Docker instances reported most deployment fields as unknown. Report how
and when the container image was built, separately from how the
instance was deployed:
- Dockerfile: optional EDGE_EVER_BUILD_CREATED_AT, EDGE_EVER_BUILD_TRIGGER
and EDGE_EVER_BUILD_METHOD build args, empty by default.
- /api/health (self-hosted-bun only): optional buildCreatedAt and
buildProvenance. deploymentVersionCreatedAt and deployment keep their
meaning and stay runtime-supplied; Cloudflare responses are unchanged.
- docker-image.yml: official images record the build time and their
provenance. Draft-release builds dispatched with release_tag are
github_release, main pushes main_push, other dispatches manual.
The container test checks the health response for a metadata build
with runtime overrides and for a default self-build; the post-publish
audit checks the published image.
- Add an explicit `docker` deployment method. It is never inferred from
the runtime, and the registry source still comes only from
EDGE_EVER_CONTAINER_IMAGE.
- Web/desktop show "Image built at" and "Image build source" for Docker;
Android shows "Image built at". Older clients ignore the new fields.
- Document the build args and runtime variables in both Docker guides.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
Opening a shared note on a phone meant copying the link to another
device. Add a collapsible "QR code" section to the note and notebook
share dialogs that renders the public link as a scannable code.
- Rendered with qrcode.react 4.2.0 (SVG, no dependencies), loaded with
the share dialogs only.
- Dark modules on a white panel in every theme so phone cameras can
read it; labelled for screen readers, no native title tooltip.
- Hidden for password-protected links, so the code never replaces the
password the recipient still has to receive separately.
- Copy in all four catalogs.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
* fix(web): show the localized label for untitled notes everywhere
Untitled notes are stored with the zh-CN default title, and several views
only replaced an empty title, so they showed 无标题笔记 in every locale.
The visible cases were the public share page (heading and browser tab),
the public notebook site, AI companion cards and mentions, the note link
picker, link text inserted for a note, and the title of a duplicated
note.
Add getMemoDisplayTitle() next to DEFAULT_MEMO_TITLE and use it in those
views, matching what MemoCard already does with isDefaultMemoTitle.
* fix(web): localize diagrams and content label on the public share page
The public share page passed zh-CN to read-only diagrams for every
language other than English, so Japanese and Polish visitors saw Chinese
diagram labels. Resolve the locale with resolveSupportedLocale(), which
the diagram renderer already supports for all four languages.
Also translate the note content aria-label, which was hard-coded in
English.
---------
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
Public share and form pages only added a robots meta tag from JavaScript,
so the HTML for /share/* and /form/* was served without any indexing or
caching directive, and the form page had none at all. Error responses
from /api/public/* also lacked X-Robots-Tag.
Send one policy everywhere a token-bearing link is served:
X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, noimageindex
Cache-Control: private, no-store
Referrer-Policy: no-referrer
- /api/public/*: shared middleware in the application, so it applies on
Cloudflare and Docker, including 404/403 responses. Routes that already
set Cache-Control keep it.
- /share/* and /form/* HTML: _headers rules for Cloudflare static assets
and the self-hosted static server.
- Referrer-Policy keeps the share token out of Referer headers sent to
linked sites.
robots.txt is deliberately not used to block these paths: a disallowed
URL can still be indexed from external links, because crawlers never see
the noindex header.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
The README rewrite in d635c45f changed the "Build & Verify" step but left
the product site's manual deployment copy unchanged, so the
"product site deployment prompts mirror the root READMEs" regression test
fails on main and on every open PR.
* refactor: remove unused imports, variables and parameters
Remove the 110 bindings reported by no-unused-vars:
- 78 unused imports. Nine whole value-import statements disappear:
shadcn/ui input, tooltip, button and switch, MobileWebClipCapture,
AccountSecurityModal and @/lib/api in plugin-host. None of these
modules has top-level side effects beyond displayName assignments,
and @/lib/api is still imported by 60 other web modules. The other
removals are type-only imports or bindings from modules that stay
imported, so module evaluation is unchanged.
- Dead helpers: appendResourceMarkdown, handleTogglePin (mobile),
CheckCircleCheck, moveTargetTitle, moveTargetSelectRef,
handleMoveTargetSelectKeyDown (memo list), copiedLabel (share
dialog), and an unused palette and flowchart in the diagram editor.
- Component props that are passed but never read are dropped from the
destructuring only. Their prop types and call sites are unchanged,
so no caller changes behaviour.
- Tests: iterate Object.values() where keys were unused, and drop
unused fixture bindings and callback parameters.
* ci: enforce no-unused-vars in oxlint
Turn the rule on with the conventional escapes: names starting with an
underscore and rest siblings used to omit a property
(`({ id, ...item }) => item`) are allowed.
The API rejects a save that changes the title while most of the note
content disappears with an English message, and clients showed it
verbatim in every locale.
- shared: add editor.saveState.errorReason.suspiciousOverwrite in all
four catalogs and getMemoSaveErrorReasonKey(), matching the error code
or the server message; the API reuses the exported code and message.
- desktop sync details: translate the item by lastErrorCode.
- Android: map the stored message to its zh-CN source text so the
localized components translate it.
- web editor: show the reason in the save status tooltip and label
instead of the bare "Could not save".
The automatic sync runner reset runningRef inside a finally block, after
awaiting refreshSyncQueueItems(). If reading the queue threw there,
runningRef stayed true and every later call returned early as if a pass
were still running, so automatic sync stopped until the app restarted.
A failing getMobileSyncRetryDelay() also surfaced as an unhandled
rejection from the void-ed run.
Move the settle step into settleMobileSyncPass(), where refreshing the
visible queue and reading the retry delay each handle their own errors
and the runner is always marked idle. Ordering is unchanged: refresh,
mark idle, run a pass requested meanwhile, otherwise schedule the retry.
This also removes the return inside finally reported by
no-unsafe-finally.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
* refactor: resolve oxlint correctness findings without behavior changes
- Snapshot iterations that mutate their collection with Array.from()
instead of a spread (live childNodes, self-removing disposers, a Set
extended inside its own loop).
- Drop empty spread fallbacks, redundant regex escapes, Boolean() casts
inside negations, a rethrow-only try/catch and statement ternaries.
- Use startsWith/endsWith for anchored literal checks in the extension.
- List U+FE0F explicitly in the mobile attachment emoji class; the
matched set is unchanged.
- Fix the WeChat copy fixture, where \oint in a template literal lost its
backslash and the block formula never exercised \oint.
- Document the intentional control-character regexes (filename
sanitizing and input validation), the throwing provider stream test,
Astro's generated type reference and the mobile auto-sync finally
block with narrow inline exceptions.
* ci: run oxlint correctness rules on pull requests
Pin oxlint 1.88.0 and enable only its correctness category across apps/
and packages/, excluding build output, vendored code and the iOS app.
Findings are errors and the script passes --deny-warnings, so CI fails
on any finding. no-unused-vars stays off until unused code is removed
in a dedicated pass.
The shape-library trigger opened its menu on every pointerenter. When the
editor replaced the note list under a pointer that did not move, or when
the pointer only passed over the toolbar, the menu opened by itself and
stayed open. For mind maps and flowcharts that menu was modal, so the
back-to-list button could not be pressed until the menu was closed. On
touch screens pointerenter fires right before the pointerdown that
toggles the menu, so a tap could open it and close it again.
- Open the menu on hover only for mouse pointers.
- Make the mind-map and flowchart insert menu non-modal, as the
architecture library already is.
New mind maps, flowcharts and architecture diagrams always started with
Chinese labels, whatever language the interface used.
- createDefaultDiagramDocument takes optional starter labels. Without
them it returns the existing Chinese starter unchanged, so the other
callers (tests, desktop sidecar checks) keep their output.
- The web client passes translated labels from new diagram.seed keys in
en-US, zh-CN, ja and pl.
- fitDefaultDiagramLabels sizes the nodes and lays the starter out again
only when a translated label needs more room than the default label it
replaces, so the Chinese starter keeps its tuned geometry. The helper is
loaded with the lazily loaded diagram editor, which keeps dagre out of
the workspace chunk; if that import fails the note is still created
with the starter geometry.
Turn on both compiler checks in the root TypeScript configuration, which
apps/web, apps/api, apps/extension, packages/shared and packages/plugin-api
extend, and in the separate Expo configuration of apps/mobile.
No switch statement falls through today. The 19 members that override a
base class member (React error boundaries, the local database recovery
error and the vendored poster badge) now declare `override`; this only
changes type checking and is erased from the emitted JavaScript.
test:desktop listed 40 of the 49 Electron main-process test files by hand,
and the five ACP tests that need the desktop working directory ran in a
second command. Four files were missing from both lists
(desktop-device-model, edit-context-menu, rpc, window-lifecycle), so the
desktop build never ran them.
The first command now runs everything under apps/desktop/src/main and
ignores only the five tests the second command runs with --cwd
apps/desktop. The renderer tests and the sidecar step are unchanged, and a
new main-process test is picked up without editing the script.
* feat(memos): duplicate a note with its files
Add "Duplicate note" to the note list's context menu and the text editor's
"More note actions" menu. The copy keeps the note's content and tags, is
titled "<title> (copy)" in the UI language, and opens in the editor.
POST /api/v1/memos/:id/duplicate (write:memos) copies every image and
attachment of the note to a new resource with its own stored object and
rewrites the content to reference the copies, so editing or deleting either
note never affects the other. Shares, revisions, the pinned state, public
form links and unsubmitted form uploads are not copied. A note with more
than 20 files or more than 64 MiB of files is refused, and files written for
a copy that fails are removed.
The Web and desktop clients synchronize the note's queued changes before
duplicating and refuse while any remain, including unresolved conflicts;
the editor item stays disabled until the current edit is saved.
* fix(memos): keep committed duplicate files and check the whole desktop outbox
- Copied objects are removed only when the write batch fails. A failure
after the commit, such as a transient error while reading the new memo,
no longer deletes files that committed resource rows reference. When the
memo row is missing after the commit (its notebook was removed meanwhile),
the rows are removed before their objects.
- The sidecar lists at most 200 outbox items, so a conflict of the note
further down the queue was invisible and the stale server version could be
copied. The desktop client now compares the listed items with the
sidecar's status counts and refuses to duplicate unless the whole
outstanding queue was listed, nothing is being synchronized, and no item
belongs to the note.
- Regression tests cover a read failure after the commit and a target
conflict at position 201 behind 200 other conflicts.
* test(api): cover public table form access, uploads and submissions
Run the public form routes and the owner form settings routes on SQLite
with every migration and filesystem storage: unknown, closed and
deleted-note tokens, password unlock and its rate limit, the fields a
form publishes, stale pending upload cleanup, field validation, and
which uploads a submission may attach.
* fix(api): accept file uploads on public table forms
Public form routes run without a signed-in user, but storing an upload read
the workspace from the auth context, so every valid upload to
POST /api/public/forms/:token/resources failed with a TypeError (HTTP 500).
In the form page the visitor's row was then saved without its file.
- Resource creation accepts the note's workspace explicitly, and the form
upload passes the form's workspace.
- A form accepts uploads only when it publishes an attachment field, and
holds at most 50 uploads that were not submitted yet (stale ones are
still retired after an hour). The limit is checked again after storing,
so concurrent uploads cannot exceed it.
- A submission marks as used only the files its new row references; a file
sent in another cell stays pending and is retired like other stale
uploads instead of being kept forever.
* test(api): cover JSON backup restore end to end
Export a workspace through GET /api/v1/backups/json and restore it into
another installation through the restore routes, on SQLite with every
migration and filesystem storage, the way the ZIP backup does:
- notebooks, notes, revisions, tags, pinned state and files round-trip
unchanged, and the restored notes are searchable and tagged;
- restoring the same backup twice changes nothing and keeps one object
per file, and re-restoring a file replaces and removes its old object;
- restoring brings back notes and notebooks deleted after the backup and
undoes later edits;
- damaged or minimal content falls back safely (empty document, Markdown
derived from JSON, default title, normalized tags);
- ids used by another workspace, notebooks or notes pointing outside the
workspace, revisions of another note, invalid file metadata, missing
notes, empty files and another user's file id are rejected without
writing;
- only signed-in users can restore.
Raises line coverage of backup-service.ts from 6% to 99% and of
backup-routes.ts from 46% to 94%.
* fix(api): validate a restore page before writing any note
restoreJsonMemos checked that each revision belongs to its note inside the
write loop, so a page whose second note carried another note's revision
returned 400 after the first note had already been restored. The check now
runs for the whole page before anything is written.
* test(api): cover note trash, restore and permanent deletion
* test(api): cover user management and login session endpoints
Exercise the user and session routes against an in-memory SQLite database with every migration applied and sessions created through real password logins: owner-only access, member provisioning, username and password validation, password resets and account disabling revoking sessions, per-device session listing, renaming and revocation, and per-user storage usage.
* test(api): cover object storage settings and credential handling
Exercise the object storage routes and resolution helpers against a fully migrated in-memory SQLite database with a stubbed S3 endpoint: owner-only access, secret redaction and encryption at rest, input validation, switching providers, per-resource storage resolution, fallback-key credential migration, undecryptable credentials and grouped deletion.
The full non-E2E suite (`bun run test`) only ran inside the release
workflow, and pull requests only built the Docker image, so a failing test
or type error surfaced at release time. A new Test workflow runs on every
pull request and push to main (Markdown and docs-only changes excluded):
- "Type check and build": `bun run typecheck`, `bun run typecheck:mobile`
and `bun run build:web`;
- "Regression tests": `bun run test` (bulk and integration suites).
It uses the Bun version pinned in package.json, retries `bun install` like
the other workflows, cancels superseded runs, reads the repository only,
and is limited to this repository so deployment forks spend no runners.
* fix(api): store LF line breaks for multipart image notes
multipart/form-data encodes line breaks in text fields as CRLF. Browsers
always do so, and Bun 1.4 now does as well, so notes created through
POST /api/v1/memos/with-image (used by the Web Clipper) were stored with
CRLF line breaks, while every other note uses LF. The route now normalizes
the Markdown field to LF before creating the note.
This also fixes the existing route contract test under Bun 1.4, and a new
test sends a CRLF multipart body like a browser does.
* test(desktop): make ACP host tests independent of the machine and Bun version
- The ACP command allow-list test checked that a missing command is not
installed, but on macOS the resolver also looks in /opt/homebrew/bin and
/usr/local/bin, so it failed on any machine with that command installed.
The test now only sees its temporary directory.
- The fake WorkBuddy agent started its account API without a port during
probes and chats. Bun 1.3 then listened on a random port, while Bun 1.4,
like Node, rejects port NaN, so six WorkBuddy session tests hung until
their timeout. Like WorkBuddy itself, the fake agent now serves the
account API only when started with a port.
* feat(templates): show unedited default templates in the current UI language
Default templates are stored in the language of the workspace's first
sign-in, so switching the UI language left them in that language. While a
default template still equals one of its seeded translations, the web
template center and the Android template picker now show it in the current
UI language, and using it creates the note in that language. Templates the
user created or edited are shown and used exactly as stored.
POST /api/v1/templates/:id/use accepts an optional `locale`; without it the
stored template is used as before, so MCP, agents and older clients are
unaffected.
* fix(templates): edit the stored template and stop localizing retagged defaults
- The template center now keeps each card's stored template next to its
display translation. Editing starts from the stored fields, so saving a
name-only change in another UI language no longer writes the translated
title, description and Markdown.
- A default template whose tags differ from its seeded tags is treated as
edited and is no longer localized.
- Add regression tests for the name-only edit and changed tags.
Mirror the retry loop already used in desktop-build.yml for every remaining one-shot 'bun install --frozen-lockfile' step so transient registry or network failures (e.g. a failed mermaid tarball download) no longer fail the whole run. deploy-tools.yml gains shell: bash because its matrix includes windows-latest; sync-edgeever-upstream.yml uses break on success so the following verification commands still run.
* feat(workspace): localize default notebooks and welcome note at first sign-in
A new installation always created its five default notebooks, welcome
note and note templates in Chinese, whatever the interface language.
Members added by the owner got notebooks and templates in the owner's
language instead of their own.
The seed data is now localized once, at the first sign-in of the
workspace's user, using the UI locale the client sends with the login
request (Web and Android send it; other clients fall back to
Accept-Language, and unsupported languages to English).
Migration 0070 marks the default workspace as waiting for this only on
an installation nobody has used yet: no users, no notes beyond the
welcome note, no edits to it, no extra notebooks, revisions or
resources. Existing installations keep their data unchanged. Member
workspaces created by the owner are marked when created.
The sign-in localizes notebook names, templates, the welcome note and
its search document in one transaction that also clears the mark, and
replaces only values that still equal a seeded translation. A failed
attempt leaves the mark for the next sign-in to retry, and a second
sign-in changes nothing. The demo clears the mark so its bilingual seed
stays as it is.
Refs #483
* fix(workspace): guard seed inserts and title-only welcome edits during localization
- Default template and AI prompt inserts in the first-sign-in batch now
require the pending marker, so a delayed concurrent sign-in cannot
recreate seeds removed after the faster sign-in finished.
- The welcome note is treated as untouched only while it keeps the seeded
title, the system actor, the seed content hash, and revision 0, so a
title-only edit is no longer overwritten.
- Add regression tests for both cases.
Refs #483
The Android app translates copy by looking it up in a dictionary. 33
strings had no entry, so English, Japanese and Polish users saw them in
Chinese: the default dialog OK button, the Sign in button, the editor
save statuses (Saving, Local draft, Not saved), revision restore states,
search empty state, and delete, upload, load and connection errors.
Add English, Japanese and Polish entries for them and a test that keeps
them translated.
On iOS, the launch spinner showed "启动中…" for every language; it now
follows the app language.
A malformed JSON body, or a body over the route's size limit, made Hono
throw an HTTPException that the API reported as a 500 internal error. In
the companion API the same requests returned 503 "unavailable, please
retry", so clients retried a request that could never succeed. These
now return 400 bad_request and 413 payload_too_large in the API's usual
error shape.
A fractional limit or offset such as ?limit=1.5 was passed to SQLite as
a float and failed with a datatype mismatch. Limits, offsets and cursors
are now truncated to whole numbers, and the two private copies of the
clamp helper reuse the shared one.
Copy images in generic page and selection clips into note resources so clips can retain them when source URLs change. Keep remote URLs for images that cannot be copied.
Protect concurrent note edits, parse Markdown image syntax correctly, and bound image transfers by time and size. Add unit and Chromium browser coverage.
Refs #159
* feat(editor): add setting to turn off spellcheck underlines
Add a device-local "Underline spelling mistakes" switch to the editing
preferences. The rich-text editor and the mobile plain-text editor now
set spellcheck from this preference and update live when it changes.
Defaults to enabled, so existing behavior is unchanged.
Refs #468
* feat(i18n): add Polish as an in-app locale
Add Polish (pl) across clients, mirroring how Japanese was added:
- Shared: full pl catalog, locale matching for pl/pl-*, Polish memo
templates and factory AI prompts, mobile editor strings, and Polish as
an AI translation target and selection-translate chip.
- Web: "Polski" in the language picker; the catalog is lazy-loaded in its
own i18n-pl chunk and kept out of the PWA precache like ja.
- Android: pl locale option, mobile-only strings, web-clip labels.
Messages that only had an English branch now use English for every
non-Chinese locale, so Japanese no longer falls back to Chinese there.
- iOS: .polish UI language (pl-PL), pl argument for every t() call,
pl in CFBundleLocalizations and Localizable.xcstrings.
- Companion: accepts locale "pl" and detects Polish requests.
- Browser extension: _locales/pl messages.
- Marketing site: /pl/ pages, hreflang, sitemap, language switcher.
- Google Play listing copy for pl-PL (manual publish only).
* fix(ios): show the note editor in Polish and Japanese
The iOS editor received every interface language except English as
Chinese, so with Polish or Japanese selected its toolbar and image
gallery controls were labeled in Chinese. Pass Polish and Japanese
through to the embedded editor, label its toolbar and the shared image
gallery controls in both languages, and rebuild the checked-in
EditorBundle. The Android editor uses the same gallery labels.
Also translate the last iOS strings that had no Polish text: the
follow-system language label, note created/updated times and the
current-device marker.
Refs #473
* fix(companion): recognize Polish typed without diacritics
Requests in Latin letters without Polish diacritics were always treated
as English, so with a Polish interface "Napisz plan na jutro" got an
English reply. With a Polish interface, such text is now told apart by
common English and Polish words; when it is still unclear, the recent
conversation and then the interface language decide. Other interface
languages keep treating Latin text as English.
Refs #473
* chore(ios): regenerate the Xcode project for Polish
Run xcodegen so the shipped Info.plist lists Polish in
CFBundleLocalizations and the project knows the pl region. The
hand-written AiDirectStream.swift entries are replaced by the IDs
xcodegen generates. MARKETING_VERSION and CURRENT_PROJECT_VERSION stay
in the project file because the release script and Xcode Cloud update
them there.
Refs #473
* i18n(pl): translate the sidebar shortcut, desktop menus and video scope
Add Polish for features that reached main while this branch was open:
the show/hide sidebar shortcut label, the desktop application and
editing context menus, and the new "ai:generate" MCP scope. The desktop
menus switch to Polish for pl and pl-* locales; other locales are
unchanged.
Refs #473
Right-clicking in the desktop app showed nothing, because the main
process never handled webContents "context-menu". Browsers offer Cut,
Copy, Paste and Paste as plain text there, so desktop users, notably on
Windows, could not paste with the mouse and took the missing menu for
missing rich paste.
Show the native editing menu for editable fields (Cut, Copy, Paste with
formatting, Paste as plain text, Select all, enabled per editFlags),
spelling suggestions and Add to dictionary for misspelled words, Copy
for selected text outside fields, and Copy link address for links. The
main window and windows it opens get the menu; pages that handle their
own contextmenu event are unaffected. No app-specific formatting
commands are added.
Refs #401
* feat(editor): add setting to turn off spellcheck underlines
Add a device-local "Underline spelling mistakes" switch to the editing
preferences. The rich-text editor and the mobile plain-text editor now
set spellcheck from this preference and update live when it changes.
Defaults to enabled, so existing behavior is unchanged.
Refs #468
* fix(editor): keep the spellcheck setting when it cannot be saved
When localStorage rejects the write, remember the choice in memory for
the rest of the session so reopening Settings or the editor no longer
falls back to the default.
Refs #468
* feat(web): add a keyboard shortcut to show or hide the sidebar
The notebook sidebar can already collapse into an icon rail, but only
with the mouse. Add a configurable "Show/hide sidebar" shortcut,
Ctrl/⌘+\ by default, next to the existing outline shortcut. It toggles
the same persisted collapsed state, works only in the desktop layout,
and is ignored while a dialog or another view is open. The collapse
button tooltip now shows the shortcut.
Refs #97
* fix(web): ignore the sidebar shortcut while Focus Mode is on
Focus Mode hides the notebook sidebar, so the shortcut used to change
and save its collapsed state without any visible feedback. It now does
nothing while Focus Mode is active, and the saved state is left as it
was when Focus Mode ends.
Refs #97
