macOS/Windows CI runners report prefers-reduced-motion: reduce, making the
component skip the rocket animation and dispatch startFocusSession
immediately. The spec read the host setting directly, so the three
inline-launch assertions failed on those platforms (release build 18.13.0)
while passing on Linux. Stub matchMedia in both startSession describe blocks
and add coverage for the reduced-motion shortcut.
The iOS and macOS release lanes both run on a v* tag push and can race
on App Store Connect's per-app review-submission state. When they
collide, the lane that submits second fails with 'A review submission is
already in progress' -- but only after its binary has already uploaded
and processed successfully, so the build is safe.
Route both lanes through a shared submit_to_app_store helper that treats
that one collision as a soft success and emits a GitHub Actions warning
annotation so the required manual step (add the build to the open
submission) stays visible on a green run. Every other failure, and any
failure before upload (e.g. the version-creation race), still aborts the
lane loudly.
* fix(sync): scan all tags when archiving to avoid dangling tag refs
The archive path only cleaned tags named in each task's own tagIds, so a
one-sided tag->task reference (tag.taskIds holds an id the task omits) left
behind by a sync replay was never removed. That dangling reference later
tripped cross-model validation and forced a reconciliation/REPAIR.
Lift removeTasksFromAllTags into the shared helpers and reuse it in the
archive path so cleanup is symmetric with the delete path (scans every tag).
Add regression coverage.
* refactor(store): route project-delete tag cleanup through shared helper
Replace the hand-rolled all-tags scan in handleDeleteProject with the shared
removeTasksFromAllTags helper, matching the delete and archive paths (and
gaining its no-op skip for tags that don't reference the deleted tasks).
Move the helper into the STATE UPDATE HELPERS section (it is a state->state
transform, not a list helper) and let its JSDoc own the one-sided-tag-ref
rationale, trimming the duplicated archive call-site comment to a pointer.
No behavior change: final tag taskIds are identical; only unaffected tags now
keep their reference identity instead of being rewritten to equal arrays.
Standardize dialog actions: primary=mat-flat-button color=primary,
secondary/cancel=mat-button, destructive=color=warn. Drop dead Bootstrap
'btn btn-primary' classes and decorative check/close icons. Document the
convention in docs/styling-guide.md and update e2e selectors that keyed
on the old stroked variant.
Closes#8683
* feat(update-check): notify desktop users about new releases (#5463)
* fix(update-check): build release URL locally, use HttpClient with timeout
* feat(update-check): add translations for all locales
* feat(rate-dialog): native store review + prompt after a productive win
Baseline of PR #8680 (squashed) so review improvements land as a separate,
cherry-pickable commit on top.
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(rate-dialog): calm banner, feedback cooldown, delayed win prompt
Review + UX follow-ups on top of PR #8680:
- Fix (correctness): re-check full eligibility at prompt fire-time, not just
opt-out, so a crash/data-damage recorded after arming still suppresses it.
- Fix: iOS advances the rating cadence only once the native request resolves;
a reject leaves eligibility intact instead of burning a lifetime prompt.
- Fix: Android review-flow failure now logs and abandons instead of opening the
Play Store unprompted (the trigger is an automatic win, not a user tap).
- UX: web/electron/F-Droid now show a calm, non-modal banner that opens the full
rate/feedback dialog on request, rather than a modal shoved in mid-flow.
- UX: 'give feedback' no longer permanently opts out — it starts a long cooldown
(~90 app-start days) so an engaged user can still be asked once more later.
- UX: the win prompt fires a few seconds after the completion, not on the tap.
- UX: dedicated 'Send feedback' entry in the Help menu (GitHub Discussions).
- UX: show the maintainer email as selectable text (mailto: dead-end fallback).
- Refactor: move selectTodayProgress into work-context.selectors (colocation);
idempotency guard on the win subscription.
Co-Authored-By: Claude <noreply@anthropic.com>
* test(rate-dialog): import WIN_PROMPT_DELAY_MS in spec instead of mirroring it
Export the delay constant from the service and reference it in the spec so the
test can't silently drift from the real value. Found by a review pass.
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(rate-dialog): recurring cadence, version-age gate, GitHub star CTA
Growth-focused follow-ups (review found the lifetime cap starves review
recency/velocity, which is what stores rank on):
- Recurring cadence: after the fixed onboarding tiers (32/96 app-start days) the
prompt no longer stops forever — it recurs every ~180 app-start days (~6+
months of real use), well inside Apple's ~3/365 allowance and Play's own
quota. Still calm: win-timed, opt-out/crash/feedback-gated, OS-throttled.
- Version-age gate: hold the prompt for 7 days after the app version changes so a
fresh (possibly regressed) release isn't asked to be rated immediately. Tracked
via two device-local LS keys, checked at arm time and fire time.
- Play tier-burn is now only a deferral, not a lifetime loss (recurring cadence).
- Web/Electron CTA: 'Star us on GitHub' (the desktop-distribution equivalent of
store ranking) instead of the near-zero-conversion how-to-rate doc.
Tests cover recurrence at + beyond the last tier, the version-age gate, and the
updated cadence expectations. 60/60 green; tsc clean.
Co-Authored-By: Claude <noreply@anthropic.com>
* fix(rate-dialog): register iOS plugin, drop version-age gate, cut per-tick churn
Second multi-review pass (7 reviewers):
- CRITICAL (Codex, verified): the iOS StoreReview Capacitor plugin was never
registered — CustomViewController registers WebDavHttpPlugin but not
StoreReviewPlugin, so requestReview() rejected and the native App Store review
card never showed. Register it via registerPluginInstance.
- Remove the version-age gate (4 reviewers): getAppVersionStr() changes every
release and the app ships ~weekly, so the 7-day window kept re-arming on every
update (web SW reload / Electron auto-update) and near-permanently suppressed
the prompt on desktop — the platform where the GitHub-star intent matters most.
It also duplicated the 30-day crash gate, which already covers crashing
regressions. Drops 2 LS keys, a constant, and ~40 LOC.
- Perf: add distinctUntilChanged on the armed win stream so the 1s time-tracking
tick (new {done,total} with identical numbers) no longer re-runs scan/filter
every second for the whole session.
59/59 specs green; tsc clean. Kotlin/Swift can't be compiled here — the iOS
registration needs an on-device/simulator smoke test.
Co-Authored-By: Claude <noreply@anthropic.com>
* chore(i18n): translate new rate-prompt strings into all locales
Add BANNER_ACTION, BTN_STAR_GITHUB (F.D_RATE) and SEND_FEEDBACK (MH.HM) to all
27 non-en locale files — previously they existed only in en.json and fell back
to English for everyone else. SEND_FEEDBACK reuses each locale's existing
feedback wording for consistency; GitHub is kept untranslated.
Deliberately edits locale files beyond the usual en-only workflow, per request.
Best-effort translations — a native check on the less-common languages is
welcome.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Fixes the Today background leaking onto non-context pages (Planner,
Schedule, Boards, Config) and the startup flash reported in #8643.
The active work context stays "Today" (the reducer default) on pages
that aren't a tag/project, so its background was shown there wrongly.
Resolve the background per-route instead: per-context image -> global
wallpaper -> none, with overlay-opacity and blur following whichever
image is actually shown (never the sticky context's on global pages).
- add a global wallpaper (image dark/light + overlay opacity + blur) to
MiscConfig, surfaced via a "Set wallpaper..." dialog under Theme
- resolveBackground() replaces the URL image helper and returns the
styling source; a cleared/empty image falls back to the global one
- app.component derives opacity/blur from the resolved source
Builds on the URL-aware background stream contributed in the PR.
Co-authored-by: Johannes Millan <johannes.millan@gmail.com>
Co-authored-by: jibin7jose <jibin7jose@users.noreply.github.com>
Clicking the + button moved focus onto the button, which unmounts once
the input clears, dropping focus to <body>. Route the click through a
new onSubmitBtnClick() that refocuses the input after addTask() settles
so the next task can be typed right away. The Enter-key path already
retained input focus, so it is unchanged.
The #8667 regex only rejected pasted display names (values with spaces),
so a bare single-segment slug like `test_config` still passed and produced
a confusing 404 at poll time (#8665). A GitLab project reference must be a
numeric ID or a namespace-qualified path (`group/project`, subgroups, or
the `%2F`-encoded form) — the REST API cannot resolve a bare slug (verified
live: `/projects/gitlab/issues` → 404, `/projects/gitlab-org%2Fgitlab/issues`
→ 200). Require a path separator for the non-numeric branch so the mistake
gets inline feedback (Save/Test are gated on form validity) instead. The
separator lookahead keeps the char class a single unnested quantifier.
* feat(sync): show banner when LWW discards a user content edit
Auto-resolved LWW conflicts were only surfaced as a generic "N local/
remote wins" count snack, so a field-level edit silently dropped by
last-write-wins (e.g. a title edit lost to a concurrent notes edit) was
invisible to the user (#8694).
Split the resolution outcome: routine self-healing (reschedule/repeat/
archive/done churn) keeps the quiet count snack, while a resolution that
discarded a genuine content edit (task title/notes/subtasks/attachments)
shows a dismissible banner naming the affected task(s).
- New pure summarizeLwwResolutions() classifier in @sp/sync-core (inspects
the losing side's changed fields; UPDATE only, so create/delete/move and
scheduling churn stay routine).
- Titles are HTML-escaped before the innerHTML banner (they come from
synced remote data) and never logged.
* fix(sync): correct + simplify LWW content-conflict notice (multi-review)
Address multi-agent review of the previous commit:
- CRITICAL: the classifier's multi-entity branch made the feature a no-op
in production. Captured ops are always wrapped as
{ actionPayload, entityChanges: [] } and task edits never populate
entityChanges (only time-tracking does), so a real title/notes edit was
read as having no changed fields → classified routine → banner never
fired. Fixed by dropping the branch and relying on extractUpdateChanges
(which unwraps actionPayload), gated to UPDATE ops. Spec now uses the
real wrapped payload shape so this can't regress.
- Move the classifier out of the framework-agnostic @sp/sync-core package
into the app (findLwwContentConflicts); it held app-specific TASK field
names and was exported but unused. TASK-only, no generics/callback.
- De-duplicate content conflicts per task (one task can yield several
concurrent conflicts) so the banner never lists a title twice.
- Direction-neutral wording ("Older edits may have been discarded") since
the discarded side depends on which client won.
- Use the banner's built-in dismiss button instead of a no-op action.
- Consolidate escapeHtml: escapeHtmlAttr now re-exports the shared util.
- Guard against a non-string title before trim().
* fix(sync): drop dead 'attachments' from LWW content fields (review)
Second-review WARNING: attachments are edited via dedicated
[TaskAttachment] actions with payload { taskId, taskAttachment }, never
updateTask({ task: { changes: { attachments } } }), so extractUpdateChanges
never surfaces an 'attachments' key — the entry could never match and
falsely claimed coverage. Removed it (title/notes/subTaskIds are live) and
added a guard test asserting a real attachment-action-shaped op is not
flagged, so it isn't naively re-added.
* feat(plainspace): add "Open in Plainspace" header button for shared projects
Surfaces a one-click link to the bound Plainspace space in the project
header (page-title actions), shown only for projects shared on Plainspace.
- getSpaceUrl$ resolves the space slug via /me and builds {host}/{slug}
- openProjectOnPlainspace opens it externally (Electron) / new tab (web),
with an OPEN_FAILED snack when the slug can't be resolved (offline/token)
- selectPlainspaceProviderForProject selector (selectIsProjectShared\* DRY'd)
* fix(plainspace): harden Open-in-Plainspace URL resolution + a11y
Multi-review follow-ups:
- getSpaceUrl$ guards a malformed /me body (non-array projects) instead of
throwing an unhandled rejection, and requires a non-empty slug (blank slug
would open the host root) — both now return null → OPEN_FAILED snack
- add aria-label to the header icon button
- correct stale comments referencing the removed context-menu entry
* docs(plainspace): note web popup-blocker limitation on external open
Users with several past installs/reinstalls accumulate >20 client IDs in
the vector clock, so pruning fires on nearly every download-merge. The old
notice was a sticky WARNING recommending a destructive "sync reset" for a
benign, self-healing cleanup, and it recurred constantly.
Split the signal by purpose without touching pruning correctness:
- Log: OpLog.info -> OpLog.warn, plus prunedIds/survivingIds so the churn
is diagnosable from the exported log history users share in reports.
- Snack: throttle to once per app session (take(1)); WARNING -> CUSTOM
with a neutral icon and auto-dismiss instead of a sticky alert.
- Reword the message: drop "exceeding the limit"/"sync reset", keep the
numbers as a breadcrumb.
* fix(electron): open file:// URLs with special characters (#8695)
Local file:// URLs with non-ASCII names or spaces (e.g. Grüne, "Another
One") failed to open on Windows: both open sinks handed the URL to
shell.openExternal, which percent-encodes the path (ü → %C3%BC, space →
%20) before ShellExecute, so the OS then searched for a literally-named
folder and failed. Pure-ASCII paths worked because there was nothing to
encode.
Route local file: URLs through shell.openPath with a decoded filesystem
path (fileURLToPath) instead. openPath takes a raw path, so Unicode names
and spaces open correctly. This also applies the executable-extension
guard to file: URLs, which previously only ran on the OPEN_PATH sink
(GHSA-hr87-735w-hfq3).
Shared openLocalPath()/isLocalFileUrl() cover both the OPEN_EXTERNAL IPC
handler and the navigation-interception path in main-window.
* test(electron): cover NTLM/exec vectors at the un-pre-gated openPath sink
Follow-up to the #8695 review. Add regression tests locking in that
openLocalPath alone (OPEN_PATH has no scheme pre-gate) blocks the
path-based UNC file: URL (file:////host/share, GHSA-hr87-735w-hfq3) and
an executable hidden behind a percent-encoded dot (evil%2Ebat). Document
that the decode tests run on Linux and therefore don't exercise the
Windows drive-letter/backslash conversion, and clarify why isLocalFileUrl
is intentionally broader than the renderer/scheme-allowlist checks.
The project-field validation regex was only end-anchored, so display
names containing spaces (e.g. "My Group/My Gitlab") passed validation
and produced a confusing 404 at poll time instead of inline feedback
(#8665). Anchor the regex at both ends and simplify the path branch to a
plain character class so it stays a permissive "did you paste a display
name?" guard (still accepts consecutive hyphens and other GitLab-valid
paths). Clarify the field hint to ask for the path slug or numeric ID,
and add regression tests plus a field-wiring check.
* test(sync): arm setup-sync flag so encryption prompt spec exercises dialog path
The two _promptSuperSyncEncryptionIfNeeded() specs added in #8679 predated the
_shouldPromptEncryptionAfterSetupSync one-shot guard introduced by #8678. After
both merged, the method early-returns unless the flag is armed, so MatDialog.open
was never called and the "opens immediately" / "defers then opens (#8670)" specs
failed. Arm the flag via the public markPromptEncryptionAfterSetupSync() in the
describe beforeEach; this also makes the "does not prompt" specs exercise their
real code paths instead of passing on the early return.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016QwEVhejcpqtTknDqaCNic
* test(encryption): stop crypto.subtle stub leaking across specs
encryption.browser.spec stubbed window.crypto.subtle to simulate an insecure
context, capturing Object.getOwnPropertyDescriptor(window.crypto, 'subtle') to
restore it. But subtle is an accessor inherited from Crypto.prototype, not an
own property, so that descriptor is undefined and the stub defines a shadowing
OWN property. The finally block only restored `if (originalDescriptor)` — always
falsy — so the `subtle: undefined` stub was never removed and leaked into every
later spec in the karma run. Any spec relying on isCryptoSubtleAvailable() then
saw false suite-wide; under Jasmine's randomized order this intermittently broke
the SuperSyncEncryptionMigrationBannerService specs (banner never opened → 7
failures), surfacing only when this spec happened to run first.
Restore via a helper that reinstates the original descriptor when present and
otherwise deletes the shadowing own property, re-exposing the prototype getter.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016QwEVhejcpqtTknDqaCNic
---------
Co-authored-by: Claude <noreply@anthropic.com>
After the #8670 E2EE-mandatory upload guard, first-time SuperSync setup skips
the initial upload (no key yet), so the first sync reaches IN_SYNC almost
instantly — faster than the sync-config dialog's close animation. The post-sync
_promptSuperSyncEncryptionIfNeeded then ran while the config dialog was still in
openDialogs and hit the one-shot 'dialog already open -> skip' guard, so the
mandatory-encryption prompt never opened. Setup silently finished with sync
enabled, no encryption configured, and nothing uploaded — and the whole
@supersync e2e suite went red (all 6 shards, ~72 failures with 'Unable to
determine Client A vs B').
Make the guard DEFER instead of DROP: wait (bounded) for open dialogs to clear,
then re-validate the active provider and re-check encryption state before
prompting. Add a fast-path so we never wait on our own prompt dialog. Re-checking
the provider after the wait prevents opening the disableClose setup dialog for a
provider that was switched/disabled while we waited. Nothing is uploaded before a
key exists, so the security invariant of #8670 is preserved.
Regression tests cover: immediate open when no dialog is open, defer-then-open
once the dialog closes (#8670), skip when encryption is configured while waiting,
skip when the provider is no longer SuperSync after the wait, and skip when
already enabled.
NOTE: this branch predates #8670; rebase onto current master (which contains the
isEncryptionMandatory guard) before merging so this actually turns the red
@supersync CI green.
* feat(sync): calm E2EE migration banner for existing unencrypted SuperSync
Nudge established, unencrypted SuperSync accounts to enable end-to-end
encryption via a calm, dismissible banner (once per app start, device-local
snooze) instead of the dead-end per-sync setup modal.
- New SuperSyncEncryptionMigrationBannerService, shown at
afterInitialSyncDoneAndDataLoadedInitially$ (mirrors SyncSafetyBannerService).
- Detect: SuperSync + isReady() + getLastServerSeq() > 0 + getEncryptKey()
undefined + WebCrypto available. isReady() being false for the
half-configured state auto-excludes the multi-device needs-password cohort.
- Data safety: the action runs a fresh sync (download+merge) and re-checks the
server is still unencrypted immediately before the destructive
delete-and-reupload; aborts (snack, no re-encrypt) if the server turned out
encrypted elsewhere. Opens the escapable dialog (initialSetup: false).
- Snooze (14d) via localStorage, no telemetry; recurs calmly rather than
dismiss-forever.
- Avoid double-prompt: gate the legacy setup modal behind a one-shot flag set by
the config dialog only on fresh SuperSync enable, so established users are
owned by the banner and fresh setups still get the one-time modal.
Refs #8672, #8671
* fix(sync): harden SuperSync E2EE migration banner per multi-review
Address findings from the multi-agent review:
- Arm the fresh-setup encryption flag regardless of connectivity. Previously it
was set only inside `if (isOnline())`, so an offline SuperSync setup never
flagged and the later online sync silently skipped the prompt (and the banner,
since seq was 0), risking an unencrypted upload. (Codex CRITICAL)
- Snooze only once the migration dialog is actually reached, not on the Enable
click. A transient pre-sync failure (HANDLED_ERROR: offline/network/lock) no
longer hides the nudge for the full 14-day window. (consensus)
- Consume the one-shot setup flag at the top of the post-sync prompt (once
SuperSync is confirmed) instead of only when the modal opens, so it can't leak
to a later, unrelated sync and pop the dead-end modal; also short-circuits the
common path before loading config.
- Reuse `_isMigrationNeeded()` for the post-sync re-check and delete the
duplicated `_isServerStillUnencrypted` (DRY); add a dialog-stacking guard so
the escapable dialog never stacks on an enter-password prompt.
- Correct the detection comment: `isReady()` excludes only the half-configured
state; the never-encrypted-locally cohort is caught by the HANDLED_ERROR defer.
- Document why the dialog is opened directly (the shared opener forces
disableClose, which would break the calm banner's escapability), and add a
TODO(#8670) to retire the legacy modal + flag once the upload guard lands.
Refs #8672, #8671
* test(sync): cover offline arming of the SuperSync setup encryption flag
Follow-up to the multi-review verification:
- Add a dialog-sync-cfg regression test asserting the fresh-setup encryption
flag is armed even when offline (and that no sync is kicked off), locking in
the fix that moved arming outside the isOnline() gate.
- Note the one-shot flag consume-at-top tradeoff in _promptSuperSyncEncryptionIfNeeded
(a rare blocked modal-open won't retry; the migration banner catches it next
app start).
Refs #8672
Background auto-imports fire regardless of what the user is viewing, but
getTaskDefaults inherited the active non-Today tag into the imported task,
stamping an unrelated tag that then synced to all devices (#8673).
Reachable via two paths, both fixed:
- issue-provider backlog polls (pollingMode 'always', now the Plainspace
default) — and the classic 'whenProjectOpen' poll too, whose in-flight
import can resolve after a context switch and read the live tag.
- calendar auto-import for the current day.
Every import through checkAndImportNewIssuesToBacklogForProject is an
automatic backlog poll targeting the provider's default project, so mark
them (and the calendar auto-import) with a new isAutoImport flag on
addTaskFromIssue and skip the contextTagIds inheritance for those. Naming
follows the existing isAutoImportForCurrentDay / isAutoAddToBacklog.
Foreground (user-initiated) imports are unchanged.
Closes#8673
* feat(plainspace): create tasks directly in a Plainspace-backed project
Adding a top-level task to an SP project that has a bound PLAINSPACE issue
provider now creates the task in the Plainspace space so the team sees it,
symmetric with the existing auto-import. Wires into the generic
autoCreateIssueOnTaskAdd$ pipeline:
- PlainspaceApiService.createTask$ -> POST /api/integration/tasks { spaceId,
title }; errors propagate so a failed add surfaces a snack.
- PlainspaceSyncAdapterService.createIssue links the returned SPTask id and
seeds the two-way-sync baseline (no issueNumber, so no '#123' title prefix).
- _hasAutoCreateEnabled recognises the native PLAINSPACE key (no opt-in flag;
the bound provider is the opt-in).
Requires a new PAT-authed server route POST /api/integration/tasks (documented
in docs/plainspace-api-extension-plan.md 4c); inert until that ships.
* fix(plainspace): only auto-create tasks once the provider is configured
Multi-review follow-ups to the create-task feature:
- _hasAutoCreateEnabled now requires a bound Plainspace provider (spaceId +
token), not just isEnabled. selectEnabledIssueProviders filters on the flag
only, so a mid-connect provider (spaceId/token still null) previously POSTed an
invalid create and error-snacked on every task add; now it skips silently until
configured. Adds a covering spec.
- Drop the unnecessary 'as unknown as' double cast in createIssue.
- Drop the unnecessary 'as any' on the valid 'PLAINSPACE' key in the effect spec.
* feat(plainspace): poll for new tasks in the background by default
Default Plainspace providers to pollingMode 'always' so tasks assigned to
me auto-import into the bound project's backlog without navigating to that
project. Covers both creation paths (share auto-provision and the generic
add-provider dialog) via DEFAULT_PLAINSPACE_CFG.
Keep background ('always'-mode) polls silent: skip the per-poll 'Polling
backlog…' spinner snack and only notify when a task is actually imported,
so a 5-min background poll no longer flashes UI every tick.
Affects new connections only; existing providers keep their stored
pollingMode.
* fix(plainspace): deterministic task id to avoid cross-device import dupes
Multi-review (sync-correctness) caught a CRITICAL surfaced by defaulting
Plainspace to background 'always' polling: imported tasks used a random
nanoid() id and dedup is purely local, so two open clients polling within a
sync round-trip would each create their own task for the same issue and the
op-log would keep both. Every other built-in provider defaults to
whenProjectOpen, so Plainspace is the first to hit this at scale.
Give Plainspace imports a deterministic natural-key id
(ps_<providerId>_<issueId>), mirroring the existing calendar
generateCalendarTaskId pattern, so concurrent addTask ops converge on one
entity id instead of duplicating. Also scope the config comment to what is
actually suppressed (the backlog-poll spinner; the update-poll progress bar
still ticks).
* fix(sync): never upload plaintext ops for E2EE-mandatory providers
SuperSync's first-time setup ran an initial sync (dialog-sync-cfg save ->
sync(true)) BEFORE the user chose an encryption password, so all local ops
(incl. issue-provider credentials) were uploaded to the server in cleartext.
Completing setup deleted them; aborting left them stored indefinitely, breaking
the E2EE promise (GHSA-9v8x-68pf-p5x7).
Add an optional `isEncryptionMandatory` capability to OperationSyncCapable
(true for SuperSync) and refuse to upload in the op-log upload path while no
usable key is configured. Downloads still run (merge-first) and the encryption-
enable flow performs the first, encrypted upload, so the setup flow and prompt
are unchanged. File-based providers, where unencrypted sync is a legitimate
user choice, leave the flag unset.
* fix(sync): fail closed on plaintext snapshot for E2EE-mandatory providers
Multi-review hardening for GHSA-9v8x-68pf-p5x7. The op-upload guard closes the
reported leak, but SnapshotUploadService.deleteAndReuploadWithNewEncryption could
still push a plaintext snapshot for SuperSync on two adjacent paths: the (today
UI-unreachable) disable-encryption flow, and a keyless import declaring
isEncryptionEnabled:true. Reject an unencrypted snapshot for an encryption-
mandatory provider before any destructive deleteAllData, so the "never transmit
plaintext" invariant holds regardless of caller.
Also lower the mandatory-encryption upload-skip log from warn to normal: it is an
expected by-design skip during the pre-encryption setup window and would
otherwise fire on every auto-sync cycle.
* fix(sync): consolidate op-log into the encryption-enable snapshot
Follow-up to the GHSA-9v8x-68pf-p5x7 upload guard. With the guard, first-time
SuperSync setup leaves the whole local history unsynced until encryption is
enabled; the enable-snapshot then represents that full state, but the ops were
re-uploaded incrementally on top of it on the next sync (redundant server op-log
bloat, and previously untested at whole-history volume).
deleteAndReuploadWithNewEncryption now captures the pending ops the snapshot
subsumes (before the destructive delete, under runWithSyncBlocked + a modal
dialog so the set is stable) and marks them synced after a successful upload —
mirroring planRegularOpsAfterFullStateUpload in the op-log upload path, which
this direct snapshot upload bypasses. Also fixes the same latent redundancy in
the enable-from-settings-with-pending-ops flow.
Adds a multi-client e2e: local task history exists before first-time encrypted
setup, then a second client with the same password receives exactly those tasks
with no duplicates, conflicts, or errors.
* ci(e2e): add optional grep input to manual SuperSync e2e dispatch
* fix(sync): capture subsumed ops before state snapshot to prevent mark-synced data loss
deleteAndReuploadWithNewEncryption captured getUnsynced() AFTER the full-state
snapshot, so an op created in that window was marked synced yet absent from the
snapshot — silently lost. Capture the unsynced set first: every marked-synced op
is then guaranteed present in the snapshot, and a concurrent op arriving after
the capture is left unsynced and re-uploaded next sync (idempotent by op id).
* test(sync): mock WebCrypto so mandatory-encryption guard test reaches the guard
The 'enabling without a usable key' case passed isEncryptionEnabled: true but did
not mock WebCrypto, so the availability check threw WebCryptoNotAvailableError in
non-secure CI before the /unencrypted snapshot/ guard under test.
* fix(electron): block executable launch via shell.openPath
window.ea.openPath is reachable by any plugin, same-origin iframe plugin, or
renderer XSS, and its guard only blocked UNC/remote paths (NTLM leak,
GHSA-hr87). shell.openPath hands a local file to the OS handler, and on
Windows ShellExecute runs .bat/.cmd/.vbs/.hta/... from a plain file with no
exec bit. Chained with a writable-dir drop (e.g. FILE_SYNC_SAVE into the
local-file sync folder) or a malicious synced FILE attachment clicked by the
user, that is renderer -> native code execution bypassing the nodeExecution
consent gate.
Add hasExecutableFileExtension() (normalizes Windows trailing dots/spaces and
NTFS alternate data streams) and refuse those paths at the openPath sink.
Applied at the sink, not in the shared isPathSafeToOpen, so link/image
rendering (where a remote https://.../x.exe is legitimate) is unaffected.
* fix(electron): close # filename bypass in openPath executable gate
The executable-extension check split every path on `?`/`#` to drop a URL
query/fragment, but `#` is a legal Windows/NTFS filename char (and both `#`
and `?` are legal on POSIX). For a bare filesystem path that split truncated
the real filename: `C:\sync\evil.txt#.bat` was read as `.txt` and allowed,
yet ShellExecute runs it as `.bat` — defeating the gate via the same
drop-a-file-then-openPath vector the fix targets. Gate the query/fragment
split behind an actual `file:` scheme so real filenames keep their extension.
Also add well-known ShellExecute/launcher vectors the curated denylist
missed: settingcontent-ms, appref-ms, library-ms, wsc, chm, hlp, diagcab,
msix/appx family (Windows) and pkg, terminal, fileloc, inetloc (macOS).
Adds regression tests for both.
* fix(electron): require file:// (not bare file:) before query/fragment split
The executable-extension gate stripped a URL query/fragment for any string
starting with `file:`. On POSIX `#`, `?` and `:` are all legal filename
chars, so a file whose name merely starts with the literal `file:` (e.g.
`file:notes.txt#.sh`) was mis-parsed as a URL and its real `.sh`/`.desktop`
extension hidden. Require the `//` of an actual `file://` URL so only genuine
URLs get the query/fragment split; bare paths keep their real extension.
* fix(electron): fail-safe exec confirmation dialog (GHSA-256q)
The EXEC confirmation was the only gate before an arbitrary shell command
runs with the user's privileges, but it did not fail safe:
- defaultId: 2 was out of range for a two-button dialog, leaving the
focused default per-platform-undefined, so an accidental Enter could
execute. Cancel is now defaultId + cancelId (Enter/Escape never runs).
- 'Remember my answer' defaulted to checked, so one careless click could
whitelist a command to the silent allow-list forever. It is now opt-in.
Add electron/ipc-handlers/exec.test.cjs as a regression guard.
* docs(plugins): correct misleading plugin sandboxing claims
Docs claimed JS plugins run in 'isolated VM contexts' and iframes run
'without allow-same-origin' — both are false. JS plugins run in the host
renderer via new Function, and iframes use allow-same-origin (required for
#8467), so both can reach the privileged window.ea bridge. Align the docs
with the code (plugin-iframe.util.ts) and stress the trust model.
* fix(electron): fail closed on corrupt exec allow-list, cover error paths
The EXEC handler is wired to ipcMain.on (fire-and-forget), so a throw on a
corrupt allow-list surfaced as an unhandled promise rejection with no user
feedback. Wrap the handler body in try/catch and route failures through
errorHandlerWithFrontendInform (the same channel exec errors already use),
failing closed so a corrupt store never falls through to executing.
Expand the regression tests: assert the corrupt-config path informs the error
and runs nothing, cover exec-error routing, and guard allow-list append (an
overwrite regression that wipes remembered commands previously passed green).
* docs(plugins): document window.ea.exec shell path in trust model
The trust-model section implied executeNodeScript() was the only process
path; on desktop window.ea.exec also runs arbitrary shell commands via
child_process.exec behind a separate, weaker gate (confirmation dialog +
persistent allow-list, not the nodeExecution consent).
* test(electron): run exec security regression tests in CI
The test:electron runner globs electron/*.test.cjs (non-recursive), so the
guard at electron/ipc-handlers/exec.test.cjs was never executed by CI —
verified: the suite went 160 -> 168 tests once discovered. Move it to
electron/exec.test.cjs (matching every sibling electron test) and point
execModulePath at ipc-handlers/exec.ts.
* refactor(electron): narrow exec allow-list without an unsafe cast
Drop the `as string[]` cast that asserted away the very corruption the
Array.isArray guard is meant to catch; narrow the unknown value honestly so
the guard is a real type-check. Behavior is unchanged (falsy -> empty list,
truthy non-array -> fail closed).
* fix(electron): stop logging exec command content
Per CLAUDE.md rule 9 (log history is exportable, never log user content), a
command can carry a secret in its arguments; log a content-free line instead.
Also fold the duplicated exec-spawn into a single runCommand() helper so the
allow-listed and just-confirmed paths share one audited call site.
* fix(electron): remove exec IPC to close GHSA-256q at the root
window.ea.exec exposed arbitrary shell (child_process.exec) to the whole
renderer: JS plugins (new Function in the host realm), same-origin iframe
plugins (window.parent.ea), and any renderer XSS — bypassing the per-plugin
nodeExecution consent gate entirely. Its only consumer, COMMAND task
attachments, is dormant: no UI creates them (the edit dialog offers only
LINK/IMG/FILE).
Rather than guard a dormant RCE primitive, remove it: delete the EXEC IPC
handler + preload.exec + the ElectronAPI method + the directive's COMMAND
branch. This closes the vector for plugins, iframes, AND host-realm XSS at
once (a bootstrap handoff would only hide it from plugins), and supersedes
the earlier dialog hardening (that primitive no longer exists).
Keep the 'COMMAND' literal in the synced TaskAttachment type (removing a
synced union member breaks typia validation on peers/legacy data); a click
on a legacy COMMAND attachment now shows an informational snack instead of
executing.
* docs(plugins): reflect exec IPC removal in the trust model
window.ea.exec no longer exists (removed to close GHSA-256q); the docs now
state executeNodeScript is the only sanctioned native-code path.
* test(electron): guard exec IPC stays removed (GHSA-256q)
The interim exec security tests were deleted together with the executor, so the
shipped fix had no regression coverage. Add electron/exec.test.cjs (picked up by
the electron/*.test.cjs CI glob) asserting the bare exec primitive stays gone:
no IPC.EXEC event, no exec.ts handler, no preload exec bridge, no ElectronAPI.exec
method, no initExecIpc wiring. Targets only the removed surface, not the
sanctioned PLUGIN_EXEC_NODE_SCRIPT/executeScript nodeExecution path.
* chore(electron): mark ALLOWED_COMMANDS store key as legacy
Its only reader/writer was the deleted exec handler (GHSA-256q). Document that it
is retained purely so older persisted stores keep loading.
* feat(plainspace): add Collaborate action to project context menu
Surface Plainspace sharing from the project context menu (active, non-Inbox,
not-yet-shared projects) so it can be discovered at the moment of collaboration
intent, reusing PlainspaceShareService. A new selectIsProjectSharedOnPlainspace
selector hides the action once a project is shared to avoid provisioning a
duplicate space on a repeat click.
* docs(plainspace): document collaboration in wiki
Add Plainspace to the issue-integration comparison (matrix + per-provider
section) and a how-to for sharing a project via the project menu, including the
network/privacy caveat.
* feat(plainspace): place Collaborate action below the share-list item
Group the two share/export actions and lift Collaborate higher for
discoverability. Gated to active, non-inbox, not-already-shared projects.
* fix(plainspace): smoother first-run connect and value-first dialog
Pre-check connectivity and revalidate a stored token before the space
picker, so a stale/foreign token routes to the connect dialog and an
offline state shows a calm message instead of the raw 'check your token'
picker error. Make the connect dialog value-first: lead with what you
get, drop the 4-step how-to and email hint in favor of one short pointer
(token-creation guidance moves to plainspace.org).
* docs(plans): dedicated from-Super-Productivity flow on plainspace.org
Open plan for a guided token/connect flow on plainspace.org when a user
arrives from SP (Model A manual token, Model B OAuth-style handoff).
* refactor(plainspace): drop redundant connect pre-check (multi-review)
The space picker already detects a stale token and offers a reconnect
(#8616), so the revalidate() pre-check duplicated that path, cost an
extra GET /me, and forced re-auth on a valid token during a transient
server blip. Keep only the one-line offline guard; drop revalidate(),
the discriminated union, and the unnecessary _isOnline() seam (navigator
.onLine is spyable in the runner). Fix stale doc comments and document
the disabled-provider trade-off in the selector.
* feat(plainspace): show brand icon in the connect dialog title
* feat(plainspace): deep-link connect dialog to the from-SP onboarding flow
Point the dialog's 'Open Plainspace' link at the dedicated
/connect/super-productivity entrypoint (which guides token creation)
instead of the bare marketing host, closing the connect-flow funnel leak.
* feat(plainspace): bounce back to the app after connecting (desktop)
Append a validated `?return=superproductivity://plainspace-connect` deep
link to the connect URL, gated on IS_ELECTRON (only desktop registers the
scheme — web/mobile would get dead buttons). Handle that action in the
Electron protocol handler by surfacing the window, so the connect page's
"Open Super Productivity" button re-focuses the app.
Desktop-only; needs an on-device check.
* chore(deps): bump @ngrx/* to 21.1.1 and @capacitor/* to latest 8.x
- @ngrx/{store,effects,entity,store-devtools,schematics} 21.1.0 -> 21.1.1
(moved as a set; the family pins each other's peers exactly)
- @capacitor/{core,cli,android,ios} -> 8.4.1, @capacitor/keyboard 8.0.1 -> 8.0.5
Angular left at 21.2.x: it is already the latest stable 21.x, and Angular 22
is blocked by @ngrx (no Angular-22-compatible release exists yet).
* ci(dependabot): group coupled npm families into single PRs
npm updates had no groups, so lockstep families (ngrx pins its own peers
exactly, Angular/Capacitor move by major together) arrived as separate
single-package PRs that can never resolve npm ci alone. Group @ngrx,
@angular, @angular-eslint, @capacitor, and typescript-eslint so each
family updates as one coherent PR.
* chore(deps): refresh safe in-range tooling + tier-2 bumps
Tier 2 (package.json):
- @material-symbols/font-400 ^0.44.10 -> ^0.45.5 (icon font, 0.x minor)
- eslint-plugin-jsdoc 62.9.0 -> 63.0.10 (its only breaking change is
'drop Node 20'; we run 22; plugin is not wired into eslint.config.js
so there is no lint-rule impact)
In-range leaf refresh (lockfile only; already permitted by caret ranges):
- @playwright/test + playwright 1.60.0 -> 1.61.1
- jasmine-core 6.2.0 -> 6.3.0
- nanoid 5.1.11 -> 5.1.16, fs-extra 11.3.5 -> 11.3.6
- baseline-browser-mapping 2.10.32 -> 2.10.40
- eslint-plugin-prettier 5.5.5 -> 5.5.6
Angular 21.2.x patches, electron-builder, @typescript-eslint and
prettier/stylelint are intentionally left for 'npm update' in a real
terminal: their build-tooling dep trees can't be regenerated cleanly
here (the sandbox prunes cross-platform binaries).
* style(habit-tracker): remove empty .header-spacer rule
Dead empty block left over from 394e554bd0 (compact-view refactor);
triggered stylelint block-no-empty. The .header-spacer div stays in the
template — it's positioned by the parent grid and needs no own styles.
* feat(electron): trigger global shortcuts via superproductivity:// URLs
On Wayland the compositor owns global hotkeys, so Electron's globalShortcut
often does not register. Add three actions — toggle-visibility, new-note and
new-task — to the existing protocol handler so a compositor keybind can call
`xdg-open superproductivity://<action>`. No extra CLI tool or runtime is
needed: xdg-open (Linux), open (macOS) and start (Windows) already ship with
the OS, and the running instance receives the URL via the existing
single-instance / second-instance path.
Extract the show/hide logic into a shared toggleWindowVisibility() used by both
the globalShowHide shortcut and the new protocol action, and add a key-repeat
debounce so one held key press no longer hides then immediately re-shows the
window.
Docs: add a Wayland keybind recipe (Niri/sway/Hyprland) to the keyboard
shortcuts wiki page.
Refs #7114
* fix(electron): correct toggle-visibility focus race and debounce
On Linux/Windows the second-instance handler pre-focused the window before processProtocolUrl ran, so toggle-visibility always read 'visible' and hid the window the user asked to show. Skip that pre-focus for toggle-visibility only (new getProtocolAction helper); every other action keeps the bring-to-front behavior.
Make the key-repeat debounce direction-agnostic with a sliding quiet-gap (1000->750ms): it now guards both show and hide, settles a held key on a single toggle, and fires on the xdg-open path where the old isHidden-only guard was always false.
Stop logging the create-task title and URL path to the exportable log (CLAUDE.md rule 9 / privacy).
Add coverage for the real second-instance path, held-key-from-hidden, gap expiry, the #7282 minimize fallback, the macOS hide path, unfocused-show, and the log redaction; document AppImage/Flatpak/Snap scheme registration. Refs #7114.
* fix(electron): show window on cold-start toggle-visibility launch
Cold start: when superproductivity://toggle-visibility launches the app (it wasn't running), the freshly-shown window was immediately hidden again because the toggle saw it focused. Flag the cold-start URL during the argv scan and SHOW — never toggle — the window once it's ready (via processPendingProtocolUrls), respecting start-minimized-to-tray. The already-running second-instance path keeps real toggle behavior.
Rename the two interactive protocol actions new-task/new-note to add-task/add-note: aligns with the app's Add-Task vocabulary and the globalAddTask/globalAddNote keys, and avoids colliding with the programmatic create-task/<title>. The action names are a frozen public contract once users bind them in compositor configs, so this is the pre-merge moment to settle the naming. Refs #7114.
Issue #7330 ("Data damage detected ... Repair attempted but failed")
recurred on SIMPLE_COUNTER for users already on >= v18.6.0, where the
original TASK-only fix didn't reach.
Root cause is the same partial-LWW-recreate path: a concurrent
delete-vs-update across devices resurrects a counter (LWW resolves
local-delete + remote-update to 'remote'), and lwwUpdateMetaReducer
recreated it from the {id}-only delete payload. Because SIMPLE_COUNTER
had no RECREATE_FALLBACK entry, the recreated counter was missing
required fields - most often `type`, an enum typia rejects and that
dataRepair/autoFixTypiaErrors had no rule for - so post-sync validation
dead-ended on the repair dialog every sync.
Fix mirrors the TASK fix, two layers kept in lockstep by requiredKeys:
- Register SIMPLE_COUNTER in RECREATE_FALLBACK (defaults from
EMPTY_SIMPLE_COUNTER, type=ClickCounter) so the meta-reducer recreate
path backfills required fields and the bad state is never created.
- Add a simpleCounter.<id>.<field>===undefined branch to
autoFixTypiaErrors to heal copies already corrupt on disk.
Tests: auto-fix + meta-reducer unit specs (incl. a real-typia
appDataValidators.simpleCounter proof), a full validate->repair->validate
integration repro, and a deterministic SuperSync delete-vs-update e2e
asserting no native repair dialog fires.
The task-detail-panel was lazily rendered via @defer (prefetch on idle).
Under load the on-idle main trigger can be starved, leaving the right-panel
shell open but its content empty — intermittently failing E2E tests that
open the detail panel (e.g. add-subtask-with-detail-panel-open and
planner-add-subtask-from-detail timing out on the panel becoming visible).
Switch the trigger to 'on immediate' so the panel renders as soon as the
block is created. The component stays code-split and idle-prefetched, so
the initial-bundle win is preserved (verified: eager bundle size and lazy
chunk count unchanged before/after).
The uninstall purge comment claimed orphaned credentials are cleared
'until a later purge', but no reconcile exists: once the plugin is gone
from the registry, removeSecretsForPlugin/clearOAuthTokens are never
re-triggered for it. On an IndexedDB failure the secret/token orphans on
disk until the same plugin id is reinstalled and removed again. Reword
the comment to state this honestly.
Reported by @sbomsdorf in review of #8633.
* feat(plugins): enable OAuth-based issue-provider plugins
Generic, provider-agnostic plugin-framework hooks so an issue-provider plugin
that needs an exact OAuth redirect can work without any built-in code:
- OAuthFlowConfig.redirectUri: a plugin may declare an exact pre-registered
callback; the host uses it for both the authorize request and token exchange.
- The Electron loopback honors a plugin-requested fixed port and rejects with a
clear message when that port is already in use.
- Apply user-supplied clientId/clientSecret/redirectUri overrides onto a
plugin's oauthConfig (bring-your-own OAuth app).
- Fix: merging a partial pluginConfig update no longer drops omitted keys and
deep-merges nested objects (e.g. twoWaySync).
Split out of the Basecamp community-plugin work per PR #8507 feedback; contains
no provider-specific code.
* fix(plugins): address #8546 review
- validate OAuthFlowConfig.redirectUri per platform (loopback / same-origin /
app scheme) and fail fast instead of hanging; restrict desktop loopback to 127.0.0.1
- warn when a client secret is dropped on web/native (bring-your-own credentials)
- validate the IPC loopback port to [1024,65535], register the error handler before
listen(), and close the failed server
- merge pluginConfig via generic recursion instead of a hardcoded twoWaySync case
- nits: named token-store imports; fix stale prepareRedirectUri comment
- tests: redirectUri validation, the web client-secret warning, and generic merge
* fix(plugins): address #8546 round-2 review
- loopback error handler calls cleanupServer() so a post-listen runtime error
doesn't leave the server ref / 5-min timer dangling
- share OAUTH_LOOPBACK_PORT_{MIN,MAX} between the renderer and Electron main so
the bounds never drift; reject out-of-range (incl. 0/80/443) redirect ports early
- drop _getElectronLoopbackPort and parse the already-validated redirectUri once
- document that a bring-your-own clientSecret syncs via pluginConfig (override boundary)
- skip __proto__/constructor/prototype keys in the pluginConfig merge (defense-in-depth)
- test: prototype-pollution guard
* fix(plugins): address #8546 round-3 review
- reject native redirectUri overrides outright (closes CodeQL
js/incomplete-url-scheme-check) via a pure, per-platform validateOAuthRedirectUri
util (electron loopback / native reject / web same-origin)
- gate bring-your-own OAuth credentials to the desktop loopback flow and warn
(instead of silently dropping clientId) when set on web/native
- namespace BYO under pluginConfig.oauthOverrides (was flat keys); document the
convention on OAuthFlowConfig (public plugin API)
- shallow top-level pluginConfig merge: drop the deep recursion + proto guard;
nested objects (e.g. twoWaySync) are replaced wholesale, matching callers
- pin the web redirect to /assets/oauth-callback.html via a shared constant so a
same-origin wrong-path URI fails fast; note the desktop 127.0.0.1-only rule
- companion tests for each
* fix(plugins): strip desktop redirectUri on web/native OAuth flows
A plugin-declared redirectUri is the desktop loopback override; keeping it on
the web/native branches made a web/native-capable plugin throw at connect time
(the loopback URI fails web/native redirectUri validation). Strip it on those
branches so prepareRedirectUri falls through to the platform default. Document
redirectUri as desktop-only in the plugin API and fix a misleading test name.
* refactor(plugins): extract resolveEffectiveOAuthConfig and harden native fallthrough
Move the platform client/secret/redirectUri selection out of the bridge into a
pure, parameterized util so every branch is unit-testable (the IS_* platform
consts are module-level and cannot be mocked in karma). Also strip clientSecret
and redirectUri on the native fall-through — a native platform where the plugin
ships no matching client id — keeping both strictly desktop-only.
Optional hardening on top of the redirectUri fix; safe to drop independently.
Adds an opt-in, default-off setting that keeps the focus-mode break-end sound
looping until the break is dismissed, instead of firing once. Useful when you
step away from your desk and want a persistent cue that the break is over.
Scope and decisions (per the discussion on #8593):
- One toggle only. Reuses the existing break-end sound (positive.mp3) and the
global sound volume. No new sound picker or per-feature volume.
- Stored per-device in localStorage, not the synced config, mirroring
TaskWidgetSettingsService. Looping audio behaves differently across platforms
(desktop keeps the AudioContext running while the window is unfocused; mobile
suspends it on app-background, #8243), so a single synced value would behave
differently per device. The setting is labelled as local to the device.
- Limited to the focus-mode break timer reaching zero (detectBreakTimeUp$).
- A single selector-based effect owns the loop lifecycle (mirrors
whiteNoiseSound$), so the loop starts once and stops on any leave-break
transition. A hard 10-minute ceiling stops it regardless if the user truly
walked away. The audio primitive stops any previous source before starting
and uses a monotonic start-token, so a restart can never leak a second loop.
Closes#8593
* refactor(boards): extract doesTaskMatchPanel membership predicate
Pull the board-panel column-membership filter out of the component's inline
.filter() into a pure, exported doesTaskMatchPanel() in boards.util, the
companion to rewriteTagIdsForPanel (the two encode the same tag rules). The
component now delegates to it, hoisting the backlog predicate so it's allocated
once per recompute rather than once per task. The predicate is a required
argument since backlog membership derives from project state.
* feat(tasks): reassign tags when dragging between tag groups
In the grouped-by-tag work view, dropping a task into a different tag group now
reassigns its tags instead of only reordering:
- onto another tag group → move (drop the source group's tag, add the target's);
- onto the "No tag" bucket → clear all of the task's tags;
- onto the "Unknown tag" / ambiguous (duplicate-title) buckets, or reordering
within a group → unchanged (falls through to the existing reorder).
The customizer emits a group-title -> tagId map (the NO_TAG_GROUP_ID sentinel
for the No-tag bucket, null for un-retaggable buckets), derived from a single
per-title metadata source shared with the group-ordering map so the two can't
drift. task-list intercepts a cross-group drop and dispatches updateTags.
* test(tasks): de-flake planner add-subtask-from-detail e2e
The detail panel's deferred open-time _focusFirst() (~delay(50) + a 150ms
guarded timeout) can land after the inline add-subtask draft opens, steal
focus from it, and trip its blur-to-close — so the draft input renders then
vanishes and '.e2e-add-subtask-input' is never seen (a load-dependent flake,
~1/30 under contention). Wait for the panel's open-time auto-focus to settle
before driving the draft, mirroring add-subtask-with-detail-panel-open.spec.ts.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* feat(sync): nudge long-time users without sync to set it up
Offline-first means a user who never configures sync has no backup at
all; clearing browser data or losing the device wipes everything. Once
the app has clearly been used for a while AND holds real data, show a
calm, low-priority banner once encouraging sync setup.
Trigger combines wall-clock age (>= 7 days since a lazily-seeded
FIRST_USE_TIMESTAMP) with a task-count gate (>= 20 tasks), so it is
robust both to users who restart many times a day and to those who
leave the app running for weeks (where app-start count fails), and
never nags an empty/dormant install. Shown at most once: both "Set up
sync" and "Not now" persist a dismissed flag; a configured provider
suppresses it entirely.
Reuses the existing banner system and mirrors NoteStartupBannerService.
* refactor(sync): apply review feedback to data-safety nudge
- Rename LS.FIRST_USE_TIMESTAMP -> SYNC_SAFETY_FIRST_SEEN and document that
it is not a true install date (seeded at upgrade time for existing
installs), so no other feature reuses it as one.
- Tests: add an unhydrated-config (undefined) skip case and assert the
task-count selector, guarding the earlier race fix and a selector swap.
- i18n: match each locale's existing register for the nudge message
(pt/cs/sk/tr -> formal, id -> informal) per translation review.
* test(planner): stabilize add-subtask-from-detail focus race
Wait for the detail panel's deferred open-time auto-focus to settle before
opening the inline subtask draft. The auto-focus lands ~200ms after the panel
opens and, if it fires after the draft input is focused, steals focus and
blur-closes the input — making toBeFocused() flake with 'element(s) not found'.
Mirrors the guard already used in add-subtask-with-detail-panel-open.spec.ts.
* feat(focus-mode): make preparation opt-in, smooth start transition
The full-screen preparation countdown is now opt-in (off by default) via a
new isShowPreparation config flag; the deprecated isSkipPreparation is kept
for synced-config back-compat. By default, starting a session now plays a
brief inline rocket launch from the play button, then begins.
Smooth the prep->running swap: the clock/controls cross-fade sequentially
(old fades out, then new fades in) via a new fadeSwap animation.
Fix the focus task-selector panel that rendered transparent (undefined
--c-bg-raised) -> opaque highest-elevation surface on the standard scrim.
* fix(focus-mode): guard re-entrant start, reduced-motion, clock cross-fade
- Ignore a re-entrant startSession() while the inline launch is playing
(keyboard Enter / double-click on the still-focused FAB) and disable the
play button during launch, so a second timer can't reset the new session.
- Skip the inline rocket launch + its 800ms delay under prefers-reduced-motion
and start immediately (no invisible dead delay for motion-sensitive users).
- Cross-fade the clock digits with the duration slider (fade out before fade
in) instead of a hard visibility toggle.
- Fix stale e2e launch-duration comment (~600ms -> ~800ms).
* fix(tasks): render notes markdown on first paint instead of flashing plain text
The inline-markdown model setter deferred the rendered preview behind an
async resolveMarkdownImages() call, which is async even when there is
nothing to resolve. This briefly showed the raw notes as plain text before
the parsed markdown appeared when opening the task detail panel.
Render synchronously when the notes contain no clipboard-image URLs (the
common case) and only keep the deferred path when there are images to
resolve to blob: URLs, so we still avoid flashing a broken image.
The hasResolvableImages gate uses a coarse substring check (a safe superset
of what resolveMarkdownImages rewrites) rather than duplicating the
resolver's URL regex: it can't drift out of sync, and it avoids that
regex's O(n^2) backtracking on adversarial notes.
* fix(tasks): stop checklist notes flashing raw markdown on panel open
Opening a task's notes via its checklist progress badge routes through
TaskDetailTargetPanel.Notes, whose handler both set isFocusNotes=true (which
opened the inline-markdown textarea showing the raw '- [ ] ' source) and
called focusItem() on the notes wrapper. focusItem (150ms) won the focus race
and blurred the editor back to preview, leaving a ~150ms flash of raw
markdown before the rendered checklist reappeared. Visible for checklists;
invisible for plain notes where raw and rendered text look alike.
Drop the spurious isFocusNotes=true on auto-open: preview was always the
settled end state, and explicit edits still work via click/Enter.
* fix(tasks): stop late panel auto-focus from closing add-subtask draft
The detail panel's on-open auto-focus runs behind delay(50) + 150ms timers
(_focusFirst / focusItem via _scheduleTaskGuardedFocus). Under load those can
fire *after* the user already opened the inline "add subtask" draft. Focusing
a panel item then blurs the draft input, whose blur handler closes the draft —
so the input vanishes and "Add subtask" silently does nothing.
This surfaced as the flaky e2e "Planner: add subtask from detail panel"
(#8617/#8630): the input was visible, then went "element not found" while
waiting for toBeFocused, because the late auto-focus blurred and closed it.
Guard the single deferred-focus choke point so it never steals focus from an
open draft. Task-change already resets isAddSubtaskInputVisible before
re-focusing, so legitimate panel-open auto-focus is unaffected.
* fix(focus-mode): show notes as single view, not parsed + unparsed at once
The focus-mode notes panel bound [isFocus] to its open/close signal, so
opening it force-entered edit mode and always showed the raw textarea and
the dimmed live preview together.
Open the panel in read (rendered) mode instead; tapping enters edit mode.
Add an opt-in isHidePreviewWhileEditing input to inline-markdown so the
compact panel shows a plain textarea while editing (no live preview). The
task detail panel keeps its live-preview-while-editing behavior.
* fix(tasks): reliably focus the add-subtask draft input on open
The detail panel focused the just-opened draft via a post-render
setTimeout. On a slow CI runner that macrotask can fire before this
view's change detection commits the inputEl viewChild, so focus()
no-ops and never retries — the draft opens unfocused, then is torn
down. Have the input own its initial focus via afterNextRender, which
is tied to the render lifecycle. Fixes the flaky planner add-subtask
e2e and the underlying slow-device UX fragility (#8617).
* feat(plugins): add local-only secret storage API for plugins
Add setSecret/getSecret/deleteSecret to the plugin API, backed by a
dedicated 'sup-plugin-secrets' IndexedDB that is never part of Super
Productivity's sync, exports, or backups (mirrors the existing OAuth
token store). Secrets are namespaced per plugin and purged on uninstall.
Unblocks credential-using plugins (e.g. IMAP mailbox -> task) that must
not put passwords in persistDataSynced or synced issue-provider config.
Also purge plugin OAuth tokens on uninstall (best-effort, alongside the
secret purge) — they previously leaked past uninstall.
Refs #7511
* fix(plugins): purge plugin secrets and OAuth tokens on cache clear
clearUploadedPluginsFromMemory (the 'Clear plugin cache' action) wiped
plugin code and persisted nodeExecution consent (#8512 Phase 2) but left
secrets and OAuth tokens in their dedicated stores. A same-id re-upload
after a cache clear has no existingState, so the re-upload purge never
fires and the new plugin could inherit the previous plugin's credentials
— the same id-reuse gap #8512 closed for consent. Purge both here too,
best-effort and idempotent, mirroring the per-plugin uninstall purge.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* feat(plugins): persist nodeExecution consent per plugin (#8512)
Phase 2 of #8512: remember an uploaded plugin's nodeExecution consent so
it is asked once, not every app session, while keeping the trust decision
local to the device.
- Main-owned, local-only store (electron/plugin-node-consent-store.ts,
wrapping simple-store under key 'pluginNodeExecutionConsent'); never
pfapi-synced, so a grant on one device never auto-grants on another.
- Ask-once is scoped to UPLOADED plugins; built-in plugins (sync-md) keep
the per-session verified prompt unchanged (regression-safe).
- Consent is written only after a native Allow in main; the renderer has a
delete-only clearConsent IPC (fail-safe) and no way to self-grant.
- Cleared on disable / uninstall / re-upload (never in generic teardown),
so revoke = the existing disable toggle and changed code re-consents.
- No code hash: re-ask-on-change is structural (re-upload clears consent);
a renderer hash would be forgeable and security-worthless. version:1 is
the migration anchor if main-owned hashing is ever added.
Tests: electron 154 pass (consent-store + executor ask-once/deny/clear/
built-in-never-persisted); 474 plugin specs pass incl. the sync-exclusion
guard. Docs updated.
* fix(plugins): harden persisted consent against prototype-pollution ids
Multi-review (security) found a CRITICAL in the Phase 2 consent store: the
consents map was a plain object keyed on an attacker-controlled pluginId, so
an uploaded plugin with id 'constructor' / 'toString' / 'valueOf' /
'hasOwnProperty' resolved consents[id] to the inherited Object.prototype
member (a truthy function). The executor's ask-once check treated that as a
prior grant and minted a nodeExecution token with NO consent dialog on a fresh
install — full code execution with zero user approval. ('__proto__' was already
blocked by the id allowlist; these names pass it.) Unit tests missed it because
the executor test stub used a Map, which is immune to the footgun.
Fix:
- Store: null-prototype consents map (Object.create(null)) + own-property
(hasOwnProperty) guarded reads + reject non-object entries. Closes the class
for any prototype-member id, including across a disk round-trip.
- Executor: reject __proto__/prototype/constructor in assertSafePluginId as
defense-in-depth at the boundary.
- Regression tests: consent store returns null for prototype-member ids (fresh,
after a real set, after clear); grant request for these ids is rejected with
no dialog and no mint.
Also from review: ask-once path now re-checks the sender URL after the consent
read (parity with the dialog path); clarified why the consent mutation queue is
not redundant with simple-store's save queue.
Electron suite 156/156 pass.
* refactor(plugins): log consent persist-failure via electron-log
Multi-review follow-ups (non-blocking):
- Route the best-effort consent persist-failure to electron-log/main (the
user-exportable host log) instead of console; console in the executor is
otherwise the sandboxed plugin's own output. Only the validated id is logged.
- Clarify the disable-path comment: clearing revokes the live session grant
always, and the persisted consent only for uploaded plugins (built-ins have
none).
* fix(plugins): clear persisted consent on cache-clear and disclose persistence in dialog
Two gaps found in multi-agent review of the Phase 2 persisted-consent feature:
- clearUploadedPluginsFromMemory() (the 'Clear plugin cache' button) wiped the
plugin code from IndexedDB but left the main-owned persisted nodeExecution
consent behind. A later re-upload of the same id has no existingState, so the
re-upload consent-clear in loadPluginFromZip never fired and the (possibly
different) code was silently granted node execution with no prompt — defeating
the 'replacing code under an id always re-asks' invariant. Now clears consent
for every evicted uploaded id, mirroring removeUploadedPlugin.
- The uploaded-plugin native consent dialog still said access was valid 'for this
app session', but Allow is now persisted across sessions. The prompt now
discloses that the choice is remembered on the device until disable / remove /
re-upload, so the user consents to the actual scope.
Regression tests added on both sides.
* refactor(plugins): key persisted consent on a Map, not a null-prototype object
Multi-review simplification. The consent store keyed an attacker-controlled
pluginId into a plain object, defended against `Object.prototype` member names
(constructor/toString/…) with a null-prototype object + hasOwn guards + a
typeof-object read check. A `Map` makes that safety structural and self-evident —
an unstored key is simply `undefined` — and matches the sibling `grants` Map in
the executor. The on-disk format is unchanged (a plain {version, consents} object);
the Map is serialized via Object.fromEntries (define-semantics, no prototype write)
and rebuilt via Object.entries with the well-formedness guard moved to load time.
Also corrects the stale 'never downgrade-corrupt it' comment with the accurate
downgrade behavior, and adds a round-trip test proving a hand-edited on-disk
__proto__ data key loads inertly without polluting Object.prototype.
* refactor(plugins): funnel disable through PluginService.disablePlugin and de-dup dialog display
Two more multi-review items, now that we own the PR:
- 'Disabling a node plugin revokes its consent' previously lived only in the
plugin-management UI handler, so a future programmatic disable path could unload
the plugin yet leave persisted consent behind — re-enabling would then silently
re-grant node execution. Added PluginService.disablePlugin(setEnabled=false +
unload + clearNodeExecutionConsent) and routed the UI through it, making the
revoke a structural invariant. The consent clear is a safe no-op for non-node
plugins, so the previous requiresNodeExecution gate is dropped.
- The uploaded-plugin name/version were sanitized once for the dialog and again for
persistence (same lengths/fallbacks, duplicated). Extracted sanitizedUploadedDisplay
as the single source of truth so the persisted record always matches what the user
saw in the prompt.
Tests added for the disablePlugin invariant.
* fix(plugins): harden persisted nodeExecution consent (multi-review)
Follow-ups from a multi-agent review of #8600:
- Re-ask structurally on every upload: clear consent unconditionally in
loadPluginFromZip (outside the `existingState` branch) so a same-id
re-upload always re-prompts even if consent was orphaned (crash
mid-uninstall, IndexedDB eviction, external/partial wipe).
- Fail closed on upload: clearNodeExecutionConsent reports a persist failure
via its return value; loadPluginFromZip aborts the upload if the prior
consent could not be revoked, so replacement code can't inherit a stale
grant. Lifecycle edges (disable/uninstall/cache-clear) ignore the result so
a rare disk failure can't abort their bookkeeping.
- Mint the grant before the best-effort consent persist in the executor so a
navigation/destroy during the write drops it via cleanup and a persist
failure can't lose an approved grant.
- Validate the full consent record shape on load so a corrupt {}/array entry
can't read as a grant.
- Log only the validated id + error code on persist failure (no userData path).
- Fix a stale comment (the store keys consent in a Map, not null-proto objects).
Adds regression tests: mint-before-persist ordering, best-effort persist,
malformed-entry rejection, and the consent-clear fail-closed return contract.
* test(plugins): add clearNodeExecutionConsent to PluginBridgeService spy
loadPluginFromZip now clears prior persisted nodeExecution consent
before loading replacement code (#8512 Phase 2). The spy in this spec
lacked the method, so the call threw, was caught, returned false, and
aborted the upload, failing both load-from-zip tests.
* fix(tasks): make detail-panel add-subtask work in the Planner (#8617)
The detail panel and context menu delegated "Add subtask" to
AddSubtaskInputService.requestOpen(), a signal consumed only by the
<task> row that renders the parent. The Planner renders tasks as
<planner-task>, so the request was dropped and nothing happened
(regression from #8423; Today view still worked).
- task-detail-panel now hosts its own inline <add-subtask-input>
(works in every view; also fixes the input opening behind the
bottom panel on mobile). It controls the sub-task section's
expansion via a signal and focuses the input after the expand
animation completes; animates in/out with [@expandFade].
- task-detail-item gains expandedChange/afterExpand outputs so the
panel can control/observe the Material expansion panel.
- context menu addSubTask() reverts to direct addSubTaskTo() (a
transient menu has no place to host the inline draft).
Adds a Planner e2e repro and updates the affected unit specs.
* fix(tasks): address multi-review findings for #8617 add-subtask
- Focus the inline input via a deferred timeout in onSubTasksAfterExpand:
with animations disabled Material fires afterExpand synchronously within
the same CD pass, before the addSubtaskInput viewChild is committed, so
the first collapsed→expand "Add subtask" click left the input unfocused.
- Reset isSubTasksExpanded on task switch so the sub-task section doesn't
stay sticky-expanded across tasks (the panel instance is reused).
- Return focus to the "Add subtask" button when the draft is closed via
Escape, instead of dropping focus to <body>.
- Refresh the now-stale AddSubtaskInputService doc comment.
- Assert the draft input is focused in the Planner e2e (the focus path was
previously uncovered).
* fix(tasks): keep context-menu add-subtask on the inline-draft bus
The earlier context-menu change to addSubTaskTo() was unnecessary: the
context menu's "Add sub-task" entry is gated behind isAdvancedControls,
which only the <task> row enables. planner-task and schedule-event leave
it false, so the entry is hidden there — meaning the menu action is only
ever reachable from a rendered <task> row, where requestOpen() works.
Reverting restores the v18.12 inline-draft UX for that path and shrinks
the diff. (#8617 was only ever reachable via the detail panel, which the
self-hosted input fix already covers.)
* test(tasks): cover add-subtask focus with animations disabled
Guards the deferred-focus fix: with animations disabled Material fires
the expansion panel's afterExpand synchronously, before the panel's
add-subtask-input viewChild is committed. Verified this test fails
without the setTimeout deferral and passes with it.
