notes/CHANGELOG.md
enzotar bf4ef86874 harden: atomic writes, path validation, and save pipeline integrity
Backend (lib.rs):
- Add atomic_write/atomic_write_bytes helpers (write→fsync→rename→fsync parent)
- Apply safe_vault_path() to all 20 file-access commands (was 3)
- Apply safe_name() to workspace/canvas/attachment filename params
- Fix 2 silent error swallowing sites (let _ = fs::write)
- Fix git_status/git_commit/git_init error handling (check exit codes)
- Migrate all Regex::new() to LazyLock statics (10 total)
- Use ~tmp suffix for atomic writes (not extension replacement)
- Replace 2 unwrap() panic sites with unwrap_or_default()
- Skip ~tmp files in export_vault_zip

Frontend (Editor.tsx):
- Fix critical note-switch race: capture note path at call time,
  not when debounced timer fires (prevented old content → new note)
- Clear pending save timeout on note switch (defense-in-depth)
- Fix handleSlashSelect: route through debounced saveContent pipeline
  with domToMarkdown() instead of direct writeNote() with innerText
- Fix handlePaste stale closure (add saveContent to deps)

Changelog updated with Hardened section under v1.0.0.
2026-03-11 11:02:01 -07:00

13 KiB
Raw Blame History

Changelog

All notable changes to Graph Notes will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[1.0.0] — 2026-03-09

🎉 First Stable Release

Graph Notes reaches 1.0 — a local-first, graph-based note-taking app built with Tauri, React, and Rust.

Hardened

  • Atomic writes — all file saves use write→fsync→rename→fsync-parent to prevent corruption on crash/power loss
  • Path validationsafe_vault_path() applied to all 20 file-access commands, preventing directory traversal
  • Filename sanitizationsafe_name() rejects path separators in workspace, canvas, and attachment names
  • Note-switch save race — debounced save now captures note path at call time, preventing old content from being written to wrong note
  • Save pipeline consistency — slash command insert and image paste now route through the standard debounced save with domToMarkdown()
  • Git error handlinggit_status, git_commit, git_init now check exit codes and surface stderr on failure
  • Silent error swallowing — fixed 2 let _ = fs::write() sites to propagate errors
  • Panic prevention — replaced unwrap() with unwrap_or_default() on fallible file_name() calls
  • Export safetyexport_vault_zip skips in-progress ~tmp atomic write files
  • Regex performance — all 10 per-call Regex::new() migrated to LazyLock statics

Fixed

  • Rust compilation — resolved duplicate dirs_config_path() definition and removed reference to unlinked dirs crate
  • Content Security Policy — replaced null CSP with a proper baseline policy allowing local resources and Google Fonts
  • Canvas dependency — updated @blinksgg/canvas to correct local file path

Removed

  • Dead code — removed unused cache.rs module (196 lines) that was never compiled (no mod cache; declaration, missing notify crate dependency)

Changed

  • README — replaced Vite template boilerplate with comprehensive project documentation
  • .gitignore — added src-tauri/target/ and vault/ exclusions
  • Version — bumped from 0.9.0 → 1.0.0 across package.json, Cargo.toml, and tauri.conf.json

[0.9.0] — 2026-03-09

Added

  • Import/Export Hub — Export vault as ZIP, import .md folders from Obsidian/Notion
  • Keyboard Shortcuts Editor — View, rebind, persist all keyboard shortcuts
  • Graph Analytics — Stats dashboard with orphan detection, most-connected notes, link density
  • Note Pinning — Pin notes to sidebar top, persisted to .graph-notes/pinned.json

Changed

  • Sidebar: added 📊 Analytics action
  • Command Palette: added Graph Analytics, Import/Export, Keyboard Shortcuts commands
  • Backend: added export_vault_zip, import_folder, save_shortcuts, load_shortcuts, get_pinned, set_pinned

Dependencies

  • Added zip crate (Rust)

[0.8.0] — 2026-03-09

Added

  • Outline Sidebar — Collapsible heading tree (H1H6) with click-to-scroll and active heading tracking
  • Timeline View — Chronological note cards grouped by date with 7d/30d/1y filters
  • Document Statistics — Status bar with word count, characters, lines, reading time, heading count
  • Markdown Table Editor — Visual table grid with click-to-edit cells, add/remove rows/columns, Tab navigation
  • Random Note🎲 Discover random notes from sidebar or command palette
  • Link Suggestions — Backend suggest_links for wikilink auto-completion

Changed

  • Sidebar: added 📅 Timeline and 🎲 Random Note actions
  • Command Palette: added Timeline, Random Note commands
  • Backend: added suggest_links, list_notes_by_date, random_note commands

Dependencies

  • Added rand crate (Rust)

[0.7.0] — 2026-03-09

Added

  • Canvas Whiteboard — Freeform visual thinking surface powered by @blinksgg/canvas with card/text nodes, drag, zoom, save/load
  • Database Views — Notion-style table/gallery/list views from frontmatter properties with sort/filter
  • Backlink Context — Paragraph-level excerpts around wikilink mentions in backlinks panel
  • Dataview Queries — Inline ```dataview TABLE ... SORT ... ``` blocks rendering live query tables
  • Git Sync — commit/push/pull panel with status indicator, changed file list, repo initialization

Changed

  • GraphView rewritten using @blinksgg/canvas (replaces custom HTML5 Canvas force simulation)
  • Sidebar: added Database, Whiteboard quick actions
  • Command Palette: added Database View, New Whiteboard, Git Sync commands
  • Backlinks now use backend get_backlink_context for paragraph excerpts

Dependencies

  • Added @blinksgg/canvas, jotai, graphology, d3-force

[0.6.0] — 2026-03-09

Added

  • Tabbed Editor — Multi-note tab bar with drag-reorder, close buttons, active tab highlighting
  • Note Refactoring — Extract selection to new note (replaces with wikilink), merge notes (appends + updates links)
  • Encrypted Notes — AES-256-GCM password protection with Argon2 key derivation, lock/unlock button in editor
  • Spaced Repetition Flashcards — Study mode from ?? question :: answer ?? syntax, SM-2 scheduling, difficulty ratings
  • Heading Folding — Fold state persistence per note via .graph-notes/folds.json
  • Custom CSS Snippets — Live-preview CSS editor, persisted in ~/.config/graph-notes/custom.css
  • Workspace Layouts — Save/restore window arrangements in .graph-notes/workspaces/
  • Embeddable Widgets{{progress:N}} progress bars, {{counter:N}} badges, {{toggle:on/off}} indicators

Changed

  • Editor supports right-click context menu for refactoring operations
  • Command Palette extended with Flashcards, Custom CSS, and Save Workspace
  • Sidebar quick actions include Flashcards
  • Custom CSS loaded on mount via useCustomCssInit hook

Dependencies

  • Added aes-gcm, argon2, rand, base64 for encryption

[0.5.0] — 2026-03-08

Added

  • Kanban Board — Visual task board from - [ ] / - [/] / - [x] items across vault, with drag-and-drop between Todo/In Progress/Done columns
  • Focus / Zen Mode — Distraction-free writing (⌘⇧F): hides sidebar, breadcrumbs, meta, centers content at max 720px
  • Note Version History — Auto-snapshots every 5 min, timeline sidebar with inline diff viewer (add/remove highlighting)
  • PDF Export — Print-styled export via browser print dialog with clean typography
  • Global Search & Replace — Find/replace text across vault with dry-run preview before applying (⌘H)
  • Local Backlink Graph — Mini force-directed canvas in preview showing current note's 1-hop link connections
  • Writing Goals — Per-note word count targets with gradient progress bar (red→yellow→green)
  • Syntax-Highlighted Code Blocks — highlight.js with 8 languages, copy-to-clipboard button, dark theme

Changed

  • Editor supports focus mode (hides chrome, centers content)
  • Command Palette extended with Kanban, Focus Mode, Search & Replace, Export as PDF
  • Sidebar quick actions include Kanban Board
  • Auto-snapshot on save (throttled to 1 per 5 min)

Dependencies

  • Added highlight.js for syntax highlighting

[0.4.0] — 2026-03-08

Added

  • Frontmatter & Properties Panel — YAML --- fenced metadata with inline key-value editor (collapsible panel below breadcrumbs)
  • Table of Contents — Auto-generated outline from headings, shown alongside preview mode with active heading highlight
  • Mermaid Diagram Rendering — Fenced mermaid code blocks render as SVG diagrams in preview mode (lazy-loaded)
  • Image & Attachment Support — Paste images from clipboard, stored in _attachments/ directory with ![](path) markdown
  • Slash Commands — Type / at line start to open inline formatting menu (14 commands: headings, lists, code blocks, mermaid, tables)
  • Calendar View — Visual month grid for daily notes with dot indicators, "Today" button, and click-to-create
  • Theme Picker — 5 built-in themes (Dark Purple, Dark Emerald, Dark Ocean, Dark Rose, Light) with live preview, persisted
  • Export to HTML — Export current note as styled standalone HTML file

Changed

  • Editor now includes PropertiesPanel, TableOfContents sidebar, and SlashMenu
  • Command Palette extended with Calendar, Theme, and Export HTML commands
  • Sidebar quick actions include Calendar View
  • Added ⌘T keyboard shortcut for Theme Picker

Dependencies

  • Added mermaid for diagram rendering

[0.3.0] — 2026-03-08

Added

  • Split Editor — Open two notes side by side with a draggable divider (right-click → "Open in split")
  • Wikilink Hover Preview — Hover over [[wikilinks]] to see a floating preview card with note content and link count
  • Note Transclusion![[note-name]] embeds the content of another note inline, with recursive depth limiting (3 levels)
  • Vault Switcher — Click sidebar brand to switch between recent vaults or open a new folder
  • Drag & Drop File Organization — Drag notes between folders in the sidebar file tree
  • Breadcrumb Navigation — Path breadcrumbs shown above the editor for nested notes
  • Note Templates — Create notes from templates in _templates/ directory via Command Palette (supports {{title}} and {{date}} variables)
  • Recent Notes — Last 5 recently opened notes shown in the sidebar
  • Favorites — Pin notes as favorites (right-click → "Favorite"), persisted per vault in .graph-notes/favorites.json
  • Open in Split Pane — Right-click context menu option to open a note in a side-by-side view

Changed

  • Note view now uses SplitView component, supporting both single-pane and dual-pane editing
  • Context menu expanded with "Favorite" and "Open in split" actions, plus visual divider
  • Command Palette shows template commands when available
  • LinkPreview component renders as a global overlay for all hover previews

[0.2.0] — 2026-03-08

Added

  • Full-Text Search — Vault-wide content search in the sidebar (debounced, with context snippets and result ranking)
  • Command Palette⌘K / Ctrl+K opens a fuzzy search palette for notes, commands, and content
  • Keyboard Shortcuts⌘N new note, ⌘G graph view, ⌘D daily note, ⌘E toggle edit/preview, ⌘\ toggle sidebar
  • Note Rename — Right-click context menu on notes in sidebar for inline rename with automatic wikilink updates across vault
  • Note Delete — Right-click context menu with confirmation dialog; navigates away if active note deleted
  • Tags System#tag extraction from notes, sidebar tags section with click-to-filter, emerald-colored tag pills in editor
  • Graph Filtering — Filter bar to highlight matching nodes, focus mode (1-hop neighborhood), orphan node toggle
  • Inline Markdown Styling — Headings (# ## ###) render at proper sizes in edit mode, **bold**, *italic*, `code` styled inline
  • List Continuation — Pressing Enter after - item auto-inserts bullet on next line
  • Tab Indent/Outdent — Tab and Shift+Tab for list item indentation
  • Collapsible Sidebar — Toggle sidebar visibility with ⌘\

Changed

  • Edit/Preview mode is now global (shared via context), toggled with ⌘E from anywhere
  • Search input shows ⌘K hint for command palette discovery

[0.1.0] — 2026-03-07

Added

  • Tauri v2 Desktop App — Local-first note-taking with full filesystem access via tauri-plugin-fs
  • Contenteditable Editor — Rich inline editing with [[wikilink]] token chips (compact pills that unwrap on backspace/delete)
  • Wikilink Autocomplete — Type [[ to fuzzy-search and link notes; creates new notes if no match found
  • Force-Directed Graph View — Canvas-based visualization with semantic zoom (circles → rounded-rect cards with note previews)
  • Graph Interactions — Single-click animates zoom to node, double-click opens note, drag to reposition nodes
  • shadcn-Inspired Design System — Zinc-based neutrals, purple accent gradients, focus rings, spring transitions
  • Sidebar — Recursive file tree with search, collapsible folders, active-state indicators, note count badge
  • Backlinks Panel — Lists all notes linking to current page with highlighted context snippets
  • Markdown Preview — Toggle between edit and rendered preview modes with inline wikilink rendering
  • Daily Notes — Auto-generated daily journal entries accessible from sidebar shortcut
  • Auto-Save — Debounced 500ms save on every keystroke
  • Custom Scrollbars — Minimal 5px scrollbars matching the dark theme