77 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	63abff8681	DRY pass #2, batch 8: the Rust and ffi docs (#5372) ... sync/mod.rs listed 5 of its 9 modules; migrate's doc sat above the v9 SQL; client.rs had items after its test module; the ffi's sync_now doc had fused into client_update's; complete_reminder (ffi and EditorAction) still said recurrence advancement was to come, though the core does it; NoteQuery.view listed views the core never matched and claimed it validated. Test scratch dirs drop the old ts-/iw- prefixes. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 15:05:43 -04:00
bvandeusenandClaude Opus 5.5	1c4bf56058	A lone link's preview is looked up where the server filed it ... The server unfurls what detect_urls finds, trailing .,;:!? trimmed, and files the preview under that. The web and Android cards looked a lone link's preview up under body.trim(), punctuation included, so a note reading "https://example.com/a." never showed its card. - grammar.json gains a urls section: what the server finds in a body, and the link a lone-link note is filed under. - The web's rule moves out of NoteCard into notes/links.ts loneUrl(); Android's LinkPreviewRow gets the same loneUrl(); both trim like the server. - The server and web suites run the cases; Android's JVM test pins them by hand, as it does the tint. Fixes #5399. DRY pass #2, batch 3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:30:32 -04:00
bvandeusenandClaude Opus 5.5	4285026cfe	The repeat rules are pinned by the shared fixture ... daily/weekly/monthly/yearly was written out in the server (REMINDER_RECURRENCES), the core (recur::RECURRENCES), the web editor's <option>s and Android's picker, with nothing holding them together. grammar.json now has a recurrences list; the server, core and web suites each check theirs against it, and the web's options come from notes/recurrence.ts rather than the template. Android's picker pins the list by hand with its localised labels, as it does the tint: its JVM tests do not read the fixture. DRY pass #2, batch 3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:28:22 -04:00
bvandeusenandClaude Opus 5.5	db9e9a2dfb	A note's name is one rule, pinned by the shared fixture ... The server and the core each derived display_title and disagreed twice: the server cut it at 200 characters and the core didn't, and the server split lines with splitlines(), which also breaks on a lone \r or a U+2028, where the core and every other reading of the grammar split on \n alone. - grammar.json gains a display_titles section: blank lines, markers, an empty item, \r\n, a lone \r, U+2028, and a 201-character line of 'é' (the cut is characters, not bytes). - derive::display_title and DISPLAY_TITLE_CAP are the core's half, moved next to strip_marker. The server splits on "\n". Both suites run the cases. Behaviour: a device now names a note with a first line over 200 characters the way the web always has, and the server names a note containing a lone \r or a U+2028 the way devices always have. Fixes #5398. DRY pass #2, batch 3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:27:32 -04:00
bvandeusenandClaude Opus 5.5	2809c26214	Sync tests build a server note from wire::sample_note ... pull's note() and push's server_note each wrote out all nineteen fields of a wire::Note. wire::sample_note(id, revision) is that note; push's version changes only the body and attachments, by struct update. DRY pass #2, batch 2, F9 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:25:14 -04:00
bvandeusenandClaude Opus 5.5	2dec89bf8c	Core tests make a throwaway blob store with blobs::scratch ... blobs, store and portable each built a BlobStore in a temp directory their own way: pid+tag twice, a uuid once. blobs::scratch(tag) is that, with a counter, so two tests can never share a directory even if they pick the same tag. The desktop's and ffi's temp-dir helpers stay, one per crate: sharing them would need a test-util feature on the core crate. DRY pass #2, batch 2, F9 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:24:52 -04:00
bvandeusenandClaude Opus 5.5	3ea7c817bf	Core tests open their store through local::memory_conn ... Seven test modules each built a migrated in-memory store by hand: open, migrate, and (in sharing) wrap it in a Db. local::memory_conn() is that, and open_in_memory uses it too. Each module's db() is now one line, and the schema, Connection and Mutex imports it needed are gone. DRY pass #2, batch 2, F9 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:24:04 -04:00
bvandeusenandClaude Opus 5.5	c35e7fd589	cargo fmt: three chains rustfmt splits ... Formatting only. portable::instant (from F5), and the ffi's link and unlink (F2/F3), were laid out by hand without a toolchain; rustfmt splits each chain. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:23:57 -04:00
bvandeusenandClaude Opus 5.5	ee771e3734	Every lock of the store goes through Db::conn ... Db::conn is documented as the one way to take the lock, yet five production and test sites reached past it with db.0.lock(): the startup summary, the desktop's trash sweep and config_get, and tests in sharing and update. All five now call conn(). DRY pass #2, batch 2, F8 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:23:07 -04:00
bvandeusenandClaude Opus 5.5	63dd206b91	Access and entity words are core constants: access::*, entity::* ... "owner"/"edit"/"view" and the entity names "note"/"label"/"attachment"/"preview" were literals at about thirty sites across store, pull and push, including match arms whose spelling had to agree with the rows a different module wrote. models::access and models::entity now name them, and push names its two ops. SQL text keeps its literals; Rust-side comparisons and writes read the constants. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:22:49 -04:00
bvandeusenandClaude Opus 5.5	8aa854d60b	The store's migrations are a table of steps, applied in order ... schema::migrate was thirteen hand-copied blocks of "if version < N, apply, stamp N". The versions are now a STEPS list (SQL, or code for v8). migrate walks the list, applies each step a store hasn't had and stamps it. A new version is a new entry at the end; there is no block to copy. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:21:47 -04:00
bvandeusenandClaude Opus 5.5	61658946d7	Which reminders are this device's is one predicate: OWN_REMINDERS ... reminders and due_reminders each wrote out "owner's, not trashed, has a time". The predicate is now one constant both queries read, carrying the reason a shared note's reminder is not ours. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:21:05 -04:00
bvandeusenandClaude Opus 5.5	dc9cf85cdc	rename_label writes its rename once, merge or not ... The rename UPDATE appeared twice: once for a merge's survivor and once for a plain rename. The branch now picks which row is renamed, and one UPDATE follows. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:20:45 -04:00
bvandeusenandClaude Opus 5.5	695efb3112	The store reads a note's body through note_body everywhere ... should_snapshot and snapshot_revision each wrote out the SELECT that note_body already is. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:20:36 -04:00
bvandeusenandClaude Opus 5.5	54b1e13750	"Pending" has one definition: has_pending reads pending_fingerprint ... has_pending listed the same four predicates as pending_fingerprint (dirty notes, dirty labels, pending deletes, unsent uploads) in a second query. It is now pending_fingerprint(..)?.is_some(). Counting where LIMIT 1 would do costs nothing on a local store. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:20:16 -04:00
bvandeusenandClaude Opus 5.5	fe84924f78	The opaque content type is one core constant: local::OPAQUE_MIME ... "application/octet-stream" was written out in the blob server, its test, the store's normalize_mime and the wire default. All four now read OPAQUE_MIME; the schema's SQL column default names the same string and says so. DRY pass #2, batch 2, F7 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:20:01 -04:00
bvandeusenandClaude Opus 5.5	4ac15d3557	Every call to the server fails the same way through client::send ... Seven calls each spelled out send, describe the transport error, map a 401, and refuse anything else as unexpected_status; two read the server's {"error"} words the same way. send_raw (transport + a 401 whose meaning the caller names), send (and anything but success is unexpected) and server_reason now hold those steps. Each call keeps only what is its own: device_login's and fetch_identity's 401 wording, the release's 404 = none, sharing's 404 and refusal reason, upload's retry split. DRY pass #2, batch 2, F6 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:19:38 -04:00
bvandeusenandClaude Opus 5.5	0101b05487	Stored timestamps have one writer: local::iso and local::now ... The store's time format (RFC 3339, UTC, milliseconds, Z) is what makes lexical order chronological. It was spelled out ten times as to_rfc3339_opts(SecondsFormat::Millis, true), with two private now() copies (store, pull). local::iso(t) and local::now() now hold it; store, pull, engine and portable call them. DRY pass #2, batch 2, F5 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:18:33 -04:00
bvandeusenandClaude Opus 5.5	ef839ba0cd	The store's layout names live in the core: local::DB_FILE, BLOBS_DIR ... "inkwell.db" and "blobs" were spelled out in the ffi and the desktop (whose copy of DB_FILE sat in the crossover shim). The layout is the core's, the same on every client, so the names are now core constants and both clients read them. DRY pass #2, batch 1, F4 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:17:26 -04:00
bvandeusenandClaude Opus 5.5	1f2ddd70d3	Unlinking a device is one flow in the core: link::unlink ... The desktop's sync_unlink and the ffi's unlink were both written out in full: try the revoke, clear the link either way, and log the outcome. link::unlink(db, held) now does that. Each client reads its link with state::credentials (with its seal) before the await and passes it in. DRY pass #2, batch 1, F3 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:16:59 -04:00
bvandeusenandClaude Opus 5.5	91c47245ab	Linking a device is one flow in the core: sync::link ... The desktop's sync_link and the ffi's link_with_password/link_with_token were the same steps written out twice: probe, refuse an incompatible server before any credential is sent, log in or verify a pasted token, keep the link, and adopt the server's trash retention. link::authenticate(url, Credential) does the network half and link::store(conn, ..., seal) keeps it, sealed when the client has a seal. Each client now only reads its input and picks its seal. The desktop checks for a missing email/password before probing rather than after. Same error, sooner. DRY pass #2, batch 1, F2 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:16:53 -04:00
bvandeusenandClaude Opus 5.5	70274347af	One read of a device's link: state::credentials, with the client's seal ... Five places read the server address and token straight from sync_state: sharing, autosync, sync_unlink, update's download token, and the ffi. Reading it raw is how Android came to send its sealed token to the share routes (#5381). state::credentials(conn, seal) now holds that read. With a seal it opens the token (open_token), and without one (the desktop keeps it plain) it returns it as stored. Every site calls it. DRY pass #2, batch 1, F1 (#5372). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:14:18 -04:00
bvandeusenandClaude Opus 5.5	1173c1cf12	A device's snooze is clamped to the server's range, 1 minute to 30 days ... The server clamped; the core took any i64, so 0 or less set a reminder in the past and a huge value overflowed Duration::minutes. Every caller passes 60 or 1440 today, so this was latent. Both sides now name the range, SNOOZE_MAX_MINUTES, and point at each other. Fixes #5386. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:11:53 -04:00
bvandeusenandClaude Opus 5.5	be4897276c	Android sharing sends the opened device token, not the sealed one ... Android has stored its device token sealed ("sealed:…") since 8592b83, and core's sharing calls read the token from the store themselves. The ffi opened it in credentials() and then threw the result away, so every Share-sheet request went out as `Bearer sealed:…` and the server refused it. The sharing functions now take the server address and token from the caller. The ffi passes what credentials() opened; the desktop, which stores its token plain, reads it through sharing::stored_link. A new ffi test serves one request on a loopback port and checks the bearer token that arrives (#5381). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 14:05:10 -04:00
bvandeusenandClaude Opus 5.5	8592b83538	android: the device token is stored sealed under a Keystore key ... Family idea #5105, practice 12, as the operator chose on 2026-10-08: the token is encrypted, and Android backup stays on. The core: - Adds a TokenSeal trait in sync/state.rs, with set_sealed_link and open_token. - A sealed token is stored as "sealed:<value>". - A plain token, stored before this change or while sealing failed, is sealed in place on its next read. - A sealed token that won't open is dropped, and the server address and cursor are kept, so the app reads as unlinked and asks to sign in again. That is what happens after Android restores the app onto another phone. - The desktop passes no seal and keeps storing the token as before. The FFI: - Exports TokenSeal as a uniffi foreign trait (seal_token / open_token, null rather than an exception). - Requires it in Inkwell's constructor, so there is no moment a token could be stored unsealed. - Routes credentials(), unlink() and store_link() through it. Kotlin: - KeystoreTokenSeal is AES-GCM under an Android Keystore key, using the SealedBox framing from Minstrel's KeystoreSessionVault (Scribe snippet #5025), with no new dependency. - SealedBoxTest checks the framing on the JVM. allowBackup stays true, and the manifest says why. An unlinked phone's notes exist only on the phone, and the backup is their one other copy. The backup carries a token nothing can open. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 10:23:22 -04:00
bvandeusenandClaude Opus 5.5	1dd6fc1e20	Apps refuse to send their token over plain http:// to a public address ... Family idea #5105, practice 13, as the operator chose on 2026-10-08. The check lives in the shared core, so the desktop and Android both get it. compat::cleartext_allowed decides from the address text alone, with no DNS lookup. It allows https:// always. It allows http:// to private, loopback, link-local and CGNAT IPs (CGNAT covers Tailscale), to fc00::/7, fe80::/10 and ::1, to single-label names, and to LAN suffixes (.local, .lan, .home.arpa, .ts.net and others). The refusal runs in two places: - probe, so linking stops before a password or token is sent; - the top of run_cycle, so a device linked before this change stops syncing with a message telling it to re-link, instead of sending its token on every cycle. The server is unchanged and never forces HTTPS (rule 94). Plain http:// on a LAN links and syncs as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 10:14:14 -04:00
bvandeusenandClaude Opus 5.5	87725ecab7	android: search narrows the board in view, and combines with its filters ... As on the web, the search box is now one more facet on the board you are looking at, rather than a separate unfiltered search. "These words, in notes tagged grocery" works: on the main board the text is sent to the core together with the Filters sheet's tags, attachment and shared switches, and the core ANDs them in list_notes. Archive, Trash and a tag's view take the text alone. A search typed on Reminders, which is not a board view, moves to the main board, as the web does. The Filters chip stays while you search; it was hidden before, on the mistaken claim that the web hides its filters too. Drag-to-reorder stays off during a search, since a filtered subset can't be renumbered against notes it can't see. store::search and the FFI's search_notes had no other callers, and are removed. They also searched archived notes and ignored pinning, which the board's query does not. Scribe #2942. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-08 08:19:50 -04:00
bvandeusenandClaude Opus 5.5	c614e6859a	Revert the deliberately failing core test ... It proved the APK gate (#5237): run 8667 failed at the core's tests, skipped the APK job and still dispatched the server image. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:46:39 -04:00
bvandeusenandClaude Opus 5.5	a682d6d225	core: a deliberately failing test, to prove the APK gate (reverted next) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 22:35:06 -04:00
bvandeusenandClaude Opus 5.5	b019172d47	all: remove saved views, the Has-reminder filter and the Created range ... Step 18 of the audit follow-through (#5180), on the operator's decisions. Inkwell is for capture and recall (note 2897), and these three duplicated a surface that does the job already: - Saved views. They lived only on the web; the desktop kept its own set that never synced, and Android had none. Tags in the drawer already give one-click recall. Gone from the server (routes, model, migration 0038 drops the table), the core (store functions, schema v13 drops its table), the desktop commands, the web adapters, the drawer's Views list and the "Save view" link. - The "Has reminder" facet. The Reminders page lists them, sorted by due. - The FilterBar's "Created" range. Timeline is the date lens and keeps the created_after/created_before query it builds from local days, which also retires the UTC/local-day disagreement between the two (B3). An old link that still carries the removed keys opens the plain board; a web test pins that. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 21:29:28 -04:00
bvandeusenandClaude Opus 5.5	888c6410f0	all: trim the history essays out of the longest comments ... From the audit (#5179). Ten comment blocks narrated how the code got here: milestone numbers, earlier values, the operator's verdict on an old design. Each now says what the code does and why, and the history stays in git, Scribe and docs/sync.md. The protocol-version comment in sync.py points at docs/sync.md's policy section, which already lists every bump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 20:03:44 -04:00
bvandeusenandClaude Opus 5.5	05c82c2362	core, desktop: Db::conn everywhere, Change::default, notes_where, and shared row mappings ... From the audit (#5179, core and desktop half). - Every `db.0.lock().map_err(|e| e.to_string())?` (about 50 sites in core and the desktop) is now `db.conn()?`. The few sites that deliberately handle a poisoned lock differently, and the tests, keep their own spelling. - push::Change derives Default, so its four constructors name only the fields they set. - store: list_notes, reminders, titles and search share notes_where (ids from a query, each loaded through load_note). Labels share LABEL_SELECT/label_row, and saved filters share SAVED_FILTER_SELECT/saved_filter_row. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 19:57:24 -04:00
bvandeusenandClaude Opus 5.5	7eacd0569c	all: delete the code nothing calls ... From the audit (#5178). Each was unreachable from every client: - Checklist add-item and delete-item: REST POST /items and DELETE /items/<id>, the Tauri commands, the store, rest and local adapters, the core's add_item/delete_item, set_item_text and remove_item, and the FFI exports. Adding, rewording and removing an item are body edits in every editor. The checked toggle stays, and its rewriter is simpler without the drop branch. - Manual unfurl: POST /unfurl and its adapters. Previews arrive in the background after a save (unfurl_queue). - The /api/config `android_client` key, android_release() and the APK_NAME/MANIFEST_NAME aliases. Phones poll /api/client/android. - users.email_verified and users.avatar_path (migration 0037). Nothing set the first or read the second; the SMTP reset never checked verification. - derive::extract_tags (only tests used it; the shared fixture now runs through extract_tag_spans), the unused check and link icons, and the unused editor_add_item string. - The blob scheme is renamed tsblob -> inkblob. URLs are built as notes are read, so nothing stored carries the old one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 19:00:44 -04:00
bvandeusenandClaude Opus 5.5	442cca4398	web, core, desktop: share a note with a group, and Settings → Groups ... The Share dialog lists people and groups in one picker and shows a group share as its name and member count. Settings gains a Groups section for the admin: create, rename, delete, and add or remove people. The core client reads the directory's groups and group shares (ShareTarget: a member or a group); the desktop command takes user_id or group_id. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 18:25:16 -04:00
bvandeusenandClaude Opus 5.5	2e2714a50b	core: clippy — a one-element slice from a reference in the store test ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 17:18:53 -04:00
bvandeusenandClaude Opus 5.5	89cd1c76bb	core, web: pin, archive and reorder a note someone shared with you ... Schema v12 adds notes.state_at: a recipient's own pin, archive and order are stamped there instead of on updated_at, which stays the text's time. Push sends them only to a server advertising `shared_state` (push::Accepts), a view share included; the first pull at that level starts the feed over once so held copies drop their owner's pins. The client speaks protocol 7 and lists `shares` and `shared_state` among the features a server may lack. The web card and editor offer pin, archive and drag on shared notes; share and trash stay the owner's, and the board's trash key skips notes you don't own. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 17:13:58 -04:00
bvandeusenandClaude Opus 5.5	2e7db21b21	android: share a note, and read or edit one shared with you ... The editor's menu has Share…, which opens a sheet of who the note is shared with and lets you add someone at view or edit, change it, or stop sharing; unlinked, it says sharing needs a server. A note shared to view opens read-only; at edit only its text can change. Cards say who shared a note ("From Robin") or that yours is shared, and a view-only note's boxes don't tick. Also: two core store tests used unwrap_err on a Result<Note>, which needs Note: Debug; they use err().expect() now. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:42:30 -04:00
bvandeusenandClaude Opus 5.5	aa36b43dc3	core: shared notes on the desktop and phone, and Share from the desktop ... The core pulls with shares from a server offering them (protocol 6): a note says how it is held (owner, edit, view) and who shared it, and a revoked note leaves the device. The first such pull starts the feed over once, so notes shared before this build arrive. The store refuses what a share doesn't allow (view: everything; edit: anything but the text), push sends only the text of someone else's note, and their notes stay out of trash, reminders and reordering. Unlinking drops them. The Share dialog's calls go to the linked server over the device token, as Tauri commands and through the FFI. The desktop now offers Share and "Shared with me"; unlinked, the dialog says sharing needs a server. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:33:16 -04:00
bvandeusenandClaude Opus 5.5	df85535ea2	desktop: reminders reach you when the window isn't in front ... A Rust worker reads due reminders from the local store every 15 s and announces each occurrence once: always to the main window as a toast, and as a system notification (tauri-plugin-notification) when that window isn't focused. The page no longer polls on the desktop; its Notification went nowhere in WebKitGTK and its timer stopped with the window. The Reminders page says what each surface actually does. Core gains store::due_reminders, compared by instant, not by string. Refs #5171 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 12:46:02 -04:00
bvandeusenandClaude Opus 5.5	5989ffc1c6	desktop: Import and Export work offline; the menu toggle is reachable; errors say why ... Export and Import were a link to the server and a reject("needs a server") on the desktop. Both now run in the core with no server: - core/src/local/portable.rs builds the same zip the server writes (notes.json, a Markdown file per note, each attachment this device holds) and reads either export marker or a Google Keep Takeout zip, with the server's decompression budget and an all-or-nothing transaction. Export saves to Downloads (no new plugin) and the sidebar says where; Import takes the archive as raw IPC bytes. - core/testdata/portable.json pins the format for both copies: the server runs its Keep and native readers against it (test_portable_fixture.py) and checks its real export's keys (test_integration.py); the core runs the same cases. - Found on the way: both importers skipped a Keep note that is only a photo as "empty". It now imports, on the server and in the core. - New dependency, approved: `zip` (deflate only) plus `flate2` on its pure-Rust backend, both already in the lockfile. The AppImage applications-menu toggle moves from Account, which the desktop never shows, to the Sync page; the first-run prompt now says so. errorMessage (#5236) replaces the hand-rolled `.error ?? …` / `.message ?? e` reads at the remaining catch sites, so a desktop failure shows its real reason. Task #5170. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 11:36:42 -04:00
bvandeusenandClaude Opus 5.5	5b11490858	core: the compat forward-compat test builds its feature list from the constants ... A literal list went stale the moment attachment_sync was added (run 8513), the same way pinned version numbers did at v2 — for a reason unrelated to what the test checks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 10:13:17 -04:00
bvandeusenandClaude Opus 5.5	2b2ceaa82e	attachments sync: attach offline, upload when linked, removals stick (#5168) ... Desktop could not create an attachment at all, and a removed attachment or dismissed preview came back on the next pull. Now: - core: add_attachment keeps the bytes in the blob store and queues the row (schema v10: attachments.uploaded / upload_error). Push uploads it once its note has landed. A refusal that retrying won't fix (too large, id clash, hash mismatch) is recorded on the file and not re-sent every cycle; the editor shows it. - core: removing a synced attachment or dismissing a preview leaves a tombstone in pending_deletes; push sends it as an `attachment`/`preview` delete, and a pull while it waits doesn't put the row back. A pull also keeps files still waiting to upload instead of replacing them wholesale. - server: PUT /api/sync/attachments/<id> (raw body, sha256-checked, idempotent, size-capped) and child deletes in push, which apply regardless of LWW and answer noop for rows the caller can't see. One store_attachment helper for the upload route, the importer and sync. Protocol 5, feature attachment_sync; the client sends neither to a server without it. - server: migration 0031 makes a link preview's insert/delete bump its note, so background-fetched previews and web dismissals reach linked devices. - desktop: Attach and paste-image work offline (raw-bytes IPC command). - SVG is served as a download by the desktop blob scheme too (as #1981 did for the web), and drawn as a file chip on both. - autosync: drop the catch_unwind; release builds abort on panic, so it only ever worked in debug builds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 10:07:52 -04:00
bvandeusenandClaude Opus 5.5	efb141e555	desktop: syncs on its own — at launch, soon after an edit, every few minutes and on focus ... Until now the only caller of the sync engine was the "Sync now" button. A worker thread now owns every cycle (the button's included, so two never overlap): - launch: one cycle as the app opens; - edit: every 10s it reads a fingerprint of the pending set and sends when that moved. A fingerprint rather than "anything pending", because a rejected change stays pending and would otherwise be resent every tick forever; - timer: a pull every 5 minutes with nothing to send; - focus: at most once per 30s. Failed automatic cycles back off (doubling from 10s to 5 minutes). A panicking cycle counts as a failed one rather than ending the thread. Every cycle is emitted as inkwell://synced: the board reloads when the pull changed something, and the Sync screen shows the last automatic failure. No final push on quit; the launch cycle sends whatever was left. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:40:27 -04:00
bvandeusenandClaude Opus 5.5	38da5160a0	grammar: a #tag starts after whitespace and with a letter, on every surface ... The shared fixture went red on the server (run 8468: 5 failed), because the three tag rules disagreed: - core and web: any non-tag character counts as a boundary, so `(#todo)` and `end.#tag` are tags, and so is the `/#section` of a pasted URL; - server: only whitespace counts, but `#1st` and `#_x` are tags. A note's labels could therefore change every time it synced. All three now share the strict rule: start of line or whitespace, then a letter, then letters, digits, `_` and `-`. Nothing becomes a tag that wasn't already one everywhere, and URL anchors stop becoming labels on desktop and Android. The server's existing `http://x/#nope` test already expected this. derive.rs's boundary, markdown.ts's lookbehind and tags.py's regex change together; `_is_tag` goes because the regex now requires the letter. The fixture flips `(#todo)`, `end.#tag` and its lift case, and adds the URL case. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:22:53 -04:00
bvandeusenandClaude Opus 5.5	535331c5b2	tests: one fixture for the note grammar, run by the core, the server and the web ... The checklist grammar and the #tag rule are implemented three times (derive.rs, checklist.py/tags.py, markdown.ts), and the tag colour twice (colors.ts, DerivedTint.kt). Only Rust and Kotlin had tests. core/testdata/grammar.json now holds one set of cases (task lines, rendered items, tags, standalone-tag lifts and the tint hashes), and every suite reads it. - web: vitest, a dev dependency approved for #5166, with `npm test`. grammar.test.ts runs the fixture, and titles.test.ts pins #5165's palette fix. - ci.yml runs the web tests in the job the image build needs. desktop.yml's verify job runs them too, because the installers embed this frontend and can't see ci.yml's verdict (rule 177). - core: derive.rs reads the fixture. server: tests/test_grammar_fixture.py. - Android keeps its hand-written tint values; its doc now points at the fixture. The server is expected red here, on purpose. tags.py only takes a tag after whitespace and lets it start with a digit or `_`, while the core (the definition) takes any non-tag boundary and needs a letter. So `(#todo)` is a label on the phone and plain text on the server. The fix follows. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 23:11:26 -04:00
bvandeusenandClaude Opus 5.5	be200641cd	core: notes show their real created and edited times, and desktop search works ... Both bugs were caught red by the tests in 732fd7a (run 8418: 5 failed, 147 passed) before this fix. - load_note reads columns by NAME. Dropping `color` (fa89da1) shifted every column after it and the two timestamps were missed, so created_at showed the last edit and updated_at showed the trash time — null on any live note. Only the read was wrong; nothing stored is, so no data needs repairing. - The board's text facet binds its pattern once for its one placeholder. It pushed it twice after the title column went (95aa10c), and rusqlite refused every query with InvalidParameterCount — every desktop search failed. Android searches through store::search and was never affected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 19:42:51 -04:00
bvandeusenandClaude Opus 5.5	732fd7a827	core: the store tests pass clippy and rustfmt, so they reach the test step ... 7bc8e04 never got as far as running them: clippy's cloned_ref_to_slice_refs rejected four `&[x.clone()]` slices, and the file wasn't rustfmt-formatted. Still tests only — the expected RED is the two timestamp tests and the text-search tests, ahead of the fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 19:35:10 -04:00
bvandeusenandClaude Opus 5.5	7bc8e04518	core: the local store has tests, and two of them fail on today's code ... store.rs had none, which is how two bugs reached desktop and Android unseen. These exercise every board facet, the timestamps, tags, revisions, items, trash, reminders and label merges against a real migrated schema. Two are expected RED on this commit, on purpose, so CI shows they catch what they were written for: - each_timestamp_comes_from_its_own_column / a_new_note_carries_both_timestamps: load_note reads created_at and updated_at one column too far right since fa89da1 dropped `color`. - text_search_*: the text facet binds its LIKE pattern twice for one `?`, left over from title+body (95aa10c). The fix follows in the next commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 19:29:33 -04:00
bvandeusenandClaude Opus 5.5	fe6f0746b2	rename: the desktop is Inkwell — crates, Tauri identity, data move, packaging ... Step 3 of milestone 481 (Scribe note 5071: a full rename). - crates thoughtsync-{core,desktop,ffi,uniffi-bindgen} → inkwell-*, the Cargo.lock entries moved to match (checked with `cargo metadata --locked`) - Tauri: productName "Inkwell", identifier com.fabledsword.inkwell, binary `inkwell`, updater feed on bvandeusen/inkwell, store file inkwell.db - client agent inkwell-desktop, headers X-Inkwell-Client/-Protocol (the server reads neither), capture event inkwell://captured, display-version env - .deb: conflicts + replaces thought-sync, so the updater's install retires the old package instead of colliding on it. kebab-case("Inkwell") is `inkwell`, so the package name finally matches the command and verify.sh now asserts it - pacman: inkwell, conflicting with and replacing thoughtsync and thoughtsync-desktop - AppImage ~/Applications/Inkwell.AppImage, menu entry inkwell.desktop, installer, release titles, desktop asset names in fetch-clients.sh The one shim, chosen by the operator because it is the only copy of a local-first user's notes: crossover.rs moves the old com.fabledsword.thoughtsync app-data dir's contents into the new one on startup, before the store opens, renaming thoughtsync.db and its -wal/-shm with it. It skips when the new dir already has a store, and anything already in the new dir wins (the installer writes its channel marker there first). Tested. Android's Kotlin side (package, applicationId, uniffi class) is step 4. Its release asset names stay thoughtsync.* until then. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 14:27:26 -04:00
bvandeusenandClaude Opus 5.5	a706644455	rename: the server is Inkwell — package, env vars, image, compose, export marker ... Step 2 of milestone 481. The operator chose a full rename (Scribe note 5071), so this goes past the display strings into the identities: - src/thoughtsync → src/inkwell; every import, the Dockerfile and both compose commands, alembic env, pyproject - THOUGHTSYNC_* → INKWELL_* (database URL, secret key, log level, tag/port/bind) - container data dir /var/thoughtsync → /var/inkwell - image git.fabledsword.com/bvandeusen/inkwell; Postgres user/db default inkwell; CI's integration service follows - the files the image serves are inkwell.*. fetch-clients.sh still fetches the thoughtsync-named release assets, because the lanes that publish them are renamed in steps 3 and 4 - exports are written with app "inkwell" Two deliberate exceptions, both because data rides on them: - compose volumes are now named explicitly and overridable (INKWELL_DB_VOLUME, INKWELL_DATA_VOLUME), so a deployment installed as ThoughtSync points at the volumes and DB identity it already has. .env.example says exactly what to set - import still accepts app "thoughtsync", because exports written before the rename are backups. Tested both ways Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 14:18:49 -04:00