* test(api): cover public table form access, uploads and submissions
Run the public form routes and the owner form settings routes on SQLite
with every migration and filesystem storage: unknown, closed and
deleted-note tokens, password unlock and its rate limit, the fields a
form publishes, stale pending upload cleanup, field validation, and
which uploads a submission may attach.
* fix(api): accept file uploads on public table forms
Public form routes run without a signed-in user, but storing an upload read
the workspace from the auth context, so every valid upload to
POST /api/public/forms/:token/resources failed with a TypeError (HTTP 500).
In the form page the visitor's row was then saved without its file.
- Resource creation accepts the note's workspace explicitly, and the form
upload passes the form's workspace.
- A form accepts uploads only when it publishes an attachment field, and
holds at most 50 uploads that were not submitted yet (stale ones are
still retired after an hour). The limit is checked again after storing,
so concurrent uploads cannot exceed it.
- A submission marks as used only the files its new row references; a file
sent in another cell stays pending and is retired like other stale
uploads instead of being kept forever.
* test(api): cover JSON backup restore end to end
Export a workspace through GET /api/v1/backups/json and restore it into
another installation through the restore routes, on SQLite with every
migration and filesystem storage, the way the ZIP backup does:
- notebooks, notes, revisions, tags, pinned state and files round-trip
unchanged, and the restored notes are searchable and tagged;
- restoring the same backup twice changes nothing and keeps one object
per file, and re-restoring a file replaces and removes its old object;
- restoring brings back notes and notebooks deleted after the backup and
undoes later edits;
- damaged or minimal content falls back safely (empty document, Markdown
derived from JSON, default title, normalized tags);
- ids used by another workspace, notebooks or notes pointing outside the
workspace, revisions of another note, invalid file metadata, missing
notes, empty files and another user's file id are rejected without
writing;
- only signed-in users can restore.
Raises line coverage of backup-service.ts from 6% to 99% and of
backup-routes.ts from 46% to 94%.
* fix(api): validate a restore page before writing any note
restoreJsonMemos checked that each revision belongs to its note inside the
write loop, so a page whose second note carried another note's revision
returned 400 after the first note had already been restored. The check now
runs for the whole page before anything is written.
* test(api): cover note trash, restore and permanent deletion
* test(api): cover user management and login session endpoints
Exercise the user and session routes against an in-memory SQLite database with every migration applied and sessions created through real password logins: owner-only access, member provisioning, username and password validation, password resets and account disabling revoking sessions, per-device session listing, renaming and revocation, and per-user storage usage.
* test(api): cover object storage settings and credential handling
Exercise the object storage routes and resolution helpers against a fully migrated in-memory SQLite database with a stubbed S3 endpoint: owner-only access, secret redaction and encryption at rest, input validation, switching providers, per-resource storage resolution, fallback-key credential migration, undecryptable credentials and grouped deletion.
The full non-E2E suite (`bun run test`) only ran inside the release
workflow, and pull requests only built the Docker image, so a failing test
or type error surfaced at release time. A new Test workflow runs on every
pull request and push to main (Markdown and docs-only changes excluded):
- "Type check and build": `bun run typecheck`, `bun run typecheck:mobile`
and `bun run build:web`;
- "Regression tests": `bun run test` (bulk and integration suites).
It uses the Bun version pinned in package.json, retries `bun install` like
the other workflows, cancels superseded runs, reads the repository only,
and is limited to this repository so deployment forks spend no runners.
* fix(api): store LF line breaks for multipart image notes
multipart/form-data encodes line breaks in text fields as CRLF. Browsers
always do so, and Bun 1.4 now does as well, so notes created through
POST /api/v1/memos/with-image (used by the Web Clipper) were stored with
CRLF line breaks, while every other note uses LF. The route now normalizes
the Markdown field to LF before creating the note.
This also fixes the existing route contract test under Bun 1.4, and a new
test sends a CRLF multipart body like a browser does.
* test(desktop): make ACP host tests independent of the machine and Bun version
- The ACP command allow-list test checked that a missing command is not
installed, but on macOS the resolver also looks in /opt/homebrew/bin and
/usr/local/bin, so it failed on any machine with that command installed.
The test now only sees its temporary directory.
- The fake WorkBuddy agent started its account API without a port during
probes and chats. Bun 1.3 then listened on a random port, while Bun 1.4,
like Node, rejects port NaN, so six WorkBuddy session tests hung until
their timeout. Like WorkBuddy itself, the fake agent now serves the
account API only when started with a port.
* feat(templates): show unedited default templates in the current UI language
Default templates are stored in the language of the workspace's first
sign-in, so switching the UI language left them in that language. While a
default template still equals one of its seeded translations, the web
template center and the Android template picker now show it in the current
UI language, and using it creates the note in that language. Templates the
user created or edited are shown and used exactly as stored.
POST /api/v1/templates/:id/use accepts an optional `locale`; without it the
stored template is used as before, so MCP, agents and older clients are
unaffected.
* fix(templates): edit the stored template and stop localizing retagged defaults
- The template center now keeps each card's stored template next to its
display translation. Editing starts from the stored fields, so saving a
name-only change in another UI language no longer writes the translated
title, description and Markdown.
- A default template whose tags differ from its seeded tags is treated as
edited and is no longer localized.
- Add regression tests for the name-only edit and changed tags.
Mirror the retry loop already used in desktop-build.yml for every remaining one-shot 'bun install --frozen-lockfile' step so transient registry or network failures (e.g. a failed mermaid tarball download) no longer fail the whole run. deploy-tools.yml gains shell: bash because its matrix includes windows-latest; sync-edgeever-upstream.yml uses break on success so the following verification commands still run.
* feat(workspace): localize default notebooks and welcome note at first sign-in
A new installation always created its five default notebooks, welcome
note and note templates in Chinese, whatever the interface language.
Members added by the owner got notebooks and templates in the owner's
language instead of their own.
The seed data is now localized once, at the first sign-in of the
workspace's user, using the UI locale the client sends with the login
request (Web and Android send it; other clients fall back to
Accept-Language, and unsupported languages to English).
Migration 0070 marks the default workspace as waiting for this only on
an installation nobody has used yet: no users, no notes beyond the
welcome note, no edits to it, no extra notebooks, revisions or
resources. Existing installations keep their data unchanged. Member
workspaces created by the owner are marked when created.
The sign-in localizes notebook names, templates, the welcome note and
its search document in one transaction that also clears the mark, and
replaces only values that still equal a seeded translation. A failed
attempt leaves the mark for the next sign-in to retry, and a second
sign-in changes nothing. The demo clears the mark so its bilingual seed
stays as it is.
Refs #483
* fix(workspace): guard seed inserts and title-only welcome edits during localization
- Default template and AI prompt inserts in the first-sign-in batch now
require the pending marker, so a delayed concurrent sign-in cannot
recreate seeds removed after the faster sign-in finished.
- The welcome note is treated as untouched only while it keeps the seeded
title, the system actor, the seed content hash, and revision 0, so a
title-only edit is no longer overwritten.
- Add regression tests for both cases.
Refs #483
Add notebook-level share management, directory navigation, and live subtree checks for notes and attachments. Include migration and access-boundary regression tests.
Refs #551
Preserve HTTP status and fixed failure categories for direct and proxied agent requests, display diagnostics beside failed turns, and prevent AI SDK error logging from exposing request data.
Refs #555
Add owner-only attachment summaries and a compact member management table. Keep personal attachment statistics unchanged and exclude Trash from usage totals.
Refs #553
Dariusz Koryto