@plinth-music/cli 0.23.2 → 0.23.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -2,6 +2,50 @@
2
2
 
3
3
  Notable changes to `@plinth-music/cli`. Grouped by what a user notices, not by PR.
4
4
 
5
+ ## 0.23.3 - 2026-10-07
6
+
7
+ Three code PRs since `0.23.2` (`v0.23.2..64c6759`: #222, #223, #224; #221 docs).
8
+ A patch: fixes only, no new command or sync surface.
9
+
10
+ ⚠️ **Saves made in quick succession are no longer lost** (#222). When a document was
11
+ saved twice within about a second, as an agent often does, the daemon's own pull could
12
+ write an earlier version back over the later saves. Those edits were then gone from the
13
+ laptop and from Plinth alike, and `plinth status` showed nothing wrong. On the test
14
+ workspace, 9 of 50 saves made 0.6 seconds apart were lost before this fix and none in
15
+ the runs after it. The pull now leaves a file alone while it holds a save that has not
16
+ been sent yet, and lets the save go up first. This covers documents, tasks, projects and
17
+ meetings. **Artists are not covered yet**: their two files share one version, and that
18
+ needs its own fix first.
19
+
20
+ ⚠️ **A file you save under `files/` survives a pull or a restore** (#224). A save made
21
+ while the daemon was pulling or restoring the same file could be overwritten with no copy
22
+ kept. The save now stays where it is for its own upload; if a teammate's change wins,
23
+ your version is kept in `_conflicts/`. A teammate deleting a file in Plinth no longer
24
+ removes a newer copy you hold.
25
+
26
+ **`plinth status` lists what the daemon is holding back** (#224). A new **Held** section
27
+ names each file the daemon kept rather than overwrote or deleted - a copy that could not
28
+ be made, a download that failed its integrity check, or a file kept after a teammate
29
+ deleted it - with what to do about each. An unchanged held file is not downloaded again.
30
+
31
+ **A crafted file header can no longer pin your CPU** (#223). The YAML reader inside the
32
+ frontmatter library moves to 3.15.2, which fixes four advisories where a header with
33
+ chained merge keys took quadratic time to read. A teammate's crafted header, or a
34
+ compromised account, could otherwise stall the daemon of every member who pulled it.
35
+ This is the other half of 0.23.2's header fix.
36
+
37
+ **What is not proven.**
38
+
39
+ - Artists still use the old pull path, as above.
40
+ - A save landing during a conflict round trip, about a second, can still end up in
41
+ neither place. That belongs to the Sync Conflicts work.
42
+ - For a kept file over 4 MB, Held says it goes back into Plinth the next time the daemon
43
+ starts. A restart uploaded nothing. The file is safe on disk; the wording is wrong.
44
+ - A kept file logs the same line on every poll for up to an hour. Nothing is downloaded,
45
+ written or sent.
46
+ - #224 was proved live with two isolated daemons on the test workspace; the ambient
47
+ pull's own download window is proved in tests only.
48
+
5
49
  ## 0.23.2 - 2026-10-04
6
50
 
7
51
  Two code PRs since `0.23.1` (`v0.23.1..ea615a2`: #217, #218; #215, #216 and #219 docs).
@@ -1,5 +1,5 @@
1
1
  {
2
- "sha": "0c1d5fec200fb36f10135b8fbe4d34fdb064af94",
2
+ "sha": "e6eaa1b6b2068e06d059fada822e201e983e1de6",
3
3
  "dirty": false,
4
- "built_at": "2026-10-04T16:58:56.340Z"
4
+ "built_at": "2026-10-07T17:31:25.749Z"
5
5
  }