Release 2.80.0: swimlanes, subtasks on cards, WIP limits, a template folder and scoped MCP

README.md

@@ -308,7 +308,7 @@ Read [docs/monorepo-architecture.md](docs/monorepo-architecture.md) for the arch
 
 ### Requirements
 
-- Node.js 22+
+- Node.js 22.22 or newer
 - npm
 - Go 1.22+ for the server build path
 - Docker optional, for self-hosting

apps/desktop/electron.vite.config.ts

@@ -53,10 +53,18 @@ const MAIN_BUNDLED_MARKDOWN_PACKAGES = [
   'remark-math'
 ]
 
+// The file watchers (vault, config.toml, themes, CSS snippets, code
+// languages), bundled for the same reason. Chokidar 6 is pure ESM with
+// readdirp 5 below it; left external, main would load it from the asar and
+// count on electron-builder putting readdirp where Node looks for it, the bet
+// 2.20.0 lost. Neither has native pieces, so Rollup inlines both.
+const MAIN_BUNDLED_WATCHER_PACKAGES = ['chokidar', 'readdirp']
+
 const MAIN_EXTERNALIZE_EXCLUSIONS = [
   ...INTERNAL_WORKSPACE_PACKAGES,
   ...PACKAGED_CLI_RUNTIME_PACKAGES,
-  ...MAIN_BUNDLED_MARKDOWN_PACKAGES
+  ...MAIN_BUNDLED_MARKDOWN_PACKAGES,
+  ...MAIN_BUNDLED_WATCHER_PACKAGES
 ]
 
 function onigurumaDataUrl(): Plugin {

apps/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zennotes/desktop",
   "productName": "ZenNotes",
-  "version": "2.79.0",
+  "version": "2.80.0",
   "description": "ZenNotes desktop shell",
   "private": true,
   "main": "./out/main/index.js",
@@ -19,7 +19,7 @@
   },
   "homepage": "https://github.com/ZenNotes/zennotes/releases/latest",
   "engines": {
-    "node": ">=22"
+    "node": ">=22.22"
   },
   "scripts": {
     "dev": "electron-vite dev",
@@ -58,7 +58,7 @@
     "@zennotes/app-core": "*",
     "@zennotes/bridge-contract": "*",
     "@zennotes/shared-domain": "*",
-    "chokidar": "^4.0.3",
+    "chokidar": "^6.0.0",
     "codemirror": "^6.0.1",
     "docx": "^9.7.1",
     "dompurify": "^3.3.4",

apps/desktop/src/cli/args.ts

@@ -28,6 +28,7 @@ export const VALUELESS_FLAGS: ReadonlySet<string> = new Set([
   'meta',
   'new-window',
   'page',
+  'read-only',
   'reopen',
   'unchecked',
   'yes'

apps/desktop/src/cli/backend.ts

@@ -42,6 +42,7 @@ import {
   readNote,
   readNoteComments,
   readPrimaryNotesLocation,
+  readTemplateFolder,
   readVaultFileTextOrNull,
   renameFolder,
   renameNote,
@@ -73,6 +74,8 @@ import {
   type DatabaseVaultLayout
 } from '@shared/database-ops'
 import { createAbsenceAwareReader } from '@shared/remote-absence'
+import { normalizeSystemFolderPaths, type SystemFolderPaths } from '@shared/system-folder-paths'
+import { resolveTemplateFolder } from '@shared/template-folder'
 import { setCell } from '@shared/database-records'
 import {
   csvPathForFormDir,
@@ -107,6 +110,11 @@ export type VaultDescription =
       authConfigured: boolean
     }
 
+export interface VaultLayout {
+  primaryNotesLocation: PrimaryNotesLocation
+  systemFolderPaths: SystemFolderPaths
+}
+
 export interface VaultBackend {
   readonly kind: 'local' | 'remote'
   /** How to name this vault in output and errors. */
@@ -116,6 +124,13 @@ export interface VaultBackend {
   readonly root: string
 
   describe(): Promise<VaultDescription>
+  /** Where the system folders live and whether the inbox is the vault root:
+   *  what classifying a vault-relative path needs, for a scoped MCP client
+   *  (ZenNotes/tui#21). */
+  vaultLayout(): Promise<VaultLayout>
+  /** The vault's template folder (#1024) as its settings name it, or null:
+   *  the tag tools and commands leave its notes out, as the app does. */
+  templateFolder(): Promise<string | null>
   listNotes(): Promise<NoteMeta[]>
   listAssets(): Promise<VaultAssetMeta[]>
   listFolders(): Promise<{ folder: NoteFolder; subpath: string }[]>
@@ -227,6 +242,14 @@ class LocalBackend implements VaultBackend {
     root: this.root,
     primaryNotesLocation: await readPrimaryNotesLocation(this.root)
   })
+  vaultLayout = async (): Promise<VaultLayout> => {
+    const layout = await readDatabaseVaultLayout(this.root)
+    return {
+      primaryNotesLocation: layout.primaryNotesAtRoot ? 'root' : 'inbox',
+      systemFolderPaths: layout.systemFolderPaths ?? {}
+    }
+  }
+  templateFolder = (): Promise<string | null> => readTemplateFolder(this.root)
   listNotes = (): Promise<NoteMeta[]> => listNotes(this.root)
   listAssets = (): Promise<VaultAssetMeta[]> => listAssets(this.root)
   listFolders = (): Promise<{ folder: NoteFolder; subpath: string }[]> => listFolders(this.root)
@@ -330,6 +353,15 @@ class RemoteBackend implements VaultBackend {
       authConfigured: !!this.client.authToken
     }
   }
+  vaultLayout = async (): Promise<VaultLayout> => {
+    const settings = await this.client.getVaultSettings()
+    return {
+      primaryNotesLocation: settings.primaryNotesLocation === 'root' ? 'root' : 'inbox',
+      systemFolderPaths: normalizeSystemFolderPaths(settings.systemFolderPaths)
+    }
+  }
+  templateFolder = async (): Promise<string | null> =>
+    resolveTemplateFolder(await this.client.getVaultSettings())
   listNotes = (): Promise<NoteMeta[]> => this.client.listNotes()
   listAssets = async (): Promise<VaultAssetMeta[]> =>
     (await this.client.listAssets()).map((asset) => ({

apps/desktop/src/cli/commands/base.test.ts

@@ -141,6 +141,67 @@ describe('zn base', () => {
     expect(page).toContain('Summary of the retro.')
   })
 
+  it('adds the row to the picks of the view the database opens on, and nowhere else', async () => {
+    const dir = path.join(root, 'inbox', 'Reading.base')
+    await fsp.mkdir(dir, { recursive: true })
+    await fsp.writeFile(path.join(dir, 'data.csv'), 'id,Title\nr1,Dune\nr2,Emma\n')
+    const views = (picks: Record<string, string[] | undefined>) =>
+      Object.entries(picks).map(([id, pickedRowIds]) => ({
+        id,
+        name: id === 'shelf' ? 'Shelf' : id === 'all' ? 'All' : 'Later',
+        type: 'table',
+        filters: [],
+        sorts: [],
+        ...(pickedRowIds ? { pickedRowIds } : {})
+      }))
+    const writeSchema = (activeViewId: string) =>
+      fsp.writeFile(
+        path.join(dir, 'schema.json'),
+        JSON.stringify({
+          version: 1,
+          idFieldId: 'f_id',
+          fields: [
+            { id: 'f_id', name: 'id', type: 'text', hidden: true },
+            { id: 'f_title', name: 'Title', type: 'text' }
+          ],
+          views: views({ shelf: ['r1'], all: undefined, later: ['r2'] }),
+          activeViewId
+        })
+      )
+    const readViews = async () =>
+      (JSON.parse(await fsp.readFile(path.join(dir, 'schema.json'), 'utf8')) as {
+        views: Array<{ id: string; pickedRowIds?: string[] }>
+      }).views
+
+    // The database opens on Shelf, which shows only Dune: the new row joins it.
+    await writeSchema('shelf')
+    await cmdBaseAdd(backend(), makeArgs(['Reading'], [['set', 'Title=Ulysses'], ['json', 'true']]))
+    const added = lastJson()
+    expect(added.pickedInView).toBe('Shelf')
+    const after = await readViews()
+    expect(after.find((v) => v.id === 'shelf')?.pickedRowIds).toEqual(['r1', added.id])
+    // A view with picks the user is not looking at keeps them.
+    expect(after.find((v) => v.id === 'later')?.pickedRowIds).toEqual(['r2'])
+    expect(after.find((v) => v.id === 'all')).not.toHaveProperty('pickedRowIds')
+
+    // Opening on a view of every row, the add changes no view's picks.
+    await writeSchema('all')
+    out = []
+    await cmdBaseAdd(backend(), makeArgs(['Reading'], [['set', 'Title=Middlemarch']]))
+    expect(out.join('')).not.toContain('picked rows')
+    const plain = await readViews()
+    expect(plain.find((v) => v.id === 'shelf')?.pickedRowIds).toEqual(['r1'])
+    expect(plain.find((v) => v.id === 'later')?.pickedRowIds).toEqual(['r2'])
+    const csv = await fsp.readFile(path.join(dir, 'data.csv'), 'utf8')
+    expect(csv).toContain('Middlemarch')
+
+    // The text output says where the row went.
+    await writeSchema('later')
+    out = []
+    await cmdBaseAdd(backend(), makeArgs(['Reading'], [['set', 'Title=Persuasion']]))
+    expect(out.join('')).toContain('added to the picked rows of the Later view')
+  })
+
   it('creates a database and rejects unknown fields helpfully', async () => {
     await cmdBaseCreate(backend(), makeArgs(['Logbook'], [['json', 'true']]))
     const created = lastJson()

apps/desktop/src/cli/commands/base.ts

@@ -12,7 +12,7 @@
  */
 
 import {
-  addRow,
+  addRowInView,
   composePageBody,
   ensureSelectOption,
   recordTitle,
@@ -239,12 +239,16 @@ export async function cmdBaseAdd(vault: VaultBackend, args: ParsedArgs): Promise
   const body = bodyFlag === '-' ? (await readStdin()).trim() || null : bodyFlag ?? null
   const wantPage = body != null || getBool(args, 'page')
 
-  let doc = await ops.openDatabase(csvPath)
-  doc = addRow(doc)
-  const row = doc.rows[doc.rows.length - 1]
-  const applied = applyAssignments(doc, row.id, assignments)
-  doc = applied.doc
-  let schemaChanged = applied.schemaChanged
+  // As + Row does in the grid: when the view the database opens on shows
+  // picked rows, the new row joins them, or it would be missing from that
+  // view the next time the database is opened. Other views keep their picks.
+  const opened = await ops.openDatabase(csvPath)
+  const added = addRowInView(opened, opened.activeViewId)
+  const pickedIn = added.picksChanged ? opened.views.find((v) => v.id === opened.activeViewId)?.name ?? null : null
+  const row = added.doc.rows.find((r) => r.id === added.rowId)!
+  const applied = applyAssignments(added.doc, row.id, assignments)
+  let doc = applied.doc
+  let schemaChanged = applied.schemaChanged || added.picksChanged
 
   let pagePath: string | null = null
   if (wantPage) {
@@ -259,10 +263,15 @@ export async function cmdBaseAdd(vault: VaultBackend, args: ParsedArgs): Promise
 
   const finalRow = doc.rows.find((r) => r.id === row.id)!
   if (getBool(args, 'json')) {
-    emitJson({ ok: true, ...rowView({ ...doc, pages: pagePath ? { [row.id]: pagePath } : doc.pages }, finalRow) })
+    emitJson({
+      ok: true,
+      ...rowView({ ...doc, pages: pagePath ? { [row.id]: pagePath } : doc.pages }, finalRow),
+      ...(pickedIn !== null ? { pickedInView: pickedIn } : {})
+    })
     return
   }
   emitOk(`Added ${recordTitle(doc, finalRow)} (${row.id})`)
+  if (pickedIn !== null) emitLine(`  added to the picked rows of the ${pickedIn} view`)
   if (pagePath) emitLine(`  page: ${pagePath}`)
 }
 

apps/desktop/src/cli/commands/mcp.ts

@@ -12,14 +12,21 @@
  * names nothing is reported on stderr at startup and the server still
  * starts; the CLI's usual "resolve, then fail the command" would leave
  * the MCP client with a dead server and no message.
+ *
+ * --allow-path, --deny-path, --read-only and --access narrow what the
+ * client may see and change (ZenNotes/tui#21); the server enforces them
+ * on every tool. A bad entry is the one flag that stops the server before
+ * it serves: starting anyway would share more than the user asked for.
  */
 
+import { mcpScopeFromFlags, type McpScope } from '@shared/mcp-scope'
 import { runMcpServer } from '../../mcp/server.js'
-import type { ParsedArgs } from '../args.js'
+import { getBool, getMany, getString, type ParsedArgs } from '../args.js'
 import { resolveTarget } from '../vault-target.js'
 
 export async function cmdMcp(args: ParsedArgs): Promise<void> {
-  await runMcpServer({ resolveTarget: () => resolveTarget(args) })
+  const scope = mcpScopeFromArgs(args)
+  await runMcpServer({ resolveTarget: () => resolveTarget(args), scope })
   // The MCP SDK's connect() returns once stdin/stdout listeners are
   // wired up. Node's event loop keeps the process alive while those
   // listeners exist, but the CLI dispatcher would otherwise see this
@@ -29,3 +36,14 @@ export async function cmdMcp(args: ParsedArgs): Promise<void> {
   // (Claude Code / Desktop / Codex) chooses to give it.
   await new Promise<void>(() => {})
 }
+
+/** The scope the flags ask for; null when none were given, full access. The
+ *  legacy out/main/mcp.js entry reads the same flags off its own argv. */
+export function mcpScopeFromArgs(args: ParsedArgs): McpScope | null {
+  return mcpScopeFromFlags({
+    allow: getMany(args, 'allow-path'),
+    deny: getMany(args, 'deny-path'),
+    access: getString(args, 'access'),
+    readOnly: getBool(args, 'read-only')
+  })
+}

apps/desktop/src/cli/commands/notes.ts

@@ -4,6 +4,7 @@
  * round-trip, works whether the desktop app is open or closed.
  */
 
+import { outsideTemplateFolder } from '@shared/template-folder'
 import type { NoteFolder, NoteMeta } from '../../mcp/vault-ops.js'
 import type { VaultBackend } from '../backend.js'
 import {
@@ -37,7 +38,8 @@ export async function cmdList(vault: VaultBackend, args: ParsedArgs): Promise<vo
     ? notes.filter((n) => n.folder === folder)
     : notes.filter((n) => n.folder !== 'trash')
   if (tag) {
-    notes = notes.filter((n) =>
+    // A tag finds no template (#1024): its tags are the note it will make.
+    notes = outsideTemplateFolder(notes, await vault.templateFolder()).filter((n) =>
       n.tags.map((t) => t.toLowerCase()).includes(tag.replace(/^#/, ''))
     )
   }

apps/desktop/src/cli/commands/tags.ts

@@ -1,14 +1,16 @@
 /**
  * `zn tag list` and `zn tag find` — enumerate and discover #tags
- * across live notes (excluding trash).
+ * across live notes (excluding trash and the vault's template folder, whose
+ * tags are the notes its templates will make, #1024).
  */
 
+import { outsideTemplateFolder } from '@shared/template-folder'
 import type { VaultBackend } from '../backend.js'
 import { getBool, getNumber, getString, type ParsedArgs } from '../args.js'
 import { emitJson, emitLine, pad } from '../format.js'
 
 export async function cmdTagList(vault: VaultBackend, args: ParsedArgs): Promise<void> {
-  const all = await vault.listNotes()
+  const all = outsideTemplateFolder(await vault.listNotes(), await vault.templateFolder())
   const counts = new Map<string, number>()
   for (const n of all) {
     if (n.folder === 'trash') continue
@@ -38,7 +40,7 @@ export async function cmdTagFind(vault: VaultBackend, args: ParsedArgs): Promise
   const tag = (getString(args, 'tag') ?? args.positionals[0])?.replace(/^#/, '').toLowerCase()
   if (!tag) throw new Error('zn tag find requires a tag name (e.g. `zn tag find idea`).')
   const limit = getNumber(args, 'limit') ?? 200
-  const all = await vault.listNotes()
+  const all = outsideTemplateFolder(await vault.listNotes(), await vault.templateFolder())
   const matches = all
     .filter(
       (n) => n.folder !== 'trash' && n.tags.map((x) => x.toLowerCase()).includes(tag)