Make Deckle the knowledge base for an agent, and take the assistant out (3.0.0)

.env.example

@@ -27,7 +27,7 @@ DECKLE_IMAGE=ghcr.io/authortom/deckle:latest
 
 
 # ---- Server library ----------------------------------------------------------
-# With the server library on, your notes are stored as .md files in the container
+# With the server library on, your notes and files are stored in the container
 # (the "nib-vault" volume in compose.yaml — named before the rename, and kept
 # that way so upgrades don't strand it) instead of on your device — so Deckle
 # works from any browser, including Safari and mobile, with nothing kept
@@ -66,23 +66,39 @@ DECKLE_SESSION_SECRET=
 # wrong passwords from anyone lock everyone out for fifteen minutes.
 # DECKLE_TRUST_PROXY=true
 
-# Optional. Where Deckle keeps its own state — currently the assistant settings
-# shared by every device that signs in, API key included. Defaults to
-# ".deckle-state" inside the library directory, which is the volume you already
-# mount; it is deliberately *not* part of the library, so it never appears in a
-# listing, an export or the API.
-#
-# Sharing those settings requires DECKLE_PASSWORD. Without one the server keeps
-# no key at all — it would otherwise hand it to anyone who can reach the port —
-# and every browser keeps its own, as it always has.
+# The largest single file the library accepts, in megabytes (default 100). An
+# agent's reports, spreadsheets and images live here as well as your notes;
+# this stops one upload filling the volume.
+# DECKLE_MAX_FILE_MB=100
+
+# The folder projects live in (default "Projects"). Every folder inside it is a
+# project in the app's Projects view, and it is where an agent's
+# create_project tool puts new ones.
+# DECKLE_PROJECTS_DIR=Projects
+
+# Log and project-log times use the container's clock. Set your time zone so
+# they read as your local time.
+# TZ=Europe/London
+
+# Optional. A folder Deckle keeps to itself: never listed, exported or served.
+# Deckle 3 writes nothing there, but Deckle 2.x kept the AI assistant's
+# settings in it — provider API key included — so on an upgraded volume it may
+# still hold one. Delete ".deckle-state/assistant.json" from the volume once
+# you no longer need it. Defaults to ".deckle-state" inside the library.
 # DECKLE_STATE_DIR=/data/.deckle-state
 
 
-# ---- API (for agents and scripts) ------------------------------------------
-# Deckle exposes a REST API at /api/v1 so an agent can search, read and write your
-# knowledge base. It is OFF unless you set a token below, and it needs the
-# server library above — a local folder or in-browser library lives on your device,
-# where nothing outside the browser can reach it.
+# ---- API and MCP (for agents and scripts) -----------------------------------
+# Deckle exposes a REST API at /api/v1, and an MCP server at /api/v1/mcp, so an
+# agent such as Hermes can search, read and write your knowledge base — notes
+# and files alike — and keep its work in projects. See
+# integrations/hermes/README.md for connecting Hermes. Both are OFF unless you
+# set a token below, and both need the server library above — a local folder or
+# in-browser library lives on your device, where nothing outside the browser
+# can reach it.
+#
+# Every change made with a token is recorded in the app's Activity feed under
+# the token's name, so name tokens after the agent that holds them.
 #
 # Comma-separated tokens. Each is either a bare secret (read-write) or
 # "name:scope:secret", where scope is "r" (read-only) or "rw". Secrets must be
@@ -91,8 +107,9 @@ DECKLE_SESSION_SECRET=
 #   DECKLE_API_TOKENS=hermes:rw:REPLACE_WITH_A_LONG_RANDOM_SECRET
 #
 # TREAT THESE LIKE PASSWORDS. A read-write token can create, edit and delete
-# every note. Give each consumer its own token so you can revoke one without
-# disturbing the rest, and prefer "r" for anything that only needs to read.
+# every note and file. Give each consumer its own token so you can revoke one
+# without disturbing the rest, and prefer "r" for anything that only needs to
+# read — over MCP, a read-only token is offered the read tools only.
 DECKLE_API_TOKENS=
 
 # Optional. Origins allowed to call /api/v1 from a browser (comma-separated, or
@@ -101,7 +118,3 @@ DECKLE_API_TOKENS=
 # /api/v1, so a permitted origin still has to present a token.
 # DECKLE_API_CORS_ORIGINS=
 
-
-# ---- AI assistant ----------------------------------------------------------
-# Nothing to set here. API keys are entered in the app's assistant settings and
-# stored in your browser — they are never sent to or held by the Deckle server.

CHANGELOG.md

@@ -10,6 +10,120 @@ here.
 
 Nothing yet.
 
+## [3.0.0] — 2026-09-21
+
+A change of direction. Deckle stops being a note app with an AI assistant
+built in and becomes the knowledge base for an agent that lives elsewhere —
+Hermes, or anything else that speaks MCP or HTTP. The agent does the thinking;
+Deckle stores what it produces, shows it, searches it, and keeps a record of
+what it did. **Read Removed before upgrading** if you used the assistant.
+
+### Added
+
+- **Files, not just notes.** The library holds any file beside the notes —
+  PDFs, spreadsheets, Word and PowerPoint documents, images, audio, video,
+  CSV, JSON, code — shown in the tree with their own icons and opened in a tab
+  like a note. The viewer shows images, PDFs (in the browser's own viewer),
+  audio and video; renders Word documents, every sheet of an Excel workbook,
+  PowerPoint slides, CSV tables, JSON and text; and offers anything else as a
+  download. Files move, rename, delete and restore exactly as notes do, and
+  byte for byte: moving, binning or restoring one on the server library is a
+  rename, with nothing downloaded or uploaded again.
+- **An MCP server at `/api/v1/mcp`**, behind the same tokens as the REST API.
+  Tools: `search`, `read`, `list`, `list_projects`, `recent_activity`, and —
+  for a read-write token — `write_note`, `save_file`, `create_project`,
+  `update_project`, `log_progress`, `move` and `delete`. Streamable HTTP,
+  stateless, answering in JSON. A read-only token is shown the read tools
+  only.
+- **Projects.** Every folder inside `Projects/` is a project, with a status,
+  summary and tags in its `Overview.md` front matter and a dated `Log.md` the
+  agent keeps as it works. A **Projects** view lists them by what changed last,
+  filters by status, changes a status in place, and starts new ones.
+- **Activity.** Every change made with an API token or over MCP is recorded in
+  `.deckle/activity.jsonl` under the token's name, with whatever the agent said
+  about it. The **Activity** feed shows it grouped by day, filterable by
+  project and agent, and the Activity button in the top bar counts what is new
+  since you last looked. A file's viewer says which agent saved it, when, and
+  why.
+- **The app notices an agent's changes.** On a server library it checks the
+  activity log every 15 seconds while the tab is visible, and on focus, and
+  reloads the tree and any open note when it moves — so a file an agent saves
+  appears without a refresh. If an agent rewrites the note you are typing in,
+  your typing still wins, but its version is kept in history first.
+- **Front matter is kept, and shown.** A note's YAML front matter appears as a
+  properties strip above the text, editable as YAML, and is never passed to
+  the editor — which used to turn the fence into a rule and a heading and save
+  that back.
+- **Images in notes.** `![chart](charts/revenue.png)` shows the image, from the
+  library or the web.
+- **Search inside documents.** `GET /api/v1/search` and MCP's `search` rank
+  notes and files together, reading the text inside Word, Excel, PowerPoint,
+  OpenDocument, CSV, JSON, text and code files. PDFs and images are matched by
+  name. `kind=note|file` narrows a search to one or the other. The sidebar's
+  quick search finds files by name.
+- **`/api/v1/files`** — store any file from a raw request body (`PUT`), fetch it
+  (`GET`, or `?meta=true` for its details), bin it (`DELETE`), and list files
+  newest first. Replacing a file moves the old copy to the recycle bin; `.md`
+  paths are written as notes, with history.
+- **`GET /api/v1/activity`** — the activity log, filterable by `since`,
+  `project`, `actor` and `path`.
+- **A Hermes integration kit** in `integrations/hermes/`: setup instructions, a
+  skill that teaches Hermes how to use Deckle, and `deckle_push.py`, a
+  standard-library Python script for sending large files and whole folders —
+  which never sends hidden files, `.env` files, private keys or dependency
+  caches, and honours a `.deckleignore`.
+- **Importing takes any file.** Dropping or picking PDFs, images or whole
+  folders stores them as they are; a ZIP brings everything inside it, not just
+  its Markdown. Hidden files and `node_modules`-style caches stay behind.
+- `DECKLE_MAX_FILE_MB` (default 100) caps a single file; `DECKLE_PROJECTS_DIR`
+  (default `Projects`) moves the projects folder.
+
+### Removed
+
+- **The AI assistant**, and everything that came with it: Clever Trevor's chat
+  sheet, the background queue, the assistant's memory, Ask AI on a selection,
+  the `/ask`, `/summarize`, `/explain` and `/todo` commands, semantic search,
+  and the model picker. `Ctrl`/`Cmd`+`J` does nothing now. Nothing in your
+  library is touched: the files the assistant wrote are ordinary notes, and
+  its own folders — `.deckle/memory/`, `.deckle/runs/` — stay where they are
+  until you delete them.
+- **`/api/assistant-settings`**, and the server's copy of the assistant's
+  settings. If you used a password-protected server library, **the provider API
+  key you entered is still in `.deckle-state/assistant.json` on the volume**.
+  Deckle keeps refusing to serve that folder, but it no longer needs the file:
+  delete it, and revoke the key with your provider if you are done with it.
+- The `@anthropic-ai/sdk` dependency.
+
+### Changed
+
+- **The API's folder tree includes files.** `GET /api/v1/folders` (and the app's
+  own tree) now carries every file, as `kind: "asset"` nodes with `name`,
+  `title`, `ext` and `size`, beside the notes' `kind: "file"`. Code that
+  assumed only folders and notes should skip the new kind. `GET /api/v1/notes`
+  still lists notes only.
+- **Deleting a folder bins everything in it.** `DELETE /api/v1/folders/{path}`
+  and the app used to send a folder's notes to the recycle bin and erase any
+  other file inside it; files now go to the bin too.
+- **Version history made through the API says "agent"** rather than "AI"
+  (older snapshots keep their label). Every API write is also in the activity
+  log.
+- **The Content-Security-Policy is tighter.** `connect-src` is `'self'` — the
+  page talked to AI providers, and now talks to nothing but this server — and
+  `blob:` is allowed for frames, objects and media, which is how a stored PDF,
+  audio or video file is previewed.
+- The side panel is **Projects · Activity · Tasks · Bookmarks**.
+- `@types/node` is now a declared dev dependency; it used to arrive by way of
+  the Anthropic SDK.
+
+### Fixed
+
+- **Images vanished from notes.** The editor had no image node, so any
+  `![alt](src)` in a note was dropped on load and deleted from the file by the
+  next save.
+- **A note's front matter was mangled** by editing the note in the app.
+- Downloading a note as `.md` now copies the file itself, front matter
+  included, rather than what the editor holds.
+
 ## [2.0.0] — 2026-09-15
 
 A hardening release: security fixes, several ways data could be lost, and a
@@ -440,7 +554,8 @@ a command palette; light and dark mode with seven palettes; a responsive layout
 with drawers on a phone; and a token-authenticated REST API at `/api/v1`
 described by a self-served OpenAPI 3.1 document.
 
-[Unreleased]: https://github.com/authorTom/deckle/compare/v2.0.0...HEAD
+[Unreleased]: https://github.com/authorTom/deckle/compare/v3.0.0...HEAD
+[3.0.0]: https://github.com/authorTom/deckle/compare/v2.0.0...v3.0.0
 [2.0.0]: https://github.com/authorTom/deckle/compare/v1.6.0...v2.0.0
 [1.6.0]: https://github.com/authorTom/deckle/compare/v1.5.1...v1.6.0
 [1.5.1]: https://github.com/authorTom/deckle/compare/v1.5.0...v1.5.1