encrypted, 10);
   };
 
   const clearToken = () => {
-    // Clear cookie (primary storage)
     deleteCookie(CONFIG.COOKIE_KEY);
-    // Clear localStorage (legacy)
-    localStorage.removeItem(CONFIG.STORAGE_KEY);
   };
 
   const initiateOAuthLogin = () => {
@@ -196,7 +219,7 @@ export const Auth = (() => {
       });
 
       if (response.ok) {
-        storeToken(token); // Store in cookie
+        await storeToken(token); // Store encrypted token in cookie
         closePATModal();
         window.location.reload();
       } else {
@@ -244,8 +267,13 @@ export const Auth = (() => {
 
       const data = await response.json();
 
-      // Store token in localStorage
-      storeToken(data.token);
+      // Store username and login timestamp (milliseconds since 1970)
+      const timestamp = Date.now().toString();
+      setCookie("username", data.username, 365);
+      setCookie("login_ts", timestamp, 365);
+
+      // Store encrypted token
+      await storeToken(data.token);
 
       console.log("[Auth] Successfully exchanged auth code for token, user:", data.username);
 
@@ -279,7 +307,7 @@ export const Auth = (() => {
       ...options.headers,
     };
 
-    const token = getStoredToken();
+    const token = await getStoredToken();
     if (token) {
       headers.Authorization = `token ${token}`;
     }
@@ -350,7 +378,7 @@ export const Auth = (() => {
 
   // GraphQL API function with retry logic
   const githubGraphQL = async (query, variables = {}, retries = 5) => {
-    const token = getStoredToken();
+    const token = await getStoredToken();
     if (!token) {
       throw new Error("No authentication token available");
     }
diff --git a/assets/crypto.js b/assets/crypto.js
new file mode 100644
index 0000000..3958259
--- /dev/null
+++ b/assets/crypto.js
@@ -0,0 +1,112 @@
+// Crypto Module for Ready To Review
+// Encrypts sensitive data like GitHub tokens to prevent them from appearing raw on disk/memory
+console.log("[Crypto Module] Loading...");
+
+export const Crypto = (() => {
+  console.log("[Crypto Module] Initializing...");
+
+  // Derive encryption key from username, domain, and timestamp
+  // SECURITY: Uses PBKDF2 with 100,000 iterations to prevent brute-force attacks
+  // Even if attacker captures encrypted cookie, they cannot feasibly brute-force timestamp
+  const deriveKey = async (username, domain, timestamp) => {
+    const keyMaterial = `${username}@${domain}:${timestamp}`;
+    const encoder = new TextEncoder();
+    const data = encoder.encode(keyMaterial);
+
+    // Import raw key material for PBKDF2
+    const baseKey = await crypto.subtle.importKey("raw", data, "PBKDF2", false, ["deriveKey"]);
+
+    // Use domain as salt (public but unique per deployment)
+    // Salt doesn't need to be secret, just unique
+    const salt = encoder.encode(domain);
+
+    // Derive AES key using PBKDF2 with 100,000 iterations
+    // This makes each key derivation take ~50ms, making brute-force infeasible
+    // Nation-state attackers would need years to test all timestamps for a single year
+    return await crypto.subtle.deriveKey(
+      {
+        name: "PBKDF2",
+        salt: salt,
+        iterations: 100000,
+        hash: "SHA-256",
+      },
+      baseKey,
+      { name: "AES-GCM", length: 256 },
+      false,
+      ["encrypt", "decrypt"]
+    );
+  };
+
+  // Encrypt a token
+  const encryptToken = async (token, username, domain, timestamp) => {
+    if (!token || !username || !domain || !timestamp) {
+      throw new Error("Token, username, domain, and timestamp are required for encryption");
+    }
+
+    try {
+      const key = await deriveKey(username, domain, timestamp);
+      const encoder = new TextEncoder();
+      const data = encoder.encode(token);
+
+      // Generate random IV (initialization vector)
+      const iv = crypto.getRandomValues(new Uint8Array(12));
+
+      // Encrypt
+      const encrypted = await crypto.subtle.encrypt({ name: "AES-GCM", iv: iv }, key, data);
+
+      // Combine IV + encrypted data and encode as base64
+      const combined = new Uint8Array(iv.length + encrypted.byteLength);
+      combined.set(iv, 0);
+      combined.set(new Uint8Array(encrypted), iv.length);
+
+      // Convert to base64 for cookie storage
+      return btoa(String.fromCharCode(...combined));
+    } catch (error) {
+      console.error("[Crypto] Encryption failed:", error);
+      throw error;
+    }
+  };
+
+  // Decrypt a token
+  const decryptToken = async (encryptedToken, username, domain, timestamp) => {
+    if (!encryptedToken || !username || !domain || !timestamp) {
+      throw new Error(
+        "Encrypted token, username, domain, and timestamp are required for decryption"
+      );
+    }
+
+    try {
+      const key = await deriveKey(username, domain, timestamp);
+
+      // Decode base64
+      const combined = Uint8Array.from(atob(encryptedToken), (c) => c.charCodeAt(0));
+
+      // Extract IV (first 12 bytes) and encrypted data
+      const iv = combined.slice(0, 12);
+      const encryptedData = combined.slice(12);
+
+      // Decrypt
+      const decrypted = await crypto.subtle.decrypt(
+        { name: "AES-GCM", iv: iv },
+        key,
+        encryptedData
+      );
+
+      // Convert back to string
+      const decoder = new TextDecoder();
+      return decoder.decode(decrypted);
+    } catch (error) {
+      console.error("[Crypto] Decryption failed:", error);
+      throw error;
+    }
+  };
+
+  console.log("[Crypto Module] Exporting functions...");
+  const cryptoExports = {
+    encryptToken,
+    decryptToken,
+  };
+  console.log("[Crypto Module] Exports:", cryptoExports);
+  return cryptoExports;
+})();
+console.log("[Crypto Module] Module loaded, Crypto object:", Crypto);
diff --git a/assets/crypto.test.js b/assets/crypto.test.js
new file mode 100644
index 0000000..42271f4
--- /dev/null
+++ b/assets/crypto.test.js
@@ -0,0 +1,223 @@
+// Crypto module tests
+// Run with: node --test assets/crypto.test.js
+
+import { describe, it } from "node:test";
+import assert from "node:assert";
+
+// crypto is already available in Node.js global scope (no polyfill needed)
+
+// Import crypto module
+import { Crypto } from "./crypto.js";
+
+describe("Crypto Module", () => {
+  describe("encryptToken() and decryptToken()", () => {
+    it("should encrypt and decrypt a token successfully", async () => {
+      const token = "ghp_1234567890abcdefghijklmnopqrstuvwxyz";
+      const username = "testuser";
+      const domain = "ready-to-review.dev";
+      const timestamp = "1699564800000";
+
+      // Encrypt
+      const encrypted = await Crypto.encryptToken(token, username, domain, timestamp);
+
+      // Should be base64 encoded
+      assert.ok(encrypted.length > 0);
+      assert.ok(typeof encrypted === "string");
+      assert.notStrictEqual(encrypted, token, "Encrypted token should not match plaintext");
+
+      // Decrypt
+      const decrypted = await Crypto.decryptToken(encrypted, username, domain, timestamp);
+
+      // Should match original
+      assert.strictEqual(decrypted, token, "Decrypted token should match original");
+    });
+
+    it("should produce different ciphertext for same token (random IV)", async () => {
+      const token = "ghp_1234567890abcdefghijklmnopqrstuvwxyz";
+      const username = "testuser";
+      const domain = "ready-to-review.dev";
+      const timestamp = "1699564800000";
+
+      const encrypted1 = await Crypto.encryptToken(token, username, domain, timestamp);
+      const encrypted2 = await Crypto.encryptToken(token, username, domain, timestamp);
+
+      // Should be different due to random IV
+      assert.notStrictEqual(encrypted1, encrypted2, "Each encryption should produce different ciphertext");
+
+      // But both should decrypt to same value
+      const decrypted1 = await Crypto.decryptToken(encrypted1, username, domain, timestamp);
+      const decrypted2 = await Crypto.decryptToken(encrypted2, username, domain, timestamp);
+      assert.strictEqual(decrypted1, token);
+      assert.strictEqual(decrypted2, token);
+    });
+
+    it("should fail to decrypt with wrong username", async () => {
+      const token = "ghp_1234567890abcdefghijklmnopqrstuvwxyz";
+      const username = "testuser";
+      const domain = "ready-to-review.dev";
+      const timestamp = "1699564800000";
+
+      const encrypted = await Crypto.encryptToken(token, username, domain, timestamp);
+
+      // Try to decrypt with different username - should throw
+      await assert.rejects(async () => {
+        await Crypto.decryptToken(encrypted, "wronguser", domain, timestamp);
+      });
+    });
+
+    it("should fail to decrypt with wrong domain", async () => {
+      const token = "ghp_1234567890abcdefghijklmnopqrstuvwxyz";
+      const username = "testuser";
+      const domain = "ready-to-review.dev";
+      const timestamp = "1699564800000";
+
+      const encrypted = await Crypto.encryptToken(token, username, domain, timestamp);
+
+      // Try to decrypt with different domain - should throw
+      await assert.rejects(async () => {
+        await Crypto.decryptToken(encrypted, username, "wrong-domain.com", timestamp);
+      });
+    });
+
+    it("should fail to decrypt with wrong timestamp", async () => {
+      const token = "ghp_1234567890abcdefghijklmnopqrstuvwxyz";
+      const username = "testuser";
+      const domain = "ready-to-review.dev";
+      const timestamp = "1699564800000";
+
+      const encrypted = await Crypto.encryptToken(token, username, domain, timestamp);
+
+      // Try to decrypt with different timestamp - should throw
+      await assert.rejects(async () => {
+        await Crypto.decryptToken(encrypted, username, domain, "1699564800001");
+      });
+    });
+
+    it("should handle various token formats", async () => {
+      const tokens = [
+        "ghp_1234567890abcdefghijklmnopqrstuvwxyz", // PAT
+        "gho_1234567890abcdefghijklmnopqrstuvwxyz", // OAuth
+        "github_pat_11ABCDEFGHIJKLMNOPQRSTUVWXYZ123456789012345678901234567890", // Fine-grained PAT
+      ];
+      const username = "testuser";
+      const domain = "ready-to-review.dev";
+      const timestamp = "1699564800000";
+
+      for (const token of tokens) {
+        const encrypted = await Crypto.encryptToken(token, username, domain, timestamp);
+        const decrypted = await Crypto.decryptToken(encrypted, username, domain, timestamp);
+        assert.strictEqual(decrypted, token, `Should handle token format: ${token.substring(0, 10)}...`);
+      }
+    });
+
+    it("should require all parameters for encryption", async () => {
+      await assert.rejects(
+        async () => {
+          await Crypto.encryptToken("token", null, "domain", "timestamp");
+        },
+        {
+          message: /Token, username, domain, and timestamp are required/,
+        }
+      );
+
+      await assert.rejects(
+        async () => {
+          await Crypto.encryptToken("token", "user", null, "timestamp");
+        },
+        {
+          message: /Token, username, domain, and timestamp are required/,
+        }
+      );
+
+      await assert.rejects(
+        async () => {
+          await Crypto.encryptToken("token", "user", "domain", null);
+        },
+        {
+          message: /Token, username, domain, and timestamp are required/,
+        }
+      );
+    });
+
+    it("should require all parameters for decryption", async () => {
+      await assert.rejects(
+        async () => {
+          await Crypto.decryptToken("encrypted", null, "domain", "timestamp");
+        },
+        {
+          message: /Encrypted token, username, domain, and timestamp are required/,
+        }
+      );
+
+      await assert.rejects(
+        async () => {
+          await Crypto.decryptToken("encrypted", "user", null, "timestamp");
+        },
+        {
+          message: /Encrypted token, username, domain, and timestamp are required/,
+        }
+      );
+
+      await assert.rejects(
+        async () => {
+          await Crypto.decryptToken("encrypted", "user", "domain", null);
+        },
+        {
+          message: /Encrypted token, username, domain, and timestamp are required/,
+        }
+      );
+    });
+
+    it("should handle realistic GitHub token scenario", async () => {
+      // Simulate a real login flow
+      const githubToken = "ghp_vT3xR9pL2kQ8mN4bV7wC1yZ5sA6fD0hJ";
+      const username = "tstromberg";
+      const domain = "ready-to-review.dev";
+      const loginTimestamp = Date.now().toString();
+
+      // User logs in - token gets encrypted
+      const encryptedToken = await Crypto.encryptToken(
+        githubToken,
+        username,
+        domain,
+        loginTimestamp
+      );
+
+      // Store in cookie (simulated)
+      const cookieValue = encryptedToken;
+
+      // Later, app needs to make API call - decrypt token
+      const decryptedToken = await Crypto.decryptToken(
+        cookieValue,
+        username,
+        domain,
+        loginTimestamp
+      );
+
+      // Should be able to use decrypted token
+      assert.strictEqual(decryptedToken, githubToken);
+      assert.ok(decryptedToken.startsWith("ghp_"));
+    });
+
+    it("should produce different keys for different timestamps", async () => {
+      const token = "ghp_test123";
+      const username = "testuser";
+      const domain = "ready-to-review.dev";
+
+      const ts1 = "1699564800000";
+      const ts2 = "1699564800001"; // 1 millisecond later
+
+      const encrypted1 = await Crypto.encryptToken(token, username, domain, ts1);
+      const encrypted2 = await Crypto.encryptToken(token, username, domain, ts2);
+
+      // Can decrypt with correct timestamp
+      const decrypted1 = await Crypto.decryptToken(encrypted1, username, domain, ts1);
+      assert.strictEqual(decrypted1, token);
+
+      // Cannot decrypt ts1's token with ts2's timestamp
+      await assert.rejects(async () => {
+        await Crypto.decryptToken(encrypted1, username, domain, ts2);
+      });
+    });
+  });
+});
diff --git a/assets/integration.test.js b/assets/integration.test.js
new file mode 100644
index 0000000..c290697
--- /dev/null
+++ b/assets/integration.test.js
@@ -0,0 +1,482 @@
+// Integration tests for app initialization and token handling
+// Run with: node --test assets/integration.test.js
+
+import assert from "node:assert";
+import { describe, it } from "node:test";
+
+describe("App Integration", () => {
+  describe("State initialization", () => {
+    it("should handle null accessToken gracefully", () => {
+      // Simulate app state with null token (before async load completes)
+      const state = {
+        currentUser: null,
+        viewingUser: null,
+        accessToken: null,
+        organizations: [],
+        pullRequests: { incoming: [], outgoing: [] },
+        isDemoMode: false,
+      };
+
+      // This simulates the logging code in user.js:292
+      // Should not throw when accessToken is null
+      assert.doesNotThrow(() => {
+        const authType =
+          state.accessToken && typeof state.accessToken === "string"
+            ? state.accessToken.startsWith("ghp_")
+              ? "PAT"
+              : "OAuth"
+            : "none";
+        assert.strictEqual(authType, "none");
+      });
+    });
+
+    it("should detect PAT token type", () => {
+      const state = {
+        accessToken: "ghp_1234567890abcdefghijklmnopqrstuvwxyz",
+      };
+
+      const authType =
+        state.accessToken && typeof state.accessToken === "string"
+          ? state.accessToken.startsWith("ghp_")
+            ? "PAT"
+            : "OAuth"
+          : "none";
+
+      assert.strictEqual(authType, "PAT");
+    });
+
+    it("should detect OAuth token type", () => {
+      const state = {
+        accessToken: "gho_1234567890abcdefghijklmnopqrstuvwxyz",
+      };
+
+      const authType =
+        state.accessToken && typeof state.accessToken === "string"
+          ? state.accessToken.startsWith("ghp_")
+            ? "PAT"
+            : "OAuth"
+          : "none";
+
+      assert.strictEqual(authType, "OAuth");
+    });
+
+    it("should handle undefined accessToken", () => {
+      const state = {
+        accessToken: undefined,
+      };
+
+      assert.doesNotThrow(() => {
+        const authType =
+          state.accessToken && typeof state.accessToken === "string"
+            ? state.accessToken.startsWith("ghp_")
+              ? "PAT"
+              : "OAuth"
+            : "none";
+        assert.strictEqual(authType, "none");
+      });
+    });
+
+    it("should handle empty string accessToken", () => {
+      const state = {
+        accessToken: "",
+      };
+
+      assert.doesNotThrow(() => {
+        const authType =
+          state.accessToken && typeof state.accessToken === "string"
+            ? state.accessToken.startsWith("ghp_")
+              ? "PAT"
+              : "OAuth"
+            : "none";
+        assert.strictEqual(authType, "none");
+      });
+    });
+
+    it("should handle non-string accessToken gracefully", () => {
+      const invalidTokens = [123, true, {}, [], NaN];
+
+      for (const invalidToken of invalidTokens) {
+        const state = { accessToken: invalidToken };
+
+        assert.doesNotThrow(
+          () => {
+            const authType =
+              state.accessToken && typeof state.accessToken === "string"
+                ? state.accessToken.startsWith("ghp_")
+                  ? "PAT"
+                  : "OAuth"
+                : "none";
+            assert.strictEqual(authType, "none");
+          },
+          `Should handle ${typeof invalidToken} without throwing`
+        );
+      }
+    });
+
+    it("should handle token type check for OAuth warning (user.js:325)", () => {
+      // This is the actual code from user.js:325 that was failing
+      const state = { accessToken: null };
+      const totalCount = 100;
+      const allPRsLength = 50;
+
+      assert.doesNotThrow(() => {
+        // This should not throw even with null token
+        if (
+          state.accessToken &&
+          typeof state.accessToken === "string" &&
+          !state.accessToken.startsWith("ghp_") &&
+          totalCount > allPRsLength
+        ) {
+          // Would show OAuth warning
+        }
+      }, "Should handle null token in OAuth warning check");
+
+      // Test with OAuth token - should enter the condition
+      state.accessToken = "gho_1234567890abcdefghijklmnopqrstuvwxyz";
+      let warningTriggered = false;
+      if (
+        state.accessToken &&
+        typeof state.accessToken === "string" &&
+        !state.accessToken.startsWith("ghp_") &&
+        totalCount > allPRsLength
+      ) {
+        warningTriggered = true;
+      }
+      assert.strictEqual(warningTriggered, true, "Should trigger OAuth warning for OAuth tokens");
+
+      // Test with PAT token - should NOT enter the condition
+      state.accessToken = "ghp_1234567890abcdefghijklmnopqrstuvwxyz";
+      warningTriggered = false;
+      if (
+        state.accessToken &&
+        typeof state.accessToken === "string" &&
+        !state.accessToken.startsWith("ghp_") &&
+        totalCount > allPRsLength
+      ) {
+        warningTriggered = true;
+      }
+      assert.strictEqual(
+        warningTriggered,
+        false,
+        "Should NOT trigger OAuth warning for PAT tokens"
+      );
+    });
+  });
+
+  describe("Async token loading", () => {
+    it("should initialize with null token before async load", () => {
+      // This is how the app initializes now
+      const state = {
+        accessToken: null, // Will be loaded async in init()
+      };
+
+      assert.strictEqual(state.accessToken, null);
+    });
+
+    it("should be able to set token after async load", async () => {
+      const state = {
+        accessToken: null,
+      };
+
+      // Simulate async token loading
+      await new Promise((resolve) => {
+        setTimeout(() => {
+          state.accessToken = "ghp_test123";
+          resolve();
+        }, 0);
+      });
+
+      assert.strictEqual(state.accessToken, "ghp_test123");
+    });
+  });
+
+  describe("buildWaitingOn", () => {
+    const escapeHtml = (text) => {
+      const map = {
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&#039;",
+      };
+      return text.replace(/[&<>"']/g, (m) => map[m]);
+    };
+
+    const buildWaitingOn = (pr, viewingUser, currentUser) => {
+      if (!pr.turnData?.analysis?.next_action) {
+        return "";
+      }
+
+      const nextAction = pr.turnData.analysis.next_action;
+      const usernames = Object.keys(nextAction);
+
+      if (usernames.length === 0) {
+        return "";
+      }
+
+      // Group actions by kind
+      const actionsByKind = {};
+      usernames.forEach((username) => {
+        const action = nextAction[username];
+        const kind = action.kind || "action";
+
+        if (!actionsByKind[kind]) {
+          actionsByKind[kind] = [];
+        }
+
+        const isViewingUser = viewingUser && username === viewingUser.login;
+        const isCurrentUser = currentUser && username === currentUser.login;
+
+        let displayName = username;
+        let className = "pr-action-user";
+
+        // Special handling for _system
+        if (username === "_system") {
+          // Skip adding _system to the user list, we'll just show the action name
+          return;
+        }
+
+        // If viewing someone else's dashboard, highlight their name
+        if (viewingUser && currentUser && viewingUser.login !== currentUser.login) {
+          if (isViewingUser) {
+            displayName = viewingUser.login;
+            className = "pr-action-you";
+          }
+        } else {
+          // Normal behavior when viewing your own dashboard
+          if (isCurrentUser) {
+            displayName = "YOU";
+            className = "pr-action-you";
+          }
+        }
+
+        const title = action.reason || "Waiting for action";
+        actionsByKind[kind].push({
+          html: `<span class="${className}" title="${escapeHtml(title)}">${escapeHtml(displayName)}</span>`,
+          isYou: isCurrentUser || isViewingUser,
+        });
+      });
+
+      // Build the action groups string
+      const actionGroups = Object.entries(actionsByKind)
+        .map(([kind, users]) => {
+          // Format action kind (replace underscores with spaces)
+          const actionName = kind.replace(/_/g, " ");
+
+          if (users.length === 0) {
+            // _system action with no users
+            return actionName;
+          }
+
+          // Join user names
+          const userList = users.map((u) => u.html).join(", ");
+          return `${actionName}: ${userList}`;
+        })
+        .join("; ");
+
+      return ` <span class="pr-waiting-on">→ ${actionGroups}</span>`;
+    };
+
+    it("should return empty string when no turnData", () => {
+      const pr = {};
+      const result = buildWaitingOn(pr, null, null);
+      assert.strictEqual(result, "");
+    });
+
+    it("should return empty string when no next_action", () => {
+      const pr = { turnData: { analysis: {} } };
+      const result = buildWaitingOn(pr, null, null);
+      assert.strictEqual(result, "");
+    });
+
+    it("should return empty string when next_action is empty", () => {
+      const pr = { turnData: { analysis: { next_action: {} } } };
+      const result = buildWaitingOn(pr, null, null);
+      assert.strictEqual(result, "");
+    });
+
+    it("should show single review action for YOU", () => {
+      const pr = {
+        turnData: {
+          analysis: {
+            next_action: {
+              demo: { kind: "review", reason: "Please review this PR", critical: true },
+            },
+          },
+        },
+      };
+      const currentUser = { login: "demo" };
+      const result = buildWaitingOn(pr, currentUser, currentUser);
+
+      assert.ok(result.includes("→"), "Should start with arrow");
+      assert.ok(result.includes("review:"), "Should show action name");
+      assert.ok(result.includes('pr-action-you'), "Should use YOU class for current user");
+      assert.ok(result.includes("YOU"), "Should show YOU for current user");
+    });
+
+    it("should group multiple users under same action", () => {
+      const pr = {
+        turnData: {
+          analysis: {
+            next_action: {
+              demo: { kind: "review", reason: "Please review" },
+              alice: { kind: "review", reason: "Alice needs to review" },
+              bob: { kind: "review", reason: "Bob needs to review" },
+            },
+          },
+        },
+      };
+      const currentUser = { login: "demo" };
+      const result = buildWaitingOn(pr, currentUser, currentUser);
+
+      assert.ok(result.includes("review:"), "Should show review action");
+      assert.ok(result.includes("YOU"), "Should show YOU");
+      assert.ok(result.includes("alice"), "Should show alice");
+      assert.ok(result.includes("bob"), "Should show bob");
+      assert.ok(!result.includes(";"), "Should not have semicolon for single action type");
+    });
+
+    it("should separate different action types with semicolons", () => {
+      const pr = {
+        turnData: {
+          analysis: {
+            next_action: {
+              demo: { kind: "review", reason: "Please review" },
+              alice: { kind: "merge", reason: "Alice needs to merge" },
+              bob: { kind: "fix_tests", reason: "Bob needs to fix tests" },
+            },
+          },
+        },
+      };
+      const currentUser = { login: "demo" };
+      const result = buildWaitingOn(pr, currentUser, currentUser);
+
+      assert.ok(result.includes(";"), "Should have semicolons separating actions");
+      assert.ok(result.includes("review:"), "Should show review action");
+      assert.ok(result.includes("merge:"), "Should show merge action");
+      assert.ok(result.includes("fix tests:"), "Should show fix tests with space");
+    });
+
+    it("should handle _system user by showing only action name", () => {
+      const pr = {
+        turnData: {
+          analysis: {
+            next_action: {
+              _system: { kind: "fix_tests", reason: "Tests are failing" },
+            },
+          },
+        },
+      };
+      const currentUser = { login: "demo" };
+      const result = buildWaitingOn(pr, currentUser, currentUser);
+
+      assert.ok(result.includes("fix tests"), "Should show action name");
+      assert.ok(!result.includes("_system"), "Should not show _system username");
+      assert.ok(!result.includes(":"), "Should not have colon when only _system");
+    });
+
+    it("should replace underscores with spaces in action names", () => {
+      const pr = {
+        turnData: {
+          analysis: {
+            next_action: {
+              demo: { kind: "fix_merge_conflict", reason: "Fix conflict" },
+            },
+          },
+        },
+      };
+      const currentUser = { login: "demo" };
+      const result = buildWaitingOn(pr, currentUser, currentUser);
+
+      assert.ok(result.includes("fix merge conflict:"), "Should replace underscores with spaces");
+      assert.ok(!result.includes("fix_merge_conflict"), "Should not contain underscores");
+    });
+
+    it("should handle mixed actions including _system", () => {
+      const pr = {
+        turnData: {
+          analysis: {
+            next_action: {
+              demo: { kind: "review", reason: "Please review" },
+              alice: { kind: "add_comment", reason: "Alice needs to comment" },
+              _system: { kind: "run_tests", reason: "Tests running" },
+            },
+          },
+        },
+      };
+      const currentUser = { login: "demo" };
+      const result = buildWaitingOn(pr, currentUser, currentUser);
+
+      assert.ok(result.includes("review: "), "Should show review with users");
+      assert.ok(result.includes("add comment: "), "Should show add comment");
+      assert.ok(result.includes("run tests"), "Should show run tests from _system");
+      assert.ok(!result.includes("_system"), "Should not show _system username");
+    });
+
+    it("should escape HTML in usernames and reasons", () => {
+      const pr = {
+        turnData: {
+          analysis: {
+            next_action: {
+              'user<script>': { kind: "review", reason: 'XSS"attack' },
+            },
+          },
+        },
+      };
+      const currentUser = { login: "demo" };
+      const result = buildWaitingOn(pr, currentUser, currentUser);
+
+      assert.ok(result.includes("&lt;"), "Should escape < character");
+      assert.ok(!result.includes("<script>"), "Should not contain raw script tag");
+      assert.ok(result.includes("&quot;"), "Should escape quotes in title");
+    });
+
+    it("should use pr-action-user class for non-current users", () => {
+      const pr = {
+        turnData: {
+          analysis: {
+            next_action: {
+              alice: { kind: "review", reason: "Alice needs to review" },
+            },
+          },
+        },
+      };
+      const currentUser = { login: "demo" };
+      const result = buildWaitingOn(pr, currentUser, currentUser);
+
+      assert.ok(result.includes('pr-action-user'), "Should use pr-action-user class for others");
+      assert.ok(!result.includes('pr-action-you'), "Should not use pr-action-you class");
+    });
+
+    it("should handle complex multi-action scenario", () => {
+      const pr = {
+        turnData: {
+          analysis: {
+            next_action: {
+              demo: { kind: "review", reason: "Please review" },
+              alice: { kind: "review", reason: "Alice review" },
+              bob: { kind: "add_comment", reason: "Bob comment" },
+              charlie: { kind: "fix_tests", reason: "Charlie tests" },
+            },
+          },
+        },
+      };
+      const currentUser = { login: "demo" };
+      const result = buildWaitingOn(pr, currentUser, currentUser);
+
+      // Should have format: "→ review: YOU, alice; add comment: bob; fix tests: charlie"
+      assert.ok(result.includes("→"), "Should start with arrow");
+      assert.ok(result.includes("review: "), "Should have review action");
+      assert.ok(result.includes("YOU"), "Should show YOU");
+      assert.ok(result.includes("alice"), "Should show alice in review");
+      assert.ok(result.includes("add comment: "), "Should have add comment action");
+      assert.ok(result.includes("bob"), "Should show bob");
+      assert.ok(result.includes("fix tests: "), "Should have fix tests action");
+      assert.ok(result.includes("charlie"), "Should show charlie");
+
+      // Check semicolons separate action groups
+      const semicolonCount = (result.match(/;/g) || []).length;
+      assert.strictEqual(semicolonCount, 2, "Should have 2 semicolons for 3 action types");
+    });
+  });
+});
diff --git a/assets/styles.css b/assets/styles.css
index e703169..0f92439 100644
--- a/assets/styles.css
+++ b/assets/styles.css
@@ -1172,38 +1172,30 @@ a {
   font-weight: 500;
 }
 
-/* Waiting on section */
+/* Waiting on section - now shows action format: "-> review: YOU, someone_else" */
 .pr-waiting-on {
   display: inline;
   color: var(--color-text-secondary);
   font-size: 0.875rem;
 }
 
-.pr-waiting-on-label {
-  color: var(--color-text-tertiary);
-}
-
-.pr-waiting-on-user {
-  color: var(--color-text-secondary);
+.pr-action-user {
+  color: #6b7280;
+  font-weight: 600;
   cursor: help;
   text-decoration: none;
   position: relative;
 }
 
-.pr-waiting-on-user:hover {
+.pr-action-user:hover {
   text-decoration: underline;
 }
 
-.pr-waiting-on-you {
+.pr-action-you {
   color: #dc2626;
   font-weight: 700;
 }
 
-.pr-waiting-on-you-green {
-  color: #166534;
-  font-weight: 700;
-}
-
 /* Replaced animated dots with static text for performance */
 
 /* Removed funkyBounce animation for performance */
diff --git a/assets/user.js b/assets/user.js
index 1990f35..85b6cd4 100644
--- a/assets/user.js
+++ b/assets/user.js
@@ -289,7 +289,7 @@ export const User = (() => {
     console.log(`  1. https://github.com/search?q=${encodeURIComponent(query1)}&type=pullrequests`);
     console.log(`  2. https://github.com/search?q=${encodeURIComponent(query2)}&type=pullrequests`);
     console.log(
-      `Auth: ${state.accessToken ? (state.accessToken.startsWith("ghp_") ? "PAT" : "OAuth") : "none"}`
+      `Auth: ${state.accessToken && typeof state.accessToken === "string" ? (state.accessToken.startsWith("ghp_") ? "PAT" : "OAuth") : "none"}`
     );
 
     const [response1, response2] = await Promise.all([
@@ -322,7 +322,7 @@ export const User = (() => {
     if (prCountLoadedContainer && allPRs.length > 0) show(prCountLoadedContainer);
 
     const totalCount = response1.total_count + response2.total_count;
-    if (state.accessToken && !state.accessToken.startsWith("ghp_") && totalCount > allPRs.length) {
+    if (state.accessToken && typeof state.accessToken === "string" && !state.accessToken.startsWith("ghp_") && totalCount > allPRs.length) {
       console.info(`OAuth Apps may not show all PRs. Consider using a Personal Access Token.`);
     }
 
@@ -525,9 +525,6 @@ export const User = (() => {
         tags.push("blocked on you");
 
         const action = nextAction[currentUser.login];
-        if (action.kind === "review" || action.kind === "re_review") {
-          tags.push("needs-review");
-        }
         if (action.kind === "fix_tests" || action.kind === "rerun_tests") {
           tags.push("needs-fixes", "tests_failing");
         }
@@ -615,38 +612,16 @@ export const User = (() => {
         },
       });
 
-      // Create user name with optional @org - XSS-safe (textContent)
+      // Create user name - XSS-safe (textContent)
       const userName = el("span", {
         className: "user-name",
-      });
-
-      // Add username
-      const usernameSpan = el("span", {
-        className: "username-main",
         text: state.currentUser.login,
       });
-      userName.appendChild(usernameSpan);
 
-      // Add @org if viewing an organization workspace
+      // Check membership and show banner if in org workspace and not a member
       if (currentWorkspace) {
-        const orgSpan = el("span", {
-          className: "username-org",
-          text: `@${currentWorkspace}`,
-        });
-        userName.appendChild(orgSpan);
-
-        // Add red asterisk if user is not a member of this org
         const isMember = isUserMemberOfOrg(currentWorkspace);
         if (!isMember) {
-          const asterisk = el("span", {
-            className: "username-org-non-member",
-            text: "*",
-            attrs: {
-              title: "You are not a member of this organization",
-            },
-          });
-          userName.appendChild(asterisk);
-
           // Show banner if not a member
           if (footerBanner && notificationText) {
             footerBanner.classList.add("visible");
@@ -682,7 +657,7 @@ export const User = (() => {
         },
       });
 
-      // Create viewing label with username and optional @org - XSS-safe (textContent)
+      // Create viewing label with username - XSS-safe (textContent)
       const userName = el("span", {
         className: "user-name",
       });
@@ -696,16 +671,6 @@ export const User = (() => {
       });
       userName.appendChild(usernameSpan);
 
-      // Add @org if viewing an organization workspace
-      if (currentWorkspace) {
-        const orgSpan = el("span", {
-          className: "username-org",
-          text: `@${currentWorkspace}`,
-        });
-        userName.appendChild(orgSpan);
-        // Don't show membership info when not logged in - we don't know yet
-      }
-
       // Create login button - XSS-safe
       const loginBtn = el("button", {
         className: "btn btn-primary",
@@ -1028,8 +993,7 @@ export const User = (() => {
         const newHiddenOrgs = Workspace.hiddenOrgs();
         console.log("[populateOrgFilters] After toggle, hidden orgs:", newHiddenOrgs);
 
-        // Refresh the menu and PR sections
-        populateOrgFilters(state);
+        // Refresh PR sections (which also refreshes the menu)
         updatePRSections(state);
       });
     });
@@ -1081,8 +1045,9 @@ export const User = (() => {
 
     // Get workspace-specific settings
     const hiddenOrgs = Workspace.hiddenOrgs();
-    const hideStale =
-      getCookie(`globalFilterStale_${Workspace.currentWorkspace() || "personal"}`) === "true";
+    // Default to true (hide stale PRs by default)
+    const staleCookie = getCookie(`globalFilterStale_${Workspace.currentWorkspace() || "personal"}`);
+    const hideStale = staleCookie === null ? true : staleCookie === "true";
 
     // Update UI if checkboxes exist
     const staleCheckbox = $("globalFilterStale");
@@ -1177,37 +1142,67 @@ export const User = (() => {
       return "";
     }
 
-    const waitingList = usernames
-      .map((username) => {
-        const action = nextAction[username];
-        const isViewingUser = viewingUser && username === viewingUser.login;
-        const isCurrentUser = currentUser && username === currentUser.login;
-
-        let displayName = username;
-        let className = "pr-waiting-on-user";
-
-        // If viewing someone else's dashboard, highlight their name
-        if (viewingUser && currentUser && viewingUser.login !== currentUser.login) {
-          if (isViewingUser) {
-            displayName = viewingUser.login;
-            // Use red for incoming PRs, green for outgoing
-            className = isIncomingPR ? "pr-waiting-on-you" : "pr-waiting-on-you-green";
-          }
-        } else {
-          // Normal behavior when viewing your own dashboard
-          if (isCurrentUser) {
-            displayName = "YOU";
-            className = "pr-waiting-on-you";
-          }
+    // Group actions by kind
+    const actionsByKind = {};
+    usernames.forEach((username) => {
+      const action = nextAction[username];
+      const kind = action.kind || "action";
+
+      if (!actionsByKind[kind]) {
+        actionsByKind[kind] = [];
+      }
+
+      const isViewingUser = viewingUser && username === viewingUser.login;
+      const isCurrentUser = currentUser && username === currentUser.login;
+
+      let displayName = username;
+      let className = "pr-action-user";
+
+      // Special handling for _system
+      if (username === "_system") {
+        // Skip adding _system to the user list, we'll just show the action name
+        return;
+      }
+
+      // If viewing someone else's dashboard, highlight their name
+      if (viewingUser && currentUser && viewingUser.login !== currentUser.login) {
+        if (isViewingUser) {
+          displayName = viewingUser.login;
+          className = "pr-action-you";
         }
+      } else {
+        // Normal behavior when viewing your own dashboard
+        if (isCurrentUser) {
+          displayName = "YOU";
+          className = "pr-action-you";
+        }
+      }
+
+      const title = action.reason || "Waiting for action";
+      actionsByKind[kind].push({
+        html: `<span class="${className}" title="${escapeHtml(title)}">${escapeHtml(displayName)}</span>`,
+        isYou: isCurrentUser || isViewingUser
+      });
+    });
 
-        const title = action.reason || "Waiting for action";
+    // Build the action groups string
+    const actionGroups = Object.entries(actionsByKind)
+      .map(([kind, users]) => {
+        // Format action kind (replace underscores with spaces)
+        const actionName = kind.replace(/_/g, " ");
+
+        if (users.length === 0) {
+          // _system action with no users
+          return actionName;
+        }
 
-        return `<span class="${className}" title="${escapeHtml(title)}">${escapeHtml(displayName)}</span>`;
+        // Join user names
+        const userList = users.map(u => u.html).join(", ");
+        return `${actionName}: ${userList}`;
       })
-      .join(", ");
+      .join("; ");
 
-    return ` <span class="pr-waiting-on"><span class="pr-waiting-on-label">(waiting on</span> ${waitingList}<span class="pr-waiting-on-label">)</span></span>`;
+    return ` <span class="pr-waiting-on">→ ${actionGroups}</span>`;
   };
 
   const createPRCard = (pr) => {
@@ -1341,7 +1336,10 @@ export const User = (() => {
       return;
     }
 
-    const hideStale = getCookie(`${section}FilterStale`) === "true";
+    // Default to true (hide stale PRs by default)
+    // Use workspace-specific cookie name
+    const staleCookie = getCookie(`globalFilterStale_${Workspace.currentWorkspace() || "personal"}`);
+    const hideStale = staleCookie === null ? true : staleCookie === "true";
     const shouldHide = hideStale && isStale(pr);
 
     if (shouldHide) {
diff --git a/assets/workspace.js b/assets/workspace.js
index 2b73222..319ab99 100644
--- a/assets/workspace.js
+++ b/assets/workspace.js
@@ -34,6 +34,8 @@ export const Workspace = (() => {
   };
 
   // Get hidden orgs for current workspace
+  // IMPORTANT: Hidden orgs list is per-workspace (each workspace has its own preferences)
+  // This allows different filtering preferences for personal vs each org workspace
   const hiddenOrgs = () => {
     const workspace = currentWorkspace() || "personal";
     const cookieName = `hidden_orgs_${workspace}`;
@@ -50,11 +52,18 @@ export const Workspace = (() => {
   };
 
   // Set hidden orgs for current workspace
+  // IMPORTANT: Each workspace maintains its own separate hidden orgs list
+  // Domain cookies allow preferences to persist across page loads, but each
+  // workspace (personal, org1, org2, etc.) has independent preferences
   const setHiddenOrgs = (orgs) => {
     const workspace = currentWorkspace() || "personal";
     const cookieName = `hidden_orgs_${workspace}`;
     const cookieValue = JSON.stringify(orgs);
 
+    console.log(`[Workspace.setHiddenOrgs] Workspace: ${workspace}`);
+    console.log(`[Workspace.setHiddenOrgs] Cookie name: ${cookieName}`);
+    console.log(`[Workspace.setHiddenOrgs] Cookie value: ${cookieValue}`);
+
     // Cookie size limit check (4KB is typical browser limit)
     // Allow some overhead for cookie name and attributes
     const maxCookieSize = 3800; // Conservative limit
@@ -69,26 +78,38 @@ export const Workspace = (() => {
       return;
     }
 
-    // Set cookie with path scope for 1 year
+    // Set cookie with domain scope for 1 year (works across all subdomains)
     const expires = new Date();
     expires.setTime(expires.getTime() + 365 * 24 * 60 * 60 * 1000);
-    document.cookie = `${cookieName}=${cookieValue};expires=${expires.toUTCString()};path=/;SameSite=Lax`;
+    const isSecure = window.location.protocol === "https:";
+    const securePart = isSecure ? ";Secure" : "";
+    const cookieString = `${cookieName}=${cookieValue};expires=${expires.toUTCString()};path=/;domain=.${BASE_DOMAIN};SameSite=Lax${securePart}`;
+    console.log(`[Workspace.setHiddenOrgs] Setting cookie: ${cookieString}`);
+    document.cookie = cookieString;
+    console.log(`[Workspace.setHiddenOrgs] document.cookie after set:`, document.cookie);
   };
 
   // Toggle org visibility
   const toggleOrgVisibility = (org) => {
+    console.log(`[Workspace.toggleOrgVisibility] Toggling: ${org}`);
     const hidden = hiddenOrgs();
+    console.log(`[Workspace.toggleOrgVisibility] Current hidden orgs:`, hidden);
     const index = hidden.indexOf(org);
+    console.log(`[Workspace.toggleOrgVisibility] Index of ${org}:`, index);
 
     if (index === -1) {
       // Hide the org
+      console.log(`[Workspace.toggleOrgVisibility] Adding ${org} to hidden list`);
       hidden.push(org);
     } else {
       // Show the org
+      console.log(`[Workspace.toggleOrgVisibility] Removing ${org} from hidden list`);
       hidden.splice(index, 1);
     }
 
+    console.log(`[Workspace.toggleOrgVisibility] New hidden list:`, hidden);
     setHiddenOrgs(hidden);
+    console.log(`[Workspace.toggleOrgVisibility] After setHiddenOrgs, reading back:`, hiddenOrgs());
     return hidden;
   };
 
@@ -97,6 +118,27 @@ export const Workspace = (() => {
     return hiddenOrgs().includes(org);
   };
 
+  // Initialize default hidden orgs for org-based workspaces
+  // In org workspaces, hide personal account PRs by default, show all orgs
+  const initializeDefaults = () => {
+    const workspace = currentWorkspace();
+    const username = getCookie("username");
+
+    // Only initialize defaults for org workspaces (not personal workspace)
+    if (!workspace || !username) return;
+
+    const cookieName = `hidden_orgs_${workspace}`;
+    const existingCookie = getCookie(cookieName);
+
+    // Only set defaults if no preference exists yet
+    if (existingCookie === null) {
+      console.log(`[Workspace] Initializing defaults for org workspace: ${workspace}`);
+      console.log(`[Workspace] Hiding personal account: ${username}`);
+      // Hide the user's personal GitHub account by default
+      setHiddenOrgs([username]);
+    }
+  };
+
   // Switch workspace (redirect to different subdomain, preserving current path)
   const switchWorkspace = (org) => {
     const protocol = window.location.protocol;
@@ -143,6 +185,7 @@ export const Workspace = (() => {
     isOrgHidden,
     switchWorkspace,
     username,
+    initializeDefaults,
   };
   console.log("[Workspace Module] Exports:", workspaceExports);
   return workspaceExports;
diff --git a/assets/workspace.test.js b/assets/workspace.test.js
new file mode 100644
index 0000000..1b44cdd
--- /dev/null
+++ b/assets/workspace.test.js
@@ -0,0 +1,471 @@
+// Workspace module tests
+// Run with: node --test assets/workspace.test.js
+
+import { describe, it, before, beforeEach, afterEach } from "node:test";
+import assert from "node:assert";
+
+// Mock DOM environment
+class MockDocument {
+  constructor() {
+    this.cookieStore = {};
+  }
+
+  get cookie() {
+    return Object.entries(this.cookieStore)
+      .map(([name, value]) => `${name}=${value}`)
+      .join("; ");
+  }
+
+  set cookie(cookieString) {
+    const match = cookieString.match(/^([^=]+)=([^;]*)/);
+    if (match) {
+      const [, name, value] = match;
+      this.cookieStore[name] = value;
+    }
+  }
+
+  clearCookies() {
+    this.cookieStore = {};
+  }
+}
+
+class MockWindow {
+  constructor(hostname) {
+    this.location = {
+      hostname,
+      protocol: "https:",
+    };
+  }
+}
+
+// Setup global mocks
+let mockDocument;
+let mockWindow;
+
+function setupMocks(hostname = "ready-to-review.dev") {
+  mockDocument = new MockDocument();
+  mockWindow = new MockWindow(hostname);
+  global.document = mockDocument;
+  global.window = mockWindow;
+}
+
+function cleanupMocks() {
+  delete global.document;
+  delete global.window;
+}
+
+// Create workspace module factory for testing
+function createWorkspaceModule() {
+  const BASE_DOMAIN = "ready-to-review.dev";
+
+  const currentWorkspace = () => {
+    const hostname = window.location.hostname;
+
+    if (
+      hostname === "localhost" ||
+      hostname === "127.0.0.1" ||
+      hostname.startsWith("localhost:") ||
+      hostname.startsWith("127.0.0.1:")
+    ) {
+      return null;
+    }
+
+    const parts = hostname.split(".");
+
+    if (parts.length >= 3) {
+      const subdomain = parts[0];
+      if (["www", "dash", "api", "login", "auth-callback"].includes(subdomain)) {
+        return null;
+      }
+      return subdomain;
+    }
+
+    return null;
+  };
+
+  function getCookie(name) {
+    const nameEQ = `${name}=`;
+    const ca = document.cookie.split(";");
+    for (let i = 0; i < ca.length; i++) {
+      let c = ca[i];
+      while (c.charAt(0) === " ") c = c.substring(1, c.length);
+      if (c.indexOf(nameEQ) === 0) return c.substring(nameEQ.length, c.length);
+    }
+    return null;
+  }
+
+  const hiddenOrgs = () => {
+    const workspace = currentWorkspace() || "personal";
+    const cookieName = `hidden_orgs_${workspace}`;
+    const cookieValue = getCookie(cookieName);
+
+    if (!cookieValue) return [];
+
+    try {
+      return JSON.parse(cookieValue);
+    } catch (e) {
+      console.error("[Workspace] Failed to parse hidden_orgs cookie:", e);
+      return [];
+    }
+  };
+
+  const setHiddenOrgs = (orgs) => {
+    const workspace = currentWorkspace() || "personal";
+    const cookieName = `hidden_orgs_${workspace}`;
+    const cookieValue = JSON.stringify(orgs);
+
+    const maxCookieSize = 3800;
+    if (cookieValue.length > maxCookieSize) {
+      console.error(
+        "[Workspace] Hidden orgs list exceeds cookie size limit:",
+        cookieValue.length,
+        "bytes"
+      );
+      return;
+    }
+
+    const expires = new Date();
+    expires.setTime(expires.getTime() + 365 * 24 * 60 * 60 * 1000);
+    const isSecure = window.location.protocol === "https:";
+    const securePart = isSecure ? ";Secure" : "";
+    document.cookie = `${cookieName}=${cookieValue};expires=${expires.toUTCString()};path=/;domain=.${BASE_DOMAIN};SameSite=Lax${securePart}`;
+  };
+
+  const toggleOrgVisibility = (org) => {
+    const hidden = hiddenOrgs();
+    const index = hidden.indexOf(org);
+
+    if (index === -1) {
+      hidden.push(org);
+    } else {
+      hidden.splice(index, 1);
+    }
+
+    setHiddenOrgs(hidden);
+    return hidden;
+  };
+
+  const isOrgHidden = (org) => {
+    return hiddenOrgs().includes(org);
+  };
+
+  const initializeDefaults = () => {
+    const workspace = currentWorkspace();
+    const username = getCookie("username");
+
+    if (!workspace || !username) return;
+
+    const cookieName = `hidden_orgs_${workspace}`;
+    const existingCookie = getCookie(cookieName);
+
+    if (existingCookie === null) {
+      console.log(`[Workspace] Initializing defaults for org workspace: ${workspace}`);
+      console.log(`[Workspace] Hiding personal account: ${username}`);
+      setHiddenOrgs([username]);
+    }
+  };
+
+  return {
+    currentWorkspace,
+    hiddenOrgs,
+    setHiddenOrgs,
+    toggleOrgVisibility,
+    isOrgHidden,
+    initializeDefaults,
+  };
+}
+
+// Tests
+describe("Workspace Module", () => {
+  let Workspace;
+
+  beforeEach(() => {
+    setupMocks();
+    Workspace = createWorkspaceModule();
+  });
+
+  afterEach(() => {
+    cleanupMocks();
+  });
+
+  describe("currentWorkspace()", () => {
+    it("should return null for base domain", () => {
+      setupMocks("ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      assert.strictEqual(Workspace.currentWorkspace(), null);
+    });
+
+    it("should return null for www subdomain", () => {
+      setupMocks("www.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      assert.strictEqual(Workspace.currentWorkspace(), null);
+    });
+
+    it("should return org name for org subdomain", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      assert.strictEqual(Workspace.currentWorkspace(), "myorg");
+    });
+
+    it("should return null for localhost", () => {
+      setupMocks("localhost");
+      Workspace = createWorkspaceModule();
+      assert.strictEqual(Workspace.currentWorkspace(), null);
+    });
+  });
+
+  describe("hiddenOrgs()", () => {
+    it("should return empty array when no cookie exists", () => {
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), []);
+    });
+
+    it("should return orgs from cookie for personal workspace", () => {
+      setupMocks("ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      document.cookie = 'hidden_orgs_personal=["testuser","testorg"]';
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser", "testorg"]);
+    });
+
+    it("should return orgs from cookie for org workspace", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      document.cookie = 'hidden_orgs_myorg=["testuser"]';
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser"]);
+    });
+  });
+
+  describe("setHiddenOrgs()", () => {
+    it("should set cookie for personal workspace", () => {
+      setupMocks("ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      Workspace.setHiddenOrgs(["testuser"]);
+      assert.ok(document.cookie.includes("hidden_orgs_personal"));
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser"]);
+    });
+
+    it("should set cookie for org workspace", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      Workspace.setHiddenOrgs(["testuser", "anotherorg"]);
+      assert.ok(document.cookie.includes("hidden_orgs_myorg"));
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser", "anotherorg"]);
+    });
+
+    it("should handle empty array", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      Workspace.setHiddenOrgs([]);
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), []);
+    });
+  });
+
+  describe("toggleOrgVisibility()", () => {
+    it("should add org to hidden list when not present", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      const result = Workspace.toggleOrgVisibility("testuser");
+      assert.deepStrictEqual(result, ["testuser"]);
+      assert.ok(Workspace.isOrgHidden("testuser"));
+    });
+
+    it("should remove org from hidden list when present", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      Workspace.setHiddenOrgs(["testuser", "anotherorg"]);
+      const result = Workspace.toggleOrgVisibility("testuser");
+      assert.deepStrictEqual(result, ["anotherorg"]);
+      assert.ok(!Workspace.isOrgHidden("testuser"));
+    });
+
+    it("should toggle multiple times correctly", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+
+      Workspace.toggleOrgVisibility("testuser");
+      assert.ok(Workspace.isOrgHidden("testuser"));
+
+      Workspace.toggleOrgVisibility("testuser");
+      assert.ok(!Workspace.isOrgHidden("testuser"));
+
+      Workspace.toggleOrgVisibility("testuser");
+      assert.ok(Workspace.isOrgHidden("testuser"));
+    });
+  });
+
+  describe("initializeDefaults()", () => {
+    it("should hide personal account in org workspace on first visit", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      document.cookie = "username=testuser";
+
+      Workspace.initializeDefaults();
+
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser"]);
+      assert.ok(Workspace.isOrgHidden("testuser"));
+    });
+
+    it("should not set defaults if cookie already exists", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      document.cookie = "username=testuser";
+      document.cookie = 'hidden_orgs_myorg=["someorg"]';
+
+      Workspace.initializeDefaults();
+
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["someorg"]);
+    });
+
+    it("should not set defaults in personal workspace", () => {
+      setupMocks("ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      document.cookie = "username=testuser";
+
+      Workspace.initializeDefaults();
+
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), []);
+    });
+
+    it("should not set defaults if username cookie missing", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+
+      Workspace.initializeDefaults();
+
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), []);
+    });
+
+    it("should handle different org workspaces independently", () => {
+      // All workspaces share the same cookie store (domain cookies)
+      // but use different cookie names
+      const sharedCookieStore = new MockDocument();
+
+      // Setup org1 workspace
+      setupMocks("org1.ready-to-review.dev");
+      global.document = sharedCookieStore; // Use shared cookie store
+      Workspace = createWorkspaceModule();
+      sharedCookieStore.cookie = "username=testuser";
+      Workspace.initializeDefaults();
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser"]);
+      assert.ok(sharedCookieStore.cookie.includes("hidden_orgs_org1"));
+
+      // Setup org2 workspace - uses same cookie store
+      mockWindow = new MockWindow("org2.ready-to-review.dev");
+      global.window = mockWindow;
+      Workspace = createWorkspaceModule();
+      Workspace.initializeDefaults();
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser"]);
+      assert.ok(sharedCookieStore.cookie.includes("hidden_orgs_org2"));
+
+      // Verify org1 still has its settings
+      mockWindow = new MockWindow("org1.ready-to-review.dev");
+      global.window = mockWindow;
+      Workspace = createWorkspaceModule();
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser"]);
+
+      // Toggle in org1 shouldn't affect org2
+      Workspace.toggleOrgVisibility("testuser");
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), []);
+
+      // Switch to org2 - should still have testuser hidden
+      mockWindow = new MockWindow("org2.ready-to-review.dev");
+      global.window = mockWindow;
+      Workspace = createWorkspaceModule();
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser"]);
+    });
+  });
+
+  describe("Integration: Full workflow", () => {
+    it("should allow user to override defaults by toggling", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      document.cookie = "username=testuser";
+
+      // Initialize defaults - personal account hidden
+      Workspace.initializeDefaults();
+      assert.ok(Workspace.isOrgHidden("testuser"));
+
+      // User toggles to show personal account
+      Workspace.toggleOrgVisibility("testuser");
+      assert.ok(!Workspace.isOrgHidden("testuser"));
+
+      // User hides an org
+      Workspace.toggleOrgVisibility("someorg");
+      assert.ok(Workspace.isOrgHidden("someorg"));
+      assert.ok(!Workspace.isOrgHidden("testuser"));
+    });
+
+    it("should maintain preferences across reloads", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+      document.cookie = "username=testuser";
+
+      // First visit - defaults applied
+      Workspace.initializeDefaults();
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["testuser"]);
+
+      // User makes changes
+      Workspace.toggleOrgVisibility("testuser"); // Show personal
+      Workspace.toggleOrgVisibility("anotherorg"); // Hide org
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["anotherorg"]);
+
+      // Simulate reload - reinitialize workspace module
+      const WorkspaceReloaded = createWorkspaceModule();
+
+      // Defaults should NOT override existing preferences
+      WorkspaceReloaded.initializeDefaults();
+      assert.deepStrictEqual(WorkspaceReloaded.hiddenOrgs(), ["anotherorg"]);
+    });
+
+    it("should handle repeated toggles correctly (idempotency test)", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+
+      // Start with some orgs hidden
+      Workspace.setHiddenOrgs(["org1", "org2", "org3"]);
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["org1", "org2", "org3"]);
+
+      // Toggle org2 off (show it)
+      Workspace.toggleOrgVisibility("org2");
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["org1", "org3"]);
+      assert.ok(!Workspace.isOrgHidden("org2"));
+
+      // Toggle org2 on again (hide it)
+      Workspace.toggleOrgVisibility("org2");
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["org1", "org3", "org2"]);
+      assert.ok(Workspace.isOrgHidden("org2"));
+
+      // Toggle org2 off again
+      Workspace.toggleOrgVisibility("org2");
+      assert.deepStrictEqual(Workspace.hiddenOrgs(), ["org1", "org3"]);
+      assert.ok(!Workspace.isOrgHidden("org2"));
+
+      // Verify other orgs unchanged
+      assert.ok(Workspace.isOrgHidden("org1"));
+      assert.ok(Workspace.isOrgHidden("org3"));
+    });
+
+    it("should not duplicate orgs when toggled multiple times rapidly", () => {
+      setupMocks("myorg.ready-to-review.dev");
+      Workspace = createWorkspaceModule();
+
+      // Simulate rapid clicking - toggle same org many times
+      for (let i = 0; i < 10; i++) {
+        Workspace.toggleOrgVisibility("testorg");
+      }
+
+      // After 10 toggles (even number), should be back to visible (not hidden)
+      assert.ok(!Workspace.isOrgHidden("testorg"));
+      // And should only appear once in hidden list (or not at all)
+      const hidden = Workspace.hiddenOrgs();
+      const count = hidden.filter((org) => org === "testorg").length;
+      assert.strictEqual(count, 0, "testorg should not be in hidden list");
+
+      // Toggle once more (odd number total = 11)
+      Workspace.toggleOrgVisibility("testorg");
+      assert.ok(Workspace.isOrgHidden("testorg"));
+      const hiddenAgain = Workspace.hiddenOrgs();
+      const countAgain = hiddenAgain.filter((org) => org === "testorg").length;
+      assert.strictEqual(countAgain, 1, "testorg should appear exactly once in hidden list");
+    });
+  });
+});