@gmickel/gno 1.31.0 → 1.33.0

package/README.md

@@ -117,7 +117,7 @@ gno daemon --detach  # headless indexing + resident MCP gateway
 
 <!-- public-truth:current-version -->
 
-> Current release: **v1.31.0** — see [CHANGELOG.md](./CHANGELOG.md)
+> Current release: **v1.33.0** — see [CHANGELOG.md](./CHANGELOG.md)
 
 <!-- /public-truth -->
 
@@ -694,7 +694,7 @@ Open `http://localhost:3000` to:
   configured MCP retrieval without changing client config. Skill installation
   is visible, but client runtime execution cannot be proven automatically
 - **Manage files safely**: Rename, reveal, or move editable files to Trash with explicit index-vs-disk semantics
-- **Refactor files safely**: Move, duplicate, and organize editable notes with reference warnings
+- **Refactor files safely**: Preview and atomically rename or move editable notes while GNO rewrites supported wiki and Markdown references; stale or unsafe plans fail closed
 - **Switch presets**: Change models live without restart
 - **Command palette**: Jump, create, refactor, and section-navigate from one keyboard-first surface
 
@@ -773,7 +773,7 @@ GNO is local-first, but sometimes you want a URL to send someone. [**gno.sh**](h
 
 ![gno.sh publish reader](./assets/screenshots/publish-reader.jpg)
 
-The workflow is deliberately explicit: **export locally → upload artifact → share URL**. Private and `publish: false` notes stay on your machine. Exported artifacts omit local collection paths and source URIs.
+The workflow is deliberately explicit: **export locally → upload artifact → share URL**. Private and `publish: false` notes stay on your machine. Exported artifacts omit local collection paths and source URIs. Local PNG/JPEG/GIF/WebP/AVIF images (Markdown and Obsidian embeds) are bundled into the artifact with SHA-256 dedup, `gno-asset:` sentinels, and an exact 100 MiB serialized ceiling; external HTTPS images stay as URLs. Encrypted shares keep image bytes inside ciphertext only. Invite-only note text publishes today, but invite-only image delivery on gno.sh is not supported yet.
 
 ```bash
 # Export a single note
@@ -817,6 +817,15 @@ agent capabilities or manifests. Encrypted exports remain ciphertext-only.
 Reader metadata drops embedded local path or GNO/file URI tokens; canonical
 and image fields accept only uncredentialed public HTTP(S) targets.
 
+Resolved local PNG, JPEG, GIF, WebP, and AVIF references are bundled,
+content-addressed, and deduplicated; external public HTTPS images remain
+external. The exact serialized artifact is capped at 100 MiB. Public images
+use immutable snapshot/generation URLs, secret-link images are authorized on
+every request, and encrypted image bytes exist only inside ciphertext before
+the browser creates scoped Blob URLs. Invite-only bundled-image delivery is
+currently fail-closed; use an asset-free invite, secret link, or encrypted
+share when local images are required.
+
 Republishing a public, secret-link, or invite-only artifact updates the same URL. Encrypted shares should be replaced from a fresh local export so the server never needs your plaintext.
 
 Encrypted source-backed publish on `gno.sh` is intentionally disabled. For encrypted shares, use:
@@ -863,9 +872,10 @@ curl http://localhost:3000/api/health
 | `/api/docs`                   | GET    | List documents               |
 | `/api/docs`                   | POST   | Create document              |
 | `/api/docs/:id`               | PUT    | Update document content      |
-| `/api/docs/:id/move`          | POST   | Move editable document       |
+| `/api/docs/:id/rename`        | POST   | Apply confirmed safe rename  |
+| `/api/docs/:id/move`          | POST   | Apply confirmed safe move    |
 | `/api/docs/:id/duplicate`     | POST   | Duplicate editable document  |
-| `/api/docs/:id/refactor-plan` | POST   | Preview file-op warnings     |
+| `/api/docs/:id/refactor-plan` | POST   | Preview reference-safe plan  |
 | `/api/docs/:id/deactivate`    | POST   | Remove from index            |
 | `/api/doc`                    | GET    | Get document content         |
 | `/api/doc/:id/sections`       | GET    | Get document sections        |

package/assets/skill/SKILL.md

@@ -92,6 +92,17 @@ Recipe rules:
 | **Skill**    | `skill install/uninstall/show/paths`                                                                       | Install skill for AI agents                                              |
 | **Admin**    | `status`, `doctor`, `cleanup`, `reset`, `vec`, `completion`                                                | Maintenance and diagnostics                                              |
 
+### Publishing with local images
+
+`gno publish export` bundles resolved local PNG, JPEG, GIF, WebP, and AVIF
+references, deduplicates identical bytes, preserves public HTTPS images, and
+enforces the 100 MiB exact serialized artifact limit. Review `assetSummary`
+in `--json` output for unresolved or unsupported references. Public and
+secret-link readers serve authorized hosted URLs; encrypted exports keep image
+bytes inside ciphertext and create scoped Blob URLs only after browser
+decryption. Hosted invite-only bundled-image delivery is currently
+fail-closed, so use an asset-free invite, secret link, or encrypted share.
+
 ## Search Modes
 
 | Command                | Speed   | Best For                            |
@@ -499,6 +510,29 @@ search must include the new note. Browser provenance fields are
 `extractionHash`, `finalBodyHash`, `clipIdentity`, and `previewDigest`—do not
 invent `sourceHash`.
 
+## Reference-Safe Rename and Move
+
+When MCP writes are enabled and the user asks to rename or move an editable
+note, always use the operation-specific two-step tool. Never invent a digest or
+collapse preview and apply into one call.
+
+1. Call `gno_rename_note` or `gno_move_note` with `action: "preview"` and the
+   exact source/destination.
+2. Inspect `canApply`, `safety.blockingReasons`, and `examinedReferences`.
+   Stop and report ambiguous, malformed, unsupported, read-only, occupied,
+   cross-collection, or truncated plans.
+3. Only after explicit user approval, call the same tool with `action: "apply"`,
+   the preview's exact `schemaVersion` and `planDigest`, `confirmation: "apply"`,
+   and `confirm: true`.
+4. Treat `applied_with_sync_pending` as a committed filesystem refactor whose
+   index still needs `gno_sync` or `gno_index`; do not retry the file mutation.
+   For `stale_plan`, preview again instead of reusing the old digest.
+
+Supported wiki and Markdown destinations are rewritten in the same
+all-or-rollback filesystem transaction as the source move. Duplicate and
+create-folder do not retarget inbound references. Authentication alone never
+enables these MCP writes.
+
 ## Collection-specific embedding models
 
 Collections can override the global embedding model with `models.embed`.

package/assets/skill/cli-reference.md

@@ -887,11 +887,19 @@ export pipeline runs a sanitizer over each note's markdown. It:
   `_internal/` convention is treated as never-publish)
 - converts `[[Target|Alias]]` to the alias text, and `[[Target]]` to the
   tail segment of the target
-- drops `![[image.png]]` embeds (attachments are not bundled yet) with a
-  warning so the author can migrate to `![alt](url)` or wait for bundling
+- resolves local `![[image.png]]` / Markdown image refs for PNG/JPEG/GIF/WebP/
+  AVIF (AVIF must be AV1-decodable at producer ingress) into content-addressed
+  `gno-asset:<sha256>` sentinels (deduped; exact 100 MiB serialized ceiling;
+  ciphertext field bounds align to that envelope); preserves external HTTPS
+  images; skips fenced code (backtick and tilde); drops unsupported/missing/
+  unsafe refs with diagnostics
 - refuses to export a note whose frontmatter contains `publish: false`
   (single-note export errors; collection export silently skips)
 
+Successful exports include `assetSummary` in `--json`. Encrypted visibility
+keeps raster bytes inside ciphertext only. Hosted invite-only image delivery
+is currently fail-closed on gno.sh.
+
 Every sanitizer decision surfaces in the CLI output as a "Preprocessor
 notes" section, on the `--json` response under `warnings`, and on
 `--preview` as a structured report — so nothing is silently lost.

package/browser-extension/artifacts/gno-browser-clipper-v1.33.0.zip.sha256

@@ -0,0 +1 @@
+c398c09680951afa0b5d436f3b92cf3dfb6e49427b9df83830ce899d3b03d7e4  gno-browser-clipper-v1.33.0.zip

package/browser-extension/dist/manifest.json

@@ -21,5 +21,5 @@
   "content_security_policy": {
     "extension_pages": "script-src 'self'; object-src 'none'; connect-src http://127.0.0.1:*"
   },
-  "version": "1.31.0"
+  "version": "1.33.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gmickel/gno",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "description": "Local semantic search for your documents. Index Markdown, PDF, and Office files with hybrid BM25 + vector search.",
   "keywords": [
     "embeddings",
@@ -178,6 +178,9 @@
     "jsonc-parser": "3.3.1",
     "lucide-react": "1.28.0",
     "markitdown-ts": "0.0.10",
+    "mdast-util-from-markdown": "2.0.3",
+    "mdast-util-gfm": "3.1.0",
+    "micromark-extension-gfm": "3.0.0",
     "minimatch": "10.2.6",
     "nanoid": "6.0.0",
     "node-llama-cpp": "3.19.1",
@@ -190,6 +193,7 @@
     "react-markdown": "10.1.0",
     "rehype-sanitize": "6.0.0",
     "remark-gfm": "4.0.1",
+    "sharp": "0.35.3",
     "shiki": "4.3.1",
     "sqlite-vec": "0.1.9",
     "streamdown": "2.5.0",

package/spec/cli.md

@@ -1949,6 +1949,19 @@ tokens MUST be filtered. Canonical and image metadata MUST contain
 uncredentialed public HTTP(S) targets; local hostnames and literal loopback,
 private, or link-local addresses MUST be filtered.
 
+When local raster attachments are bundled, the V1 artifact MAY include
+`assets[]` and `requiredCapabilities: ["bundled-raster-assets@1"]`. Export
+success payloads (CLI `--json` and `POST /api/publish/export`) MUST include a
+deterministic `assetSummary` with asset/ref counts, raw/encoded/final UTF-8
+upload bytes, dedup savings, external image count, and unresolved/unsupported
+diagnostics. Exact final serialized upload bytes MUST be enforced against the
+100 MiB ceiling before returning. Encrypted V2 ciphertext string bounds MUST
+align to that same 100 MiB final-envelope budget and MUST NOT replace exact
+final serialized measurement as the authoritative upload gate. Producer
+ingress MUST require AV1-decodable AVIF payloads (structural BMFF alone is
+insufficient). Asset-free exports omit `assets` /
+`requiredCapabilities` and report zero asset counts.
+
 Secret-link and invite-only V1 spaces MUST NOT contain a manifest or agent
 capability field. Encrypted V2 spaces MUST contain only ciphertext parameters,
 the opaque secret token, route slug, source type, and encrypted visibility; no
@@ -1956,7 +1969,9 @@ plaintext manifest or evidence may appear outside the ciphertext. V2 builders
 MUST emit a closed projection, validate payload strings as non-empty bounded
 base64, require a positive safe-integer KDF iteration count, and bound the
 non-blank opaque token. Caller-supplied extension fields MUST NOT enter the
-artifact.
+artifact. Encrypted export MUST place bundled assets only inside the encrypted
+client payload. The outer V2 envelope MUST contain neither plaintext note
+content, asset descriptors, source references, nor raster bytes.
 
 ---
 
@@ -3448,6 +3463,25 @@ Error codes match exit codes: `VALIDATION` (exit 1), `RUNTIME` (exit 2), `NOT_RU
 
 ---
 
+## Workspace file refactors (non-CLI)
+
+Reference-safe note rename and same-collection move use a transport-neutral
+preview/apply contract defined in `src/core/file-refactors.ts` and frozen as:
+
+- `gno://schemas/file-refactor-preview@1.0`
+- `gno://schemas/file-refactor-apply-result@1.0`
+
+Surfaces that adapt the contract are REST/Web UI, SDK, and write-gated MCP
+(`gno_rename_note`, `gno_move_note`). This specification intentionally does
+**not** add a CLI command family or generic action bus for refactors.
+Duplicate-note and create-folder keep their existing shipped semantics and do
+not retarget inbound references.
+
+The contract separates durable filesystem commit/rollback from post-commit
+index convergence. A successful filesystem refactor is never rolled back solely
+because reindexing is temporarily unavailable
+(`applied_with_sync_pending`).
+
 ## See Also
 
 - [MCP Specification](./mcp.md)

package/spec/db/schema.sql

@@ -21,6 +21,7 @@
 --   retrieval_trace_exports/export_traces - Export manifests and trace joins
 --   document_changes - Bounded metadata-only document lifecycle journal
 --   document_change_journal_state - Monotonic cursor/retention boundary
+--   file_refactor_recovery_journal - Content-free rename/move recovery receipts
 
 -- ─────────────────────────────────────────────────────────────────────────────
 -- Schema Metadata
@@ -742,3 +743,57 @@ CREATE TABLE IF NOT EXISTS clipper_capture_idempotency (
 
 CREATE INDEX IF NOT EXISTS idx_clipper_idempotency_created
   ON clipper_capture_idempotency(created_at_ms, grant_id, key_hash);
+
+-- ─────────────────────────────────────────────────────────────────────────────
+-- File refactor recovery journal (content-free)
+-- ─────────────────────────────────────────────────────────────────────────────
+
+-- Durable receipts for multi-file rename/move apply. Stores IDs, digests,
+-- collection/relpaths, phase/state, timestamps, and fingerprints/status only.
+-- Never stores note bodies or replacement content.
+-- Bounded: create prunes oldest terminal receipts (converged/rolled_back/aborted)
+-- under FILE_REFACTOR_JOURNAL_MAX_RECEIPTS; never prunes recovery_required.
+
+CREATE TABLE IF NOT EXISTS file_refactor_recovery_journal (
+  journal_id TEXT PRIMARY KEY,
+  plan_digest TEXT NOT NULL,
+  collection TEXT NOT NULL,
+  operation TEXT NOT NULL
+    CHECK (operation IN ('rename', 'move')),
+  source_rel_path TEXT NOT NULL,
+  target_rel_path TEXT NOT NULL,
+  phase TEXT NOT NULL
+    CHECK (phase IN (
+      'prepared', 'staging', 'committing', 'committed', 'sync_pending',
+      'converged', 'rolling_back', 'rolled_back', 'recovery_required',
+      'aborted'
+    )),
+  phase_ordinal INTEGER NOT NULL CHECK (phase_ordinal >= 0),
+  filesystem_state TEXT NOT NULL
+    CHECK (filesystem_state IN (
+      'unchanged', 'committed', 'rolled_back', 'recovery_required'
+    )),
+  index_state TEXT NOT NULL
+    CHECK (index_state IN (
+      'not_attempted', 'pending', 'converged', 'skipped'
+    )),
+  file_entries_json TEXT NOT NULL
+    CHECK (length(CAST(file_entries_json AS BLOB)) <= 65536),
+  created_at_ms INTEGER NOT NULL CHECK (created_at_ms >= 0),
+  updated_at_ms INTEGER NOT NULL CHECK (updated_at_ms >= 0),
+  CHECK (length(CAST(journal_id AS BLOB)) BETWEEN 1 AND 128),
+  CHECK (
+    length(plan_digest) = 64
+    AND plan_digest NOT GLOB '*[^0-9a-f]*'
+  ),
+  CHECK (length(CAST(collection AS BLOB)) BETWEEN 1 AND 256),
+  CHECK (length(CAST(source_rel_path AS BLOB)) BETWEEN 1 AND 4096),
+  CHECK (length(CAST(target_rel_path AS BLOB)) BETWEEN 1 AND 4096),
+  CHECK (updated_at_ms >= created_at_ms)
+);
+
+CREATE INDEX IF NOT EXISTS idx_file_refactor_journal_plan_digest
+  ON file_refactor_recovery_journal(plan_digest, updated_at_ms DESC, journal_id DESC);
+
+CREATE INDEX IF NOT EXISTS idx_file_refactor_journal_collection
+  ON file_refactor_recovery_journal(collection, updated_at_ms DESC);

package/spec/mcp.md

@@ -1798,39 +1798,140 @@ Create a folder inside an existing collection (write-enabled).
 
 Rename an editable note in place (write-enabled).
 
+Same-collection rename is covered by the transport-neutral reference-safe
+refactor contract (`src/core/file-refactors.ts`). Preview and apply share one
+versioned schema pair across MCP, REST/SDK, and UI adapters:
+
+- Preview plan: `gno://schemas/file-refactor-preview@1.0`
+- Apply result: `gno://schemas/file-refactor-apply-result@1.0`
+
+The preview enumerates examined wiki/Markdown references with classifications
+and stable reason codes, destination-only edit spans, precondition fingerprints,
+a deterministic `planDigest`, safety summary, and `canApply`. Apply requires the
+exact `planDigest`, confirmation token `apply`, `confirm: true`, and
+`schemaVersion: "1.0"`. Apply never silently preview-and-confirms. Terminal
+statuses are `applied`, `applied_with_sync_pending`, `conflict`, `stale_plan`,
+`unsupported`, and `failed_rolled_back`.
+
+Filesystem commit (moved note + accepted reference rewrites) is an atomic
+all-or-rollback boundary. Index/link convergence runs only after a durable
+filesystem commit and is **not** the same transaction; reindex failure returns
+`applied_with_sync_pending` without rolling back committed files.
+
+MCP annotations remain hints, not authorization. Write gating (`--enable-write`)
+and destructive confirmation (`confirm: true` + `confirmation: "apply"`) still
+apply. No generic action-bus tool is introduced.
+
 **Input Schema:**
 
 ```json
 {
   "type": "object",
-  "properties": {
-    "ref": { "type": "string" },
-    "name": { "type": "string" }
-  },
-  "required": ["ref", "name"]
+  "oneOf": [
+    {
+      "properties": {
+        "action": { "const": "preview" },
+        "ref": { "type": "string" },
+        "name": { "type": "string" }
+      },
+      "required": ["action", "ref", "name"],
+      "additionalProperties": false
+    },
+    {
+      "properties": {
+        "action": { "const": "apply" },
+        "ref": { "type": "string" },
+        "name": { "type": "string" },
+        "schemaVersion": { "const": "1.0" },
+        "planDigest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "confirmation": { "const": "apply" },
+        "confirm": { "const": true }
+      },
+      "required": [
+        "action",
+        "ref",
+        "name",
+        "schemaVersion",
+        "planDigest",
+        "confirmation",
+        "confirm"
+      ],
+      "additionalProperties": false
+    }
+  ]
 }
 ```
 
+**Output Schema:**
+
+- `action=preview` → `gno://schemas/file-refactor-preview@1.0` (content-free plan)
+- `action=apply` → `gno://schemas/file-refactor-apply-result@1.0` (content-free receipt)
+
+Missing or incorrect apply confirmation fails before mutation.
+
 ---
 
 ### gno_move_note
 
 Move an editable note to another folder in the same collection (write-enabled).
 
+Cross-collection moves are out of scope and fail closed with
+`cross_collection_unsupported`. Preview/apply semantics, destination-only edit
+spans, stale-plan protection, and the filesystem-vs-index mutation boundary match
+`gno_rename_note` and use the same schemas:
+
+- Preview plan: `gno://schemas/file-refactor-preview@1.0`
+- Apply result: `gno://schemas/file-refactor-apply-result@1.0`
+
 **Input Schema:**
 
 ```json
 {
   "type": "object",
-  "properties": {
-    "ref": { "type": "string" },
-    "folderPath": { "type": "string" },
-    "name": { "type": "string" }
-  },
-  "required": ["ref", "folderPath"]
+  "oneOf": [
+    {
+      "properties": {
+        "action": { "const": "preview" },
+        "ref": { "type": "string" },
+        "folderPath": { "type": "string" },
+        "name": { "type": "string" }
+      },
+      "required": ["action", "ref", "folderPath"],
+      "additionalProperties": false
+    },
+    {
+      "properties": {
+        "action": { "const": "apply" },
+        "ref": { "type": "string" },
+        "folderPath": { "type": "string" },
+        "name": { "type": "string" },
+        "schemaVersion": { "const": "1.0" },
+        "planDigest": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+        "confirmation": { "const": "apply" },
+        "confirm": { "const": true }
+      },
+      "required": [
+        "action",
+        "ref",
+        "folderPath",
+        "schemaVersion",
+        "planDigest",
+        "confirmation",
+        "confirm"
+      ],
+      "additionalProperties": false
+    }
+  ]
 }
 ```
 
+**Output Schema:**
+
+- `action=preview` → `gno://schemas/file-refactor-preview@1.0` (content-free plan)
+- `action=apply` → `gno://schemas/file-refactor-apply-result@1.0` (content-free receipt)
+
+Missing or incorrect apply confirmation fails before mutation.
+
 ---
 
 ### gno_duplicate_note
@@ -2243,6 +2344,8 @@ Output schemas include version in `$id`:
 
 - `gno://schemas/search-result@1.0`
 - `gno://schemas/capture-receipt@1.0`
+- `gno://schemas/file-refactor-preview@1.0`
+- `gno://schemas/file-refactor-apply-result@1.0`
 
 Clients should check schema version for compatibility.