MetaList 0.7.2__tar.gz → 0.7.3__tar.gz

{metalist-0.7.2/metalist.egg-info → metalist-0.7.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.2
+Version: 0.7.3
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.3
+
+- Windows updates use a private verified uv release when an older installer is vulnerable to the reported PE-resource access-denied failure. A standalone repair ZIP can bootstrap installations whose existing updater cannot update itself.
+- Release candidates now run the complete test and installed-package matrix on Windows, macOS, and Linux across Python 3.10–3.14. Real Chrome and Firefox exercise repeated cold loads and encrypted login on every operating system; Windows also checks Edge over verified LAN HTTPS and the repair path from a published older release.
+
 ## Changes in 0.7.2
 
 - Login, hydration, and workspace requests share one initialized browser-tab identity. Losing the `sessionStorage` copy while opening the workspace no longer causes the reported missing-tab-ID crash. The external trigger for that storage loss remains unconfirmed.
@@ -147,6 +152,8 @@ metalist update
 ```
 The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
+On Windows, the updater checks uv before installing packages. Versions older than 0.12.13 use a temporary PE-resource editing operation that can fail with `uv-trampoline.exe: Access is denied`. This checkout selects a private, checksum-verified uv 0.12.17 for those installations, keeping the same installer through preflight and final installation. It does not replace global uv. Already-installed MetaList releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies the compatible installer to that existing updater.
+
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
 Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update` and the in-app update action; direct pip/uv install commands do not run it.

{metalist-0.7.2 → metalist-0.7.3}/README.md

@@ -12,6 +12,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.3
+
+- Windows updates use a private verified uv release when an older installer is vulnerable to the reported PE-resource access-denied failure. A standalone repair ZIP can bootstrap installations whose existing updater cannot update itself.
+- Release candidates now run the complete test and installed-package matrix on Windows, macOS, and Linux across Python 3.10–3.14. Real Chrome and Firefox exercise repeated cold loads and encrypted login on every operating system; Windows also checks Edge over verified LAN HTTPS and the repair path from a published older release.
+
 ## Changes in 0.7.2
 
 - Login, hydration, and workspace requests share one initialized browser-tab identity. Losing the `sessionStorage` copy while opening the workspace no longer causes the reported missing-tab-ID crash. The external trigger for that storage loss remains unconfirmed.
@@ -111,6 +116,8 @@ metalist update
 ```
 The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
+On Windows, the updater checks uv before installing packages. Versions older than 0.12.13 use a temporary PE-resource editing operation that can fail with `uv-trampoline.exe: Access is denied`. This checkout selects a private, checksum-verified uv 0.12.17 for those installations, keeping the same installer through preflight and final installation. It does not replace global uv. Already-installed MetaList releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies the compatible installer to that existing updater.
+
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
 Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update` and the in-app update action; direct pip/uv install commands do not run it.

{metalist-0.7.2 → metalist-0.7.3}/app/config.py

@@ -114,9 +114,9 @@ if TEST_MODE:
     # Delete existing test.db if it exists
     if test_database_path.exists():
         test_database_path.unlink()
-        print("🧪 Deleted existing test.db")
+        print("Deleted existing test.db")
 
-    print("🧪 Running in TEST MODE - using test.db")
+    print("Running in TEST MODE - using test.db")
 else:
     # Use production database
     DEFAULT_DB_PATH = str(resolve_default_database_path())

{metalist-0.7.2 → metalist-0.7.3}/app/db/live_recovery.py

@@ -44,7 +44,10 @@ def _sync_directory(path: Path) -> None:
 
 
 def _sync_file(path: Path) -> None:
-    with path.open('rb') as handle:
+    # Windows' CRT rejects fsync/_commit on a read-only descriptor with EBADF.
+    # These are live or recovery files owned by this transaction, so open them
+    # without truncation using a descriptor that every supported OS can flush.
+    with path.open('r+b') as handle:
         os.fsync(handle.fileno())
 
 

{metalist-0.7.2 → metalist-0.7.3}/app/models/database.py

@@ -124,15 +124,8 @@ class SafeSession:
         _configure_sql_logging(anchor)
         cls._memory_anchor = anchor
         print("\n" + "=" * 50)
-        print(
-            """
-🧪 SWITCHING TO TEST MODE 🧪
-┌──────────────────────────┐
-│   IN-MEMORY DATABASE     │
-│  *All Data is Temporary  │
-└──────────────────────────┘
-        """
-        )
+        print("TEST MODE: IN-MEMORY DATABASE")
+        print("All data is temporary")
         print("=" * 50 + "\n")
         return {"status": "ok", "message": "Using in-memory database"}
 
@@ -159,15 +152,7 @@ class SafeSession:
         _configure_sql_logging(conn)
         conn.close()
         print("\n" + "=" * 50)
-        print(
-            """
-📝 RETURNING TO PRODUCTION MODE 📝
-┌──────────────────────────┐
-│      PROD DATABASE       │
-│                          │
-└──────────────────────────┘
-        """
-        )
+        print("PRODUCTION MODE: FILE DATABASE")
         print("=" * 50 + "\n")
         return {"status": "ok", "message": "Using file database"}
 

{metalist-0.7.2 → metalist-0.7.3}/app/services/app_updates.py

@@ -9,6 +9,7 @@ import shutil
 import subprocess
 import sys
 import sysconfig
+import threading
 from uuid import UUID, uuid4
 
 from app.data_directory import resolve_data_directory
@@ -28,6 +29,9 @@ class AppUpdateRejected(ValueError):
     """An update cannot be started in this installation or job state."""
 
 
+_JOB_THREAD_LOCK = threading.Lock()
+
+
 def update_executable() -> Path:
     receipt = Path(sys.prefix) / 'uv-receipt.toml'
     if not receipt.is_file():
@@ -165,24 +169,23 @@ def _release_update_job_locked(job_id: str) -> None:
 def _job_lock():
     directory = jobs_directory()
     directory.mkdir(parents=True, exist_ok=True)
-    # Stable cross-process lock: all namespaces share this installation's update admission.
-    with (directory / 'admission.lock').open('a+b') as handle:
-        if os.name == 'nt':
-            if handle.tell() == 0:
-                handle.write(b'0')
-                handle.flush()
-            handle.seek(0)
-            msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
-        else:
-            fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-        try:
-            yield
-        finally:
+    # Threads share process-owned POSIX locks, so serialize them before taking
+    # the stable cross-process lock shared by all namespaces.
+    with _JOB_THREAD_LOCK:
+        with (directory / 'admission.lock').open('a+b') as handle:
             if os.name == 'nt':
                 handle.seek(0)
-                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+                msvcrt.locking(handle.fileno(), msvcrt.LK_LOCK, 1)
             else:
-                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+                fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
+            try:
+                yield
+            finally:
+                if os.name == 'nt':
+                    handle.seek(0)
+                    msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+                else:
+                    fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
 
 
 def create_update_job(target_version: str) -> dict[str, object]:

metalist-0.7.3/app/services/update_installer.py

@@ -0,0 +1,122 @@
+"""Select a compatible Windows installer; also runs standalone for old installations."""
+from __future__ import annotations
+
+from collections.abc import Mapping
+import hashlib
+import io
+import os
+from pathlib import Path
+import platform
+import re
+import shutil
+import subprocess
+import sys
+from tempfile import NamedTemporaryFile
+from urllib.request import urlopen
+import zipfile
+
+
+# Official immutable 0.12.17 release assets. 0.12.13 removed the temporary
+# Windows PE resource-editing operation that can fail under file inspection.
+INSTALLER_VERSION = "0.12.17"
+MINIMUM_WINDOWS_VERSION = (0, 12, 13)
+WINDOWS_INSTALLERS = {
+    "x86_64": (
+        "a252121d5b59398fcb137c6ea448176459a44010f33f67e0072305a637119ca7",
+        "2019cdf564cb8f749262f5f021cedc75a99abb1c6081227ca340bbcda972611d",
+    ),
+    "aarch64": (
+        "3e1aa6849d77f0e00dc865e4afab5c5b32de053e21fe35bf5ad5cec3734ec976",
+        "92e3a7af84b7da8925997eb5b856595e1c36a4b3591fbccee7d143e69f1c8656",
+    ),
+    "i686": (
+        "1d3653cb6eafd1e675e979d7cd8eeac1456202f8927a2216419993077a4c473f",
+        "8d08a9c61f18f9436069f3ccf6e13e7f665b0e9b1ff85ac98f1ec8261c493145",
+    ),
+}
+
+
+def _installer_version(executable: str, environ: Mapping[str, str]) -> tuple[int, int, int]:
+    completed = subprocess.run([executable, "--version"], env=dict(environ),
+                               capture_output=True, text=True, check=True, timeout=30)
+    match = re.fullmatch(r"uv (\d+)\.(\d+)\.(\d+)(?: \([^\r\n]+\))?", completed.stdout.strip())
+    if match is None:
+        raise RuntimeError("Cannot verify the uv installer version; MetaList was not stopped")
+    return tuple(int(part) for part in match.groups())
+
+
+def _windows_architecture() -> str:
+    machine = platform.machine().casefold()
+    aliases = {"amd64": "x86_64", "x86_64": "x86_64", "arm64": "aarch64",
+               "aarch64": "aarch64", "x86": "i686", "i386": "i686", "i686": "i686"}
+    if machine not in aliases:
+        raise RuntimeError(f"Unsupported Windows updater architecture: {machine}")
+    return aliases[machine]
+
+
+def _download_installer_archive(architecture: str) -> bytes:
+    assert architecture in WINDOWS_INSTALLERS
+    url = (f"https://github.com/astral-sh/uv/releases/download/{INSTALLER_VERSION}/"
+           f"uv-{architecture}-pc-windows-msvc.zip")
+    with urlopen(url, timeout=120) as response:
+        return response.read()
+
+
+def _managed_windows_installer(environ: Mapping[str, str]) -> str:
+    architecture = _windows_architecture()
+    archive_digest, binary_digest = WINDOWS_INSTALLERS[architecture]
+    local_directory = Path(environ["LOCALAPPDATA"])
+    if not local_directory.is_absolute():
+        raise RuntimeError("LOCALAPPDATA must be an absolute path for the update installer")
+    directory = local_directory / "MetaList" / "update-tools" / f"uv-{INSTALLER_VERSION}-{architecture}"
+    executable = directory / "uv.exe"
+    if executable.exists():
+        if hashlib.sha256(executable.read_bytes()).hexdigest() != binary_digest:
+            raise RuntimeError("Cached update installer failed checksum verification; MetaList was not stopped")
+        return str(executable)
+    print(f"Preparing verified Windows update installer uv {INSTALLER_VERSION}...", flush=True)
+    archive_body = _download_installer_archive(architecture)
+    if hashlib.sha256(archive_body).hexdigest() != archive_digest:
+        raise RuntimeError("Downloaded update installer failed checksum verification; MetaList was not stopped")
+    with zipfile.ZipFile(io.BytesIO(archive_body)) as archive:
+        binary = archive.read("uv.exe")
+    if hashlib.sha256(binary).hexdigest() != binary_digest:
+        raise RuntimeError("Update installer executable failed checksum verification; MetaList was not stopped")
+    directory.mkdir(parents=True, exist_ok=True)
+    # Publish only complete, verified bytes. This is an installer cache, never a backup.
+    with NamedTemporaryFile(dir=directory, prefix="uv-", suffix=".tmp", delete=False) as staged:
+        staged.write(binary)
+    os.replace(staged.name, executable)
+    return str(executable)
+
+
+def resolve_update_installer(*, uv_executable: str, platform_name: str,
+                             environ: Mapping[str, str]) -> str:
+    if platform_name != "win32":
+        return uv_executable
+    if _installer_version(uv_executable, environ) >= MINIMUM_WINDOWS_VERSION:
+        return uv_executable
+    executable = _managed_windows_installer(environ)
+    expected_version = tuple(int(part) for part in INSTALLER_VERSION.split("."))
+    if _installer_version(executable, environ) != expected_version:
+        raise RuntimeError("Verified update installer reported the wrong version; MetaList was not stopped")
+    return executable
+
+
+def repair_windows_update() -> None:
+    if sys.platform != "win32":
+        raise RuntimeError("This recovery launcher is for Windows installations")
+    uv_executable = shutil.which("uv")
+    metalist_executable = shutil.which("metalist")
+    if uv_executable is None or metalist_executable is None:
+        raise RuntimeError("The existing uv and MetaList commands must be available on PATH")
+    environ = dict(os.environ)
+    installer = resolve_update_installer(uv_executable=uv_executable, platform_name="win32", environ=environ)
+    # The already-installed updater discovers uv through PATH. Preserve that
+    # updater's preflight, shutdown, backup, offline install, and restart flow.
+    environ["PATH"] = str(Path(installer).parent) + os.pathsep + environ["PATH"]
+    subprocess.run([metalist_executable, "update"], env=environ, check=True)
+
+
+if __name__ == "__main__":
+    repair_windows_update()

{metalist-0.7.2 → metalist-0.7.3}/app/services/update_preflight.py

@@ -16,6 +16,7 @@ from app.services.namespace_switcher import NamespaceLaunchProcess
 from app.services.namespace_switcher import _stop_failed_namespace_launch
 from app.services.namespace_switcher import _wait_for_namespace_ready
 from app.services.windows_process_control import stop_process_tree as stop_windows_process_tree
+from app.services.update_installer import resolve_update_installer
 
 
 def _run_checked(command: list[str], *, environ: Mapping[str, str], directory: Path) -> str:
@@ -92,6 +93,9 @@ def prepare_update(*, uv_executable: str, target_version: str,
     python = str(Path(sys._base_executable).resolve())
     if not Path(python).is_file():
         raise RuntimeError("The current base Python interpreter is missing; MetaList was not stopped")
+    uv_executable = resolve_update_installer(
+        uv_executable=uv_executable, platform_name=sys.platform, environ=environ,
+    )
     print(f"Checking MetaList v{target_version} installation and startup with Python {sys.version.split()[0]}...", flush=True)
     with TemporaryDirectory(prefix="metalist-update-check-") as temporary:
         directory = Path(temporary)

{metalist-0.7.2 → metalist-0.7.3}/app/startup_js_sanity.py

@@ -165,7 +165,7 @@ def discover_typescript_source_paths(project_root: Path) -> list[Path]:
 
 
 def _path_rel(project_root: Path, path: Path) -> str:
-    return os.path.relpath(path, project_root)
+    return path.relative_to(project_root).as_posix()
 
 
 def _codeframe(lines: list[str], lineno: int, col: int, context_lines: int) -> str:

{metalist-0.7.2 → metalist-0.7.3}/app/startup_sanity.py

@@ -72,7 +72,7 @@ class _RouteDecorator:
 
 
 def _path_rel(project_root: Path, path: Path) -> str:
-    return os.path.relpath(path, project_root)
+    return path.relative_to(project_root).as_posix()
 
 
 def _suppressed(lines: list[str], lineno: int, rule_id: str) -> bool:

{metalist-0.7.2 → metalist-0.7.3}/app/version.py

@@ -1,3 +1,3 @@
 """Single authoritative MetaList application version."""
 
-__version__ = "0.7.2"
+__version__ = "0.7.3"

{metalist-0.7.2 → metalist-0.7.3/metalist.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.2
+Version: 0.7.3
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.3
+
+- Windows updates use a private verified uv release when an older installer is vulnerable to the reported PE-resource access-denied failure. A standalone repair ZIP can bootstrap installations whose existing updater cannot update itself.
+- Release candidates now run the complete test and installed-package matrix on Windows, macOS, and Linux across Python 3.10–3.14. Real Chrome and Firefox exercise repeated cold loads and encrypted login on every operating system; Windows also checks Edge over verified LAN HTTPS and the repair path from a published older release.
+
 ## Changes in 0.7.2
 
 - Login, hydration, and workspace requests share one initialized browser-tab identity. Losing the `sessionStorage` copy while opening the workspace no longer causes the reported missing-tab-ID crash. The external trigger for that storage loss remains unconfirmed.
@@ -147,6 +152,8 @@ metalist update
 ```
 The updater checks the installed version against the latest PyPI release first. If MetaList is already current, it reports the installed version and leaves all running namespaces untouched. When an update is available, it checks installer prerequisites and uses uv to install the candidate into a disposable tool environment with the current base Python interpreter. It checks dependencies and starts a temporary namespace to verify HTTP readiness, version, and runtime assets. A failed preflight leaves the current installation and running namespaces unchanged. After preflight succeeds, it stops running namespaces, and creates and verifies a new backup of every namespace before installation can begin. Each archive includes the complete notes/settings database, the attachments database when present, and any legacy search-history database. Locked namespaces are backed up with their encrypted data and key metadata intact, without requiring a password.
 
+On Windows, the updater checks uv before installing packages. Versions older than 0.12.13 use a temporary PE-resource editing operation that can fail with `uv-trampoline.exe: Access is denied`. This checkout selects a private, checksum-verified uv 0.12.17 for those installations, keeping the same installer through preflight and final installation. It does not replace global uv. Already-installed MetaList releases retain their own updater code; the standalone repair launcher described in [recovery](docs/security/recovery.md#windows-updater-pe-resource-failure) supplies the compatible installer to that existing updater.
+
 Backups are saved to `~/MetaList/namespaces/<namespace>/backups/<namespace>-<timestamp>.metalist-backup.tar.gz`; the updater prints each verified path. Existing backups remain unchanged and are not pruned. If any backup fails, the update aborts with the current installation intact; run `metalist` to restart the stopped servers after resolving the failure.
 
 Only after all backups pass does the updater hand off to an external PowerShell process on Windows or `/bin/sh` on macOS/Linux so the installed environment can unlock. It delegates installation to uv, pinning the current base interpreter and the exact tested package/dependency versions, using the cache populated during preflight with network access disabled. It then launches MetaList again, and reports the installed version (for example, `MetaList updated to v0.5.0.`). This protection requires an installed version containing the backup safeguard and applies to `metalist update` and the in-app update action; direct pip/uv install commands do not run it.

{metalist-0.7.2 → metalist-0.7.3}/metalist.egg-info/SOURCES.txt

@@ -162,6 +162,7 @@ app/services/test_reset.py
 app/services/tokens.py
 app/services/undo_state.py
 app/services/update_backups.py
+app/services/update_installer.py
 app/services/update_preflight.py
 app/services/view_cache.py
 app/services/view_diff.py