The 'integration.openURLScheme' IPC method invokes 'shell.openExternal'
with a renderer-supplied string after only checking that it contains
'://'. Electron's documentation explicitly warns that passing untrusted
URLs to 'shell.openExternal' is unsafe: schemes such as 'file://',
'smb://', 'ms-msdt:', 'search-ms:', 'jar:', 'res:', 'javascript:',
'data:' and 'vbscript:' have well-known abuse chains (local file
disclosure, NTLM credential theft over SMB on Windows, MSDT/Follina-style
RCE, etc.). Because the renderer process can also reach this IPC via any
XSS sink in untrusted RSS feed content, the previous validation was not
sufficient.
Replace the substring check with strict URL parsing plus an allowlist of
protocols that match the integration use-cases documented in the UI
(Obsidian, Bear, Drafts, Things, Notion, DEVONthink) plus generic
http/https/mailto. All other protocols are rejected with a clear error.
Adds vitest cases for representative dangerous schemes (verifying that
'shell.openExternal' is never invoked) and for every scheme shipped as a
built-in example, so future regressions on either side are caught.
- Replace text input with native dialog.showOpenDialog for vault path selection
- Add path validity detection with three-state UI (unselected/valid/invalid)
- Fix YAML frontmatter parsing failure with Chinese/special characters
- Fix ENOENT error when vault subdirectory doesn't exist
- Add AI summary (description) to Obsidian frontmatter export
- Add author fallback to feed title when entry author is empty
- Increase filename truncation limit from 20 to 80 characters for CJK titles
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
- Replace text input with native dialog.showOpenDialog for vault path selection
- Add path validity detection with three-state UI (unselected/valid/invalid)
- Fix YAML frontmatter parsing failure with Chinese/special characters
- Fix ENOENT error when vault subdirectory doesn't exist
- Add AI summary (description) to Obsidian frontmatter export
- Add author fallback to feed title when entry author is empty
- Increase filename truncation limit from 20 to 80 characters for CJK titles
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix: harden desktop e2e auth and user flows
* fix: stabilize desktop e2e in ci
* fix: stabilize ci desktop e2e flows
* fix: make ci desktop e2e more robust
* fix: avoid media interception in desktop e2e
* fix: increase desktop e2e timeouts for ci
* fix: use keyboard navigation for web e2e entries
* fix: stabilize desktop e2e navigation in ci
* fix: simplify desktop e2e navigation paths
* fix: narrow desktop e2e action selectors
* fix: add desktop e2e read-action fallbacks
* fix: reduce desktop e2e flakiness in ci
* fix: harden desktop e2e route transitions
* fix: relax desktop e2e ci assertions
* fix: prefer keyboard read toggle in desktop e2e
* fix: tolerate settings modal close races in e2e
* fix: tighten desktop e2e flows and remove gha e2e
* feat: add cross-platform e2e coverage
* fix: stabilize desktop e2e navigation
* fix: harden desktop e2e read flow
* fix: harden desktop e2e auth and follow flows
* fix: stabilize desktop e2e discover entry flows
* fix: run android e2e in a single shell
* fix: speed up mobile e2e builds in ci
* fix: build android e2e app from mobile workspace
* fix: invoke android gradle build from repo root
* fix: use absolute path for android ci build
* fix: restore android eas build in ci
* fix: target iOS simulator by udid in ci
* fix: align desktop e2e with discover card flow
* fix: reorder web e2e after relogin
* fix: navigate web e2e via real hash url
* fix: close stale settings modal before reopening
* fix: track android maestro flows
* fix: wait for settings router in web e2e
* fix: wait for web settings sync propagation
* fix: stabilize desktop e2e settings flows
* fix: harden desktop e2e regressions
* fix: stabilize desktop e2e selectors
* fix: read desktop entry state from locators
* fix: relax desktop e2e entry assertions
* fix: avoid waiting on missing desktop feed ids
* feat(cli): deep integration with desktop client
- Package CLI binary with desktop app via extraResource in Electron Forge
- Sync desktop login session to ~/.folo/config.json automatically on login/logout
- Add CliService IPC with install/uninstall methods supporting macOS (osascript), Linux (pkexec), Windows (.cmd wrapper)
- Add CLI settings tab in desktop app for install status and management
- Create prepare-cli build script to compile and bundle CLI before packaging
- Add i18n strings for CLI UI (English and Chinese)
The CLI now shares the desktop app's authentication session without requiring separate login.
Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
* fix(cli): fix CI failures in auth service and forge config
- Pass `undefined` explicitly to syncSessionToCliConfig() to satisfy TS arity check
- Make resources/cli conditional in extraResource so packaging doesn't fail when CLI bundle is absent
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(cli): make syncSessionToCliConfig token param optional
Avoids TS2554 when called without arguments on signOut, while also
satisfying the lint rule that strips explicit `undefined` arguments.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(cli): address PR review feedback
- Fix $@ shell expansion in privileged install path by writing to a
temp file first, then using admin cp (Comment #1)
- Check .cmd extension on Windows for install status and uninstall
guard so the CLI is correctly detected and removed (Comment #2)
- Wire prepare:cli into build:electron-vite instead of build:electron
so all CI packaging paths (vite + forge) include CLI (Comment #3)
- Add CLI i18n strings for ja, fr-FR, zh-TW locales (Comment #4)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
* feat: migrate desktop and mobile error tracking to PostHog
* fix(mobile): remove unsupported tab bar minimize API
* Revert "fix(mobile): remove unsupported tab bar minimize API"
This reverts commit e234dda51257dc6810f0f78e06ee918adf2214b0.
* chore: update workspace dependencies
- bump dependencies across desktop, mobile, ssr, and internal packages
- refresh pnpm lockfile
- apply type compatibility fixes required by upgraded packages
* fix(ssr): prevent tsdown CI warning from failing build
- set inlineOnly to false in tsdown config
* style: format files for CI prettier check
- apply prettier formatting to files reported by format:check
* fix(mobile): downgrade reanimated for rn 0.79 ios build
DIYgod
Sebastion
wait
John Li
Stephen Zhou
Innei