MetaList 0.3.13__tar.gz → 0.3.14__tar.gz

{metalist-0.3.13/metalist.egg-info → metalist-0.3.14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.3.13
+Version: 0.3.14
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -67,6 +67,20 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - The browser client drives interaction via `/api2` JSON endpoints.
 - Notes are loaded/decrypted into an in-memory store at startup; a post-startup DB read guard prevents accidental runtime SELECTs.
 
+## Security Boundary
+
+Password protection encrypts namespace data at rest. While a namespace is
+unlocked, the server must hold its data-encryption key and decrypted working
+data in process memory, and the browser holds the decrypted content currently
+rendered in the page. A sufficiently privileged local process, debugger,
+administrator, browser extension, or process-memory dump can therefore expose
+an unlocked namespace.
+
+Explicit logout removes the live key and purges decrypted runtime stores, but
+it cannot guarantee forensic overwriting of memory previously allocated by the
+Python or browser runtimes. Protect the host account and operating system, and
+see the detailed [security architecture and threat model](docs/security/README.md).
+
 ## Development
 
 ### Setup
@@ -85,7 +99,7 @@ After the first installation, update and restart MetaList with one cross-platfor
 ```bash
 metalist update
 ```
-The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it stops running namespaces, hands off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock, installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.3.13.`).
+The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it stops running namespaces, hands off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock, installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.3.14.`).
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 

{metalist-0.3.13 → metalist-0.3.14}/README.md

@@ -33,6 +33,20 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - The browser client drives interaction via `/api2` JSON endpoints.
 - Notes are loaded/decrypted into an in-memory store at startup; a post-startup DB read guard prevents accidental runtime SELECTs.
 
+## Security Boundary
+
+Password protection encrypts namespace data at rest. While a namespace is
+unlocked, the server must hold its data-encryption key and decrypted working
+data in process memory, and the browser holds the decrypted content currently
+rendered in the page. A sufficiently privileged local process, debugger,
+administrator, browser extension, or process-memory dump can therefore expose
+an unlocked namespace.
+
+Explicit logout removes the live key and purges decrypted runtime stores, but
+it cannot guarantee forensic overwriting of memory previously allocated by the
+Python or browser runtimes. Protect the host account and operating system, and
+see the detailed [security architecture and threat model](docs/security/README.md).
+
 ## Development
 
 ### Setup
@@ -51,7 +65,7 @@ After the first installation, update and restart MetaList with one cross-platfor
 ```bash
 metalist update
 ```
-The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it stops running namespaces, hands off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock, installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.3.13.`).
+The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it stops running namespaces, hands off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock, installs the exact version reported by PyPI with a forced cache refresh, launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.3.14.`).
 
 For pip, users can run `pip install metalist`. For a non-editable local install from this checkout, use `uv pip install .` or `pip install .` instead of the editable command below.
 

{metalist-0.3.13 → metalist-0.3.14}/app/api/routes/ontology.py

@@ -20,6 +20,7 @@ from app.services.ontology_rules_store import (
     update_rule_line,
 )
 from app.usecases.rename_tag import apply_rename_tag_everywhere
+from app.usecases.delete_tag import apply_delete_tag_everywhere
 from app.utils.text_utils import strip_html
 
 
@@ -226,6 +227,16 @@ def rename_tag(request: Request, payload: dict) -> dict:
     return apply_rename_tag_everywhere(old=old, new=new, token=token)
 
 
+@router.post("/delete-tag")
+@transactional_route
+def delete_tag(request: Request, payload: dict) -> dict:
+    tag = payload["tag"]
+    if not isinstance(tag, str) or tag.strip() == "":
+        raise HTTPException(status_code=400, detail="tag must be a non-empty string")
+    token = _maybe_bearer_token(request)
+    return apply_delete_tag_everywhere(tag=tag, token=token)
+
+
 @router.get("/focus")
 def focus_view(tag: str) -> dict:
     ontology = get_ontology()
@@ -422,8 +433,7 @@ def list_tags(q: str, limit: int) -> dict:
 
     if needle == "":
         ordered = sorted(tags, key=lambda tag: (-tag_counts.get(tag, 0), tag))
-        if limit > 0:
-            ordered = ordered[:limit]
+        ordered = ordered[:limit]
         payload = [
             {"tag": tag, "count": tag_counts.get(tag, 0)}
             for tag in ordered
@@ -446,8 +456,7 @@ def list_tags(q: str, limit: int) -> dict:
 
     matches.sort(key=lambda item: (item[0], item[1], item[2]))
     results = [item[2] for item in matches]
-    if limit > 0:
-        results = results[:limit]
+    results = results[:limit]
 
     payload = [
         {"tag": tag, "count": tag_counts.get(tag, 0)}

{metalist-0.3.13 → metalist-0.3.14}/app/services/content_formatting.py

@@ -500,9 +500,8 @@ def _render_plain_url_anchor(*, text: str, link_text: str, href_value: str) -> s
     if stripped != link_text:
         return f'<a href="{href_value}" target="_blank" rel="noopener noreferrer">{link_text}</a>'
 
-    title = link_title_store.get_ok_title(link_text)
-    if title is None:
-        link_title_store.maybe_enqueue_fetch(link_text)
+    title_html = render_standalone_link_title_html(link_text)
+    if title_html is None:
         diagnostic = link_title_store.get_diagnostic(link_text)
         diagnostic_title_attr = ""
         if diagnostic is not None:
@@ -513,14 +512,38 @@ def _render_plain_url_anchor(*, text: str, link_text: str, href_value: str) -> s
             f'target="_blank" rel="noopener noreferrer">{link_text}</a>'
         )
 
-    escaped_title = html.escape(title)
-    escaped_domain = html.escape(display_domain_for_url(link_text))
     return (
         f'<a class="link-title" href="{href_value}" title="{href_value}" '
         'target="_blank" rel="noopener noreferrer">'
+        f"{title_html}"
+        "</a>"
+    )
+
+
+def render_standalone_link_title_html(text: str) -> str | None:
+    if not isinstance(text, str):
+        raise TypeError("text must be a string")
+    stripped = text.strip()
+    if stripped == "":
+        return None
+
+    match = _PLAIN_URL_RE.fullmatch(stripped)
+    if match is None:
+        return None
+    link_text, trailing_suffix = _split_trailing_url_punctuation(match.group(0))
+    if link_text != stripped or trailing_suffix != "":
+        return None
+
+    title = link_title_store.get_ok_title(link_text)
+    if title is None:
+        link_title_store.maybe_enqueue_fetch(link_text)
+        return None
+
+    escaped_title = html.escape(title)
+    escaped_domain = html.escape(display_domain_for_url(link_text))
+    return (
         f'<span class="link-title-text">{escaped_title}</span>'
         f'<span class="link-title-domain"> · {escaped_domain}</span>'
-        "</a>"
     )
 
 

{metalist-0.3.13 → metalist-0.3.14}/app/services/embedded_references.py

@@ -8,6 +8,7 @@ from typing import Callable, FrozenSet, List, Optional, Tuple
 from app.services.content_formatting import find_consumed_content_wrapper_keys
 from app.services.content_formatting import find_global_credential_tag
 from app.services.content_formatting import format_note_content_for_view
+from app.services.content_formatting import render_standalone_link_title_html
 from app.services.inline_image_occurrences import annotate_inline_image_occurrences
 from app.services.remote_image_proxy import (
     remote_image_proxy_registry,
@@ -630,23 +631,27 @@ def _render_link_body(
     )
     if is_password_preview:
         preview = "X" * len(preview)
-    escaped_preview = html.escape(preview)
+    preview_html = None
+    if not is_password_preview:
+        preview_html = render_standalone_link_title_html(preview)
+    if preview_html is None:
+        preview_html = html.escape(preview)
     if static_export:
         if is_password_preview:
             return (
                 '<span class="note-reference-link note-reference-link-static meta-credential-password">'
-                f'<span class="meta-credential-value">{escaped_preview}</span>'
+                f'<span class="meta-credential-value">{preview_html}</span>'
                 "</span>"
             )
         return (
             f'<span class="note-reference-link note-reference-link-static">'
-            f"{escaped_preview}"
+            f"{preview_html}"
             "</span>"
         )
     return (
         f'<a href="#" class="note-reference-link" data-ref-note-id="{escaped_note_id}">'
         '<span class="note-reference-link-icon" aria-hidden="true" title="Link to reference source">&#8599;</span>'
-        f'<span class="note-reference-link-title">{escaped_preview}</span>'
+        f'<span class="note-reference-link-title">{preview_html}</span>'
         "</a>"
     )
 

{metalist-0.3.13 → metalist-0.3.14}/app/services/ontology_rules_store.py

@@ -532,6 +532,47 @@ def rename_tag_everywhere(*, old: str, new: str, token: str) -> None:
         _upsert_state_locked(rules=updated_rows, plaintext_by_id=updated_plaintext)
 
 
+def delete_tag_everywhere(*, tag: str) -> int:
+    if not isinstance(tag, str) or tag.strip() == "":
+        raise TypeError("tag must be a non-empty string")
+
+    normalized = tag.strip()
+    with _LOCK:
+        state = _STATE
+        if state is None:
+            raise RuntimeError("Ontology rules store not bootstrapped")
+        if not state.is_decrypted:
+            raise RuntimeError("Ontology rules not decrypted yet")
+
+        deleted_rule_ids: list[int] = []
+        for rule_id, line in state.plaintext_by_id.items():
+            rules = parse_rules_text(text=f"{line}\n", filename=f"ontology_rules:{rule_id}")
+            references_tag = any(
+                rule.rhs == normalized
+                or any(isinstance(atom, TagAtom) and atom.tag == normalized for atom in rule.lhs)
+                for rule in rules
+            )
+            if references_tag:
+                deleted_rule_ids.append(rule_id)
+
+        if not deleted_rule_ids:
+            return 0
+
+        with begin_writer() as connection:
+            for rule_id in deleted_rule_ids:
+                db_delete_rule(connection, rule_id)
+
+        deleted_rule_id_set = set(deleted_rule_ids)
+        updated_rows = [row for row in state.rules if row.id not in deleted_rule_id_set]
+        updated_plaintext = {
+            rule_id: line
+            for rule_id, line in state.plaintext_by_id.items()
+            if rule_id not in deleted_rule_id_set
+        }
+        _upsert_state_locked(rules=updated_rows, plaintext_by_id=updated_plaintext)
+        return len(deleted_rule_ids)
+
+
 def extract_ontology_tags(ontology: TagOntology) -> set[str]:
     tags: set[str] = set()
     for src, outs in ontology.implication_out_edges.items():

{metalist-0.3.13 → metalist-0.3.14}/app/services/tag_rename.py

@@ -5,6 +5,83 @@ import re
 from app.services.content_formatting import _unwrap_tag_token
 
 
+def delete_tag_from_tag_bar(*, tags: str, tag: str) -> tuple[str, bool]:
+    if not isinstance(tags, str):
+        raise TypeError('tags must be a string')
+    if not isinstance(tag, str) or tag == '':
+        raise TypeError('tag must be a non-empty string')
+
+    out = ''
+    changed = False
+    index = 0
+    while index < len(tags):
+        if tags.startswith('/*', index):
+            end = tags.find('*/', index + 2)
+            if end == -1:
+                out += tags[index:]
+                break
+            out += tags[index : end + 2]
+            index = end + 2
+            continue
+
+        ch = tags[index]
+        if ch.isspace():
+            out += ch
+            index += 1
+            continue
+
+        start = index
+        opener = tags[index]
+        token_end = None
+
+        if opener in {'[', '{', '('}:
+            opener_run = 1
+            while index + opener_run < len(tags) and tags[index + opener_run] == opener:
+                opener_run += 1
+            if opener_run <= 3:
+                closer = {"[": "]", "{": "}", "(": ")"}[opener]
+                needle = closer * opener_run
+                close_at = tags.find(needle, index + opener_run)
+                if close_at != -1:
+                    token_end = close_at + opener_run
+
+        if token_end is None:
+            token_end = start
+            while token_end < len(tags) and not tags[token_end].isspace():
+                token_end += 1
+
+        token = tags[start:token_end]
+        base, wrapper = _unwrap_tag_token(token)
+
+        if wrapper is None:
+            if base == tag:
+                changed = True
+            else:
+                out += token
+        else:
+            remaining = _delete_inner_token(inner=base, tag=tag)
+            if remaining != base:
+                changed = True
+                if remaining != '':
+                    opener_char, depth = wrapper
+                    closer_char = {"[": "]", "{": "}", "(": ")"}[opener_char]
+                    out += (opener_char * depth) + remaining + (closer_char * depth)
+            else:
+                out += token
+
+        index = token_end
+
+    return out, changed
+
+
+def _delete_inner_token(*, inner: str, tag: str) -> str:
+    parts = re.split(r'\s+', inner.strip())
+    remaining = [part for part in parts if part != tag]
+    if len(remaining) == len(parts):
+        return inner
+    return ' '.join(remaining)
+
+
 def rename_tag_in_tag_bar(*, tags: str, old: str, new: str) -> tuple[str, bool]:
     if not isinstance(tags, str):
         raise TypeError('tags must be a string')