Add Russian beside Polish for the web app, the mobile editor, memo templates, and AI prompt seeds. Untranslated strings stay in English. iOS, the browser extension, and the marketing site are unchanged.
Keep shared offline defaults and download optional fonts into a validated cache with reliable export fallbacks. Prune stale Android DOM assets and refresh the smaller iOS editor bundles.
Preserve lazy startup boundaries through direct shared exports and dependency-aware splitting. Add ESM graph and Chrome startup checks to prevent eager editor and font loading.
Docker instances reported most deployment fields as unknown. Report how
and when the container image was built, separately from how the
instance was deployed:
- Dockerfile: optional EDGE_EVER_BUILD_CREATED_AT, EDGE_EVER_BUILD_TRIGGER
and EDGE_EVER_BUILD_METHOD build args, empty by default.
- /api/health (self-hosted-bun only): optional buildCreatedAt and
buildProvenance. deploymentVersionCreatedAt and deployment keep their
meaning and stay runtime-supplied; Cloudflare responses are unchanged.
- docker-image.yml: official images record the build time and their
provenance. Draft-release builds dispatched with release_tag are
github_release, main pushes main_push, other dispatches manual.
The container test checks the health response for a metadata build
with runtime overrides and for a default self-build; the post-publish
audit checks the published image.
- Add an explicit `docker` deployment method. It is never inferred from
the runtime, and the registry source still comes only from
EDGE_EVER_CONTAINER_IMAGE.
- Web/desktop show "Image built at" and "Image build source" for Docker;
Android shows "Image built at". Older clients ignore the new fields.
- Document the build args and runtime variables in both Docker guides.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
Public share and form pages only added a robots meta tag from JavaScript,
so the HTML for /share/* and /form/* was served without any indexing or
caching directive, and the form page had none at all. Error responses
from /api/public/* also lacked X-Robots-Tag.
Send one policy everywhere a token-bearing link is served:
X-Robots-Tag: noindex, nofollow, noarchive, nosnippet, noimageindex
Cache-Control: private, no-store
Referrer-Policy: no-referrer
- /api/public/*: shared middleware in the application, so it applies on
Cloudflare and Docker, including 404/403 responses. Routes that already
set Cache-Control keep it.
- /share/* and /form/* HTML: _headers rules for Cloudflare static assets
and the self-hosted static server.
- Referrer-Policy keeps the share token out of Referer headers sent to
linked sites.
robots.txt is deliberately not used to block these paths: a disallowed
URL can still be indexed from external links, because crawlers never see
the noindex header.
Co-authored-by: tianma-if <yingwaizhiying@gmail.com>
Track close separately from exit, preserve probe outcomes on cleanup errors, and cover inherited pipes and Windows cwd locks. Add cross-platform CI with the official Codex ACP process chain smoke check.
Refs #523
Remove the unused React Native Markdown renderer. Pin safe YAML, shell quoting, tar, and cache dependencies; upgrade npm within the 11 series and apply upstream fixes to its hidden bundled Undici and cache copies.
Add actual-consumer security regressions and an opt-in real npm/ACP upgrade verifier. Typechecks, Web build, Android APK/signature checks, and 2,997 tests passed (23 skipped). Real old-to-new npm installs, ACP initialize, rollback, restart, and fallback retention passed under the desktop Electron runtime.
Android USB-device validation and full desktop automatic-update release gates remain pending. Dependency audit is reduced from 85 to 74 unique advisories; this is not a complete security clearance.
Raise the managed ACP archive download limit, clean orphaned staging directories after interrupted first installs, and add simulated and real Linux cross-version verification.
Video notes keep a hidden marker, and the note list can queue subtitle extraction. The desktop app downloads the audio with yt-dlp and sends it to the selected OpenAI-compatible speech service.
Official entries stay on the bundled registry. The instance returns a community file only when EDGE_EVER_COMMUNITY_REGISTRY_URL is set, and submission opens from its own marketplace entry.
Desktop lists come from the sidecar, which omitted the type flags the shared card uses. List rows now carry the same infographic, diagram, and table metadata as the web list, without the document payload.
Chrome and Firefox uploads were done by hand. Submit Web Clipper now packages the extension and sends it for review without joining the product release.
tianma-if