tomymaritano · tomymaritano · Mar 11, 2026 · Mar 11, 2026 · Mar 11, 2026 · Mar 11, 2026
@@ -76,7 +76,12 @@
       "Bash(npx vitest:*)",
       "Bash(do echo:*)",
       "Bash(do gh:*)",
-      "Bash(git tag:*)"
+      "Bash(git tag:*)",
+      "Bash(git stash:*)",
+      "Bash(ls /Users/tomasmaritano/Documents/Github/readied/readide/apps/desktop/src/renderer/components/NoteListFilterBar*)",
+      "Bash(ls /Users/tomasmaritano/Documents/Github/readied/readide/apps/desktop/src/renderer/components/*.module.css)",
+      "Bash(npm view:*)",
+      "Bash(git log:*)"
     ]
   }
 }
@@ -1,25 +1,29 @@
 # Readied — Environment Variables
+# See CLAUDE.md for development setup instructions
 # Copy this file to .env and fill in the values.
 # The desktop app runs fully offline — these are only needed for the API and web app.
 
 # ─── API (Cloudflare Workers) ───────────────────────────────
 # Set via `wrangler secret put <KEY>` for deployed environments.
 # For local dev, create packages/api/.dev.vars with these values.
 
-TURSO_DATABASE_URL=libsql://your-db.turso.io
-TURSO_AUTH_TOKEN=your_token_here
-JWT_SECRET=your_secret_here    # openssl rand -base64 32
-RESEND_API_KEY=re_your_key_here  # Resend email service
+TURSO_DATABASE_URL=
+TURSO_AUTH_TOKEN=
+# Generate with: openssl rand -base64 32
+JWT_SECRET=
+# Resend email service API key
+RESEND_API_KEY=
 SITE_URL=https://readied.app
 
 # ─── Stripe ─────────────────────────────────────────────────
-STRIPE_SECRET_KEY=sk_test_your_key_here
-STRIPE_WEBHOOK_SECRET=whsec_your_secret_here
-STRIPE_PRICE_MONTHLY=price_your_monthly_id_here
-STRIPE_PRICE_ANNUAL=price_your_annual_id_here
+STRIPE_SECRET_KEY=
+STRIPE_WEBHOOK_SECRET=
+STRIPE_PRICE_MONTHLY=
+STRIPE_PRICE_ANNUAL=
 
 # ─── Admin ──────────────────────────────────────────────────
-ADMIN_TOKEN=your_admin_token_here  # Token for /admin endpoints
+# Token for /admin endpoints
+ADMIN_TOKEN=
 
 # ─── GitHub Actions (repo secrets) ──────────────────────────
 # GH_TOKEN                    # PAT with repo scope (releases, PRs)

@@ -102,7 +102,7 @@ We use a simplified Git Flow with automated releases:
 
 ```
 main          ← Production releases (semantic-release runs here)
-  └── develop ← Integration branch
+  └── develop ← Integration branch (NEVER push directly)
         └── feature/* ← Feature development
         └── fix/*     ← Bug fixes
 ```
@@ -116,6 +116,24 @@ main          ← Production releases (semantic-release runs here)
 | `feature/*` | New features              | `develop`       |
 | `fix/*`     | Bug fixes                 | `develop`       |
 
+### Branch Protection Rules (MANDATORY)
+
+- **NEVER commit directly to `develop` or `main`** — always create a feature/fix branch first
+- **All work goes through PRs** — even small fixes, even single-line changes
+- **PR flow:** `feature/*` or `fix/*` → `develop` (via PR) → `main` (via PR)
+- **Branch naming:** `feature/short-description` for new features, `fix/short-description` for bug fixes
+
+**Claude Code MUST follow this workflow:**
+
+1. `git checkout develop && git pull origin develop`
+2. `git checkout -b fix/description-here` (or `feature/`)
+3. Make changes, commit on the branch
+4. `git push -u origin fix/description-here`
+5. `gh pr create --base develop --head fix/description-here`
+6. After merge: `git checkout develop && git pull && git branch -d fix/description-here`
+
+**NEVER do:** `git commit` on develop, `git push origin develop`, `gh pr create --base main --head develop` (unless releasing)
+
 ### Release Process (Automated)
 
 1. PR from `develop` to `main` — CI validates
@@ -174,11 +192,14 @@ git branch -d feature/my-feature
 
 Long-lived branches cause painful merge conflicts. Follow these rules:
 
+- **Always branch from develop:** `git checkout develop && git pull && git checkout -b fix/my-fix`
+- **Never push to develop directly:** All changes via PR from feature/fix branches
 - **Rebase daily:** `git fetch origin develop && git rebase origin/develop` before starting work each day
 - **Small PRs:** Prefer 3 small PRs over 1 large one. Split by layer (types → logic → UI)
 - **Max branch lifetime:** 2-3 days. If work takes longer, split into incremental PRs
 - **Don't touch unrelated files:** Avoid changes to `package.json`, lockfiles, or `apps/web` unless that's the PR's purpose — these are high-conflict files
 - **Rebase before pushing:** Always rebase against latest develop before `git push` to catch conflicts early
+- **Clean up after merge:** Delete feature branches locally and remotely after PR is merged
 
 ### Commit Messages
 

@@ -75,7 +75,7 @@
     "@types/react-dom": "^18.2.25",
     "@types/turndown": "^5.0.6",
     "@vitejs/plugin-react": "^4.2.1",
-    "electron": "^39.8.5",
+    "electron": "^35.7.5",
     "electron-builder": "^26.0.12",
     "electron-devtools-installer": "^4.0.0",
     "electron-vite": "^2.1.0",

@@ -1249,7 +1249,15 @@ function registerDataHandlers(): void {
   ipcMain.handle(
     'data:exportNote',
     async (_event: Electron.IpcMainInvokeEvent, content: string, suggestedName: string) => {
-      const safeName = suggestedName.replace(/[^a-zA-Z0-9\s-]/g, '').substring(0, 80) || 'note';
+      let safeName =
+        suggestedName
+          .normalize('NFC')
+          // eslint-disable-next-line no-control-regex
+          .replace(/[/\\:*?"<>|\x00-\x1f.]/g, '')
+          .substring(0, 80)
+          .trim() || 'note';
+      const WINDOWS_RESERVED = /^(con|prn|aux|nul|com\d|lpt\d)$/i;
+      if (WINDOWS_RESERVED.test(safeName)) safeName = `_${safeName}`;
       const { filePath, canceled } = await dialog.showSaveDialog({
         title: 'Export Note',
         defaultPath: join(app.getPath('documents'), `${safeName}.md`),
@@ -1262,7 +1270,7 @@ function registerDataHandlers(): void {
       }
 
       try {
-        writeFileSync(filePath, content, 'utf-8');
+        await writeFile(filePath, content, 'utf-8');
         return { success: true, path: filePath };
       } catch (error) {
         return {
@@ -1431,8 +1439,9 @@ function registerUpdateHandlers(): void {
       await autoUpdater.downloadUpdate();
       return { ok: true };
     } catch (err) {
-      loggers.updater().error({ error: (err as Error).message }, 'Failed to download update');
-      return { ok: false };
+      const message = (err as Error).message;
+      loggers.updater().error({ error: message }, 'Failed to download update');
+      return { ok: false, error: message };
     }
   });
 
@@ -2298,13 +2307,17 @@ function registerPluginDiscoveryHandlers(): void {
     const archivePath = filePaths[0];
     const fileName = basename(archivePath).toLowerCase();
 
+    // Hoist tmpDir so it can be cleaned up in finally
+    let tmpDir: string | null = null;
+
     try {
       // Ensure plugins dir exists
       await mkdir(paths.plugins, { recursive: true });
 
       // Extract to a temp dir first, then move validated plugin folder
-      const tmpDir = join(paths.plugins, `__installing_${Date.now()}`);
-      await mkdir(tmpDir, { recursive: true });
+      tmpDir = join(paths.plugins, `__installing_${Date.now()}`);
+      const extractDir = tmpDir;
+      await mkdir(extractDir, { recursive: true });
 
       await new Promise<void>((resolve, reject) => {
         const cb = (error: Error | null) => {
@@ -2324,25 +2337,25 @@ function registerPluginDiscoveryHandlers(): void {
                 '-Path',
                 archivePath,
                 '-DestinationPath',
-                tmpDir,
+                extractDir,
               ],
               cb
             );
           } else {
-            execFile('unzip', ['-o', archivePath, '-d', tmpDir], cb);
+            execFile('unzip', ['-o', archivePath, '-d', extractDir], cb);
           }
         } else {
-          execFile('tar', ['-xzf', archivePath, '-C', tmpDir], cb);
+          execFile('tar', ['-xzf', archivePath, '-C', extractDir], cb);
         }
       });
 
       // Find the manifest.json — could be at root or one level deep
-      const entries = await readdir(tmpDir);
-      let pluginSourceDir = tmpDir;
+      const entries = await readdir(extractDir);
+      let pluginSourceDir = extractDir;
 
       // If there's a single subdirectory, use that as the plugin root
       if (entries.length === 1 && entries[0]) {
-        const candidatePath = join(tmpDir, entries[0]);
+        const candidatePath = join(extractDir, entries[0]);
         const candidateStat = await stat(candidatePath);
         if (candidateStat.isDirectory()) {
           pluginSourceDir = candidatePath;
@@ -2352,20 +2365,17 @@ function registerPluginDiscoveryHandlers(): void {
       // Validate: must have manifest.json
       const manifestPath = join(pluginSourceDir, 'manifest.json');
       if (!existsSync(manifestPath)) {
-        await rm(tmpDir, { recursive: true, force: true });
         return { success: false, error: 'No manifest.json found in archive' };
       }
 
       const manifestRaw = await readFile(manifestPath, 'utf-8');
       const manifest = JSON.parse(manifestRaw);
       if (!manifest.id || !manifest.name) {
-        await rm(tmpDir, { recursive: true, force: true });
         return { success: false, error: 'Invalid manifest: missing id or name' };
       }
 
       // Validate plugin ID - only allow alphanumeric, hyphens, underscores
       if (!/^[a-zA-Z0-9_-]+$/.test(manifest.id)) {
-        await rm(tmpDir, { recursive: true, force: true });
         return {
           success: false,
           error: 'Invalid plugin ID: must be alphanumeric with hyphens/underscores only',
@@ -2375,7 +2385,6 @@ function registerPluginDiscoveryHandlers(): void {
       // Verify path doesn't escape plugins directory
       const destDir = join(paths.plugins, manifest.id);
       if (!normalize(destDir).startsWith(normalize(paths.plugins))) {
-        await rm(tmpDir, { recursive: true, force: true });
         return { success: false, error: 'Invalid plugin ID: path traversal detected' };
       }
 
@@ -2386,19 +2395,18 @@ function registerPluginDiscoveryHandlers(): void {
 
       await rename(pluginSourceDir, destDir);
 
-      // Clean up temp dir (in case pluginSourceDir was a subdirectory)
-      if (pluginSourceDir !== tmpDir && existsSync(tmpDir)) {
-        await rm(tmpDir, { recursive: true, force: true });
-      }
-
       return { success: true, pluginId: manifest.id, pluginName: manifest.name };
     } catch (error) {
       return { success: false, error: String(error) };
+    } finally {
+      if (tmpDir && existsSync(tmpDir)) {
+        await rm(tmpDir, { recursive: true, force: true }).catch(() => {});
+      }
     }
   });
 
   // Install plugin from a remote URL (marketplace download)
-  ipcMain.handle('plugins:installFromUrl', async (_event, url: string, _pluginSlug: string) => {
+  ipcMain.handle('plugins:installFromUrl', async (_event, url: string, pluginSlug: string) => {
     // Safety: only allow https URLs
     if (!url.startsWith('https://')) {
       return { success: false, error: 'Only HTTPS URLs are allowed' };
@@ -2429,9 +2437,9 @@ function registerPluginDiscoveryHandlers(): void {
         return { success: false, error: 'Plugin archive exceeds maximum size of 50 MB' };
       }
 
-      // Determine archive type from URL or content-type
-      const lowerUrl = url.toLowerCase();
-      const isZip = lowerUrl.endsWith('.zip') || lowerUrl.includes('.zip');
+      // Determine archive type from URL pathname
+      const urlPathname = new URL(url).pathname.toLowerCase();
+      const isZip = urlPathname.endsWith('.zip');
       const archiveExt = isZip ? '.zip' : '.tar.gz';
       const archivePath = join(tmpDir, `plugin${archiveExt}`);
       await writeFile(archivePath, buffer);
@@ -2490,10 +2498,25 @@ function registerPluginDiscoveryHandlers(): void {
 
       const manifestRaw = await readFile(manifestPath, 'utf-8');
       const manifest = JSON.parse(manifestRaw);
+      if (typeof manifest !== 'object' || manifest === null || Array.isArray(manifest)) {
+        return { success: false, error: 'Invalid manifest: not a JSON object' };
+      }
       if (!manifest.id || !manifest.name) {
         return { success: false, error: 'Invalid manifest: missing id or name' };
       }
 
+      // Cross-plugin overwrite protection: if we requested plugin A but the
+      // archive contains plugin B, block when it would overwrite an existing plugin
+      if (pluginSlug && manifest.id !== pluginSlug) {
+        const wouldOverwrite = join(paths.plugins, manifest.id);
+        if (existsSync(wouldOverwrite)) {
+          return {
+            success: false,
+            error: `Archive contains "${manifest.id}" but "${pluginSlug}" was requested. Refusing to overwrite existing plugin.`,
+          };
+        }
+      }
+
       // Validate plugin ID - only allow alphanumeric, hyphens, underscores
       if (!/^[a-zA-Z0-9_-]+$/.test(manifest.id)) {
         return {
@@ -2515,7 +2538,12 @@ function registerPluginDiscoveryHandlers(): void {
 
       await rename(pluginSourceDir, destDir);
 
-      return { success: true, pluginId: manifest.id, pluginName: manifest.name };
+      return {
+        success: true,
+        pluginId: manifest.id,
+        pluginName: manifest.name,
+        slugMismatch: pluginSlug && manifest.id !== pluginSlug ? pluginSlug : undefined,
+      };
     } catch (error) {
       return { success: false, error: String(error) };
     } finally {

@@ -750,7 +750,7 @@ export interface ReadiedAPI {
     /** Check for updates manually */
     checkNow: () => Promise<{ available: boolean; version?: string }>;
     /** Start downloading the available update */
-    startDownload: () => Promise<{ ok: boolean }>;
+    startDownload: () => Promise<{ ok: boolean; error?: string }>;
     /** Quit and install the downloaded update */
     installNow: () => Promise<void>;
     /** Subscribe to update-available events from background check */

@@ -134,14 +134,19 @@ export function NoteEditor({
   }, [note?.id]);
 
   useEffect(() => {
+    // Guard: if note switched, just sync the ref and bail out
+    if (trackedNoteIdRef.current !== note?.id) {
+      prevDirtyRef.current = isDirty;
+      return;
+    }
     if (prevDirtyRef.current && !isDirty) {
       // Transitioned from dirty to clean — save completed
       setShowSaved(true);
       if (savedTimerRef.current) clearTimeout(savedTimerRef.current);
       savedTimerRef.current = setTimeout(() => setShowSaved(false), 1500);
     }
     prevDirtyRef.current = isDirty;
-  }, [isDirty]);
+  }, [isDirty, note?.id]);
 
   // Cleanup saved timer on unmount
   useEffect(() => {

@@ -53,8 +53,8 @@ export function NoteListFilterBar({ sortBy, sortOrder, onSortChange }: NoteListF
       .then(result => {
         if (!cancelled) setTags(result);
       })
-      .catch(() => {
-        // IPC call failed — leave tags empty
+      .catch((err: unknown) => {
+        console.error('Failed to load tags:', err);
       });
     return () => {
       cancelled = true;
@@ -96,6 +96,7 @@ export function NoteListFilterBar({ sortBy, sortOrder, onSortChange }: NoteListF
             key={opt.label}
             type="button"
             className={`${styles.pill} ${statusFilter === opt.value ? styles.pillActive : ''}`}
+            aria-pressed={statusFilter === opt.value}
             onClick={() => handleStatusClick(opt.value)}
           >
             {opt.label}