* fix(android): avoid false WebView version lockout * fix(android): add WebView block recovery paths Builds on the prior authoritative-vs-fallback fix with three layered recovery mechanisms so users hit by a false BLOCK are never locked out of their data: - Last-known-good auto-recovery: persist the highest WebView version that has ever loaded the app on this device. A later transient mis-read that drops below MIN_CHROMIUM_VERSION is downgraded to WARN. - "Try anyway" override: third button on the block screen opens an AlertDialog with an explicit risk acknowledgment (crashes, render failures, possible data loss). Confirming persists an override and relaunches the app. Hardened against tapjacking via filterTouchesWhenObscured on both the activity and dialog window. - Override auto-clears once a healthy version is detected, so a future genuine block is not silently bypassed. Also tightens the UA regex (drops the misleading Safari Version/X fallback that always reads "4.0" and would falsely block) and adds diagnostic logging gated by Log.isLoggable for field debugging. Tests: 12 unit tests covering statusForVersion branches, all applyOverrides paths, and parseMajorVersion edge cases. Refs #7229 * fix(android): recover tracking after WebView cold start (#7390) When the WebView is killed in the background (e.g. profile switch on GrapheneOS) the JS-side state is lost on the next cold start, but the native foreground tracking service keeps accumulating elapsed time. The app previously discarded that elapsed time on cold start, leading to silent data loss for the user. Recovery flow: - syncTrackingToService$ detects "no current task + native is tracking" on the first emission after hydration and emits a recovery request. - syncOnResume$ does the same on warm resume. - processRecovery$ drains requests with exhaustMap, coalescing concurrent triggers onto a single in-flight recovery. - _doRecover syncs the native elapsed time onto the task and dispatches setCurrentId, restoring the JS-side tracking state. - The null→task re-emission in syncTrackingToService$ then calls updateTrackingService instead of startTrackingService when native is already tracking the same task, preserving the just-reconciled native counter (Kotlin's startTracking otherwise resets accumulatedMs). Supporting changes: - onResume$ is now a ReplaySubject(1) so cold-start emissions delivered before the JS subscriber attaches are still received. The 4 existing consumers are idempotent native-queue drains and verified safe. - parseNativeTrackingData extracted as a top-level pure function with shape validation; warning logs use a length-only fingerprint to avoid burning user content into the exportable log if the native contract ever changes. - Diagnostic 'source' label ('cold-start' | 'resume') in the recovery log line for field triage of any future re-reports. Tests: 12 unit tests for parseNativeTrackingData against the real production code, plus 4 helper-level tests for the null→task transition logic. The pipeline-level tests follow the file's existing pattern of re-implementing logic due to the IS_ANDROID_WEB_VIEW gate. Not addressed (out of scope, separate Kotlin work): write-side flush reliability under aggressive OS kills (flushOnPause$ may not complete before WebView termination). The recovery covers most cases by reading the native counter as the source of truth. * fix(sync): warn before destructive SYNC_IMPORT actions Previously the 'Server Already Has Data' dialog described a destructive SYNC_IMPORT as a 'merge' with a primary-colored 'Upload Local Data' button — leading users to clobber syncing devices' data. The decrypt- error 'Overwrite Remote' button had similarly understated copy and no final confirmation gate. - Rewrite D_SERVER_MIGRATION_CONFIRM body to call out 'overwrite' / 'replace' / 'other devices'; affirmative button is now 'Replace Server Data' with color=warn. - Rewrite D_DECRYPT_ERROR P3 + button label to make cross-device blast radius explicit. - Gate updatePWAndForceUpload behind a confirmDialog with a stronger warning string. - Add component spec for the migration dialog as a regression guard. * fix(infra): close db-startup race in supersync e2e stack pg_isready -U supersync without -d returned OK as soon as postgres accepted connections to the default database, but during first-run initdb the server briefly bounced while POSTGRES_DB was created. supersync's prisma db push then race-failed with P1001. - Healthcheck now runs psql -d supersync_db -c 'SELECT 1' so it only passes once the app's db is queryable. - Dockerfile.test entrypoint retries prisma db push up to 15x before giving up — defense in depth if anything else ever races. * chore(sync): instrument destructive-recovery paths for next incident Adds read-only diagnostic logs at the four sites a sync-stuck incident flows through, so the next occurrence is debuggable from a single log file without forensic recovery: - clean-slate.service: snapshot prior vector clock, count + opType breakdown of unsynced ops, syncImportReason — captured before any mutation - sync-wrapper.service: forceUpload(triggerSource) typed union stamps which error class drove the user into destructive recovery - remote-ops-processing.service: incoming full-state op shape + receiver's prior clock and unsynced-op tally about to be wiped - credential-store.service: encryptKey state on every fresh disk load, length-redacted ([length=N] / [empty]) — surfaces the isEncryptionEnabled=true + empty-key smoking-gun signature No behaviour change. Hot sync paths are untouched (full-state branch is gated; load() short-circuits on cache). Existing redaction patterns preserved — keys never logged in plaintext. * fix(sync): apply incoming SYNC_IMPORT silently with no pending ops Receiving clients with only already-synced data (no unsynced pending changes) used to see a conflict dialog when an incoming SYNC_IMPORT arrived. If the user picked USE_LOCAL — a natural reaction to "your data may be lost" — forceUploadLocalState() re-uploaded the pre-import state as a new SYNC_IMPORT, rolling back the import (e.g. encryption change) for every device. The originating device already gates the SYNC_IMPORT behind a strong warning (D_SERVER_MIGRATION_CONFIRM, |
||
|---|---|---|
| .air | ||
| .devcontainer | ||
| .devin | ||
| .github | ||
| .husky | ||
| .signpath/policies/super-productivity | ||
| .vscode | ||
| android | ||
| build | ||
| docs | ||
| e2e | ||
| electron | ||
| eslint-local-rules | ||
| fastlane/metadata/android | ||
| ios | ||
| nginx | ||
| packages | ||
| scripts | ||
| snap/hooks | ||
| src | ||
| tools | ||
| .browserslistrc | ||
| .dockerignore | ||
| .editorconfig | ||
| .env.example | ||
| .gitattributes | ||
| .gitignore | ||
| .gitmodules | ||
| .gitpod.yml | ||
| .npmrc | ||
| .nvmrc | ||
| .prettierignore | ||
| .prettierrc.json | ||
| .stylelintrc.mjs | ||
| AGENTS.md | ||
| angular.json | ||
| ARCHITECTURE-DECISIONS.md | ||
| capacitor.config.ts | ||
| CLAUDE.md | ||
| CONTRIBUTING.md | ||
| docker-compose.e2e.fast.yaml | ||
| docker-compose.e2e.yaml | ||
| docker-compose.supersync.yaml | ||
| docker-compose.yaml | ||
| docker-entrypoint.sh | ||
| Dockerfile | ||
| Dockerfile.e2e.dev | ||
| Dockerfile.e2e.dev.fast | ||
| electron-builder.yaml | ||
| eslint.config.js | ||
| Gemfile | ||
| Gemfile.lock | ||
| LICENSE | ||
| ngsw-config.json | ||
| package-lock.json | ||
| package.json | ||
| README.md | ||
| SECURITY.md | ||
| tsconfig.base.json | ||
| tsconfig.json | ||
| webdav.yaml | ||
An advanced todo list app with timeboxing & time tracking capabilities that supports importing tasks from your calendar, Jira, GitHub and others
🌐 Open Web App or 💻 Download
💻 Downloads & Install
For all current downloads, package links, and platform-specific notes:
check the wiki.
✔️ Features
- Keep organized and focused! Plan and categorize your tasks using sub-tasks, projects and tags and color code them as needed.
- Use timeboxing and track your time. Create time sheets and work summaries in a breeze to easily export them to your company's time tracking system.
- Helps you to establish healthy & productive habits:
- A break reminder reminds you when it's time to step away.
- The anti-procrastination feature helps you gain perspective when you really need to.
- Need some extra focus? A Pomodoro timer is also always at hand.
- Collect personal metrics to see, which of your work routines need adjustments.
- Integrate with Jira, Trello, GitHub, GitLab, Gitea, OpenProject, Linear, ClickUp and Azure DevOps. Auto import tasks assigned to you, plan the details locally, automatically create work logs, and get notified immediately, when something changes.
- Basic CalDAV integration.
- Back up and synchronize your data across multiple devices with Dropbox and WebDAV support
- Attach context information to tasks and projects. Create notes, attach files or create project-level bookmarks for links, files, and even commands.
- Super Productivity respects your privacy and does NOT collect any data and there are no user accounts or registration. You decide where you store your data!
- It's free and open source and always will be.
And much more!
Note
The web version has some limitations: See the Web App vs Desktop comparison for more details.
📖 Documentation and Guides
Getting Started
- Getting started guide (article)
- Video walkthrough (YouTube)
- Eat the frog prioritizing scheme
Starting Point in Wiki:
First steps •
Reference •
How-To
Productivity Tips:
Keyboard Shortcuts •
Short Syntax
Need Help?
Visit the discussions page
See the bottom of the README for more information on the documentation.
Advanced Topics
Here are some other topics covered in the official wiki:
Development:
Run dev server •
Package the app •
Build for Android •
Run with Docker
Data Management:
User Data •
Issue Providers •
Sync Providers
Customization:
Plugins •
Themes
APIs:
Sync Server •
Plugins •
REST
Community
The development of Super Productivity is driven by a wonderful community of users and contributors. Thank you all so much for your support!
👀 Check out our awesome curated list of community-created resources about Super Productivity
♥️ Contributing
If you want to get involved, please check out the CONTRIBUTING.md
There are several ways to help.
-
Spread the word: More users mean more people testing and contributing to the app which in turn means better stability and possibly more and better features. You can vote for Super Productivity on Slant, Product Hunt, Softpedia or on AlternativeTo, you can tweet about it, share it on LinkedIn, reddit or any of your favorite social media platforms. Every little bit helps!
-
Provide a Pull Request: Here is a list of the most popular community requests and here some info on how to run the development build (wiki). Please make sure that you're following the commit message format and to also include the issue number in your commit message, if you're fixing a particular issue (e.g.:
feat: add nice feature #31). -
Answer questions: You know the answer to another user's problem? Share your knowledge!
-
Provide your opinion: Some community suggestions are controversial. Your input might be helpful and if it is just an up- or down-vote.
-
Provide a more refined UI spec for existing feature requests
-
Make a feature or improvement request: Something can be done better? Something essential missing? Let us know!
-
Translations, Icons, etc.: You don't have to be a programmer to help; learn how to contribute translations!
-
Create custom plugins or custom themes
Special Thanks to our Sponsors!!!
Recently support for Super Productivity has been growing! A big thank you to all our sponsors, especially the ones below!
(If you are, intend to or have been a sponsor and want to be shown here, please let me know!)
Code Signing
Windows binaries are signed. Free code signing is provided by SignPath.io, certificate by SignPath Foundation.
Documentation: Manual versus Automated
There are two wikis: the official one hosted in by GitHub autonomously generated variant using DeepWiki.com. The manually curated version is a more stable and approachable resource designed to help you understand the app from a more human-focused perspective whereas DeepWiki is optimized for explaining the code itself with little regard for context beyond that.
Official Wiki
It is preferable to maintain local documentation rather than rely on an external service. It also preferable that the documentation is updated in tandem with the code changes as demonstrated in this commit.
Changes to files within ./docs/wiki are linted in CI before being automatically
sync'd to the repository's official Wiki hosted by GitHub.
Migrating to Docusaurus is a long-term goal once the content and structure of the wiki has matured and the remaining "legacy docs" have either been reworked or removed. There are some automations in development to help reduce the difference between the published docs and the state of the code while retaining a human-in-the-loop.
DeepWiki.com
If you have very specific questions about how the code works or why a bug might be producing
a particular message it might be useful to
. It can help "cite your sources" when discussing functionality and code that you don't fully
understand as part of feature requests or bug reports.
This automated reference does come with some significant drawbacks:
- Intent: Describes what code does, not why decisions or tradeoffs were made.
- Staleness: Will *always* lag behind the code.
- Code-Focused: Does not provide guides or conceptual explanations.
- Cost: Potential future cost and higher resource usage than static docs.

