Mirrors/super-productivity
1
0
Fork 0
mirror of https://github.com/johannesjo/super-productivity.git synced 2026-07-18 00:46:45 +00:00
Code Issues Projects Releases Wiki Activity
super-productivity/packages/plugin-dev/sync-md
History
Johannes Millan 7f029b1798
fix(plugins): harden nodeExecution grants (#8205) 
* fix(plugins): harden node execution grants

* fix(plugins): harden iframe bridge boundaries (#8208)

* fix(plugins): harden iframe bridge boundaries

* fix(plugins): tighten iframe bridge follow-up

* test(plugins): make node-executor electron test hermetic

The new plugin-node-executor test read the real built-in plugin manifest
(src/assets/bundled-plugins/sync-md/manifest.json), which is a build
artifact absent when 'npm run test:electron' runs in CI (before the
frontend/plugin build). Stub the manifest read, scoped to the executor
module via Module._load, so the grant/token/webContents assertions no
longer depend on built plugin assets.

* fix(plugins): allow iframe formatDate & getCurrentLanguage i18n methods

The iframe API allow-list gate added in #8208 only listed a subset of
the i18n methods that master's #8146 exposes to iframe plugins. Without
this, plugin calls to formatDate/getCurrentLanguage (and translate) are
rejected with 'Unknown API method'. Add all three so the merged gate
matches the methods createBoundMethods/createPluginApiScript expose.

* docs(plugins): document node-exec handoff bootstrap-ordering invariant

The one-shot consumePluginNodeExecutionApi() handoff is defended by
construction ordering, not structural isolation: PluginBridgeService must
consume it before any plugin 'new Function' code runs (both share window.ea
in one renderer realm). Document the invariant at the consumption site so a
future lazy-service/early-plugin-load refactor can't silently regress it.
Surfaced by the post-merge security review (latent finding; not currently
exploitable).

* fix(plugins): use static iframe sandbox attribute to avoid NG0910

Binding a security-sensitive iframe attribute (sandbox) via [attr.sandbox]
makes Angular throw RuntimeError NG0910 and tear down the iframe, crashing
the plugin view to the global error screen. This broke the plugin-iframe,
plugin-loading and plugin-lifecycle e2e tests.

Restore the static sandbox attribute (still without allow-same-origin, so
the opaque-origin isolation from #8208 is preserved) and drop the now-unused
iframeSandbox binding/import.
2026-06-09 18:16:41 +02:00
..
docs feat(sync-md): new approach and make it work better 2025-07-07 18:39:14 +02:00
scripts fix: all console errors 2025-07-22 20:34:12 +02:00
src fix(plugins): harden nodeExecution grants (#8205) 2026-06-09 18:16:41 +02:00
.gitignore feat(sync-md): new approach and make it work better 2025-07-07 18:39:14 +02:00
.prettierrc.json feat(syncMd): add comprehensive test suite and development configuration 2025-07-10 14:56:19 +02:00
eslint.config.js chore(deps): upgrade ESLint to v9 with flat config 2026-01-10 16:08:11 +01:00
jest.config.cjs fix(sync-md): prevent crash from sync oscillation when adding subtask to markdown file 2026-03-24 14:12:50 +01:00
jest.config.js.bak fix(sync-md): fix failing tests after parser changes 2025-07-10 19:17:41 +02:00
package-lock.json chore(deps): bump the npm_and_yarn group across 5 directories with 1 update (#7172) 2026-04-09 20:34:44 +02:00
package.json build: update vite dep 2025-10-28 11:07:52 +01:00
README.md fix(sync): fix stale comments, doc refs, and preserve lastSeq on clean-slate 2026-02-12 16:27:56 +01:00
tsconfig.json feat(sync-md): new approach and make it work better 2025-07-07 18:39:14 +02:00
vite.config.ts feat(sync-md): new approach and make it work better 2025-07-07 18:39:14 +02:00

README.md

Sync-MD Plugin v2.0.0

A SuperProductivity plugin that enables bidirectional synchronization between markdown files and project tasks.

Features

  • Bidirectional Sync: Keep markdown files and SuperProductivity tasks in sync
  • Batch API Integration: Efficient bulk operations for better performance
  • Smart Debouncing: 10-second delays prevent conflicts during active editing
  • Real-time Monitoring: File system watching with automatic sync triggers
  • Task Hierarchy: Preserves parent-child relationships in markdown
  • Modern Architecture: Built with Solid.js UI and modular TypeScript

Quick Start

# Install dependencies
npm install

# Development mode with hot reload
npm run dev:watch

# Build for production
npm run build

# Package as plugin
npm run package

Architecture

Core Components

  • src/fileWatcherBatch.ts - Main sync engine with batch API support
  • src/background.ts - Plugin lifecycle and message handling
  • src/App.tsx - Solid.js UI for configuration
  • src/utils/ - Reusable utilities (parser, debouncer, file ops)

Build System

  • build-proper.js - Main build script
  • build-plugin.js - Package as distributable ZIP
  • watch-and-build.js - Development with auto-rebuild

Configuration

{
  projectId: "project-uuid",
  filePath: "/path/to/tasks.md",
  syncDirection: "fileToProject" | "projectToFile" | "bidirectional"
}

Markdown Format

- [ ] Parent task
  - [x] <!-- sp:task-id --> Completed subtask
  - [ ] Pending subtask

Tasks are linked using HTML comments containing unique IDs.

Testing

# Run all tests
npm test

# Watch mode
npm run test:watch

# Coverage report
npm run test:coverage

Cleanup

To remove old/unnecessary files after updating:

chmod +x cleanup.sh
./cleanup.sh