12 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5	ed623a7bef	M10.7d: download attachment bytes into a content-addressed store (task 2107) ... The client half of task 1942's server work. Metadata already rides the delta feed; this fetches the payload so a synced image exists on the device. Blobs are filed under their own sha256, so the same image attached to five notes is stored once and re-downloading it is free — the dedupe the task asks for falls out of content addressing rather than needing bookkeeping. The hash is also the integrity check, applied on the way IN. Bytes that don't hash to what the server advertised are refused rather than filed under a name that lies about them — and because the blob then still counts as missing, the next sync simply tries again. SECURITY: the hash arrives in a server response and becomes a FILENAME, so it is validated as 64 hex characters before touching the filesystem. Without that, a hostile or buggy server could send "../../..." and steer a write outside the blob directory. Tested. A failed attachment never fails the sync. Notes are the primary data and have already landed; aborting here would let one unreachable file block every future sync. Counted, logged, surfaced in the UI as "they'll retry on the next sync", and retried because the blob is still absent. sha2 is pure Rust, so the Windows cross-compile lane pays nothing for it — the constraint recorded in ci-requirements.md. SPLIT, deliberately: this stores the bytes but does NOT yet render them in the webview. That half needs a custom URI scheme or the asset protocol, whose URL form differs by platform (Windows uses http://scheme.localhost/, others scheme://localhost/) — and CI cannot verify webview rendering at all, being headless with no webview. Guessing at it here would ship an unverifiable change on the most fragile lane. Follow-up filed; synced images will show as broken until it lands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi	2026-07-26 00:43:34 -04:00
bvandeusenandClaude Opus 5	b5f7dc2635	M10.7c: push + the full sync cycle (task 2106) ... Local -> server, then push-then-pull as the only ordering the UI can invoke. LOCAL TOMBSTONES (schema v2). Found while writing push: delete_forever and remove_label just DROPPED the row, leaving no record it existed. Offline that means the delete can never be pushed — and the next pull faithfully resurrects the note from the server. A deletion that undoes itself is about the worst thing sync can do, so deletes now record into pending_deletes until the server acknowledges them. merge_labels had the same hole. merge_labels also moved memberships without marking the affected notes dirty. A note's label set only reaches the server via the note itself, so a merge looked done locally and never synced. Now marked before the delete cascades the rows away. Result handling, per status: created/applied -> clear dirty, store the returned sync_revision noop -> clear dirty, drop the tombstone (a row the server never saw, created and deleted entirely offline) kept -> clear dirty WITHOUT touching content. Re-pushing would lose the same last-write-wins comparison forever; the following pull adopts the server's version. rejected -> stay dirty and surface the reason. A duplicate label name is the realistic case and only a human can resolve it. The subtle one is `kept` plus a skewed clock. Normally the server's kept revision sits above our cursor, so the next pull fetches it anyway. If the clock makes a genuinely later local edit look older, that revision can be BELOW the cursor — the pull skips it and the stale local copy stays on screen with nothing marking it wrong. So a kept result at or below the cursor rewinds the cursor to re-fetch that note. Both directions tested. label_ids carries MANUAL memberships only. Tag-sourced ones are re-derived server-side from the body; sending them would convert them into manual assignments that no longer disappear when the #tag is deleted from the text. engine::run_cycle is push-then-pull, and a failed push ABORTS before the pull — pulling anyway would overwrite the exact rows we just failed to save, turning a recoverable network error into lost work. sync_pull is removed from the command surface accordingly: offering a bare pull would hand the UI a way to discard unsent edits. sync_now and sync_has_pending replace it. Both loops have anti-spin guards: push stops when a batch clears nothing, pull stops when the cursor doesn't advance. 15 push tests against an in-memory database. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi	2026-07-26 00:20:09 -04:00
bvandeusenandClaude Opus 5	dc8b2d360d	M10.7b: pull the change feed into the local store (task 2105) ... Server -> local. sync/wire.rs mirrors the delta-feed JSON exactly as notes/serialize.py sends it; sync/pull.rs applies it. ATOMICITY IS THE POINT. The cursor is written in the SAME transaction as the page it describes. A cursor committed ahead of its data would skip those rows forever while reporting a clean sync — the worst kind of failure, because nothing looks wrong. A test forces a mid-page failure and asserts the cursor stayed put. Every degradation leans toward re-downloading rather than skipping: an unparseable cursor means full sync, wire fields are all defaulted so a newer server adding a field (or an older one omitting one) yields a partial note instead of a rejected page, and a page that fails rolls back whole. Labels are applied before notes so a membership never references a row that doesn't exist. A note also carries enough of its labels to materialize them, because notes and labels page from ONE shared sequence and a note can arrive referencing a label whose own delta landed in an earlier page. via_tag is applied verbatim rather than re-deriving #tags from the body. The server already reconciled them on save, and re-deriving would go through the local find-or-create path, which marks new labels dirty — pushing them straight back. Sync churn manufactured out of nothing. Duplicate-label merge, the subtle one: a label created offline can collide by name with one the server already had under a different id. Both sides enforce one label per name, so the server's row has to win — but simply deleting the local duplicate would CASCADE its note_labels away, stripping the label off notes this pull never mentions, with no later page to repair it. So we free the name, insert the server's row, re-point the memberships, then drop the husk. Tested. Children (items/attachments/previews/labels) are replaced wholesale rather than diffed: a delta carries the note's FULL state, so what arrived IS the complete set, and diffing could strand a row the server no longer has. The loop trusts the data over the flag — a server claiming has_more without advancing its cursor stops with an error instead of spinning forever. Pull can overwrite a row with unpushed local edits. The documented cycle is push-then-pull (M10.7c), so that should never happen; when it does it's counted as clobbered_dirty and logged rather than hidden. 17 tests, all against an in-memory database. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi	2026-07-26 00:05:27 -04:00
bvandeusenandClaude Opus 5	bbb2fd9b1c	M10.7a: link/unlink a server — device auth + sync_state (task 2104) ... The pairing step. Nothing else in the sync arc can move until this works. sync/state.rs owns the link record in the sync_state row M10.4 already put in the local schema. Two safety properties are the reason it isn't just three setters: - Linking a DIFFERENT server resets the change-feed cursor. A cursor is only meaningful against the server that issued it; carrying one across would silently skip every change on the new server below that watermark — data loss wearing the costume of a successful sync. Re-linking the SAME server (a token refresh) keeps it, so a routine re-auth doesn't force a full re-download. - Unlink clears the cursor too, so a later link can't inherit a watermark from a server that never issued it. An unparseable or absent cursor reads as 0 (full sync). That direction is always safe: a redundant re-sync costs time, a too-high cursor costs notes. Likewise a half-written row (server but no token) reports NOT linked. state::Status deliberately has no device_token field — it crosses into the webview, and a long-lived bearer token has no business reachable from page scripts. A test asserts the token never appears in its serialization. Token lives in the app-data SQLite file, not an OS keyring: the keyring crate needs libsecret/DBus on Linux, which adds a C dependency to a binary that has to cross-compile and fails outright on headless/minimal-WM setups — the same class of environment assumption behind the black-window bug. sync_link runs the M10.6 handshake FIRST and refuses an incompatible server before any credential is sent. Two credential paths, because neither covers everyone: device-login (a fresh install has no session to mint a token from) and a pasted token (some users would rather not type a password into a desktop app). A pasted token is verified against /api/auth/me before being stored — auth.py's login_required accepts bearer — since an unverified paste would turn a copy/paste slip into a failure surfacing at the next sync, far from its cause. The store lock is taken only after all network work: a std MutexGuard isn't Send so it cannot cross an await, and holding the store for a round-trip would freeze every note operation in the UI. Unlink is LOCAL only — the token stays valid server-side until revoked under Account -> Linked devices. A pasted token arrives without its device id, so a reliable remote revoke isn't possible from here; the UI must say so rather than imply a revoke that didn't happen. Follow-up filed. No UI yet — that's M10.7e. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi	2026-07-25 23:35:51 -04:00
bvandeusenandClaude Opus 5	4eb92942d0	M10.6: HTTP transport for the handshake (task 1995) ... Adds the client's first outbound call: GET {server}/api/config, carrying X-ThoughtSync-Client and X-ThoughtSync-Protocol, feeding compat::evaluate. Deliberately its OWN commit. This introduces the first HTTP+TLS stack into a crate that cross-compiles to Windows from Linux via cargo-xwin — the lane that has already broken once on a transitive C dependency (libsqlite3-sys needing llvm-lib). Landing it alone means a failure here has exactly one possible cause, instead of surfacing mid-way through M10.7's much larger change where it would be expensive to bisect. TLS backend is native-tls, NOT rustls, and that is the whole point of the choice: on x86_64-pc-windows-msvc native-tls resolves to `schannel`, which is pure-Rust bindings to the OS TLS stack, so nothing C or assembly has to cross-compile on the fragile lane. rustls would pull in ring/aws-lc-rs and their assembler. On Linux native-tls uses OpenSSL, whose headers ci-tauri already ships (libssl-dev, part of Tauri's own Linux prerequisites). Verified from run 2884's log rather than assumed: tokio and http are already in the Windows tree via tauri, but no HTTP client and no TLS stack were — so this genuinely is new surface there, not a no-op. probe() distinguishes "never got a usable answer" (Err) from "answered, but we can't work with it" (Ok + verdict). Those need very different messages: one is "check what you typed", the other is "update something". Transport errors are translated out of reqwest's Display, which is accurate but reads like a stack trace. Still no UI — M10.7 owns the link/settings surface that calls server_probe. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi	2026-07-25 22:47:10 -04:00
bvandeusenandClaude Opus 5	fbbe877c46	M10.6: client↔server sync protocol handshake (task 1995) ... Version the sync WIRE PROTOCOL separately from either program's release version, so a self-hosted server and the desktop app can sit on different releases and still work out whether they can talk. Each side declares two numbers — what it speaks, and the oldest counterpart it accepts. Either side can therefore mark a change breaking without the other shipping in step, which is the whole point: no app↔server lockstep. Server advertises on the existing public /api/config (a client must be able to ask "can I talk to you?" before it holds a device token, or even has an account): sync_protocol_version, min_client_protocol_version, sync_features. sync_features exists because a version number can only say newer/older. An ADDITIVE change earns a capability name instead of a minimum bump, so a newer client meeting an older server drops that one feature and syncs the rest, rather than refusing. Raising a minimum is reserved for genuinely breaking changes — it's the switch that hard-blocks the other side. Client half is pure decision logic (sync/compat.rs), no I/O, so every branch is unit-testable — there's no live-server lane in CI. Three outcomes: ok / degraded{unavailable} / incompatible{reason, client_must_update}. The last names which side can fix it, so the message is actionable. A server that predates the handshake sends no protocol fields at all; that reads as "update the server", deliberately not as a parse error, which would look to the user like they mistyped the URL. normalize_base_url defaults a bare host to https://, never http:// — silently downgrading would put a long-lived device token on the wire in cleartext because someone omitted five characters. Plain HTTP on a trusted LAN stays supported; the user types http:// and thereby chooses it. Transport (the actual fetch) lands next, separately: it needs an HTTP/TLS stack, and that's a real risk to the Windows cross-compile lane, so it gets its own CI run to bisect against rather than riding along with this. No UI here by design — the link/settings surface it feeds is M10.7's, per this task's own sequencing. Policy documented in docs/sync.md. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SreJkbxB4gx8pPsu8QbLPi	2026-07-25 22:40:25 -04:00
bvandeusenandClaude Opus 4.8	f325402902	desktop: robust startup + operation logging (portability troubleshooting) ... There was essentially no logging — useless for proving the app renders across different environments. Add real observability: - tauri-plugin-log -> stdout (so `2>&1 | tee` captures a run) AND a persistent file in the app log dir (grabbable after the fact on any machine). Level Info. - Startup diagnostics: app version, OS/arch, the Linux display/session stack (XDG_SESSION_TYPE, desktop, Wayland/X11, GDK_BACKEND), the WebKit render- hardening vars actually in effect, resolved log + data dirs, DB open/migrate result, and note/label counts. - log_event command + a frontend logEvent() helper: boot line (data source + WebKit user-agent) from main.ts, first-route config/session/destination from the router guard, and — via the bridge invoke() wrapper — every failed Tauri command named with its error, so a broken basic function is self-identifying. Task 2040. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-25 10:18:06 -04:00
bvandeusenandClaude Opus 4.8	ed1b3aa814	desktop M10.4: Rust local SQLite store + Tauri commands ... The on-device core that makes the desktop app work with no server and no login. - rusqlite (bundled SQLite, so no system libsqlite dependency to vary across builds); uuid v4 ids; RFC3339/Date.toISOString-compatible timestamps. - Schema mirroring the note model: notes, labels, note_labels (with via_tag), checklist_items, attachments, link_previews, note_revisions, saved_filters, plus per-row sync_revision/dirty + a sync_state row for the M10.7 engine. user_version-gated migrations. - derive.rs: pure [[wiki-link]] + #tag scanners (mirror the frontend inline rules, no regex dep) with unit tests; #tags re-sync via_tag labels on save, [[links]] drive backlinks at query time (derived, never stored). - store.rs: the full repository surface (facet/label/date/text list, create, PATCH-semantics update, pin/archive/color/kind, checklist items, labels CRUD + merge, reminders complete/snooze, reorder, trash/restore/delete, revisions + restore, titles/search/backlinks/link-search, saved filters). - commands.rs: ~38 #[tauri::command]s over a Mutex<Connection> in managed state. - lib.rs: opens the DB in the platform app-data dir on setup; synthetic offline config/user so the auth-gated router resolves with no login. Attachment upload / URL unfurl / import are intentionally deferred (network/file concerns); adapters/local.ts (M10.5) wires all of the above via invoke. Task 1993. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-24 22:54:58 -04:00
bvandeusenandClaude Opus 4.8	98d918dda2	M10 (task 2022, issue 2021): Arch pacman package + commit icon set (native, system libs) ... Native-first fix for the AppImage black window: a PKGBUILD that builds from source, linked against SYSTEM graphics libs, so it renders on the host driver. - desktop/packaging/arch/{PKGBUILD,thoughtsync.desktop,README.md}: `makepkg -si` installs /usr/bin/thoughtsync + .desktop + icon; deps webkit2gtk-4.1/gtk3/...; builds the frontend + `cargo build --release` (no tauri-cli). Uses the host graphics stack -> avoids EGL_BAD_PARAMETER. - Commit the icon set (desktop/src-tauri/icons/*.png, un-gitignored) so BOTH `cargo build` (pacman) and `cargo tauri build` (deb/appimage) work without a generate step; bundle.icon -> the 4 committed PNGs; drop the `cargo tauri icon` step from desktop.yml. - Broaden the WebKit software-render hardening (lib.rs) to ALL Linux (was AppImage-scoped) so the native build also renders if system WebKit is finicky. Can't CI-test the PKGBUILD (Arch-only; CI is Debian) -- operator builds locally. desktop.yml re-verifies the deb+AppImage build with the committed icons. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-24 17:02:40 -04:00
bvandeusenandClaude Opus 4.8	3f5b87682e	issue 2021: harden Linux WebKit rendering (fixes black AppImage window) ... WebKitGTK's DMA-BUF/EGL renderer fails to init on many Linux GPU/driver/Wayland setups -> 'EGL_BAD_PARAMETER' -> black window (known WebKitGTK issue, not app code). Per Tauri's Linux-graphics guidance, set the software-fallback env vars at startup before the webview is created, scoped to AppImage launches (native installs keep GPU accel): __NV_DISABLE_EXPLICIT_SYNC / WEBKIT_DISABLE_DMABUF_RENDERER / WEBKIT_DISABLE_COMPOSITING_MODE, each only if the user already set it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-24 14:38:27 -04:00
bvandeusenandClaude Opus 4.8	877a6a572f	M10 (task 2013): integrated AppImage — app self-integration (OOBE + Account toggle) ... The Linux AppImage can now install itself into the applications menu, so it behaves like an installed app instead of a loose file. - Rust (desktop/src-tauri/src/integration.rs): integration_status / integrate_desktop / unintegrate_desktop commands — detect $APPIMAGE, copy the AppImage to ~/Applications, write ~/.local/share/applications/thoughtsync.desktop + embedded icon, update-desktop-database. Registered in lib.rs. - Frontend: withGlobalTauri exposes window.__TAURI__.core.invoke; desktop/bridge.ts (isDesktop + typed invoke, NO @tauri-apps/api dep -> web bundle unaffected); DesktopIntegrationPrompt (first-run OOBE, remembered) mounted in App.vue; AccountView "Desktop app" add/remove control. All desktop-guarded -> no-ops on web. - desktop.yml: upload the .deb + .AppImage as a run artifact (continue-on-error) so the build is downloadable for hand-testing. Verified by CI: ci.yml (vue-tsc) for the frontend, desktop.yml (cargo + tauri build) for the Rust + AppImage. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-24 13:24:20 -04:00
bvandeusenandClaude Opus 4.8	db24d7ea18	M10.2: Tauri v2 desktop scaffold (desktop/) — Vue frontend as the webview ... New desktop/ Tauri v2 project (Linux-first, cross-platform-ready): - src-tauri: Cargo.toml (lib + thin main.rs shim), build.rs, lib.rs (Builder entry point), tauri.conf.json (frontendDist -> ../../frontend/dist, devUrl :5173, deb+appimage bundles), capabilities/default.json (core:default), .gitignore. - The shared Vue 3 frontend is the sibling ../frontend; before-commands cd via "$(git rev-parse --show-toplevel)/frontend" since frontend and src-tauri are siblings, not nested. - Icons generated from frontend/public/icon.svg via `cargo tauri icon` in CI (M10.8), not committed. Boots the shared UI in a native window. The local data adapter (M10.3/M10.5) and CI build verification (M10.8) follow. desktop/** is not yet in the CI paths filter — added with the desktop lane in M10.8. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm	2026-07-24 11:13:09 -04:00