MetaList 0.7.4__tar.gz → 0.7.6__tar.gz

{metalist-0.7.4 → metalist-0.7.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.4
+Version: 0.7.6
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.5
+
+- Unexpected API 500 errors now show the exception class and MetaList source line in the browser, without exposing note contents, exception messages, or local filesystem paths.
+- A local release command validates the exact cross-platform CI matrix, publishes only its tested artifacts, then verifies the public PyPI package in a clean installation.
+
 ## Changes in 0.7.4
 
 - Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.

{metalist-0.7.4 → metalist-0.7.6}/README.md

@@ -12,6 +12,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.5
+
+- Unexpected API 500 errors now show the exception class and MetaList source line in the browser, without exposing note contents, exception messages, or local filesystem paths.
+- A local release command validates the exact cross-platform CI matrix, publishes only its tested artifacts, then verifies the public PyPI package in a clean installation.
+
 ## Changes in 0.7.4
 
 - Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.

{metalist-0.7.4 → metalist-0.7.6}/app/main.py

@@ -38,6 +38,7 @@ from app.services.search_history import search_history_store
 from app.services.runtime_hardening import apply_runtime_hardening
 from app.security.encryption import set_encryption_required
 from app.security.http_headers import apply_security_headers
+from app.security.http_error_diagnostics import describe_server_exception
 from app.security.request_boundary import RequestBoundaryMiddleware
 from app.security.request_boundary import resolve_allowed_request_hosts
 from app.security.validation_errors import summarize_validation_errors
@@ -149,6 +150,18 @@ async def request_validation_error(request: Request, exc: RequestValidationError
 async def handle_ontology_parse_error(request: Request, exc: OntologyParseError):
     return JSONResponse(status_code=400, content={"detail": str(exc)})
 
+
+@app.exception_handler(Exception)
+async def handle_unexpected_server_error(request: Request, exc: Exception):
+    return JSONResponse(
+        status_code=500,
+        content={
+            "detail": "Internal server error",
+            "diagnostic": describe_server_exception(exc),
+        },
+        headers={"Cache-Control": "no-store, private", "X-Content-Type-Options": "nosniff"},
+    )
+
 _startup_timing_enabled = True
 
 

metalist-0.7.6/app/security/http_error_diagnostics.py

@@ -0,0 +1,19 @@
+"""Small, data-free diagnostics for unexpected HTTP failures."""
+
+from pathlib import Path
+import traceback
+
+
+_APP_DIRECTORY = Path(__file__).resolve().parents[1]
+_REPOSITORY_DIRECTORY = _APP_DIRECTORY.parent
+
+
+def describe_server_exception(error: Exception) -> dict[str, str]:
+    """Expose the exception class and last application frame, never its message."""
+    location = "external"
+    for frame in reversed(traceback.extract_tb(error.__traceback__)):
+        path = Path(frame.filename).resolve()
+        if path.is_relative_to(_APP_DIRECTORY):
+            location = f"{path.relative_to(_REPOSITORY_DIRECTORY).as_posix()}:{frame.lineno}"
+            break
+    return {"errorType": type(error).__name__, "codeLocation": location}

{metalist-0.7.4 → metalist-0.7.6}/app/services/content_formatting.py

@@ -328,7 +328,7 @@ def remove_formatting_scope_delimiters(
 def _is_removable_formatting_tag(token: str) -> bool:
     if not isinstance(token, str):
         raise TypeError(f"token must be a string, got {type(token)}")
-    if not token.startswith("@"):
+    if not token.startswith("@") or token == "@":
         return False
     tag_name = _canonical_meta_tag_name(token[1:].casefold())
     if tag_name in _REMOVABLE_FORMATTING_TAGS:
@@ -822,7 +822,7 @@ def _add_implied_meta_tags(*, tags: str, config: MetaTagConfig) -> MetaTagConfig
         implied_terms = ontology.infer_implication_only(base_tags=source_terms)
         implied_meta_tags: Set[str] = set()
         for term in implied_terms:
-            if not term.startswith("@"):
+            if not term.startswith("@") or term == "@":
                 continue
             tag_name = _canonical_meta_tag_name(term[1:].casefold())
             if _is_formatting_meta_tag_name(tag_name):
@@ -1230,7 +1230,7 @@ def _parse_meta_tags(tags: str) -> MetaTagConfig:
     for token in tokens:
         base, wrapper = _unwrap_tag_token(token)
         if wrapper is None:
-            if not base.startswith("@"):
+            if not base.startswith("@") or base == "@":
                 continue
             tag_name = _canonical_meta_tag_name(base[1:].casefold())
             if not _is_formatting_meta_tag_name(tag_name):
@@ -1248,7 +1248,7 @@ def _parse_meta_tags(tags: str) -> MetaTagConfig:
         key = (opener, depth)
         wrappers_to_consume.add(key)
         for inner in inner_tokens:
-            if not inner.startswith("@"):
+            if not inner.startswith("@") or inner == "@":
                 continue
             tag_name = _canonical_meta_tag_name(inner[1:].casefold())
             if not _is_formatting_meta_tag_name(tag_name):
@@ -1257,9 +1257,7 @@ def _parse_meta_tags(tags: str) -> MetaTagConfig:
                     if key in scoped_renderers:
                         existing = scoped_renderers[key]
                     if existing is not None and existing != tag_name:
-                        raise ValueError(
-                            f"Wrapper {key} has conflicting scoped renderers: {existing} vs {tag_name}"
-                        )
+                        continue
                     scoped_renderers[key] = tag_name
                 continue
             if key not in scoped:

{metalist-0.7.4 → metalist-0.7.6}/app/static/js/modules/api-client.js

@@ -7,6 +7,7 @@ import { computeScrollAnchor } from './mode-manager/services/scroll-anchor-servi
 import { CommandGate } from './mode-manager/services/command-gate-service.js';
 import { buildSessionHeaders } from './session-auth.js';
 import { sanitizeNoteHtmlForStorage } from './note-html-sanitizer.js';
+import { describeApiFailure } from './api-error-diagnostics.js';
 
 function buildAuthHeaders(includeContentType) {
     return buildSessionHeaders(includeContentType);
@@ -125,7 +126,7 @@ export const NotesAPI = {
             if (!response.ok) {
                 // Use centralized error handling
                 ErrorHandler.handleApiError(null, response);
-                throw new HttpRequestError(`API call failed: ${response.status} ${response.statusText}`);
+                throw new HttpRequestError(await describeApiFailure(response));
             }
 
             const data = await response.json();

metalist-0.7.6/app/static/js/modules/api-error-diagnostics.js

@@ -0,0 +1,16 @@
+const ERROR_TYPE = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const CODE_LOCATION = /^(?:app(?:\/[A-Za-z_][A-Za-z0-9_]*)+\.py:\d+|external)$/;
+
+export async function describeApiFailure(response) {
+    const base = `API call failed: ${response.status} ${response.statusText}`;
+    if (response.status < 500 || !response.headers.get('content-type')?.includes('application/json')) {
+        return base;
+    }
+
+    const body = await response.json();
+    const diagnostic = body?.diagnostic;
+    if (!ERROR_TYPE.test(diagnostic?.errorType) || !CODE_LOCATION.test(diagnostic?.codeLocation)) {
+        return base;
+    }
+    return `${base} (${diagnostic.errorType} at ${diagnostic.codeLocation})`;
+}

{metalist-0.7.4 → metalist-0.7.6}/app/static/js/modules/mode-manager/services/tag-syntax-service.js

@@ -28,6 +28,28 @@ const TAG_WRAPPER_PAIRS = new Map([
     ['(', ')'],
 ]);
 const TAG_WRAPPER_CHARS = new Set(['[', ']', '{', '}', '(', ')']);
+const SCOPED_RENDERER_TAGS = new Set(['@markdown', '@latex', '@json', '@csv', '@shell']);
+const KNOWN_META_TAGS = new Set([
+    '@footnote', '@monospace', '@heading', '@red', '@green', '@blue', '@grey',
+    '@highlighter', '@bold', '@italic', '@strikethrough', '@serif', '@copyable',
+    '@list-bulleted', '@list-numbered', '@username', '@password', '@email',
+    '@todo', '@done', '@markdown', '@llm', '@latex', '@shell', '@json', '@csv',
+]);
+
+function isSupportedMetaTag(term) {
+    if (typeof term !== 'string') {
+        throw new Error('isSupportedMetaTag requires string');
+    }
+    if (!term.startsWith('@')) {
+        return true;
+    }
+    const folded = term.toLowerCase();
+    if (KNOWN_META_TAGS.has(folded)) {
+        return true;
+    }
+    return /^@size=(?:\d+(?:\.\d*)?|\.\d+)$/.test(folded)
+        && /[1-9]/.test(folded.slice('@size='.length));
+}
 
 function isAsciiPrintable(char) {
     if (typeof char !== 'string' || char.length === 0) {
@@ -515,8 +537,10 @@ export function analyzeTagBarInput(rawInput) {
 
     const sanitizedSegments = [];
     const normalizedSegments = [];
+    let globalRenderer = null;
     for (const segment of segments) {
         normalizedSegments.push(segment.text);
+        let sanitizedToken = segment.text;
         if (segment.type === 'token') {
             const wrapperInfo = analyzeUnclosedWrapperTokenInfo(segment.text);
             if (wrapperInfo) {
@@ -530,8 +554,42 @@ export function analyzeTagBarInput(rawInput) {
                 hasReservedOrTag = true;
                 continue;
             }
+            if (closedWrapperInfo) {
+                let scopedRenderer = null;
+                const retainedTerms = tagTerms.filter((term) => {
+                    if (!isSupportedMetaTag(term)) {
+                        return false;
+                    }
+                    const renderer = term.toLowerCase();
+                    if (!SCOPED_RENDERER_TAGS.has(renderer)) {
+                        return true;
+                    }
+                    if (scopedRenderer !== null && scopedRenderer !== renderer) {
+                        return false;
+                    }
+                    scopedRenderer = renderer;
+                    return true;
+                });
+                if (retainedTerms.length === 0) {
+                    continue;
+                }
+                const opener = segment.text[0];
+                const prefix = opener.repeat(closedWrapperInfo.depth);
+                const suffix = TAG_WRAPPER_PAIRS.get(opener).repeat(closedWrapperInfo.depth);
+                sanitizedToken = `${prefix}${retainedTerms.join(' ')}${suffix}`;
+            } else if (!isSupportedMetaTag(segment.text)) {
+                continue;
+            } else {
+                const renderer = segment.text.toLowerCase();
+                if (SCOPED_RENDERER_TAGS.has(renderer)) {
+                    if (globalRenderer !== null && globalRenderer !== renderer) {
+                        continue;
+                    }
+                    globalRenderer = renderer;
+                }
+            }
         }
-        sanitizedSegments.push(segment.text);
+        sanitizedSegments.push(sanitizedToken);
     }
 
     const sanitizedText = sanitizedSegments.join(' ').trim();

{metalist-0.7.4 → metalist-0.7.6}/app/version.py

@@ -1,3 +1,3 @@
 """Single authoritative MetaList application version."""
 
-__version__ = "0.7.4"
+__version__ = "0.7.6"

{metalist-0.7.4 → metalist-0.7.6}/metalist.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: metalist
-Version: 0.7.4
+Version: 0.7.6
 Summary: A minimalist single-user note-taking app with SSR, fast in-memory tree operations, and efficient sync.
 Project-URL: Homepage, https://github.com/evolvingstuff/metalist
 Project-URL: Repository, https://github.com/evolvingstuff/metalist
@@ -48,6 +48,11 @@ A minimalist single-user note-taking app focused on server-side rendering (SSR),
 - Multi-tab search contexts with server-persisted scroll/search state (survives browser restarts)
 - Manual namespace backups/restores to a user-selected backup folder with retention controls
 
+## Changes in 0.7.5
+
+- Unexpected API 500 errors now show the exception class and MetaList source line in the browser, without exposing note contents, exception messages, or local filesystem paths.
+- A local release command validates the exact cross-platform CI matrix, publishes only its tested artifacts, then verifies the public PyPI package in a clean installation.
+
 ## Changes in 0.7.4
 
 - Updates use a private, checksum-verified uv release on Windows, macOS, and Linux. The updater does not execute a user-installed uv, and it revalidates both the cached official archive and extracted executable before each use.

{metalist-0.7.4 → metalist-0.7.6}/metalist.egg-info/SOURCES.txt

@@ -70,6 +70,7 @@ app/presentation/render/__init__.py
 app/presentation/render/note_renderer.py
 app/security/authenticated_logging.py
 app/security/encryption.py
+app/security/http_error_diagnostics.py
 app/security/http_headers.py
 app/security/note_html.py
 app/security/request_boundary.py
@@ -224,6 +225,7 @@ app/static/js/namespace-deleted.js
 app/static/js/namespace-renamed.js
 app/static/js/modules/activity-tracker.js
 app/static/js/modules/api-client.js
+app/static/js/modules/api-error-diagnostics.js
 app/static/js/modules/api-failure-classification-service.js
 app/static/js/modules/app-update-service.js
 app/static/js/modules/application-state.js

{metalist-0.7.4 → metalist-0.7.6}/pyproject.toml

@@ -77,6 +77,8 @@ app = [
 release = [
     "build==1.6.1",
     "pip-audit==2.10.1",
+    "requests==2.34.2",
+    "rich==14.3.4",
     "setuptools==83.0.0",
     "uv==0.11.23",
     "wheel==0.48.0",