timet 1.6.4 → 1.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cd119a6557987c9bdf16530865c16c60b3aca4cf30ed5424a04649f55bb6f430
-  data.tar.gz: 6a0e25787dce7bc903e3b2fa6374631db80045ae3dbf353b9cb8b2fd6cbbcf95
+  metadata.gz: b43ddbb0c2a4744c09fede5bbe507ea736a9690daebf6cbccba07d427fcd929c
+  data.tar.gz: 9b90a62f2e4cc6c7ee089510ca9c1a023c8f35a22164fa1837140109c1cdda77
 SHA512:
-  metadata.gz: 74c3b445e264432d4412afef6bdc53e6f2c1f8a1b8d64c430a4c638d70f58190654faa2d7b550ebcc97fb2068d0091fcb7d4f4ce5d365179c7828db4e0076830
-  data.tar.gz: 9563a33fff69df1b70375f7528174cd5ff064f77b2d78a2f8609d861e095d7f50312e065e21c587786c442ed10b6c7de2803e96e2d556db4626e729cfa04e0e2
+  metadata.gz: dbbcb0cf64a60c26147145f010d7213782b25fe627136e4ed1827e41e4c90748b413d8de5877540cab93cde39f1eb4b093df33bc28da8e8d20d67e894a96c5ab
+  data.tar.gz: 927452644bc0201d87343845193b46481f20b836d8d197fd7b42ebbaed1a42b835deba4352af8ec5e25c81df62e800e772ab66f53dc9d31cc5e250dba61120bf

data/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [1.6.5] - 2026-08-01
+
+**Improvements:**
+
+- **Documentation:** Expanded `README.md` with detailed setup instructions for Supabase S3-compatible storage, environment variable configuration, and usage of the `timet sync` command.
+- **Dependencies:** Updated locked gem dependencies in `Gemfile.lock` including `aws-sdk`, `rubocop`, `sqlite3`, `json`, and `rake`.
+
+**Bug Fixes & Security:**
+
+- **Security Patches:** Resolved multiple security vulnerabilities by updating locked gem versions:
+  - `addressable` (`>= 2.9.0`): Addressed ReDoS vulnerability in Addressable templates ([CVE-2026-35611](https://github.com/sporkmonger/addressable/security/advisories/GHSA-h27x-rffw-24p4)).
+  - `json` (`>= 2.19.9`): Fixed heap buffer overflow when streaming to IO ([CVE-2026-54696](https://nvd.nist.gov/vuln/detail/CVE-2026-54696)).
+  - `mcp` (`>= 0.23.0`): Resolved SSE stream hijacking, session poisoning, memory exhaustion, and DNS-rebinding protection issues ([CVE-2026-33946](https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-qvqr-5cv7-wh35)).
+  - `sqlite3` (`>= 2.9.5`): Patched Use-After-Free vulnerabilities when redefining functions and in aggregate callbacks ([CVE-2026-54619](https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54619), [CVE-2026-54620](https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54620)).
+
 ## [1.6.4] - 2026-03-26
 
 **Improvements:**
@@ -8,6 +23,7 @@
 - **Test Coverage:** Expanded test suite for bidirectional sync scenarios, including conflict resolution and remote item handling.
 
 **Bug Fixes:**
+- Fix validation editor spec to properly stub database update
 
 - **Sync Logic:** Fixed item synchronization to properly handle local-only and remote-only items with timestamp-based decision making.
 - **Database Updates:** Corrected `update_item_from_hash` method to properly bind ID parameter in SQL queries.

data/README.md

@@ -251,7 +251,7 @@ Once configured, Timet will automatically send a notification to your Discord ch
 | `timet su [start_date]..[end_date]`              | Display a report of tracked time for a date range.                     | `timet su 2024-01-02..2024-01-03` |
 | `timet resume (r) [id]`                          | Resume tracking a task by ID or the last completed task.               | `timet resume [id]`               |
 | `timet resume (r) [id] --pomodoro=[minutes]`     | Resume tracking with a Pomodoro timer.                                 | `timet resume 1 --pomodoro=25`    |
-| `timet sync`                                     | Sync local db with remote (S3) external db                             | `timet sync`                      |
+| `timet sync`                                     | Sync local database with S3 storage (bidirectional sync).              | `timet sync`                      |
 | `timet version`                                  | Display the current version.                                           | `timet version`                   |
 
 ### Date Range in Summary
@@ -260,18 +260,47 @@ The `timet summary` command now supports specifying a date range for generating
 
 #### Examples:
 
-- **Single Date:** Display a report for a specific date.
+- **Single Date**: Display a report for a specific date.
 
   ```sh
   timet su 2024-01-03
   ```
 
-- **Date Range:** Display a report for a date range.
+- **Date Range**: Display a report for a date range.
 
   ```sh
   timet su 2024-01-02..2024-01-03
   ```
 
+### Sync Operations
+
+```bash
+# Sync local database with S3
+timet sync
+```
+
+This command performs a bidirectional sync:
+1. Creates the S3 bucket if it doesn't exist
+2. If a remote database exists, downloads it and compares with the local database using MD5 hashing
+3. If databases differ, syncs the changes
+4. If no remote database exists, uploads the local database as `timet.db`
+
+### Example Sync Workflow:
+
+```bash
+# First time setup: configure credentials
+mkdir -p ~/.timet && cd ~/.timet
+cat > .env <<-'EOF'
+S3_ENDPOINT=https://abcdefghijklmnop.supabase.co/storage/v1/object
+S3_ACCESS_KEY=your-access-key-here
+S3_SECRET_KEY=your-secret-key-here
+S3_REGION=us-east-1
+EOF
+
+# Sync your time tracking data to cloud
+timet sync
+```
+
 <a name="data"></a>
 
 ## 🗃️ Data
@@ -284,23 +313,101 @@ Timet's data is stored in `~/.timet`.
 
 Timet supports backing up and syncing your time tracking data with S3-compatible storage services (such as Supabase S3). To configure S3 backup, follow these steps:
 
-### Environment Variables
+### Setting Up Supabase S3 Storage
+
+#### 1. Create a Database Project in Supabase
 
-Create a `.env` file in your project root (`~/.timet`) with the following variables:
+If you don't have a Supabase project yet:
+1. Go to [Supabase](https://supabase.com/) and create a new project
+2. Choose a region close to your location
+3. Complete the project setup wizard
+
+#### 2. Enable S3 Storage in Supabase
+
+1. In your Supabase project dashboard, navigate to **Settings** → **Storage**
+2. Click **Create storage bucket** or select an existing bucket
+3. Configure the bucket:
+   - **Bucket name**: Use a descriptive name like `timet-data` or `time-tracking`
+   - **File size limit**: Choose appropriate limits (e.g., 10MB per file)
+   - **Public access**: Set to **Private** for security
+
+#### 3. Generate S3 Access Credentials
+
+Supabase uses AWS-compatible S3 APIs, so it requires access keys:
+
+1. Go to your Supabase project dashboard → **Settings** → **API**
+2. Scroll down to **Service Role Secrets** or **S3 Configuration**
+3. Click **Generate New Key** or view existing credentials
+4. Copy the following values (you won't be able to see them again after leaving this page):
+   - `SERVICE_ROLE_KEY` → This is your S3_ACCESS_KEY
+   - The corresponding secret → This is your S3_SECRET_KEY
+
+> ⚠️ **Important**: If you don't see these options in Settings, check:
+> - **Security** tab in project settings
+> - **Database** → **Connection Pooling** section (sometimes under **Settings**)
+> - Contact Supabase support if credentials aren't visible
+>
+> Alternatively, create a custom S3-compatible endpoint using Supabase's API:
+> ```bash
+> # Format: https://<project-ref>.supabase.co/storage/v1/object
+> ```
+
+#### 4. Configure Environment Variables
+
+Create a `.env` file in `~/.timet/` with the following variables:
 
 ```bash
-S3_ENDPOINT=your_s3_endpoint_url
-S3_ACCESS_KEY=your_access_key
-S3_SECRET_KEY=your_secret_key
-S3_REGION=your_s3_region
+S3_ENDPOINT=https://<your-project-id>.supabase.co/storage/v1/object
+S3_ACCESS_KEY=<your-service-role-key>
+S3_SECRET_KEY=<your-service-role-secret>
+S3_REGION=us-west-1  # Or your Supabase region (e.g., europe-west3, ap-southeast-1)
 ```
 
+Replace the placeholders with your actual values from Step 3. Example:
+
+```bash
+S3_ENDPOINT=https://abcdefghijklmnop.supabase.co/storage/v1/object
+S3_ACCESS_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
+S3_SECRET_KEY=xyz987-abc123-def456-ghi789-jkl012
+S3_REGION=us-east-1
+```
+
+#### 5. Create the S3 Bucket (Optional)
+
+If you haven't created a bucket yet in Supabase, Timet can create one:
+
+```bash
+timet s3 create <bucket-name>
+```
+
+Or use the shortcut:
+
+```bash
+timet s3 create timet-data
+```
+
+
 ### Security Considerations
 
-- Keep your `.env` file private and never commit it to version control
+- Keep your `.env` file private and never commit it to version control (`.env` should be in your `.gitignore`)
 - Use strong, unique access keys
 - Regularly rotate your S3 access credentials
 - Implement appropriate IAM policies to restrict bucket access
+- For production use, consider using a dedicated service role with minimum required permissions
+
+### Verification
+
+After configuration, verify the connection:
+
+```bash
+# List objects in your bucket (if you have list permissions)
+timet s3 list-buckets
+
+# Or simply try a sync operation to upload your data
+timet sync
+```
+
+All S3 operations are logged to `~/.timet/s3_supabase.log`.
 
 ## Development
 

data/lib/timet/version.rb

@@ -6,6 +6,6 @@ module Timet
   # @return [String] The version number in the format 'major.minor.patch'.
   #
   # @example Get the version of the Timet application
-  #   Timet::VERSION # => '1.6.4'
-  VERSION = '1.6.4'
+  #   Timet::VERSION # => '1.6.5'
+  VERSION = '1.6.5'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: timet
 version: !ruby/object:Gem::Version
-  version: 1.6.4
+  version: 1.6.5
 platform: ruby
 authors:
 - Frank Vielma
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-27 00:00:00.000000000 Z
+date: 2026-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor