Release 2.51.0: ecosystem boundaries, znserver cutover, pacman updater, Cloud vault retirement, Vim block edits

.gitattributes

@@ -0,0 +1,4 @@
+# Contract fixtures are hashed byte for byte by the TypeScript, Go server, and
+# TUI consumers, so they must check out with LF on every platform, including
+# Windows runners whose Git defaults to CRLF conversion.
+packages/bridge-contract/fixtures/** text eol=lf

.github/workflows/boundary-artifact-release.yml

@@ -0,0 +1,67 @@
+name: Prepare boundary artifact release
+on:
+  workflow_dispatch:
+    inputs:
+      artifact:
+        type: choice
+        options: [core, web, viewer]
+        required: true
+      source_commit:
+        description: Reviewed full source commit SHA
+        type: string
+        required: true
+permissions:
+  contents: read
+concurrency:
+  group: boundary-release-${{ inputs.artifact }}
+  cancel-in-progress: false
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      tag: ${{ steps.prepare.outputs.tag }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.source_commit }}
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+      - run: npm run test:run
+      - run: npm run test:web-artifact
+      - if: inputs.artifact == 'core'
+        run: npm run test:app-core-package && npm run test:app-core-browser
+      - if: inputs.artifact == 'core'
+        env:
+          ZEN_CORE_VITE_VERSION: 8.2.2
+        run: npm run test:app-core-package && npm run test:app-core-browser
+      - id: prepare
+        env:
+          ARTIFACT: ${{ inputs.artifact }}
+          APPROVED_SOURCE: ${{ inputs.source_commit }}
+        run: node tooling/scripts/prepare-boundary-release.mjs "$ARTIFACT"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: boundary-release
+          path: ${{ steps.prepare.outputs.directory }}
+          if-no-files-found: error
+  draft:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: boundary-artifacts
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: boundary-release
+          path: release
+      - env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          TAG: ${{ needs.build.outputs.tag }}
+          SOURCE_COMMIT: ${{ inputs.source_commit }}
+        run: gh release create "$TAG" release/* --target "$SOURCE_COMMIT" --title "$TAG" --draft --prerelease --notes "Immutable boundary artifacts. Validate consumer pins before publishing this draft."

.github/workflows/ci.yml

@@ -52,21 +52,48 @@ jobs:
           node-version: 22
           cache: npm
 
-      - name: Set up Go
-        uses: actions/setup-go@v6
-        with:
-          # Pin a modern Go instead of go.mod's `go 1.22`: the 1.22 macOS
-          # linker omits the LC_UUID load command, which the updated
-          # macos-latest dyld now rejects ("missing LC_UUID", abort trap) when
-          # launching `go test` binaries. go.mod stays at 1.22 (its real
-          # minimum), so Nix/release builds are unaffected.
-          go-version: stable
-          cache-dependency-path: apps/server/go.sum
-
       - name: Install dependencies
         run: npm ci
 
-      - name: Typecheck and build app
+      - name: Verify terminal artifacts and legacy launchers
+        if: matrix.os != 'windows-latest'
+        run: node --test tooling/scripts/terminal-artifact.test.mjs tooling/scripts/terminal-launcher.test.mjs
+
+      - name: Verify standalone shared packages
+        run: npm run test:shared-packages
+
+      - name: Verify isolated editor package and assets
+        if: matrix.os == 'ubuntu-latest'
+        run: npm run test:app-core-package
+
+      - name: Exercise the installed editor in Chrome
+        if: matrix.os == 'ubuntu-latest'
+        run: npm run test:app-core-browser
+
+      - name: Verify the editor with the mobile Vite version
+        if: matrix.os == 'ubuntu-latest'
         env:
-          GOCACHE: ${{ runner.temp }}/go-build-cache
+          ZEN_CORE_VITE_VERSION: 8.2.2
+        run: npm run test:app-core-package
+
+      - name: Exercise the Vite 8 editor in Chrome
+        if: matrix.os == 'ubuntu-latest'
+        run: npm run test:app-core-browser
+
+      - name: Collect browser evidence
+        if: always() && matrix.os == 'ubuntu-latest'
+        run: node tooling/scripts/collect-app-core-evidence.mjs "$RUNNER_TEMP/app-core-browser-evidence"
+
+      - name: Retain browser evidence
+        if: always() && matrix.os == 'ubuntu-latest'
+        uses: actions/upload-artifact@v4
+        with:
+          name: app-core-browser-evidence
+          path: ${{ runner.temp }}/app-core-browser-evidence
+          if-no-files-found: ignore
+
+      - name: Verify browser asset build lock
+        run: npm run test:web-dist-lock
+
+      - name: Typecheck and build app
         run: npm run build:prod

.github/workflows/nix-build.yml

@@ -1,8 +1,9 @@
 name: Nix build
 
-# Builds AND validates the flake packages on a Nix runner whenever the Nix
-# packaging changes, so the prebuilt-desktop wrapper and the server package are
-# verified in CI (the maintainers don't have a Nix machine to test on locally).
+# Builds AND validates the flake package on a Nix runner whenever the Nix
+# packaging changes, so the prebuilt-desktop wrapper is verified in CI (the
+# maintainers don't have a Nix machine to test on locally). The server's Nix
+# build lives in ZenNotes/znserver.
 
 on:
   push:
@@ -32,7 +33,6 @@ jobs:
       - name: Build packages
         run: |
           nix build --fallback --print-build-logs .#zennotes-desktop -o result-desktop
-          nix build --fallback --print-build-logs .#zennotes-server  -o result-server
 
       - name: Validate desktop package
         run: |

.github/workflows/nix-update.yml

@@ -41,7 +41,6 @@ jobs:
         run: |
           set -euo pipefail
           DATA=packaging/nix/release-data.json
-          FAKE="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
 
           # 1) Source hash — the fetchFromGitHub tree for tag v$V.
           SRC_HASH=$(nix run --fallback nixpkgs#nix-prefetch-github -- ZenNotes zennotes --rev "v$V" | jq -r '.hash // .sha256')
@@ -59,33 +58,15 @@ jobs:
             "https://github.com/ZenNotes/zennotes/releases/download/v$V/ZenNotes-$V-linux-x64.tar.gz" | jq -r '.hash')
           echo "desktopHash = $DESKTOP_HASH"
 
-          # Write version + source + npm + desktop now; leave vendorHash fake so the
-          # Go build surfaces the real one.
-          jq --arg v "$V" --arg h "$SRC_HASH" --arg n "$NPM_HASH" --arg d "$DESKTOP_HASH" --arg f "$FAKE" \
-            '.version=$v | .hash=$h | .npmDepsHash=$n | .desktopHash=$d | .vendorHash=$f' "$DATA" > "$DATA.tmp"
-          mv "$DATA.tmp" "$DATA"
-
-          # 3) vendorHash — build the server; the Go vendor fixed-output derivation
-          #    reports the real hash as a mismatch against the fake one.
-          set +e
-          nix build --fallback .#zennotes-server --no-link 2> build.log
-          set -e
-          VENDOR_HASH=$(grep -oE 'got:[[:space:]]+sha256-[A-Za-z0-9+/=]+' build.log \
-            | grep -oE 'sha256-[A-Za-z0-9+/=]+' | head -1 || true)
-          if [ -z "$VENDOR_HASH" ]; then
-            echo "::error::Could not extract vendorHash from the build output."
-            cat build.log
-            exit 1
-          fi
-          echo "vendorHash = $VENDOR_HASH"
-          jq --arg vh "$VENDOR_HASH" '.vendorHash=$vh' "$DATA" > "$DATA.tmp"
+          jq --arg v "$V" --arg h "$SRC_HASH" --arg n "$NPM_HASH" --arg d "$DESKTOP_HASH" \
+            '.version=$v | .hash=$h | .npmDepsHash=$n | .desktopHash=$d' "$DATA" > "$DATA.tmp"
           mv "$DATA.tmp" "$DATA"
 
           echo "=== updated release-data.json ==="
           cat "$DATA"
 
       - name: Verify the packages build with the new hashes
-        run: nix build --fallback .#zennotes-desktop .#zennotes-server --no-link --print-build-logs
+        run: nix build --fallback .#zennotes-desktop --no-link --print-build-logs
 
       - name: Open a PR with the update
         uses: peter-evans/create-pull-request@v6
@@ -100,6 +81,5 @@ jobs:
             - `version`
             - `hash` (source) — `nix-prefetch-github`
             - `npmDepsHash` — `prefetch-npm-deps`
-            - `vendorHash` — Go fixed-output build
 
-            Verified with `nix build .#zennotes-desktop .#zennotes-server`.
+            Verified with `nix build .#zennotes-desktop`.

.github/workflows/share-viewer-artifact.yml

@@ -0,0 +1,34 @@
+name: Public share viewer artifact
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'apps/share-viewer/**'
+      - 'packages/**'
+      - 'tooling/scripts/**'
+      - 'package*.json'
+      - 'tsconfig.base.json'
+      - 'LICENSE'
+      - '.github/workflows/share-viewer-artifact.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  candidate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: node --test tooling/scripts/pack-web-artifact.test.mjs
+      - run: npm run pack:share-viewer
+      - uses: actions/upload-artifact@v4
+        with:
+          name: share-viewer-candidate
+          path: dist/viewer-artifacts/*
+          if-no-files-found: error

.github/workflows/web-artifact.yml

@@ -0,0 +1,34 @@
+name: Self-hosted web artifact boundary
+
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'apps/web/**'
+      - 'packages/**'
+      - 'tooling/scripts/**'
+      - 'package*.json'
+      - 'tsconfig.base.json'
+      - 'LICENSE'
+      - '.github/workflows/web-artifact.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  browser:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run test:web-artifact
+      - run: npm run artifact:web
+      - uses: actions/upload-artifact@v4
+        with:
+          name: self-hosted-web-candidate
+          path: dist/web-artifacts/*
+          if-no-files-found: error

.gitignore

@@ -8,8 +8,8 @@ apps/web/dist
 # The bare `dist` above does not cover these suffixed names.
 dist.stage-*
 dist.retired-*
-apps/server/web/.web-dist.lock
-apps/server/bin
+apps/web/.web-dist.lock
+dist/server-binaries
 .DS_Store
 *.log
 .env
@@ -28,3 +28,6 @@ result
 result-*
 # Release notes / launch copy are kept local only, never committed.
 docs/releases/
+# Verified native CLI artifacts; release pins are tracked separately.
+apps/desktop/build/terminal/
+apps/desktop/build/terminal.stage-*

CONTRIBUTING.md

@@ -23,11 +23,11 @@ npm run dev
 
 Useful scripts:
 
-- `npm run dev` — run the desktop app with hot reload (`dev:web`, `dev:server`, and `dev:web-stack` cover the web client and Go server)
+- `npm run dev` — run the desktop app with hot reload (`dev:web`, `dev:server`, and `dev:web-stack` cover the web client and the pinned Go server release)
 - `npm run typecheck` — TypeScript across every workspace
 - `npm run test:run` — the full test suite, non-interactive (`npm test` is the watch variant)
-- `npm run build` — production build of the web client, desktop app, and Go server
-- `cd apps/server && go test ./...` — the Go server's own tests
+- `npm run build` — production build of the web client and desktop app
+- The Go server and its tests live in [ZenNotes/znserver](https://github.com/ZenNotes/znserver)
 
 There is no lint step; match the style of the surrounding code (Prettier is available
 if a file you touched is already formatted with it).