docs: add public site

.claude/commands/start.md

@@ -0,0 +1,21 @@
+# /start
+
+Start Tolaria in Tauri dev mode.
+
+## Steps
+
+1. Change to the Tolaria workspace:
+
+```bash
+cd /Users/luca/Workspace/tolaria
+```
+
+2. Start the native development app:
+
+```bash
+pnpm tauri dev
+```
+
+3. Keep the command running. Report the Vite local URL once it appears and leave the dev process alive for the user.
+
+This is a local utility command, not a Laputa task. Do not run `/laputa-next-task`, CodeScene gates, Todoist updates, commits, or pushes for this command unless the user asks separately.

.codescene-thresholds

@@ -1,2 +1,2 @@
-HOTSPOT_THRESHOLD=9.97
-AVERAGE_THRESHOLD=9.85
+HOTSPOT_THRESHOLD=10.0
+AVERAGE_THRESHOLD=9.89

.env.example

@@ -12,3 +12,7 @@ VITE_SENTRY_DSN=
 # PostHog (https://posthog.com → Project → Settings → Project API Key)
 VITE_POSTHOG_KEY=
 VITE_POSTHOG_HOST=https://eu.i.posthog.com
+
+# Lara CLI (https://github.com/translated/lara-cli)
+LARA_ACCESS_KEY_ID=
+LARA_ACCESS_KEY_SECRET=

.github/workflows/ci.yml

@@ -65,22 +65,21 @@ jobs:
       - name: Vite build check
         run: pnpm build
 
-      # ── 1. Tests ──────────────────────────────────────────────────────────
-      - name: Run frontend tests
-        run: pnpm test
+      - name: Docs build check
+        run: pnpm docs:build
 
+      # ── 1. Coverage-backed tests ──────────────────────────────────────────
+      # The coverage commands run the same frontend and Rust test suites, so keep
+      # them as the canonical test lane instead of running every suite twice.
       - name: Bundle MCP server resources (required by Tauri build)
         run: node scripts/bundle-mcp-server.mjs
 
-      - name: Run Rust tests
-        run: cargo test --manifest-path=src-tauri/Cargo.toml
-
-      # ── 2. Coverage (enforced — fails build if thresholds not met) ────────
-      - name: Frontend coverage (≥70% lines/functions/branches/statements)
+      # ── 2. Tests + coverage (enforced — fails build if thresholds not met) ─
+      - name: Frontend tests + coverage (≥70% lines/functions/branches/statements)
         run: pnpm test:coverage
         # Thresholds configured in vite.config.ts — exits non-zero if coverage drops
 
-      - name: Rust coverage (≥85% lines)
+      - name: Rust tests + coverage (≥85% lines)
         run: |
           cargo llvm-cov \
             --manifest-path src-tauri/Cargo.toml \

.github/workflows/release-stable.yml

@@ -62,6 +62,8 @@ jobs:
         include:
           - arch: aarch64
             target: aarch64-apple-darwin
+          - arch: x86_64
+            target: x86_64-apple-darwin
     steps:
       - uses: actions/checkout@v4
 
@@ -227,6 +229,7 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
           VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
@@ -318,6 +321,7 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
           VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
           VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
@@ -429,6 +433,7 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
           VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
           VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
@@ -497,6 +502,54 @@ jobs:
       - name: Download all artifacts
         uses: actions/download-artifact@v4
 
+      - name: Normalize macOS release artifact names
+        run: |
+          normalize_macos_artifacts() {
+            local arch="$1"
+            local normalized_updater="$2"
+            local normalized_dmg="$3"
+            local updater_dir="updater-${arch}"
+            local updater_file
+            updater_file=$(find "$updater_dir" -maxdepth 1 -name "*.app.tar.gz" -print -quit)
+            if [ -z "$updater_file" ]; then
+              echo "::error::Missing macOS updater artifact in ${updater_dir}" >&2
+              return 1
+            fi
+
+            local sig_file="${updater_file}.sig"
+            if [ ! -f "$sig_file" ]; then
+              echo "::error::Missing macOS updater signature for ${updater_file}" >&2
+              return 1
+            fi
+
+            local normalized_sig="${normalized_updater}.sig"
+            if [ "$updater_file" != "$normalized_updater" ]; then
+              mv "$updater_file" "$normalized_updater"
+            fi
+            if [ "$sig_file" != "$normalized_sig" ]; then
+              mv "$sig_file" "$normalized_sig"
+            fi
+
+            local dmg_dir="dmg-${arch}"
+            local dmg_file
+            dmg_file=$(find "$dmg_dir" -maxdepth 1 -name "*.dmg" -print -quit)
+            if [ -z "$dmg_file" ]; then
+              echo "::error::Missing macOS DMG artifact in ${dmg_dir}" >&2
+              return 1
+            fi
+
+            if [ "$dmg_file" != "$normalized_dmg" ]; then
+              mv "$dmg_file" "$normalized_dmg"
+            fi
+          }
+
+          normalize_macos_artifacts aarch64 \
+            "updater-aarch64/Tolaria_${{ needs.version.outputs.version }}_macOS_Silicon.app.tar.gz" \
+            "dmg-aarch64/Tolaria_${{ needs.version.outputs.version }}_macOS_Silicon.dmg"
+          normalize_macos_artifacts x86_64 \
+            "updater-x86_64/Tolaria_${{ needs.version.outputs.version }}_macOS_Intel.app.tar.gz" \
+            "dmg-x86_64/Tolaria_${{ needs.version.outputs.version }}_macOS_Intel.dmg"
+
       - name: Generate release notes
         run: |
           PREV_TAG=$(git tag --list 'stable-v*' --sort=-version:refname | grep -vx "${{ needs.version.outputs.tag }}" | head -n 1 || echo "")
@@ -513,7 +566,7 @@ jobs:
             echo "---"
             echo "**Stable release — manually promoted from \`main\`**"
             echo ""
-            echo "**Includes macOS (Apple Silicon), Windows x64, and Linux x64 bundles**"
+            echo "**Includes macOS (Apple Silicon and Intel), Windows x64, and Linux x64 bundles**"
             echo ""
             echo "*Built from \`$(git rev-parse --short ${{ needs.version.outputs.tag }})\` on $(date -u +%Y-%m-%d)*"
           } > release_notes.md
@@ -545,6 +598,12 @@ jobs:
           ARM_TARBALL=$(basename "$ARM_UPDATER_FILE")
           ARM_DMG=$(basename "$(find_required "dmg-aarch64/*.dmg")")
 
+          INTEL_SIG_FILE=$(find_required "updater-x86_64/*.app.tar.gz.sig")
+          INTEL_UPDATER_FILE="${INTEL_SIG_FILE%.sig}"
+          INTEL_SIG=$(cat "$INTEL_SIG_FILE")
+          INTEL_TARBALL=$(basename "$INTEL_UPDATER_FILE")
+          INTEL_DMG=$(basename "$(find_required "dmg-x86_64/*.dmg")")
+
           LINUX_SIG_FILE=$(find_required "linux-x86_64-bundles/*/*.AppImage.sig" "linux-x86_64-bundles/*/*.AppImage.tar.gz.sig" "linux-x86_64-bundles/*/*.deb.sig" "linux-x86_64-bundles/*.AppImage.sig" "linux-x86_64-bundles/*.AppImage.tar.gz.sig" "linux-x86_64-bundles/*.deb.sig")
           LINUX_UPDATER_FILE="${LINUX_SIG_FILE%.sig}"
           LINUX_SIG=$(cat "$LINUX_SIG_FILE")
@@ -568,6 +627,11 @@ jobs:
                 "url": "https://github.com/${REPO}/releases/download/${TAG}/${ARM_TARBALL}",
                 "dmg_url": "https://github.com/${REPO}/releases/download/${TAG}/${ARM_DMG}"
               },
+              "darwin-x86_64": {
+                "signature": "${INTEL_SIG}",
+                "url": "https://github.com/${REPO}/releases/download/${TAG}/${INTEL_TARBALL}",
+                "dmg_url": "https://github.com/${REPO}/releases/download/${TAG}/${INTEL_DMG}"
+              },
               "linux-x86_64": {
                 "signature": "${LINUX_SIG}",
                 "url": "https://github.com/${REPO}/releases/download/${TAG}/${LINUX_UPDATER}",
@@ -595,6 +659,9 @@ jobs:
             dmg-aarch64/*.dmg
             updater-aarch64/*.app.tar.gz
             updater-aarch64/*.app.tar.gz.sig
+            dmg-x86_64/*.dmg
+            updater-x86_64/*.app.tar.gz
+            updater-x86_64/*.app.tar.gz.sig
             linux-x86_64-bundles/*.deb
             linux-x86_64-bundles/*.deb.sig
             linux-x86_64-bundles/*.AppImage
@@ -622,10 +689,10 @@ jobs:
             stable-latest.json
 
   # ─────────────────────────────────────────────────────────────
-  # Phase 4: Update GitHub Pages
+  # Phase 4: Update GitHub Pages with docs, release history, and download assets
   # ─────────────────────────────────────────────────────────────
   pages:
-    name: Update release history page
+    name: Update docs and release pages
     needs: [version, release]
     runs-on: ubuntu-latest
     permissions:
@@ -636,23 +703,39 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
 
-      - name: Build release history page
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build docs and release pages
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          VITEPRESS_BASE="/${GITHUB_REPOSITORY#*/}/" pnpm docs:build
           mkdir -p _site/alpha _site/stable
+          cp -R site/.vitepress/dist/. _site/
           gh api -H "Accept: application/vnd.github.html+json" repos/${{ github.repository }}/releases --paginate > _site/releases.json
           PAGES_URL="https://refactoringhq.github.io/${GITHUB_REPOSITORY#*/}"
 
           curl -fsSL "${PAGES_URL}/alpha/latest.json" -o _site/alpha/latest.json || echo '{}' > _site/alpha/latest.json
           gh release download --repo ${{ github.repository }} "${{ needs.version.outputs.tag }}" --pattern "stable-latest.json" --output _site/stable/latest.json || echo '{}' > _site/stable/latest.json
           bun scripts/build-release-download-page.ts --latest-json _site/stable/latest.json --releases-json _site/releases.json --output-file _site/stable/download/index.html
-          bun scripts/build-release-history-page.ts --releases-json _site/releases.json --output-file _site/index.html
+          bun scripts/build-release-history-page.ts --releases-json _site/releases.json --output-file _site/releases/index.html
           mkdir -p _site/download
           cp _site/stable/download/index.html _site/download/index.html
 

.github/workflows/release.yml

@@ -121,6 +121,8 @@ jobs:
         include:
           - arch: aarch64
             target: aarch64-apple-darwin
+          - arch: x86_64
+            target: x86_64-apple-darwin
     steps:
       - uses: actions/checkout@v4
 
@@ -286,6 +288,7 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
           VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
@@ -372,6 +375,7 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
           VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
           VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
@@ -483,6 +487,7 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
           VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
           VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
@@ -551,6 +556,37 @@ jobs:
       - name: Download all artifacts
         uses: actions/download-artifact@v4
 
+      - name: Normalize macOS updater artifact names
+        run: |
+          normalize_updater() {
+            local arch="$1"
+            local normalized_updater="$2"
+            local artifact_dir="updater-${arch}"
+            local updater_file
+            updater_file=$(find "$artifact_dir" -maxdepth 1 -name "*.app.tar.gz" -print -quit)
+            if [ -z "$updater_file" ]; then
+              echo "::error::Missing macOS updater artifact in ${artifact_dir}" >&2
+              return 1
+            fi
+
+            local sig_file="${updater_file}.sig"
+            if [ ! -f "$sig_file" ]; then
+              echo "::error::Missing macOS updater signature for ${updater_file}" >&2
+              return 1
+            fi
+
+            local normalized_sig="${normalized_updater}.sig"
+            if [ "$updater_file" != "$normalized_updater" ]; then
+              mv "$updater_file" "$normalized_updater"
+            fi
+            if [ "$sig_file" != "$normalized_sig" ]; then
+              mv "$sig_file" "$normalized_sig"
+            fi
+          }
+
+          normalize_updater aarch64 "updater-aarch64/Tolaria_${{ needs.version.outputs.version }}_macOS_Silicon.app.tar.gz"
+          normalize_updater x86_64 "updater-x86_64/Tolaria_${{ needs.version.outputs.version }}_macOS_Intel.app.tar.gz"
+
       - name: Generate release notes
         run: |
           PREV_TAG=$(python3 <<'PY'
@@ -587,7 +623,7 @@ jobs:
             echo "---"
             echo "**Alpha build — updated on every push to \`main\`**"
             echo ""
-            echo "**Includes macOS (Apple Silicon), Linux x64, and Windows x64 bundles**"
+            echo "**Includes macOS (Apple Silicon and Intel), Linux x64, and Windows x64 bundles**"
             echo ""
             echo "*Built from \`$(git rev-parse --short HEAD)\` on $(date -u +%Y-%m-%d)*"
           } > release_notes.md
@@ -616,6 +652,11 @@ jobs:
           ARM_SIG=$(cat "$ARM_SIG_FILE")
           ARM_UPDATER=$(basename "$ARM_UPDATER_FILE")
 
+          INTEL_SIG_FILE=$(find_required "updater-x86_64/*.app.tar.gz.sig")
+          INTEL_UPDATER_FILE="${INTEL_SIG_FILE%.sig}"
+          INTEL_SIG=$(cat "$INTEL_SIG_FILE")
+          INTEL_UPDATER=$(basename "$INTEL_UPDATER_FILE")
+
           LINUX_SIG_FILE=$(find_required "linux-x86_64-bundles/*/*.AppImage.sig" "linux-x86_64-bundles/*/*.AppImage.tar.gz.sig" "linux-x86_64-bundles/*/*.deb.sig" "linux-x86_64-bundles/*.AppImage.sig" "linux-x86_64-bundles/*.AppImage.tar.gz.sig" "linux-x86_64-bundles/*.deb.sig")
           LINUX_UPDATER_FILE="${LINUX_SIG_FILE%.sig}"
           LINUX_SIG=$(cat "$LINUX_SIG_FILE")
@@ -639,6 +680,11 @@ jobs:
                 "url": "https://github.com/${REPO}/releases/download/${TAG}/${ARM_UPDATER}",
                 "download_url": "https://github.com/${REPO}/releases/download/${TAG}/${ARM_UPDATER}"
               },
+              "darwin-x86_64": {
+                "signature": "${INTEL_SIG}",
+                "url": "https://github.com/${REPO}/releases/download/${TAG}/${INTEL_UPDATER}",
+                "download_url": "https://github.com/${REPO}/releases/download/${TAG}/${INTEL_UPDATER}"
+              },
               "linux-x86_64": {
                 "signature": "${LINUX_SIG}",
                 "url": "https://github.com/${REPO}/releases/download/${TAG}/${LINUX_UPDATER}",
@@ -665,6 +711,8 @@ jobs:
           files: |
             updater-aarch64/*.app.tar.gz
             updater-aarch64/*.app.tar.gz.sig
+            updater-x86_64/*.app.tar.gz
+            updater-x86_64/*.app.tar.gz.sig
             linux-x86_64-bundles/*.deb
             linux-x86_64-bundles/*.deb.sig
             linux-x86_64-bundles/*.AppImage
@@ -692,10 +740,10 @@ jobs:
             alpha-latest.json
 
   # ─────────────────────────────────────────────────────────────
-  # Phase 4: Update GitHub Pages with release history
+  # Phase 4: Update GitHub Pages with docs, release history, and download assets
   # ─────────────────────────────────────────────────────────────
   pages:
-    name: Update release history page
+    name: Update docs and release pages
     needs: [version, release]
     runs-on: ubuntu-latest
     permissions:
@@ -706,23 +754,39 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
 
-      - name: Build release history page
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build docs and release pages
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          VITEPRESS_BASE="/${GITHUB_REPOSITORY#*/}/" pnpm docs:build
           mkdir -p _site/alpha _site/stable
+          cp -R site/.vitepress/dist/. _site/
           gh api -H "Accept: application/vnd.github.html+json" repos/${{ github.repository }}/releases --paginate > _site/releases.json
           PAGES_URL="https://refactoringhq.github.io/${GITHUB_REPOSITORY#*/}"
 
           gh release download --repo ${{ github.repository }} "${{ needs.version.outputs.tag }}" --pattern "alpha-latest.json" --output _site/alpha/latest.json || echo '{}' > _site/alpha/latest.json
           curl -fsSL "${PAGES_URL}/stable/latest.json" -o _site/stable/latest.json || echo '{}' > _site/stable/latest.json
           bun scripts/build-release-download-page.ts --latest-json _site/stable/latest.json --releases-json _site/releases.json --output-file _site/stable/download/index.html
-          bun scripts/build-release-history-page.ts --releases-json _site/releases.json --output-file _site/index.html
+          bun scripts/build-release-history-page.ts --releases-json _site/releases.json --output-file _site/releases/index.html
           mkdir -p _site/download
           cp _site/stable/download/index.html _site/download/index.html
 

.gitignore

@@ -10,6 +10,9 @@ lerna-debug.log*
 node_modules
 dist
 dist-ssr
+site/.vitepress/cache/
+site/.vitepress/dist/
+_site/
 *.local
 
 # Editor directories and files
@@ -70,5 +73,6 @@ CODE-HEALTH-REPORT.md
 *.key.pub
 
 # Local environment variables (never commit)
+.env
 .env.local
 .env.*.local

README.md

@@ -33,10 +33,12 @@ You can find some Loom walkthroughs below — they are short and to the point:
 
 ## Getting started
 
-Download the [latest release here](https://github.com/refactoringhq/tolaria/releases/latest/download/Tolaria.app.tar.gz).
+Download the [latest release here](https://refactoringhq.github.io/tolaria/download/).
 
 When you open Tolaria for the first time you get the chance of cloning the [getting started vault](https://github.com/refactoringhq/tolaria-getting-started) — which gives you a walkthrough of the whole app.
 
+The public user docs live in [`site/`](site/) and are intended for GitHub Pages. Start with [Install Tolaria](site/start/install.md), then [First Launch](site/start/first-launch.md).
+
 ## Open source and local setup
 
 Tolaria is open source and built with Tauri, React, and TypeScript. If you want to run or contribute to the app locally, here is [how to get started](https://github.com/refactoringhq/tolaria/blob/main/docs/GETTING-STARTED.md). You can also find the gist below 👇

docs/ABSTRACTIONS.md

@@ -57,6 +57,19 @@ The frontmatter parser (Rust: `vault/mod.rs`, TS: `utils/frontmatter.ts`) must f
 
 All data lives in markdown files with YAML frontmatter. There is no database — the filesystem is the source of truth.
 
+### Vault Git Capability
+
+Git is a per-vault capability, not a prerequisite for the document model. A vault can be:
+
+| State | Meaning | UI behavior |
+|---|---|---|
+| Git-backed | The vault path contains a Git repository | History, changes, commits, sync, conflict resolution, remotes, AutoGit, and auto-sync are available according to remote/config state |
+| Non-git | The vault path is a plain folder | Markdown scanning, editing, search, and navigation work; Git-dependent status-bar controls and command-palette entries are replaced by `Git disabled` + `Initialize Git for Current Vault` |
+
+Plain folders become Git-backed only when the user explicitly runs Git initialization from the setup dialog, status bar, or command palette. Features that depend on Git must check this capability instead of assuming every vault has `.git`.
+
+Git initialization is intentionally scoped to dedicated vault folders. When the current non-git folder looks like a broad personal root such as Documents, Desktop, or Downloads and does not already carry Tolaria-managed vault markers, `init_git_repo` refuses to run Git and asks the user to select or create a dedicated subfolder instead.
+
 ### VaultEntry
 
 The core data type representing a single note, defined in Rust (`src-tauri/src/vault/mod.rs`) and TypeScript (`src/types.ts`).
@@ -132,9 +145,22 @@ interface VaultEntry {
   trashed: boolean          // Kept for backward compatibility (Trash system removed — delete is permanent)
   trashedAt: number | null  // Kept for backward compatibility (Trash system removed)
   properties: Record<string, string>  // Scalar frontmatter fields (custom properties)
+  fileKind?: 'markdown' | 'text' | 'binary'  // Controls editor/raw/preview behavior
 }
 ```
 
+### File kinds and binary previews
+
+`VaultEntry.fileKind` comes from the Rust vault scanner and intentionally stays coarse-grained:
+
+| `fileKind` | Source files | UI behavior |
+|---|---|---|
+| `markdown` or absent | `.md`, `.markdown` | Full Tolaria note model: frontmatter, BlockNote, raw editor, relationships, title sync |
+| `text` | UTF-8 editable formats such as `.yml`, `.json`, `.ts`, `.py`, `.sh` | Opens through the raw editor without Markdown note semantics |
+| `binary` | Images, PDFs, archives, other non-text files | Stays a normal vault file; previewable images open in `FilePreview`, unsupported or broken binaries show an explicit fallback |
+
+Image previewability is inferred in the renderer from the filename extension (`src/utils/filePreview.ts`) rather than stored as a new persisted kind. This keeps the filesystem as source of truth and avoids converting assets into proprietary objects.
+
 ### Entity Types (isA / type)
 
 Entity type is stored in the `type:` frontmatter field (e.g. `type: Quarter`). The legacy field name `Is A:` is still accepted as an alias for backwards compatibility but new notes use `type:`. The `VaultEntry.isA` property in TypeScript/Rust holds the resolved value.
@@ -240,7 +266,9 @@ Tolaria separates **display title** from the file identifier:
 - **Display title resolution** (`extract_title` in `vault/parsing.rs`): first `# H1` on the first non-empty body line, then legacy frontmatter `title:`, then slug-to-title from the filename stem.
 - **Opening a note is read-only**: selecting a note does not inject or auto-correct `title:` frontmatter.
 - **Explicit filename actions** (`rename_note`): breadcrumb rename/sync actions stage crash-safe note renames through a hidden `.tolaria-rename-txn/` transaction directory, recover unfinished renames on the next vault scan, update wikilinks across the vault, and surface any failed backlink rewrites instead of silently reporting partial success. The editor body remains the title editing surface.
+- **Unicode-aware note stems** (`src/utils/noteSlug.ts`, `vault/rename.rs`): frontend and backend slugging preserve Unicode letters/digits in note filenames, untitled-rename detection, and fallback wikilink targets while still collapsing symbol-only titles to `untitled`.
 - **Portable filename validation** (`vault/filename_rules.rs`): note filenames, folder names, and custom view filenames all reject Windows-reserved device names, invalid characters, and trailing dot/space suffixes so a vault created on macOS/Linux still clones and syncs cleanly on Windows.
+- **Recoverable save failures** (`useEditorSave`, `vault/file.rs`): invalid platform path syntax is reported as a clear retryable save error, while the editor keeps the unsaved buffer intact for another attempt.
 - **Untitled drafts** start as `untitled-*.md` and are auto-renamed on save once the note gains an H1.
 
 ### Title Surface (UI)
@@ -269,7 +297,7 @@ type SidebarSelection =
 
 `SidebarSelection.kind === 'folder'` is a first-class navigation target, not just a visual highlight.
 
-- `FolderTree` keeps the folder interaction surface decomposed into `FolderTreeRow`, `FolderNameInput`, `FolderContextMenu`, and disclosure/context-menu hooks so nested row rendering, inline rename, and right-click actions stay isolated.
+- `FolderTree` keeps the folder interaction surface decomposed into `FolderTreeRow`, `FolderNameInput`, `FolderContextMenu`, and disclosure/context-menu hooks so nested row rendering, inline rename, and right-click actions stay isolated. Non-mutating reveal/copy-path menu items stay callback-driven from `App` so filesystem convenience actions do not leak into folder mutation hooks.
 - `useFolderActions()` composes `useFolderRename()` and `useFolderDelete()` to keep folder mutations selection-aware while the rest of `App.tsx` only wires the resulting callbacks into `Sidebar` and the command registry.
 - `useNoteRetargeting()` is the shared retargeting abstraction for note drops and command-palette actions. It owns the "can drop here?" checks, updates `type:` via frontmatter when a note lands on a type section, and delegates folder moves through the same crash-safe rename pipeline used by the backend rename commands.
 - A successful folder rename reloads the folder tree plus vault entries, rewrites any affected folder-scoped tabs, and updates `SidebarSelection` to the new relative path when the renamed folder stays selected.
@@ -295,25 +323,30 @@ type SidebarSelection =
 `vault::scan_vault(path)` in `src-tauri/src/vault/mod.rs`:
 
 1. Validates the path exists and is a directory
-2. Scans root-level `.md` files (non-recursive)
-3. Recursively scans protected folders: `type/`, legacy `config/`, `attachments/`
-4. Files in non-protected subfolders are **not indexed** (flat vault enforcement)
-5. For each `.md` file, calls `parse_md_file()`:
+2. Recursively scans non-hidden files while skipping hidden directories such as `.git/`
+3. For each `.md` file, calls `parse_md_file()`:
    - Reads content with `fs::read_to_string()`
    - Parses frontmatter with `gray_matter::Matter::<YAML>`
    - Extracts title from first `#` heading
    - Reads entity type from `type:` frontmatter field (`Is A:` accepted as legacy alias); type is never inferred from folder
    - Parses dates as ISO 8601 to Unix timestamps
    - Extracts relationships, outgoing links, custom properties, word count, snippet
+4. For recognized non-markdown text and binary files, emits a minimal `VaultEntry` with `fileKind`
+5. Sorts by `modified_at` descending
+6. Skips unparseable files with a warning log
 
 The folder tree hides only the dedicated `type/` directory, since note types already have their own sidebar section. Default vault folders such as `attachments/` and `views/` remain visible alongside user-created folders.
-6. Sorts by `modified_at` descending
-7. Skips unparseable files with a warning log
+
+Command-facing vault content is filtered through `vault::filter_gitignored_entries`, `vault::filter_gitignored_folders`, and `vault::filter_gitignored_paths` when the app setting `hide_gitignored_files` is enabled. The cache still stores the complete scan; `list_vault`, `reload_vault`, `list_vault_folders`, and search apply the visibility filter at the boundary before React consumes entries. The filter batches paths through `git check-ignore --no-index --stdin`, so negated and specific `.gitignore` patterns follow Git semantics as closely as the app can reasonably support.
 
 A `vault_health_check` command detects stray files in non-protected subfolders and filename-title mismatches. On vault load, a migration banner offers to flatten stray files to the root via `flatten_vault`.
 
 Command-layer path access is fenced to the active vault before file operations reach the vault backend. `src-tauri/src/commands/vault/boundary.rs` canonicalizes the configured/requested vault root, rejects `..` escapes and absolute paths outside that root, and validates writable targets through the nearest existing ancestor so note reads, saves, deletes, view-file edits, folder mutations, and image attachment writes cannot step outside the active vault. Image attachment commands refresh the runtime asset scope after saving so files created under a previously missing `attachments/` directory can render immediately.
 
+UI-only file actions operate on paths that are already selected or indexed in React state. Reveal-in-Finder and external-open calls route through the Tauri opener plugin, while copy-path uses the browser clipboard API; none of those actions mutate vault contents or bypass the backend write boundary.
+
+The local MCP WebSocket bridge follows the same active-vault boundary. `useVaultSwitcher` calls `sync_mcp_bridge_vault` after the persisted selection loads and after each vault switch; the desktop command starts/restarts the bridge with that vault's canonical path, or stops it when there is no selected vault. MCP Node entrypoints require `VAULT_PATH` and fail clearly instead of falling back to `~/Laputa`.
+
 ### Vault Caching
 
 `vault::scan_vault_cached(path)` wraps scanning with git-based caching:
@@ -416,6 +449,10 @@ interface PulseCommit {
 - `pullAndPush()`: pulls then auto-pushes for divergence recovery
 - `ConflictNoteBanner`: inline banner in editor for conflicted notes (Keep mine / Keep theirs)
 
+### External Vault Refresh
+
+External vault mutations are any disk writes Tolaria did not just perform through its own save path: Git pulls, AI-agent writes, filesystem watcher events, and edits from another app. These changes must route through `refreshPulledVaultState()` rather than calling `reloadVault()` in isolation. The shared refresh abstraction reloads entries, folders, and saved views together, preserves unsaved active-editor content, reopens a clean active note from disk, and closes the active tab if the file disappeared. `useVaultWatcher` supplies changed filesystem paths to this abstraction after debouncing and after filtering recent app-owned saves.
+
 `useGitRemoteStatus` is the commit-time companion to `useAutoSync`:
 - Re-checks `git_remote_status` when the Commit dialog opens and right before submit
 - Converts `hasRemote: false` into a local-only commit path
@@ -472,6 +509,24 @@ Defined in `src/components/editorSchema.tsx` and styled in `src/components/Edito
 - Tolaria keeps `defaultLanguage: "text"` so unlabeled code blocks do not silently become JavaScript while still supporting the packaged language aliases such as `ts` → `typescript`.
 - Inline-code chip styling remains scoped to `.bn-inline-content code`, so fenced `pre > code` nodes keep BlockNote's dark shell instead of inheriting the muted inline surface.
 
+### Markdown Math
+
+Defined in `src/utils/mathMarkdown.ts`, `src/components/editorSchema.tsx`, and styled in `src/components/EditorTheme.css`:
+
+- `$...$` becomes a `mathInline` schema node and line-owned `$$...$$` / multiline `$$` blocks become `mathBlock` nodes.
+- The rich editor renders both node types through KaTeX with `throwOnError: false`, so malformed formulas keep their source visible instead of breaking the note.
+- `serializeMathAwareBlocks()` converts math nodes back to Markdown delimiters before save, raw-mode entry, and editor-position snapshots.
+- Raw CodeMirror mode always shows the plain Markdown source, so imported technical notes stay editable outside Tolaria.
+
+### Mermaid Diagrams
+
+Defined in `src/utils/mermaidMarkdown.ts`, `src/components/MermaidDiagram.tsx`, `src/components/editorSchema.tsx`, and styled in `src/components/EditorTheme.css`:
+
+- Fenced `mermaid` blocks become `mermaidBlock` schema nodes before BlockNote sees the Markdown body.
+- Each `mermaidBlock` stores the original fenced Markdown plus the diagram body, so raw-mode entry and saves can restore the canonical source instead of serializing generated SVG.
+- The rich editor renders diagrams with the `mermaid` package and uses the original source as an inline fallback when rendering fails.
+- `serializeMermaidAwareBlocks()` wraps the math-aware serializer so math, wikilinks, and diagrams share the same Markdown-first save path.
+
 ### Formatting Surface Policy
 
 Defined in `src/components/tolariaEditorFormatting.tsx` and `src/components/tolariaEditorFormattingConfig.ts`:
@@ -481,29 +536,34 @@ Defined in `src/components/tolariaEditorFormatting.tsx` and `src/components/tola
 - Tolaria's formatting-toolbar controller also keeps file/image actions mounted across the tiny hover gap between an image block and the floating toolbar, and while the toolbar itself is hovered, so image controls remain usable instead of collapsing mid-interaction.
 - The `/` slash menu remains the supported path for markdown-safe block transformations such as headings, quotes, and list blocks. Tolaria filters out BlockNote's toggle-heading and toggle-list variants because those do not map cleanly to the markdown note model.
 - The block-handle side menu keeps only actions that survive Tolaria's markdown round-trip. Delete and table-header toggles remain available; BlockNote's `Colors` submenu is removed because block colors are not part of Tolaria's supported markdown surface.
+- `useNoteWikilinkDrop()` is the shared editor-drop abstraction for dragging note rows into either editor mode. It reads the existing note-retargeting drag payload, resolves the vault-relative stem, and inserts a canonical `[[wikilink]]` without hijacking unrelated plain-text drags.
+- `useTauriDragDropEvent()` owns the shared Tauri window drag/drop subscription and duplicate-unlisten cleanup used by native drop features.
+- `useNativePathDrop()` is the shared Tauri file/folder-drop abstraction for text inputs that need filesystem paths instead of attachment import. It consumes native window drag/drop events, gates them to the target element bounds or focused text selection, and lets AI composer / command-palette inputs insert formatted paths at the current cursor.
 
 ### Markdown-to-BlockNote Pipeline
 
 ```mermaid
 flowchart LR
     A["📄 Raw markdown\n(from disk)"] --> B["splitFrontmatter()\n→ yaml + body"]
-    B --> C["preProcessWikilinks(body)\n[[target]] → ‹token›"]
-    C --> D["tryParseMarkdownToBlocks()\n→ BlockNote block tree"]
-    D --> E["injectWikilinks(blocks)\n‹token› → WikiLink node"]
-    E --> F["editor.replaceBlocks()\n→ rendered editor"]
+    B --> C["preProcessMermaidMarkdown(body)\nmermaid fence → token"]
+    C --> D["preProcessWikilinks(body)\n[[target]] → ‹token›"]
+    D --> E["preProcessMathMarkdown(body)\n$...$ / $$...$$ → tokens"]
+    E --> F["tryParseMarkdownToBlocks()\n→ BlockNote block tree"]
+    F --> G["injectWikilinks + injectMathInBlocks + injectMermaidInBlocks\n tokens → schema nodes"]
+    G --> H["editor.replaceBlocks()\n→ rendered editor"]
 
     style A fill:#f8f9fa,stroke:#6c757d,color:#000
-    style F fill:#d4edda,stroke:#28a745,color:#000
+    style H fill:#d4edda,stroke:#28a745,color:#000
 ```
 
-> Placeholder tokens use `\u2039` and `\u203A` to avoid colliding with markdown syntax.
+> Wikilink placeholder tokens use `\u2039` and `\u203A`; math and Mermaid placeholder tokens use ASCII sentinels with URI-encoded payloads.
 
 ### BlockNote-to-Markdown Pipeline (Save)
 
 ```mermaid
 flowchart LR
     A["✏️ BlockNote blocks\n(editor state)"] --> B["blocksToMarkdownLossy()"]
-    B --> C["postProcessWikilinks()\nWikiLink node → [[target]]"]
+    B --> C["restoreWikilinks + serializeMermaidAwareBlocks()\nschema nodes → Markdown source"]
     C --> D["prepend frontmatter yaml"]
     D --> E["invoke('save_note_content')\n→ disk write"]
 
@@ -525,6 +585,8 @@ Wikilink resolution (`resolveEntry` in `src/utils/wikilink.ts`) uses multi-pass
 Toggle via Cmd+K → "Raw Editor" or breadcrumb bar button. Uses CodeMirror 6 (`useCodeMirror` hook) to edit the raw markdown + frontmatter directly. Changes saved via the same `save_note_content` command.
 While the user types, `useEditorSaveWithLinks` derives a transient `VaultEntry` patch from parseable frontmatter so the Inspector, relationship chips, and note-list-visible metadata stay in sync with the raw editor before the next vault reload. Temporarily invalid or half-typed frontmatter is ignored until it becomes parseable again, which avoids clobbering the last known good derived state.
 
+Current-note find/replace is intentionally backed by raw CodeMirror mode. `Cmd+F`, "Find in Note", and "Replace in Note" switch the active Markdown/text note to raw mode, show the compact find bar above CodeMirror, and operate on the current note only. Plain text matching is case-insensitive by default, `Aa` toggles case sensitivity, `.*` toggles JavaScript-regex matching, and regex replacement supports capture groups through JavaScript replacement syntax.
+
 ### Arrow Ligature Normalization
 
 Typed ASCII arrow sequences are normalized consistently in both editor modes:
@@ -541,6 +603,18 @@ The app uses internal light and dark themes owned by Tolaria (see [ADR-0081](adr
 2. **Editor theme** (`src/theme.json`): BlockNote typography, flattened to CSS vars by `useEditorTheme`
 3. **Runtime theme bridge**: Applies `data-theme` and `.dark` for shadcn/ui, while CodeMirror and editor-specific consumers derive any non-CSS-variable values from the same semantic contract
 
+## Localization
+
+App UI strings are resolved through `src/lib/i18n.ts`, with flat JSON catalogs in `src/lib/locales/*.json` (see [ADR-0087](adr/0087-json-catalogs-and-lara-cli-localization.md)):
+
+- `AppLocale`: canonical locale tags such as `'en'`, `'zh-CN'`, `'fr-FR'`, `'es-419'`
+- `UiLanguagePreference`: `'system' | AppLocale`; persisted settings serialize `system` as `null`
+- `resolveEffectiveLocale()`: maps an explicit preference or system/browser language list to the effective supported locale, including legacy aliases
+- `translate()` / `createTranslator()`: resolve keys with English fallback and simple `{name}` interpolation
+- `scripts/validate-locales.mjs`: asserts every checked-in locale catalog matches the English keyset and stays flat-string-only
+
+`App.tsx` owns the effective locale and passes it to localized app chrome through props. Settings and command-palette language commands call back into `saveSettings`, so UI language changes update the current session without touching vault content or reopening the vault.
+
 ## Inspector Abstraction
 
 The Inspector panel (`src/components/Inspector.tsx`) is composed of sub-panels:
@@ -561,7 +635,7 @@ The Inspector panel (`src/components/Inspector.tsx`) is composed of sub-panels:
 
 ### Search
 
-Keyword-based search scans all vault `.md` files using `walkdir`:
+Keyword-based search scans all vault `.md` files using `walkdir` and applies the same Gitignored-content visibility filter as vault loading:
 
 ```typescript
 interface SearchResult {
@@ -595,7 +669,7 @@ No indexing step required — search runs directly against the filesystem.
 
 Per-vault settings stored locally and scoped by vault path:
 - Managed by `useVaultConfig` hook and `vaultConfigStore`
-- Settings: zoom, view mode, tag colors, status colors, property display modes, Inbox note-list column overrides, explicit organization workflow toggle
+- Settings: zoom, view mode, editor mode, note layout, tag colors, status colors, property display modes, Inbox/All Notes note-list column overrides, explicit organization workflow toggle
 - One-time migration from localStorage (`configMigration.ts`)
 
 ### AI Guidance Files
@@ -623,6 +697,7 @@ Tolaria tracks managed vault-level AI guidance separately from normal note conte
 `useAiAgentsOnboarding(enabled)` adds a separate first-launch agent step:
 - Reads a local dismissal flag for the AI agents prompt (with a legacy fallback to the older Claude-only key)
 - Only shows after vault onboarding has already resolved to a ready state
+- Uses `get_ai_agents_status`, whose backend treats the app process path, login-shell path, and supported local/toolchain/app install locations, including Windows `.exe` and npm/pnpm/Scoop shim paths, as valid CLI-agent sources
 - Persists dismissal locally once the user continues
 
 ### Remote Git Operations
@@ -650,11 +725,13 @@ interface Settings {
   anonymous_id: string | null
   release_channel: string | null // null = stable default, "alpha" = every-push prerelease feed
   theme_mode: 'light' | 'dark' | null
-  default_ai_agent: 'claude_code' | 'codex' | null
+  ui_language: AppLocale | null
+  default_ai_agent: 'claude_code' | 'codex' | 'opencode' | 'pi' | null
+  hide_gitignored_files: boolean | null // null = default true
 }
 ```
 
-Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is installation-local because it controls device comfort rather than vault structure. `default_ai_agent` is an installation-local preference that selects which supported CLI agent the AI panel, command palette AI mode, and status bar should target by default. The AutoGit fields are also installation-local: `useAutoGit` consumes them to schedule automatic checkpoints, while `useCommitFlow` and the status bar quick action reuse the same checkpoint runner and deterministic automatic commit message generation.
+Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is installation-local because it controls device comfort rather than vault structure. `ui_language` is also installation-local: `null` follows the supported system language with English fallback, while explicit values pin the UI language for this installation. Stored legacy aliases such as `zh-Hans` are normalized to canonical locale codes before the setting reaches React state. `default_ai_agent` is an installation-local preference that selects which supported CLI agent the AI panel, command palette AI mode, and status bar should target by default. `hide_gitignored_files` is also installation-local and defaults to `true`; changing it reloads entries, search, saved views, and folders without restarting. The AutoGit fields are also installation-local: `useAutoGit` consumes them to schedule automatic checkpoints, while `useCommitFlow` and the status bar quick action reuse the same checkpoint runner and deterministic automatic commit message generation.
 
 ## Telemetry
 
@@ -666,7 +743,7 @@ Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is ins
 - **`useTelemetry(settings, loaded)`** — Reactively initializes/tears down Sentry and PostHog based on settings. Called once in `App`.
 
 ### Libraries
-- **`src/lib/telemetry.ts`** — `initSentry()`, `teardownSentry()`, `initPostHog()`, `teardownPostHog()`, `trackEvent()`. Path scrubber via `beforeSend` hook. DSN/key from `VITE_SENTRY_DSN` / `VITE_POSTHOG_KEY` env vars.
+- **`src/lib/telemetry.ts`** — `initSentry()`, `teardownSentry()`, `initPostHog()`, `teardownPostHog()`, `trackEvent()`. Path scrubber via `beforeSend` hook. DSN/release/key from `VITE_SENTRY_DSN`, `VITE_SENTRY_RELEASE`, and `VITE_POSTHOG_KEY` env vars.
 - **`src/main.tsx`** — React root error callbacks (`onCaughtError`, `onUncaughtError`, `onRecoverableError`) forward component-stack context to `Sentry.reactErrorHandler()` for debuggable production React errors.
 - **`src-tauri/src/telemetry.rs`** — Rust-side Sentry init with `beforeSend` path scrubber. `init_sentry_from_settings()` reads settings and conditionally initializes. `reinit_sentry()` for runtime toggle.
 
@@ -694,6 +771,6 @@ Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is ins
 - **`download_and_install_app_update`** — Channel-aware download/install with streamed progress events.
 
 ### CI/CD
-- **`.github/workflows/release.yml`** — Alpha prereleases from every push to `main` using calendar-semver technical versions (`YYYY.M.D-alpha.N`) and clean `Alpha YYYY.M.D.N` release names. GitHub alpha tags zero-pad the prerelease sequence (`alpha-vYYYY.M.D-alpha.NNNN`) so GitHub release ordering stays chronological while the shipped app version remains `YYYY.M.D-alpha.N`. Publishes `alpha/latest.json` and refreshes the legacy `latest.json` / `latest-canary.json` aliases to the alpha feed.
-- **`.github/workflows/release-stable.yml`** — Stable releases from `stable-vYYYY.M.D` tags. Publishes `stable/latest.json`, macOS Apple Silicon artifacts, Windows x64 installers/updater bundles, and Linux x86_64 `.deb` / AppImage artifacts.
+- **`.github/workflows/release.yml`** — Alpha prereleases from every push to `main` using calendar-semver technical versions (`YYYY.M.D-alpha.N`) and clean `Alpha YYYY.M.D.N` release names. GitHub alpha tags zero-pad the prerelease sequence (`alpha-vYYYY.M.D-alpha.NNNN`) so GitHub release ordering stays chronological while the shipped app version remains `YYYY.M.D-alpha.N`. Publishes `alpha/latest.json` with macOS Apple Silicon/Intel, Linux x64, and Windows x64 updater entries, then refreshes the legacy `latest.json` / `latest-canary.json` aliases to the alpha feed. macOS release assets use `Tolaria_<version>_macOS_Silicon` and `Tolaria_<version>_macOS_Intel` base names. Packaged builds pass the computed version as `VITE_SENTRY_RELEASE`.
+- **`.github/workflows/release-stable.yml`** — Stable releases from `stable-vYYYY.M.D` tags. Publishes `stable/latest.json`, macOS Apple Silicon and Intel DMG/updater artifacts, Windows x64 installers/updater bundles, and Linux x86_64 `.deb` / AppImage artifacts. Stable macOS DMG/updater assets use the same `Tolaria_<version>_macOS_Silicon` and `Tolaria_<version>_macOS_Intel` base names. Packaged builds pass the computed version as `VITE_SENTRY_RELEASE`.
 - **Beta cohorts** are handled in PostHog targeting only. There is no beta updater feed.

docs/ARCHITECTURE.md

@@ -24,6 +24,7 @@ When deciding where to persist a piece of data, ask: **"Would the user want this
 | Pinned properties per type | API keys (OpenAI, Google) |
 | Sidebar label overrides | Auto-sync interval |
 | Property display order | Window size / position |
+| Vault-authored `.gitignore` patterns | Whether this installation hides Gitignored files |
 | Any user-visible customization of how content is organized or displayed | Any machine-specific or credential-type setting |
 
 **Rule:** If the information is about *how the content is structured or presented* and the user would expect it to be consistent wherever they open their vault, store it in the vault (frontmatter of the relevant note, using the `_field` underscore convention for system properties). If it's about *this specific installation of the app*, store it in `~/.config/com.tolaria.app/settings.json` or localStorage.
@@ -32,6 +33,7 @@ Examples:
 - ✅ Vault: `_pinned_properties` in a Type note (every device should show the same pinned properties)
 - ✅ Vault: `_icon: shapes` in a Type note (icon is part of the type's identity)
 - ✅ App settings: `zoom: 1.3` (machine-specific preference)
+- ✅ App settings: `ui_language: "zh-CN"` (installation-specific UI language)
 
 ### No hardcoded exceptions
 
@@ -81,6 +83,11 @@ flowchart LR
 3. **No orphan state updates**: Never call `updateEntry()` before the corresponding `handleUpdateFrontmatter()` or `handleDeleteProperty()` has resolved. The three functions in `useEntryActions` (`handleCustomizeType`, `handleRenameSection`, `handleToggleTypeVisibility`) follow this rule — disk write first, then state update.
 4. **Recovery via reload**: If state ever diverges from disk (crash, external edit, race condition), `Reload Vault` (Cmd+K → "Reload Vault") invalidates the cache and does a full filesystem rescan via the `reload_vault` Tauri command, replacing all React state. The `reload_vault_entry` command can re-read a single file.
 5. **Cache is disposable**: The `reload_vault` command deletes the cache file before rescanning, guaranteeing fresh data. The cache never contains data that doesn't exist on the filesystem.
+6. **Visibility filters are command-boundary concerns**: Gitignored-content visibility is applied after scanning/caching, before entries, folders, or search results reach React. The cache remains complete so toggling the setting can show ignored content again without rebuilding a different cache shape.
+
+#### External Change Detection
+
+The main window starts a native watcher for the active vault through `start_vault_watcher` / `stop_vault_watcher` (`src-tauri/src/vault_watcher.rs`, backed by Rust `notify`). The watcher emits `vault-changed` events for content paths and ignores churn from `.git/`, `node_modules/`, temp files, and `.tolaria-rename-txn`. `useVaultWatcher` batches those events, suppresses recent app-owned saves, and sends the remaining external paths through `refreshPulledVaultState()` so folders, saved views, note-list state, and the clean active editor all refresh under the ADR-0071 unsaved-edit rules. `useVaultLoader.isReloading` drives the status-bar reload spinner for both manual and watcher-triggered reloads.
 
 ## Tech Stack
 
@@ -90,6 +97,7 @@ flowchart LR
 | Frontend | React + TypeScript | React 19, TS 5.9 |
 | Editor | BlockNote | 0.46.2 |
 | Code block highlighting | @blocknote/code-block | 0.46.2 |
+| Diagram rendering | Mermaid | 11.14.0 |
 | Raw editor | CodeMirror 6 | - |
 | Styling | Tailwind CSS v4 + CSS variables | 4.1.18 |
 | UI primitives | Radix UI + shadcn/ui | - |
@@ -97,8 +105,10 @@ flowchart LR
 | Build | Vite | 7.3.1 |
 | Backend language | Rust (edition 2021) | 1.77.2 |
 | Frontmatter parsing | gray_matter | 0.2 |
-| AI (agent panel) | CLI agent adapters (Claude Code + Codex) | - |
+| Filesystem watcher | notify | 6.1 |
+| AI (agent panel) | CLI agent adapters (Claude Code + Codex + OpenCode + Pi) | - |
 | Search | Keyword (walkdir-based file scan) | - |
+| Localization | App-owned runtime + JSON catalogs (`src/lib/i18n.ts`, `src/lib/locales/*.json`, `lara.yaml`) | English fallback + Lara CLI sync |
 | MCP | @modelcontextprotocol/sdk | 1.0 |
 | Tests | Vitest (unit), Playwright (E2E/smoke), cargo test (Rust) | - |
 | Package manager | pnpm | - |
@@ -135,7 +145,7 @@ flowchart TD
         end
 
         subgraph EXT["External Services"]
-            CCLI["Claude CLI / Codex CLI\n(agent subprocesses)"]
+            CCLI["Claude / Codex / OpenCode / Pi CLI\n(agent subprocesses)"]
             MCP["MCP Server\n(ws://9710, 9711)"]
             GCLI["git CLI\n(system executable)"]
             REMOTE["Git remotes\n(GitHub/GitLab/Gitea/etc.)"]
@@ -176,16 +186,19 @@ flowchart TD
 └──────────────────────────────────────────────────────────────┘
 ```
 
-- **Sidebar** (150-400px, resizable): Top-level filters (All Notes, Changes, Pulse), collapsible type-based section groups, and a dedicated folder tree. The folder tree shows user-created folders plus default vault folders such as `attachments/` and `views/`; only the dedicated `type/` directory stays hidden because note types already have their own sidebar section. The folder tree supports inline folder creation and rename, exposes a right-click menu for rename/delete, and auto-expands ancestor folders when the current selection or rename target is nested. Type sections and folder rows also act as note drop targets: dropping a note on a type updates its `type:` frontmatter, while dropping it on a folder runs the same crash-safe move path as the command palette flow. Each type can have a custom icon, color, sort, and visibility set via its type document in `type/`.
-- **Note List / Pulse View** (200-500px, resizable): When a section group, filter, or saved view is selected, shows filtered notes with snippets, modified dates, status indicators, and per-context note-list controls. When `selection.kind === 'entity'`, the same pane enters **Neighborhood** mode: the source note is pinned at the top as a normal active row, outgoing relationship groups render first, inverse/backlink groups follow, empty groups stay visible with `0`, and duplicates across groups are allowed when multiple relationships are true. Plain click / `Enter` open the focused note without replacing the current Neighborhood, while Cmd/Ctrl-click and Cmd/Ctrl-`Enter` pivot the pane into the clicked note's Neighborhood. Saved views reuse the same sort and visible-column controls as the built-in lists, and those changes persist back into the view `.yml` definition (`sort`, `listPropertiesDisplay`). When Pulse filter is active, shows `PulseView` — a chronological git activity feed grouped by day.
-- **Editor** (flex, fills remaining space): Single note open at a time (no tabs — see ADR-0003). Breadcrumb bar with word count, BlockNote rich text editor with wikilink support, markdown-safe formatting controls, and schema-backed fenced code block highlighting via `@blocknote/code-block`. Can toggle to diff view (modified files) or raw CodeMirror view. Decomposed into `Editor` (orchestrator), `EditorContent`, `EditorRightPanel`, `SingleEditorView`, with hooks `useDiffMode`, `useEditorFocus`, and `useEditorSave`, plus the `useRawMode`/`RawEditorView` pair for markdown source editing. Rich BlockNote input and raw CodeMirror input both route typed `->`, `<-`, and `<->` through the shared `src/utils/arrowLigatures.ts` resolver so arrow ligatures stay consistent across mode switches while escaped ASCII sequences remain literal. Navigation history (Cmd+[/]) replaces tabs.
+- **Sidebar** (150-400px, resizable): Top-level filters (All Notes, Changes, Pulse), collapsible type-based section groups, and a dedicated folder tree. The folder tree shows user-created folders plus default vault folders such as `attachments/` and `views/`; only the dedicated `type/` directory stays hidden because note types already have their own sidebar section. The folder tree supports inline folder creation and rename, exposes a right-click menu for rename/delete plus filesystem reveal/copy-path actions, and auto-expands ancestor folders when the current selection or rename target is nested. Type sections and folder rows also act as note drop targets: dropping a note on a type updates its `type:` frontmatter, while dropping it on a folder runs the same crash-safe move path as the command palette flow. Each type can have a custom icon, color, sort, and visibility set via its type document in `type/`.
+- **Note List / Pulse View** (200-500px, resizable): When a section group, filter, or saved view is selected, shows filtered notes with snippets, modified dates, status indicators, and per-context note-list controls. When `selection.kind === 'entity'`, the same pane enters **Neighborhood** mode: the source note is pinned at the top as a normal active row, outgoing relationship groups render first, inverse/backlink groups follow, empty groups stay visible with `0`, and duplicates across groups are allowed when multiple relationships are true. Plain click / `Enter` open the focused note without replacing the current Neighborhood, while Cmd/Ctrl-click and Cmd/Ctrl-`Enter` pivot the pane into the clicked note's Neighborhood. Folder-backed lists also show non-Markdown files: previewable image binaries get an image indicator and open in the editor pane, while unsupported binaries remain muted instead of auto-launching an external app. Saved views reuse the same sort and visible-column controls as the built-in lists, and those changes persist back into the view `.yml` definition (`sort`, `listPropertiesDisplay`). When Pulse filter is active, shows `PulseView` — a chronological git activity feed grouped by day.
+- **Editor** (flex, fills remaining space): Single note open at a time (no tabs — see ADR-0003). Breadcrumb bar with word count and note-layout toggle, BlockNote rich text editor with wikilink support, Markdown-compatible inline/display math rendering, first-class Mermaid diagram blocks, markdown-safe formatting controls, and schema-backed fenced code block highlighting via `@blocknote/code-block`. Can toggle to diff view (modified files), raw CodeMirror view, or a wide-screen left-aligned note column while preserving the same readable max width. Binary image files render through `FilePreview` as ordinary vault files using Tauri asset URLs, with explicit unsupported/broken fallback states and keyboard focus returning to the note list on `Escape`. Decomposed into `Editor` (orchestrator), `EditorContent`, `FilePreview`, `EditorRightPanel`, `SingleEditorView`, with hooks `useDiffMode`, `useEditorFocus`, and `useEditorSave`, plus the `useRawMode`/`RawEditorView` pair for markdown source editing. Rich BlockNote input and raw CodeMirror input both route typed `->`, `<-`, and `<->` through the shared `src/utils/arrowLigatures.ts` resolver so arrow ligatures stay consistent across mode switches while escaped ASCII sequences remain literal. Navigation history (Cmd+[/]) replaces tabs.
 - **Inspector / AI Agent** (200-500px or 40px collapsed): Toggles between Inspector (frontmatter, relationships, instances, backlinks, git history) and AI Agent panel (the selected CLI agent with tool execution). The Sparkle icon in the breadcrumb bar toggles between them. Per-note `icon` is a suggested Inspector property and the command palette's "Set Note Icon" action opens that field directly. When viewing a Type note, the Inspector shows an **Instances** section listing all notes of that type (sorted by modified_at desc, capped at 50).
 
 Panels are separated by `ResizeHandle` components that support drag-to-resize.
 
 The main Tauri window derives its minimum width from the visible panes instead of a single fixed floor. `useMainWindowSizeConstraints` treats the editor-only shell as the 480px baseline, adds sidebar / note-list / expanded-inspector allowances on top, and calls the native `update_current_window_min_size` command whenever view mode or inspector visibility changes. That same native command also grows the current window back out when a wider pane combination is restored, while note windows skip this path and keep their dedicated 800×700 initial sizing.
 
+The main Tauri window also persists its last normal size and screen position in the app config directory as `window-state.json`. The state stores logical window points, while `window_state.rs` migrates older physical-pixel state on read so Retina and non-Retina launches restore the same user-facing bounds. On startup, the restored frame applies only to the main window and clamps to the currently available monitor work areas, so stale coordinates from a disconnected display fall back to a visible placement. Maximized, fullscreen, minimized, and detached note-window frames are not written as the restore baseline.
+
 Linux uses custom React-rendered window chrome instead of the native Tauri menu bar. `setup_linux_window_chrome()` drops server-side decorations on the main window, `openNoteInNewWindow()` does the same for detached note windows, and `LinuxTitlebar`/`LinuxMenuButton` route both window controls and menu actions back through the same shared command pipeline that macOS uses for native menu clicks.
+When Tolaria is launched from a Linux AppImage, `run()` also injects `WEBKIT_DISABLE_DMABUF_RENDERER=1` unless the user already set that variable. This keeps the workaround scoped to bundled WebKitGTK launches that are prone to Fedora/Wayland DMA-BUF crashes without changing native package installs.
 
 ## Multi-Window (Note Windows)
 
@@ -211,12 +224,12 @@ Notes can be opened in separate Tauri windows for focused editing. Secondary win
 
 Full agent mode — spawns the selected local CLI agent as a subprocess with tool access and MCP vault integration.
 
-1. **Frontend** (`AiPanel` + `useCliAiAgent` + `aiAgents.ts`) — streaming UI with reasoning blocks, tool action cards, response display, onboarding, and default-agent selection
+1. **Frontend** (`AiPanel` + `useCliAiAgent` + `aiAgentSession.ts` + `aiAgents.ts`) — one normalized session lifecycle for message state, reasoning blocks, tool action cards, response display, onboarding, and default-agent selection
 2. **Backend** (`ai_agents.rs`) — normalizes agent availability and streaming, dispatching to per-agent adapters
-3. **Agent adapters** — Claude Code still uses `claude_cli.rs`; Codex runs through `codex exec --json` with the CLI's normal approval / sandbox defaults
-4. **MCP Integration** — Claude receives the generated MCP config file path, while Codex receives the same Tolaria MCP server via transient `-c mcp_servers.tolaria.*` config overrides
+3. **Agent adapters** — Claude Code still uses `claude_cli.rs` with `acceptEdits`, strict Tolaria MCP config, a file/search-only built-in tool list, hidden Windows subprocess launches, and closed stdin for print-mode subprocesses so Windows launches receive EOF; Codex runs through `codex --sandbox workspace-write --ask-for-approval never exec --json`; OpenCode runs through `opencode run --format json`; Pi runs through `pi --mode json --no-session` with `npm:pi-mcp-adapter`. OpenCode and Pi both launch from the active vault cwd with closed stdin and transient MCP config. All app-launched paths use hidden Windows launches and avoid dangerous permission-bypass flags.
+4. **MCP Integration** — Claude receives the generated MCP config file path, Codex receives the same Tolaria MCP server via transient `-c mcp_servers.tolaria.*` config overrides, OpenCode receives it through `OPENCODE_CONFIG_CONTENT`, and Pi receives it through a temporary `PI_CODING_AGENT_DIR/mcp.json` consumed by `pi-mcp-adapter`
 
-Claude Code availability intentionally does not depend only on the desktop app's inherited `PATH`. The detector checks the current process path, the user's login shell, and supported local/toolchain install locations such as native `~/.local/bin`, local `~/.claude/local`, Mise/asdf shims, npm-global, and Homebrew paths so first-run onboarding works on fresh macOS installs.
+CLI-agent availability intentionally does not depend only on the desktop app's inherited `PATH`. The detectors check the current process path, the user's login shell, and supported local/toolchain install locations such as native `~/.local/bin`, local `~/.claude/local`, Mise/asdf shims, npm-global, Homebrew, Windows `%APPDATA%\npm`/pnpm/Scoop shims, Windows `.exe` launchers, and the macOS Codex app resource path so first-run onboarding works on fresh macOS and Windows installs.
 
 #### Agent Event Flow
 
@@ -231,11 +244,11 @@ sequenceDiagram
     U->>FE: sendMessage(text, references)
     FE->>FE: buildContextSnapshot(activeNote, linkedNotes, openTabs)
     FE->>R: invoke('stream_ai_agent', {agent, message, systemPrompt, vaultPath})
-    R->>R: pick adapter for claude_code or codex
+    R->>R: pick adapter for claude_code, codex, opencode, or pi
     R->>C: spawn agent with MCP-enabled config
 
     loop Normalized stream
-        C-->>R: Claude NDJSON or Codex JSONL events
+        C-->>R: Claude NDJSON, Codex JSONL, OpenCode JSON, or Pi JSON events
         R-->>FE: emit("ai-agent-stream", event)
         alt TextDelta
             FE->>FE: accumulate response (revealed on Done)
@@ -257,7 +270,7 @@ sequenceDiagram
 
 #### File Operation Detection
 
-When the agent writes or edits vault files, `useCliAiAgent` detects this from normalized tool inputs and calls `onFileCreated` or `onFileModified` callbacks to trigger vault reload.
+When the agent writes or edits vault files, `aiAgentFileOperations.ts` detects this from normalized tool inputs and calls `onFileCreated` or `onFileModified` callbacks to trigger vault reload. Unrecognized write-like operations fall back to a full vault refresh.
 
 ### Context Building
 
@@ -277,7 +290,7 @@ Token budget: 60% of 180k context limit (~108k tokens max). Active note gets pri
 
 ### Authentication
 
-Each CLI agent authenticates itself outside Tolaria. Claude Code uses its existing CLI login; Codex surfaces a friendly prompt to run `codex login` when needed. Tolaria does not store model-provider API keys in app settings.
+Each CLI agent authenticates itself outside Tolaria. Claude Code uses its existing CLI login; Codex surfaces a friendly prompt to run `codex login` when needed; OpenCode surfaces a friendly prompt to run `opencode auth login` or configure a provider when needed; Pi surfaces a friendly prompt to run `pi /login` or configure a provider API key when needed. Tolaria does not store model-provider API keys in app settings.
 
 ## MCP Server
 
@@ -314,14 +327,15 @@ The MCP server (`mcp-server/`) exposes vault operations as tools for AI assistan
 Tolaria can register itself as an MCP server in:
 - `~/.claude.json` and `~/.claude/mcp.json` (Claude Code compatibility across current CLI and legacy MCP-file setups)
 - `~/.cursor/mcp.json` (Cursor)
+- `~/.config/mcp/mcp.json` (generic MCP-compatible clients)
 
-That setup is user-initiated through the status bar / command palette flow, not a startup side effect. Registration is non-destructive (additive, preserves other servers), uses `upsert` semantics, and can be reversed by removing Tolaria's entry again. The `useMcpStatus` hook tracks whether the active vault is explicitly connected (`checking | installed | not_installed`).
+That setup is user-initiated through the status bar / command palette flow, not a startup side effect. Registration is non-destructive (additive, preserves other servers), uses `upsert` semantics, and can be reversed by removing Tolaria's entry again. Tolaria verifies Node.js is available before writing config, writes an explicit `type: "stdio"` entry, pins `VAULT_PATH` to the active vault, and sets `WS_UI_PORT=9711` so UI actions route back to the desktop app. Packaged builds resolve `mcp-server/` from the installed resource directory next to the executable before falling back to macOS `Resources`, Linux bundle paths, and AppImage paths. The `useMcpStatus` hook tracks whether the active vault is explicitly connected (`checking | installed | not_installed`). The desktop WebSocket bridge is started only when a persisted active vault exists and is resynced from React state on vault changes; no selected vault stops the bridge instead of falling back to `~/Laputa`.
 
 ### Architecture
 
 ```mermaid
 flowchart TD
-    subgraph MCP["MCP Server (Node.js) — spawned by Tauri on startup"]
+    subgraph MCP["MCP Server (Node.js) — selected-vault scoped"]
         IDX["index.js"]
         VAULT["vault.js\n(findMarkdownFiles, readNote, createNote,\nsearchNotes, appendToNote, editNoteFrontmatter,\ndeleteNote, linkNotes, listNotes, vaultContext)"]
         WSB["ws-bridge.js"]
@@ -333,8 +347,8 @@ flowchart TD
         WSB -->|"port 9711 — UI bridge"| FE["Frontend\n(useAiActivity)"]
     end
 
-    TAURI["Tauri (mcp.rs)"] -->|"spawn on startup"| MCP
-    UI["Status bar / Command Palette"] -->|"explicit setup or disconnect"| CFG["~/.claude.json\n~/.claude/mcp.json\n~/.cursor/mcp.json"]
+    TAURI["Tauri bridge lifecycle"] -->|"start/stop/restart with active VAULT_PATH"| MCP
+    UI["Status bar / Command Palette"] -->|"explicit setup or disconnect"| CFG["~/.claude.json\n~/.claude/mcp.json\n~/.cursor/mcp.json\n~/.config/mcp/mcp.json"]
 ```
 
 ### WebSocket Bridge
@@ -361,11 +375,12 @@ flowchart LR
 | Function | Purpose |
 |----------|---------|
 | `spawn_ws_bridge(vault_path)` | Spawns `ws-bridge.js` as child process with VAULT_PATH env |
-| `register_mcp(vault_path)` | Writes Tolaria entry to Claude Code and Cursor MCP configs on explicit user request |
-| `remove_mcp()` | Removes Tolaria's MCP entry from Claude Code and Cursor configs |
+| `sync_mcp_bridge_vault(vault_path?)` | Starts, restarts, or stops the desktop WebSocket bridge as the selected vault changes |
+| `register_mcp(vault_path)` | Verifies Node.js, resolves the packaged `mcp-server/`, and writes Tolaria's explicit stdio entry to Claude Code, Cursor, and generic MCP configs on user request |
+| `remove_mcp()` | Removes Tolaria's MCP entry from Claude Code, Cursor, and generic MCP configs |
 | `upsert_mcp_config(path, entry)` | Atomic config file update (create/merge, preserves others) |
 
-The `WsBridgeChild` state wrapper in `lib.rs` ensures the bridge process is killed on app exit via `RunEvent::Exit` handler. The same desktop layer now keeps the Tauri asset protocol scoped to the active vault instead of every filesystem path.
+The `WsBridgeChild` state wrapper in `lib.rs` ensures the bridge process is replaced on vault switches, stopped when no active vault is selected, and killed on app exit via the `RunEvent::Exit` handler. The same desktop layer now keeps the Tauri asset protocol scoped to the active vault instead of every filesystem path.
 
 ## Search
 
@@ -412,6 +427,12 @@ The app uses internal app-owned light and dark themes (see [ADR-0081](adr/0081-i
 2. **Editor theme** (`src/theme.json`): BlockNote-specific typography. Flattened to CSS vars by `useEditorTheme`; editor colors resolve through the same semantic app variables.
 3. **Theme runtime**: Applies `data-theme` and the shadcn-compatible `.dark` class before React consumers render, with a localStorage mirror to avoid startup flash when dark mode is selected.
 
+## Localization
+
+Tolaria's app chrome uses an app-owned localization runtime in `src/lib/i18n.ts`, backed by flat JSON catalogs in `src/lib/locales/` and Lara CLI synchronization through `lara.yaml` (see [ADR-0087](adr/0087-json-catalogs-and-lara-cli-localization.md)). `en.json` is the canonical source catalog, locale files are one file per locale, and English remains the fallback for any missing locale file or key. The installation-local `ui_language` setting stores an explicit locale when the user chooses one; `null` means "follow the system language when Tolaria supports it, otherwise English." Legacy stored values such as `zh-Hans` are normalized to canonical locale codes like `zh-CN`.
+
+`App.tsx` derives the effective locale from settings and browser/system language hints, then passes it down to localized surfaces. Settings exposes a keyboard-accessible shadcn `Select`, and the command palette includes actions to open language settings or switch directly to a supported language.
+
 ## Vault Management
 
 ### Vault List
@@ -433,6 +454,7 @@ Per-vault UI settings stored locally per vault path (currently in browser/Tauri
 - `zoom`: Float zoom level (0.8–1.5)
 - `view_mode`: "all" | "editor-list" | "editor-only"
 - `editor_mode`: "raw" | "preview" (persists across note switches and sessions)
+- `note_layout`: "centered" | "left" (wide-screen note column alignment for rich and raw editors)
 - `tag_colors`, `status_colors`: Custom color overrides
 - `property_display_modes`: Property display preferences
 - `inbox.noteListProperties`: Optional Inbox-only property chip override for the note list
@@ -443,12 +465,14 @@ Per-vault UI settings stored locally per vault path (currently in browser/Tauri
 
 On first launch, `useOnboarding` checks if the default vault exists. If not, it shows `WelcomeScreen` with three options:
 - **Create a new vault** → creates an empty git repo in a folder the user chooses
-- **Open an existing folder** → system file picker
+- **Open an existing folder** → system file picker; plain Markdown folders without `.git` open immediately in supported non-git mode
 - **Get started with a template** → pick a parent folder, then call `create_getting_started_vault()` with the derived `.../Getting Started` child path so the cloned vault opens into the populated repo root immediately
 
-When an opened folder is not yet a git repo, `init_git_repo` runs `git init`, ensures Tolaria's default `.gitignore`, stages the vault, and writes the initial `Initial vault setup` commit. That app-managed setup commit explicitly disables commit signing for the single command so inherited global or local `commit.gpgsign` preferences cannot strand onboarding when GPG is missing or misconfigured. Later `git_commit` calls honor the user's signing configuration first, then retry the same app-managed commit once with `commit.gpgsign=false` only when Git reports a signing-helper failure, so working GPG/SSH signing setups continue to sign while broken GPG setups do not create repeated opaque commit failures.
+When an opened folder is not yet a git repo, Tolaria shows a dismissible Git setup dialog and a persistent `Git disabled` status-bar warning. Markdown scanning, note browsing, note editing, and search continue normally. Git-dependent surfaces (history, changes, commit, sync, conflict resolution, remotes, AutoGit, and auto-sync) stay unavailable until the user explicitly initializes Git from the dialog, the status-bar warning, or the `Initialize Git for Current Vault` command-palette action.
 
-Once a vault is ready, `useAiAgentsOnboarding` can show a one-time `AiAgentsOnboardingPrompt`. That prompt reads `useAiAgentsStatus` so first launch surfaces whether Claude Code and Codex are installed, offers per-agent install links when they are missing, and stores local dismissal so the prompt does not repeat on every launch.
+When the user enables Git later, `init_git_repo` runs `git init`, ensures Tolaria's default `.gitignore`, stages the vault, and writes the initial `Initial vault setup` commit. Before app-managed setup and remote-connection commits, Tolaria ensures the vault has local `user.name` / `user.email` values, falling back to `Tolaria <vault@tolaria.md>` when the vault has no local Git identity yet. That app-managed setup commit explicitly disables commit signing for the single command so inherited global or local `commit.gpgsign` preferences cannot strand onboarding when GPG is missing or misconfigured. Later `git_commit` calls honor the user's signing configuration first, then retry the same app-managed commit once with `commit.gpgsign=false` only when Git reports a signing-helper failure, so working GPG/SSH signing setups continue to sign while broken GPG setups do not create repeated opaque commit failures.
+
+Once a vault is ready, `useAiAgentsOnboarding` can show a one-time `AiAgentsOnboardingPrompt`. That prompt reads `useAiAgentsStatus` so first launch surfaces whether Claude Code, Codex, OpenCode, and Pi are installed, offers per-agent install links when they are missing, and stores local dismissal so the prompt does not repeat on every launch.
 
 `useGettingStartedClone` reuses the same parent-folder semantics for the status-bar / command-palette clone action, and `Toast` is rendered through the AI-agents onboarding gate so the resolved destination path stays visible right after a successful clone.
 
@@ -496,6 +520,7 @@ sequenceDiagram
     participant MCP as MCP Server
     participant U as User
 
+    T->>T: apply Linux AppImage WebKit env override<br/>(AppImage only)
     T->>T: run_startup_tasks()<br/>(migrate + seed only)
     T->>MCP: spawn_ws_bridge() — ports 9710 + 9711
     T->>A: App mounts
@@ -569,7 +594,9 @@ flowchart TD
 
 `useGitRemoteStatus` re-checks `git_remote_status` when the commit dialog opens and again right before submit. If `hasRemote` is false, Tolaria keeps the flow local-only: the status bar shows a neutral `No remote` chip, the dialog copy switches from "Commit & Push" to "Commit", and no `git_push` call is attempted.
 
-The same local-only state enables the explicit Add Remote flow. `AddRemoteModal` is reachable from the `No remote` chip and the command palette. The backend `git_add_remote` command adds `origin`, fetches it, refuses incompatible histories, and only enables tracking after a safe push or fast-forward-compatible check succeeds.
+If the current vault is not a Git repository, Tolaria treats Git as disabled instead of degraded. The status bar replaces changes, commit, sync, remote, conflict, and history controls with a `Git disabled` warning that reopens Git setup. Command registration follows the same state: only `Initialize Git for Current Vault` is available in the Git group, while pull, commit, changes, conflict, and remote commands are hidden. `useAutoSync` is disabled for non-git vaults so the app does not run background Git commands against plain folders.
+
+The same local-only state enables the explicit Add Remote flow. `AddRemoteModal` is reachable from the `No remote` chip and the command palette. The backend `git_add_remote` command ensures the local author identity, adds `origin`, fetches it, refuses incompatible histories, and only enables tracking after a safe push or fast-forward-compatible check succeeds.
 
 `useCommitFlow` also exposes `runAutomaticCheckpoint()`, a dialog-free commit path shared by AutoGit and the bottom-bar Commit button. `useAutoGit` watches the last editor activity plus app focus/visibility state, and when the vault is git-backed, all saves are flushed, and no unsaved edits remain, it triggers the same deterministic `Updated N note(s)` / `Updated N file(s)` commit message path after the configured idle or inactive thresholds. The bottom-bar quick action reuses that checkpoint flow after forcing a save first, so manual quick commits and scheduled AutoGit commits stay aligned on message generation and push behavior.
 
@@ -593,6 +620,7 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 | `parsing.rs` | Text processing: snippet extraction, markdown stripping, ISO date parsing, `extract_title` (H1 → legacy frontmatter → filename), `slug_to_title` |
 | `title_sync.rs` | Legacy filename → `title` frontmatter sync helper; no longer used by the normal note-open flow |
 | `cache.rs` | Git-based incremental vault caching (`scan_vault_cached`), git helpers |
+| `ignored.rs` | Gitignored-content visibility filtering via batched `git check-ignore` |
 | `filename_rules.rs` | Cross-platform validation for note filenames, folder names, and custom view filenames |
 | `rename.rs` | `rename_note` / `rename_note_filename` / `move_note_to_folder` — stage crash-safe file moves, update `title` frontmatter when needed, recover unfinished rename transactions, and report backlink rewrite failures |
 | `image.rs` | `save_image` / `copy_image_to_vault` — save editor image attachments with sanitized filenames |
@@ -607,9 +635,10 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 | `vault/` | Vault scanning, caching, parsing, rename, image, migration |
 | `frontmatter/` | YAML frontmatter read/write (`mod.rs`, `yaml.rs`, `ops.rs`) |
 | `git/` | Git operations (`commit.rs`, `status.rs`, `history.rs`, `conflict.rs`, `remote.rs`, `pulse.rs`, `clone.rs`, `connect.rs`) |
-| `search.rs` | Keyword search — walkdir-based vault file scan |
+| `search.rs` | Keyword search — walkdir-based vault file scan with Gitignored-content visibility filtering |
 | `ai_agents.rs` | Shared CLI-agent detection, stream normalization, and adapter dispatch |
 | `claude_cli.rs` | Claude Code subprocess spawning + NDJSON stream parsing |
+| `pi_cli.rs`, `pi_config.rs`, `pi_discovery.rs`, `pi_events.rs` | Pi subprocess launch, transient MCP adapter config, discovery, and JSON stream parsing |
 | `mcp.rs` | MCP server spawning + explicit config registration/removal |
 | `commands/` | Tauri command handlers (split into submodules) |
 | `settings.rs` | App settings persistence |
@@ -623,7 +652,7 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 
 | Command | Description |
 |---------|-------------|
-| `list_vault` | Scan vault (cached) → `Vec<VaultEntry>` |
+| `list_vault` | Scan vault (cached), then apply Gitignored-content visibility → `Vec<VaultEntry>` |
 | `get_note_content` | Read note file content |
 | `save_note_content` | Write note content to disk |
 | `delete_note` | Permanently delete note from disk (with confirm dialog) |
@@ -635,8 +664,9 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 | `sync_note_title` | Legacy helper: rewrite `title` frontmatter from filename → `bool` (modified); not used by the normal note-open flow |
 | `batch_archive_notes` | Archive multiple notes |
 | `batch_delete_notes` | Permanently delete notes from disk |
-| `reload_vault` | Sync the active vault asset scope, invalidate cache, and full rescan from filesystem → `Vec<VaultEntry>` |
+| `reload_vault` | Sync the active vault asset scope, invalidate cache, full rescan from filesystem, then apply Gitignored-content visibility → `Vec<VaultEntry>` |
 | `reload_vault_entry` | Re-read a single file from disk → `VaultEntry` |
+| `start_vault_watcher` / `stop_vault_watcher` | Start or stop native active-vault filesystem change events |
 | `check_vault_exists` | Check if vault path exists |
 | `create_empty_vault` | Create a git-backed vault, then seed root `AGENTS.md`, `CLAUDE.md`, `type.md`, and `note.md` defaults |
 | `create_getting_started_vault` | Clone the public Getting Started vault, refresh Tolaria-managed guidance/config defaults, and keep the cloned repo clean |
@@ -691,13 +721,13 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 | Command | Description |
 |---------|-------------|
 | `stream_claude_chat` | Claude CLI chat mode (streaming) |
-| `stream_claude_agent` | Claude CLI agent mode (streaming + tools) |
 | `check_claude_cli` | Check if Claude CLI is available |
-| `get_ai_agents_status` | Check Claude Code + Codex availability |
-| `stream_ai_agent` | Stream the selected CLI agent through the normalized event layer |
-| `register_mcp_tools` | Register MCP in Claude/Cursor config for the active vault |
-| `remove_mcp_tools` | Remove Tolaria's MCP entry from Claude/Cursor config |
-| `check_mcp_status` | Check whether the active vault is explicitly registered in Claude/Cursor config |
+| `get_ai_agents_status` | Check Claude Code + Codex + OpenCode + Pi availability |
+| `stream_ai_agent` | Stream Claude Code, Codex, OpenCode, or Pi through the normalized agent event layer |
+| `register_mcp_tools` | Register MCP in Claude/Cursor/generic config for the active vault |
+| `remove_mcp_tools` | Remove Tolaria's MCP entry from Claude/Cursor/generic config |
+| `check_mcp_status` | Check whether the active vault is explicitly registered in Claude/Cursor/generic config |
+| `sync_mcp_bridge_vault` | Sync the desktop WebSocket bridge process to the selected vault, or stop it when no vault is selected |
 
 The desktop MCP WebSocket bridge is intentionally local-only. `mcp-server/ws-bridge.js` binds both bridge ports to loopback, rejects non-loopback clients, accepts browser/Tauri origins only on the UI bridge, and rejects browser-origin requests on the tool bridge so remote pages cannot drive vault tools directly.
 
@@ -749,17 +779,19 @@ No Redux or global context. State lives in the root `App.tsx` and custom hooks:
 | `useNoteCreation` | — | Note/type creation with optimistic persistence |
 | `useNoteRename` | — | Note renaming and folder moves with wikilink update |
 | `useNoteRetargeting` | — | Shared note retargeting logic for drag/drop and command-palette actions |
+| `useTauriDragDropEvent` | — | Shared native window drag/drop event subscription and cleanup |
+| `useNativePathDrop` | — | Tauri-native file/folder path drops for AI and command text inputs |
 | `frontmatterOps` | — (pure functions) | Frontmatter CRUD: key→VaultEntry mapping, mock/Tauri dispatch |
 | `useTabManagement` | Navigation history, note switching | Note navigation lifecycle |
 | `useVaultSwitcher` | `vaultPath`, `extraVaults` | Vault switching |
 | `useTheme` | Editor theme CSS vars and theme-mode bridge | Editor typography and app theme runtime |
-| `useCliAiAgent` | `messages`, `status`, tool actions | Selected AI agent conversation |
+| `useCliAiAgent` | `messages`, `status`, tool actions | Selected AI agent conversation backed by the shared session pipeline |
 | `useAutoSync` | Sync interval, pull/push state | Git auto-sync |
 | `useAutoGit` | Last activity timestamp, idle/inactive checkpoint triggers | Automatic commit/push checkpoints |
 | `useCommitFlow` | Commit dialog state, shared manual/automatic checkpoint runner | Git commit/push orchestration |
 | `useGitRemoteStatus` | `remoteStatus`, `refreshRemoteStatus()` | On-demand remote detection for commit UI |
 | `useUnifiedSearch` | Query, results, loading state | Keyword search |
-| `useSettings` | App settings (telemetry, release channel, theme mode, auto-sync interval, AutoGit thresholds, default AI agent) | Persistent settings |
+| `useSettings` | App settings (telemetry, release channel, theme mode, UI language, auto-sync interval, AutoGit thresholds, default AI agent, Gitignored-content visibility) | Persistent settings |
 | `useVaultConfig` | Per-vault UI preferences | Vault-specific config |
 | `appCommandDispatcher` | Canonical shortcut/menu command IDs | Shared execution path for renderer and native menu commands |
 
@@ -773,20 +805,23 @@ Data flows unidirectionally: `App` passes data and callbacks as props to child c
 | Cmd+P / Cmd+O | Open quick open palette |
 | Cmd+N | Create new note |
 | Cmd+S | Save current note |
+| Cmd+F | Find in current note when the editor is focused; otherwise note-list search can claim it |
+| Cmd+Shift+F | Find in vault |
 | Cmd+[ / Cmd+] | Navigate back / forward (replaces tabs) |
 | Cmd+Z / Cmd+Shift+Z | Undo / Redo |
 | Cmd+1–9 | Switch to tab N |
 | Cmd+[ / Cmd+] | Navigate back / forward |
 | `[[` in editor | Open wikilink suggestion menu |
 
-Selection-dependent actions are wired through the command palette and the native menus. For example, a deleted file opened from Changes view becomes a read-only diff preview, and that state enables the "Restore Deleted Note" menu/command while normal note mutation actions stay disabled. Folder selection follows the same pattern: when `selection.kind === 'folder'`, the command palette exposes "Rename Folder" and "Delete Folder", and the sidebar row can launch the same flows directly through inline rename or the folder context menu. Active notes now follow the same shared-action model for retargeting: Cmd+K can open "Change Note Type…" and "Move Note to Folder…", and the sidebar drop targets call the same hook-backed implementations instead of maintaining separate mutation paths.
+Selection-dependent actions are wired through the command palette and the native menus. For example, a deleted file opened from Changes view becomes a read-only diff preview, and that state enables the "Restore Deleted Note" menu/command while normal note mutation actions stay disabled. Folder selection follows the same pattern: when `selection.kind === 'folder'`, the command palette exposes "Reveal Folder in Finder", "Copy Folder Path", "Rename Folder", and "Delete Folder", and the sidebar row can launch the same flows directly through inline rename or the folder context menu. Active files also expose "Reveal in Finder" and "Copy File Path" through the command palette; non-Markdown file tabs additionally expose "Open in Default App", matching the `FilePreview` header controls. Active notes now follow the same shared-action model for retargeting: Cmd+K can open "Change Note Type…" and "Move Note to Folder…", and the sidebar drop targets call the same hook-backed implementations instead of maintaining separate mutation paths.
 
 Shortcut routing is explicit:
 
 - `appCommandCatalog.ts` is the shared shortcut manifest for command IDs, modifier rules, and deterministic QA metadata
 - `formatShortcutDisplay()` derives platform-accurate visible shortcut labels (`⌘` on macOS, `Ctrl` on Windows/Linux) from that same manifest so menus, tooltips, and command-palette copy stay aligned with real accelerators
 - `useAppKeyboard` is the primary execution path for real shortcut keypresses, including Tauri runs
-- macOS browser-reserved chords such as `Cmd+O` and `Cmd+Shift+L` are unblocked at webview init via `tauri-plugin-prevent-default`, then continue through the same renderer-first command path
+- macOS browser-reserved chords such as `Cmd+O`, `Cmd+F`, and `Cmd+Shift+L` are unblocked at webview init via `tauri-plugin-prevent-default`, then continue through the same renderer-first command path
+- `Cmd+F` is surface-aware: editor focus opens current-note find/replace in raw CodeMirror, note-list focus preserves note-list search, and native menu enablement follows focus availability events so only one `Cmd+F` menu item is active
 - `menu.rs`, `useMenuEvents`, and Linux's `LinuxMenuButton` emit the same command IDs for native menu clicks, accelerators, and custom titlebar menu actions
 - `appCommandDispatcher.ts` suppresses the paired native-menu/renderer echo from a single shortcut so the command runs once
 - Deterministic QA uses two explicit proof paths from the shared manifest:
@@ -808,12 +843,13 @@ push to main
       → if stable already uses today, advance alpha to the next calendar day so semver still increases
   → build job:
       → pnpm install, stamp version, pnpm build, tauri build --target aarch64-apple-darwin --bundles app
-      → upload signed .app.tar.gz + .sig updater artifacts
+      → pnpm install, stamp version, pnpm build, tauri build --target x86_64-apple-darwin --bundles app
+      → upload signed Apple Silicon and Intel .app.tar.gz + .sig updater artifacts named Tolaria_<version>_macOS_Silicon and Tolaria_<version>_macOS_Intel
   → build-windows job:
       → pnpm install, stamp version, tauri build --target x86_64-pc-windows-msvc --bundles nsis
       → upload NSIS installer, optional MSI artifacts, and signed Windows updater bundles
   → release job:
-      → generate alpha-latest.json
+      → generate alpha-latest.json with darwin-aarch64, darwin-x86_64, Linux, and Windows updater URLs
       → publish GitHub prerelease alpha-vYYYY.M.D-alpha.NNNN named Tolaria Alpha YYYY.M.D.N
   → pages job:
       → build static HTML release history page
@@ -830,7 +866,8 @@ push stable-vYYYY.M.D tag
   → version job: validate YYYY.M.D from the tag
   → build job:
       → pnpm install, stamp version, pnpm build, tauri build --target aarch64-apple-darwin
-      → upload signed .app.tar.gz + .sig and .dmg artifacts
+      → pnpm install, stamp version, pnpm build, tauri build --target x86_64-apple-darwin
+      → upload signed Apple Silicon and Intel .app.tar.gz + .sig and .dmg artifacts named Tolaria_<version>_macOS_Silicon and Tolaria_<version>_macOS_Intel
   → build-linux job:
       → pnpm install, stamp version, tauri build --target x86_64-unknown-linux-gnu --bundles deb,appimage
       → upload .deb, .AppImage, and signed Linux updater bundles
@@ -838,7 +875,7 @@ push stable-vYYYY.M.D tag
       → pnpm install, stamp version, tauri build --target x86_64-pc-windows-msvc --bundles nsis
       → upload NSIS installer, optional MSI artifacts, and signed Windows updater bundles
   → release job:
-      → generate stable-latest.json with macOS, Linux, and Windows updater URLs plus platform-specific manual download URLs
+      → generate stable-latest.json with macOS Apple Silicon, macOS Intel, Linux, and Windows updater URLs plus platform-specific manual download URLs
       → publish GitHub release Tolaria YYYY.M.D
   → pages job:
       → publish stable/latest.json
@@ -883,7 +920,7 @@ sequenceDiagram
     App->>User: TelemetryConsentDialog
     alt Accept
         User->>Settings: telemetry_consent=true, anonymous_id=UUID
-        Settings->>Sentry: init(DSN, anonymous_id)
+        Settings->>Sentry: init(DSN, release, anonymous_id)
         Settings->>PostHog: init(key, anonymous_id)
     else Decline
         User->>Settings: telemetry_consent=false
@@ -905,6 +942,7 @@ sequenceDiagram
 **Architecture:**
 - **Rust:** `sentry` crate initialized in `lib.rs::setup()` via `telemetry::init_sentry_from_settings()`
 - **JS:** `@sentry/react` + `posthog-js` initialized lazily by `useTelemetry` hook; the React root also wires `onCaughtError`, `onUncaughtError`, and `onRecoverableError` through `Sentry.reactErrorHandler()` so production React invariants include component stack context when crash reporting is enabled.
+- **Release grouping:** packaged release workflows pass `VITE_SENTRY_RELEASE` from the computed build version so frontend Sentry events group by the shipped alpha or stable version.
 - **Settings:** `telemetry_consent`, `crash_reporting_enabled`, `analytics_enabled`, `anonymous_id` in `Settings` struct
 - **Consent:** `TelemetryConsentDialog` shown when `telemetry_consent === null`
 
@@ -959,7 +997,7 @@ Desktop-only modules gated at the crate level:
 Desktop-only features gated at the function level in `commands/`:
 - Git operations (commit, pull, push, status, history, diff, conflicts)
 - Clone-by-URL via system git (`clone_repo`)
-- CLI AI agent streaming (Claude, Codex)
+- CLI AI agent streaming (Claude, Codex, OpenCode, Pi)
 - MCP registration and status
 - Menu state updates
 

docs/GETTING-STARTED.md

@@ -106,16 +106,15 @@ tolaria/
 │   │   └── ui/                   # shadcn/ui primitives
 │   │       ├── button.tsx, dialog.tsx, input.tsx, ...
 │   │
-│   ├── hooks/                    # Custom React hooks (~87 files)
+│   ├── hooks/                    # Custom React hooks (~86 files)
 │   │   ├── useVaultLoader.ts     # Loads vault entries + content
 │   │   ├── useVaultSwitcher.ts   # Multi-vault management
 │   │   ├── useVaultConfig.ts     # Per-vault UI settings
 │   │   ├── useNoteActions.ts     # Composes creation + rename + frontmatter
 │   │   ├── useNoteCreation.ts    # Note/type creation
 │   │   ├── useNoteRename.ts     # Note renaming + wikilink updates
-│   │   ├── useAiAgent.ts         # Legacy Claude-specific stream helpers reused by the shared agent hook
-│   │   ├── useCliAiAgent.ts      # Selected AI agent state + normalized tool tracking
-│   │   ├── useAiAgentsStatus.ts  # Claude/Codex availability polling
+│   │   ├── useCliAiAgent.ts      # Selected AI agent state + normalized session pipeline
+│   │   ├── useAiAgentsStatus.ts  # Claude/Codex/OpenCode/Pi availability polling
 │   │   ├── useAiAgentPreferences.ts # Default-agent persistence + cycling
 │   │   ├── useAiActivity.ts      # MCP UI bridge listener
 │   │   ├── useAutoSync.ts        # Auto git pull/push
@@ -157,6 +156,8 @@ tolaria/
 │   ├── lib/
 │   │   ├── aiAgents.ts           # Shared agent registry + status helpers
 │   │   ├── appUpdater.ts         # Frontend wrapper around channel-aware updater commands
+│   │   ├── i18n.ts               # App-owned localization runtime and locale resolution
+│   │   ├── locales/              # JSON locale catalogs (English source + translated locales)
 │   │   ├── releaseChannel.ts     # Alpha/stable normalization helpers
 │   │   └── utils.ts              # Tailwind merge + cn() helper
 │   │
@@ -189,6 +190,7 @@ tolaria/
 │   │   ├── search.rs             # Keyword search (walkdir-based)
 │   │   ├── ai_agents.rs          # Shared CLI-agent detection + stream adapters
 │   │   ├── claude_cli.rs         # Claude CLI subprocess management
+│   │   ├── pi_cli.rs             # Pi CLI subprocess management
 │   │   ├── mcp.rs                # MCP server lifecycle + explicit config registration/removal
 │   │   ├── app_updater.rs        # Alpha/stable updater endpoint selection
 │   │   ├── settings.rs           # App settings persistence
@@ -211,6 +213,7 @@ tolaria/
 ├── scripts/                      # Build/utility scripts
 │
 ├── package.json                  # Frontend dependencies + scripts
+├── lara.yaml                     # Lara CLI locale sync configuration
 ├── vite.config.ts                # Vite bundler config
 ├── tsconfig.json                 # TypeScript config
 ├── playwright.config.ts          # Full Playwright regression config
@@ -258,8 +261,9 @@ tolaria/
 | `src-tauri/src/frontmatter/ops.rs` | YAML manipulation — how properties are updated/deleted in files. |
 | `src-tauri/src/git/` | All git operations (clone, commit, pull, push, conflicts, pulse, add-remote). |
 | `src-tauri/src/search.rs` | Keyword search — scans vault files with walkdir. |
-| `src-tauri/src/ai_agents.rs` | Shared CLI-agent availability checks, safe-default Codex adapter, and stream normalization. |
+| `src-tauri/src/ai_agents.rs` | Shared CLI-agent availability checks, adapter dispatch, and stream normalization. |
 | `src-tauri/src/claude_cli.rs` | Claude CLI subprocess spawning + NDJSON stream parsing. |
+| `src-tauri/src/pi_cli.rs` | Pi subprocess spawning through JSON mode and transient MCP adapter config. |
 | `src-tauri/src/app_updater.rs` | Desktop updater bridge — selects alpha/stable manifests and streams install progress. |
 
 ### Editor
@@ -279,7 +283,9 @@ tolaria/
 | File | Why it matters |
 |------|---------------|
 | `src/components/AiPanel.tsx` | AI agent panel — selected CLI agent with tool execution, reasoning, and actions. |
-| `src/hooks/useCliAiAgent.ts` | Agent state: messages, streaming, tool tracking, file detection. |
+| `src/hooks/useCliAiAgent.ts` | Thin React owner for the selected CLI agent session state. |
+| `src/lib/aiAgentSession.ts` | Single message/session lifecycle for prompt normalization, history, streaming, and reset behavior. |
+| `src/lib/aiAgentFileOperations.ts` | Detects agent-created or modified vault files from normalized tool inputs. |
 | `src/lib/aiAgents.ts` | Supported agent definitions, status normalization, and default-agent helpers. |
 | `src/utils/ai-context.ts` | Context snapshot builder for AI conversations. |
 
@@ -294,12 +300,12 @@ tolaria/
 
 | File | Why it matters |
 |------|---------------|
-| `src/hooks/useSettings.ts` | App settings (telemetry, release channel, theme mode, auto-sync interval, default AI agent). |
+| `src/hooks/useSettings.ts` | App settings (telemetry, release channel, theme mode, UI language, auto-sync interval, default AI agent). |
 | `src/lib/releaseChannel.ts` | Normalizes persisted updater-channel values (`stable` default, optional `alpha`). |
 | `src/lib/appUpdater.ts` | Frontend wrapper for channel-aware updater commands. |
 | `src/hooks/useMainWindowSizeConstraints.ts` | Derives the main-window minimum width from the visible panes and asks Tauri to grow back to fit wider layouts. |
 | `src/hooks/useVaultConfig.ts` | Per-vault local UI preferences (zoom, view mode, colors, Inbox columns, explicit organization workflow). |
-| `src/components/SettingsPanel.tsx` | Settings UI for telemetry, release channel, sync interval, default AI agent, and the vault-level explicit organization toggle. |
+| `src/components/SettingsPanel.tsx` | Settings UI for telemetry, release channel, sync interval, UI language, default AI agent, and the vault-level explicit organization toggle. |
 | `src/hooks/useUpdater.ts` | In-app updates using the selected alpha/stable feed. |
 
 ## Architecture Patterns
@@ -339,6 +345,8 @@ type SidebarSelection =
 
 Commands whose availability depends on the current note or Git state must also flow through `update_menu_state` so the native menu stays in sync with the command palette. The deleted-note restore action in Changes view is the reference example: the row opens a deleted diff preview, the command palette exposes "Restore Deleted Note", and the Note menu enables the same action only while that preview is active.
 
+Current-note find/replace is a surface-aware command: editor focus enables "Find in Note" / "Replace in Note" and routes Cmd+F into raw CodeMirror mode; note-list focus enables existing note-list search instead. When adding another focus-dependent command, mirror this pattern with an availability event consumed by `useMenuEvents.ts` and `update_menu_state`.
+
 For automated shortcut QA, use the explicit proof path from `appCommandCatalog.ts`:
 
 - `window.__laputaTest.triggerShortcutCommand()` for deterministic renderer shortcut-event coverage
@@ -412,5 +420,11 @@ BASE_URL="http://localhost:5173" npx playwright test tests/smoke/<slug>.spec.ts
 1. **Agent system prompt**: Edit `src/utils/ai-agent.ts` (inline system prompt string)
 2. **Context building**: Edit `src/utils/ai-context.ts` for what data is sent to the agent
 3. **Tool action display**: Edit `src/components/AiActionCard.tsx`
-4. **Claude CLI arguments**: Edit `src-tauri/src/claude_cli.rs` (`run_agent_stream()`)
-5. **Shared agent adapters / Codex args**: Edit `src-tauri/src/ai_agents.rs` (keep Codex on the normal approval/sandbox path unless you are intentionally designing an advanced mode)
+4. **Claude CLI arguments**: Edit `src-tauri/src/claude_cli.rs` (`run_agent_stream()`; keep app-managed launches on strict Tolaria MCP config, `acceptEdits`, and the scoped file/search tool list)
+5. **Shared agent adapters / Codex/Pi args**: Edit `src-tauri/src/ai_agents.rs` plus the per-agent adapter modules (keep Codex sandboxed with active-vault `workspace-write`, keep Pi on transient MCP config, and do not use dangerous permission bypasses unless an ADR explicitly designs a new mode)
+
+### Work with external MCP setup
+
+1. **Backend registration/status**: Edit `src-tauri/src/mcp.rs`; registration must verify Node.js first, resolve the packaged `mcp-server/` for macOS, Windows, Linux, and AppImage installs, and write an explicit stdio entry with `VAULT_PATH` plus `WS_UI_PORT=9711`
+2. **Setup dialog copy/actions**: Edit `src/components/McpSetupDialog.tsx`; users should see the Node.js prerequisite and the manual config shape before Tolaria writes third-party config files
+3. **Status hook/toasts**: Edit `src/hooks/useMcpStatus.ts` when setup, reconnect, disconnect, or failure messaging changes

docs/PUBLIC-DOCS-PLAN.md

@@ -0,0 +1,34 @@
+# Public Docs Plan
+
+This document records the phase 1 information architecture for public Tolaria documentation. The public docs source lives in `site/`; the existing `docs/` directory remains contributor, architecture, and agent context.
+
+## Audiences
+
+| Audience | Needs | Primary location |
+|---|---|---|
+| New users | Install, first launch, understand the app layout, clone the starter vault | `site/start/` |
+| Active users | Learn concrete workflows such as organizing, Git sync, custom views, and AI | `site/guides/` |
+| Power users | Understand file layout, frontmatter, filters, shortcuts, and platform support | `site/reference/` |
+| Contributors and agents | Architecture, abstractions, ADRs, development workflow | `docs/`, `AGENTS.md` |
+
+## Hosting Shape
+
+The GitHub Pages output should reserve the root for public docs and mount release assets underneath it:
+
+```text
+/                  public docs home
+/releases/         release history
+/download/         latest stable download redirect
+/stable/latest.json
+/alpha/latest.json
+/latest.json       compatibility alias for alpha latest
+/latest-canary.json compatibility alias for alpha latest
+```
+
+Every user-visible app change should answer:
+
+```text
+Public docs impact:
+- updated: <pages>
+- not needed because: <reason>
+```

docs/adr/0082-markdown-durable-math-notes.md

@@ -0,0 +1,40 @@
+---
+type: ADR
+id: "0082"
+title: "Markdown-durable math in notes"
+status: active
+date: 2026-04-26
+---
+
+## Context
+
+Tolaria notes are durable Markdown files, while the main editor uses BlockNote and raw mode uses CodeMirror. Users coming from technical note-taking tools expect inline math such as `$E=mc^2$` and display math such as `$$ ... $$` to render inside notes without turning the note into an app-only document format.
+
+BlockNote does not currently ship a first-party math block in the local editor package. Tiptap now offers an official Mathematics extension that renders KaTeX nodes, but Tolaria's save path still depends on BlockNote's Markdown parser and `blocksToMarkdownLossy()` serializer. Adding opaque ProseMirror math nodes without an explicit Tolaria serializer would risk losing or rewriting the original Markdown source.
+
+## Decision
+
+**Tolaria will support note math through a Markdown placeholder round-trip owned by the editor pipeline.**
+
+The initial implementation:
+
+- Treats `$...$` as inline math and line-owned `$$...$$` / multiline `$$` blocks as display math.
+- Converts math source to temporary placeholders before BlockNote parses Markdown.
+- Replaces placeholders with Tolaria schema nodes that render via the existing `katex` dependency.
+- Serializes those schema nodes back to the original Markdown delimiters before saving or entering raw mode.
+- Uses KaTeX with `throwOnError: false` and `trust: false` so malformed or untrusted formulas remain visible rather than breaking the note.
+
+## Options considered
+
+- **Tolaria-owned placeholder round-trip with KaTeX rendering** (chosen): matches the existing wikilink architecture, preserves plain-text source, and avoids depending on BlockNote support for non-default ProseMirror math nodes.
+- **Tiptap Mathematics extension directly in BlockNote**: attractive because it is official Tiptap and KaTeX-backed, but it does not by itself solve Tolaria's BlockNote Markdown serializer contract.
+- **Raw-mode-only math support**: preserves source but fails the rich editor reading experience users expect.
+- **Store formulas as custom JSON/frontmatter metadata**: richer structured editing later, but violates the Markdown-first durability requirement.
+
+## Consequences
+
+- `src/utils/mathMarkdown.ts` is the canonical parser/serializer bridge for note math.
+- The rich editor renders math as schema nodes; raw mode remains the most direct way to edit exact math source.
+- CodeMirror raw editing keeps the literal Markdown delimiters, so imported Obsidian-style notes remain understandable outside Tolaria.
+- Future equation editing helpers can be added on top of the same Markdown source contract instead of changing the storage model.
+- Re-evaluate direct Tiptap Mathematics integration only if it can be proven to preserve Tolaria's Markdown save path without custom lossy behavior.

docs/adr/0083-dual-architecture-macos-release-artifacts.md

@@ -0,0 +1,38 @@
+---
+type: ADR
+id: "0083"
+title: "Dual-architecture macOS release artifacts"
+status: active
+date: 2026-04-26
+supersedes: "0080"
+---
+
+## Context
+
+ADR-0080 made Tolaria's desktop release pipeline cross-platform, but the macOS leg still shipped only Apple Silicon artifacts. That left Intel Mac users without a compatible build in both the alpha feed and stable releases, even though Tauri and Rust can produce `x86_64-apple-darwin` bundles from the same release workflow.
+
+The updater manifest also needs to distinguish macOS CPU architectures. A generic `darwin` or macOS-only entry would make it too easy for an Intel installation to see an Apple Silicon updater bundle, and browser user agents cannot reliably tell Apple Silicon Macs apart from Intel Macs.
+
+## Decision
+
+**Tolaria publishes macOS release artifacts for both Apple Silicon (`darwin-aarch64`) and Intel (`darwin-x86_64`) in every alpha and stable release.**
+
+- Alpha and stable workflows build the macOS matrix for `aarch64-apple-darwin` and `x86_64-apple-darwin`.
+- Alpha manifests include signed updater tarballs for `darwin-aarch64` and `darwin-x86_64`.
+- Stable manifests include both macOS updater tarballs and both manual DMG downloads, alongside the existing Windows x64 and Linux x86_64 entries.
+- Release jobs normalize macOS artifact filenames with the architecture suffix before publishing so GitHub release assets stay unambiguous.
+- The stable download page exposes separate Apple Silicon and Intel Mac links. When both Mac links exist, a generic macOS browser is not auto-redirected because user-agent architecture detection is unreliable.
+- The cross-platform filename portability decisions from ADR-0080 remain in force.
+
+## Options considered
+
+- **Publish separate Apple Silicon and Intel Mac artifacts** (chosen): gives each updater client an architecture-specific manifest key and gives users explicit manual download links. Cons: doubles the macOS release matrix and signing/notarization surface.
+- **Publish a universal macOS binary**: gives users one download, but requires lipo/re-sign/notarize coordination and reintroduces the artifact-combining complexity the release pipeline intentionally avoided.
+- **Keep Apple Silicon-only macOS releases**: keeps CI cheaper, but leaves Intel Mac users unsupported and makes the release artifacts inconsistent with Tolaria's desktop support goals.
+
+## Consequences
+
+- macOS release jobs now run one matrix entry per CPU architecture.
+- Release manifest consumers must treat `darwin-aarch64` and `darwin-x86_64` as distinct platform keys.
+- Stable manual downloads show two Mac choices instead of pretending browser detection can select the right CPU architecture.
+- Future macOS release changes must validate both updater and manual-download artifacts for both architectures.

docs/adr/0084-app-localization-foundation.md

@@ -0,0 +1,35 @@
+---
+type: ADR
+id: "0084"
+title: "App-owned localization foundation"
+status: active
+date: 2026-04-26
+---
+
+## Context
+
+Tolaria was effectively English-only. Users requested a general i18n foundation and Chinese-language support. We need a path that lets the UI adopt additional locales without pushing UI-language preferences into vault files or making every partially translated string a runtime failure.
+
+## Decision
+
+Tolaria owns a dependency-free frontend localization layer in `src/lib/i18n.ts`.
+
+- English is the canonical fallback locale.
+- Simplified Chinese (`zh-Hans`) is the first additional locale.
+- `ui_language` is an installation-local app setting in `~/.config/com.tolaria.app/settings.json`; `null` means "follow system language when supported, otherwise English".
+- Missing translation keys fall back to English.
+- App-level chrome receives locale through props from `App.tsx`, following the existing props-down/callbacks-up architecture instead of introducing global React context.
+- Language switching is exposed in Settings and through command-palette actions.
+
+## Alternatives considered
+
+- **Add an i18n dependency now**: useful long term, but unnecessary for the first locale and would add framework surface before we know Tolaria's locale workflow.
+- **Store language in the vault**: rejected because UI language is an installation preference, not content structure.
+- **Translate ad hoc strings inline**: rejected because it would make fallback behavior inconsistent and future locales expensive.
+
+## Consequences
+
+- New UI strings should be added to `src/lib/i18n.ts` first and rendered through `translate()` / `createTranslator()` where the surface already receives locale.
+- Partially translated locales remain usable because English is the fallback for missing keys.
+- Locale choice changes UI chrome immediately after settings save or command-palette language commands without reopening the vault.
+- Larger feature surfaces can migrate to the shared localization module incrementally.

docs/adr/0085-non-git-vault-support.md

@@ -0,0 +1,39 @@
+---
+type: ADR
+id: "0085"
+title: "Non-git vaults open with explicit later Git initialization"
+status: active
+date: 2026-04-26
+supersedes: "0034"
+---
+
+## Context
+
+ADR-0034 made Git a hard prerequisite for opening a vault because Git-backed cache, history, change, and sync flows failed invisibly when users opened plain Markdown folders. That protected Git features, but it blocked the common adoption path of opening an existing folder from Obsidian, iCloud, Dropbox, or a manually maintained notes directory.
+
+Tolaria now needs the opposite default: browsing and editing Markdown should work immediately, while Git remains an explicit capability users can enable when they want history, sync, commits, or collaboration.
+
+## Decision
+
+**Open existing Markdown folders even when they are not Git repositories.** A non-git vault is a supported state, not an error state. On open, Tolaria asks whether to initialize Git; if the user dismisses the prompt, the app keeps working and the status bar permanently shows a `Git disabled` warning. Clicking that warning, or running `Initialize Git for Current Vault` from the command palette, reopens the setup action.
+
+While a vault is not Git-backed:
+
+- Git history, change, commit, sync, conflict, and remote actions are hidden or disabled.
+- Background auto-sync and AutoGit checkpoints do not run.
+- Markdown scanning, note browsing, note editing, search, and non-Git vault features continue normally.
+
+`init_git_repo` remains the single backend command for enabling Git later. It creates the repository, writes Tolaria's default `.gitignore`, stages the vault, and creates the unsigned setup commit.
+
+## Options considered
+
+- **Option A (chosen): Supported non-git mode with explicit later initialization.** Best adoption path; keeps Git capabilities visible without blocking the basic notes workflow.
+- **Option B: Keep the ADR-0034 blocking modal.** Prevents Git feature ambiguity, but rejects valid plain-folder workflows.
+- **Option C: Auto-initialize Git when opening a plain folder.** Low friction, but surprising for users who do not want Tolaria to mutate folder metadata.
+
+## Consequences
+
+- Existing Git-backed vaults keep the same history, commit, sync, and remote behavior.
+- UI surfaces must treat Git capability as stateful per vault, not as an app-wide invariant.
+- Tests need to cover both Git-backed and non-git vaults in browser mocks and native QA.
+- Future Git-dependent features must check the current vault's Git state before registering commands or running background work.

docs/adr/0086-in-app-image-file-preview.md

@@ -0,0 +1,32 @@
+---
+type: ADR
+id: "0086"
+title: "In-app image previews for binary vault files"
+status: active
+date: 2026-04-26
+supersedes: "0041"
+---
+
+## Context
+
+ADR-0041 made the vault scanner index all visible files and introduced `fileKind` as `"markdown"`, `"text"`, or `"binary"`. Binary files were deliberately shown as inert entries until Tolaria had a dedicated preview model.
+
+That made image references visible in folder views, but opening an image still felt outside the normal Tolaria workflow. Users need to inspect screenshots, diagrams, and other image assets while keeping their place in the vault.
+
+## Decision
+
+**Tolaria previews supported image files in the editor pane while keeping them as ordinary binary `VaultEntry` files.**
+
+- The scanner keeps the existing `fileKind: "binary"` representation. Image previewability is inferred in the renderer from the file extension, not by introducing a proprietary image document type.
+- Opening a binary entry creates the same single active-tab state used for notes, but with empty content and no `get_note_content` text read.
+- `FilePreview` renders supported image extensions through Tauri's asset protocol (`convertFileSrc`) so the original file remains on disk.
+- Broken images and unsupported binary files render an explicit fallback state with an intentional "Open in default app" action instead of launching another app automatically.
+- Note-list rows use an image indicator for previewable image binaries. Unsupported binary rows remain muted and non-clickable in the normal list surface.
+- The preview surface is keyboard focusable and `Escape` returns focus to the note list, matching the app's keyboard-first navigation model.
+
+## Consequences
+
+- The existing `VaultEntry` model and cache version do not need to change.
+- Supported image files can participate in normal selection/navigation context without being converted into Markdown notes.
+- Unsupported/broken binary files have a clear in-app state when reached through navigation paths that can select them.
+- Any future PDF, audio, or video preview should extend the same file-preview renderer rather than adding new vault-owned document representations.

docs/adr/0087-json-catalogs-and-lara-cli-localization.md

@@ -0,0 +1,39 @@
+---
+type: ADR
+id: "0087"
+title: "JSON locale catalogs with Lara CLI synchronization"
+status: active
+date: 2026-04-27
+supersedes:
+  - "0084"
+---
+
+## Context
+
+ADR-0084 established an app-owned localization layer in `src/lib/i18n.ts` with English fallback and hand-maintained TypeScript dictionaries. That was enough for the first localized UI surface, but it does not scale well to a broader locale matrix or machine-assisted translation workflows.
+
+We now want Tolaria to support a wider set of locales and to automate translation updates with Lara CLI while keeping the runtime dependency-light and preserving the existing English fallback behavior.
+
+## Decision
+
+Tolaria will keep its app-owned runtime localization layer, but the translation source-of-truth moves to flat JSON catalogs in `src/lib/locales/`.
+
+- `src/lib/locales/en.json` is the canonical source catalog.
+- Additional locale files use one JSON file per locale code (for example `zh-CN.json`, `fr-FR.json`).
+- `src/lib/i18n.ts` keeps fallback, interpolation, locale resolution, and props-down locale wiring, but it now loads locale catalogs from JSON files instead of TypeScript objects.
+- Lara CLI configuration lives in `lara.yaml`, and translation runs happen through repo scripts (`pnpm l10n:translate`, `pnpm l10n:translate:force`).
+- `scripts/validate-locales.mjs` verifies that every locale catalog present in the repo matches the English keyset and only contains flat string values.
+- Legacy stored preferences such as `zh-Hans` are normalized to the canonical `zh-CN` locale.
+
+## Alternatives considered
+
+- **Keep TypeScript dictionaries and point Lara at `.ts` files**: possible, but JSON is the more standard interchange format for translation tooling and keeps diffs simpler for translators and reviewers.
+- **Adopt a full frontend i18n framework now**: rejected because Tolaria already has working locale propagation and fallback behavior, and the immediate need is better content management plus translation automation.
+- **Store translated strings outside the app repo**: rejected because Tolaria's chrome localization should stay versioned with the app code that consumes it.
+
+## Consequences
+
+- Translators and automation tools now work against plain JSON catalogs instead of editing source code.
+- The runtime keeps English fallback behavior, so a missing locale file or missing key does not break app chrome.
+- Locale additions become a data/config change first: add the locale metadata, run Lara, review JSON output, then ship.
+- Localization work now has a dedicated validation step that can run in CI or before commit.

docs/adr/0088-markdown-durable-mermaid-diagrams.md

@@ -0,0 +1,40 @@
+---
+type: ADR
+id: "0088"
+title: "Markdown-durable Mermaid diagrams in notes"
+status: active
+date: 2026-04-27
+---
+
+## Context
+
+Tolaria notes are plain Markdown files, while the rich editor uses BlockNote and raw mode uses CodeMirror. Users need fenced `mermaid` blocks to render as diagrams in the note surface without changing the canonical file format or hiding the source from raw editing.
+
+BlockNote can parse fenced code blocks, but a generic highlighted code block does not provide diagram rendering. Rendering Mermaid directly from the Markdown fence also has to preserve the original fence source when notes are saved, copied through raw mode, closed, and reopened.
+
+## Decision
+
+**Tolaria will support Mermaid diagrams through a Markdown placeholder round-trip owned by the editor pipeline and rendered with the `mermaid` package.**
+
+The implementation:
+
+- Converts fenced `mermaid` blocks to temporary placeholders before BlockNote parses Markdown.
+- Replaces placeholders with a `mermaidBlock` schema block that stores both the original fenced source and the diagram body.
+- Renders the block through Mermaid in the rich editor.
+- Serializes `mermaidBlock` nodes back to their stored fenced Markdown before save, raw-mode entry, and editor-position snapshots.
+- Shows the original source as an inline fallback when Mermaid cannot render a diagram.
+
+## Options considered
+
+- **Tolaria-owned placeholder round-trip with Mermaid rendering** (chosen): matches the existing wikilink and math architecture, keeps Markdown as the source of truth, and gives Tolaria explicit control over serialization.
+- **Render all `mermaid` code blocks by overriding the generic code-block renderer**: smaller surface, but it couples diagram behavior to the code-highlighting package and makes exact source preservation harder.
+- **Raw-mode-only Mermaid support**: preserves source but fails the enhanced note reading experience users expect.
+- **Store parsed diagram metadata outside the Markdown body**: enables richer future editing, but violates the files-first model.
+
+## Consequences
+
+- `src/utils/mermaidMarkdown.ts` is the canonical parser/serializer bridge for note diagrams.
+- Rich mode renders diagrams as schema-backed blocks; raw mode remains the direct source editor.
+- Invalid Mermaid source remains visible instead of breaking the editor surface.
+- `mermaid` is now a runtime dependency and should be upgraded deliberately with rendering regression coverage.
+- Future diagram controls, such as copy source or expand, can attach to the same `mermaidBlock` without changing storage.

docs/adr/0089-active-vault-filesystem-watcher.md

@@ -0,0 +1,36 @@
+---
+type: ADR
+id: "0089"
+title: "Active vault filesystem watcher"
+status: active
+date: 2026-04-27
+---
+
+## Context
+
+Tolaria treats the filesystem as the source of truth, but before this decision the running app only noticed external file changes after a manual Reload Vault, a Git pull, or an AI-agent-specific refresh callback. Edits from another editor, terminal commands, another Tolaria window, or a non-pull Git operation could leave React state and the editor surface stale.
+
+ADR-0071 already defines the safe reconciliation policy for external vault mutations: reload vault-derived state, protect unsaved local edits, and reopen the clean active note from disk when needed. Filesystem watching needed to reuse that policy instead of adding another ad hoc reload path.
+
+## Decision
+
+**Tolaria watches the active desktop vault with a native filesystem watcher and routes external change batches through the shared external-refresh reconciler.**
+
+The desktop backend exposes `start_vault_watcher` and `stop_vault_watcher` commands backed by Rust `notify`. It watches the active vault recursively, ignores known non-content churn such as `.git/`, `node_modules/`, temp files, and `.tolaria-rename-txn`, then emits `vault-changed` events with the active vault path and changed paths.
+
+The renderer owns batching and reconciliation. `useVaultWatcher` starts the backend watcher for the active main-window vault, debounces native events into one refresh, filters out recent app-owned saves, and calls `refreshPulledVaultState()`. Manual Reload Vault still uses `reload_vault` directly, but now exposes visible reload feedback.
+
+## Options considered
+
+- **Native active-vault watcher plus shared reconciliation** (chosen): keeps external changes visible without polling and preserves ADR-0071 behavior for clean and unsaved tabs. Cons: adds one native dependency and a long-lived watcher state.
+- **Frontend-only polling**: simpler backend surface, but wastes work on idle vaults and still needs careful active-note reconciliation.
+- **Direct `reloadVault()` on every native event**: easy to implement, but bypasses clean-tab reopen handling and can clobber the user experience around unsaved edits.
+- **Watch every configured vault**: could pre-warm state, but burns resources for inactive vaults and complicates event ownership across windows.
+
+## Consequences
+
+- External writes converge automatically into the visible vault state after a short debounce.
+- Active clean notes are refreshed through the same path as pull and AI-agent updates; unsaved local edits remain protected.
+- Tolaria app-owned saves are suppressed briefly so autosave does not trigger a full external refresh loop.
+- The status bar can show reload progress for manual and automatic refreshes.
+- The watcher is a desktop-only integration; mobile builds keep no-op command stubs until a mobile-specific filesystem strategy exists.

docs/adr/0090-pi-cli-agent-adapter.md

@@ -0,0 +1,35 @@
+---
+type: ADR
+id: "0090"
+title: "Pi CLI agent adapter"
+status: active
+date: 2026-04-28
+---
+
+## Context
+
+Tolaria already supports Claude Code, Codex, and OpenCode as local CLI agents in the AI panel. The next provider request is Pi Coding Agent support with the same first-class availability, settings, status, streaming, and MCP vault access.
+
+Pi exposes non-interactive JSON events through `pi --mode json`, but Pi core intentionally does not include built-in MCP. Its supported MCP path is the `pi-mcp-adapter` extension, which reads MCP server definitions from Pi-compatible config files.
+
+## Decision
+
+Tolaria adds Pi as a supported CLI agent id (`pi`) and launches app-managed Pi sessions through a dedicated adapter module.
+
+The adapter runs `pi --mode json --no-session` from the active vault cwd, closes stdin, and points `PI_CODING_AGENT_DIR` at a temporary directory containing Tolaria's `mcp.json`. That config loads the Tolaria MCP server through `pi-mcp-adapter`, pins `VAULT_PATH` to the selected vault, sets `WS_UI_PORT=9711`, uses lazy server lifecycle, and exposes the small Tolaria tool set directly.
+
+Pi availability follows the existing desktop pattern: check the inherited `PATH`, the user's login shell, and common local/toolchain install locations. Pi authentication remains owned by the Pi CLI; Tolaria only surfaces setup errors and does not store provider API keys.
+
+## Options Considered
+
+- **Transient Pi adapter config** (chosen): gives app-launched Pi sessions Tolaria MCP access without mutating user or vault config files. Cons: requires the Pi MCP adapter extension path to be available to Pi.
+- **Write `.mcp.json` into the active vault**: simple for Pi discovery, but creates project files as a side effect of a chat session and can dirty user vaults.
+- **Rely on global `~/.pi/agent/mcp.json`**: matches Pi documentation, but silently retargets or depends on user-global state and conflicts with Tolaria's explicit integration boundary.
+- **Skip MCP for Pi**: easier to implement, but creates a weaker agent than the existing providers and violates the requirement for first-class MCP support.
+
+## Consequences
+
+- The AI panel, settings, command palette, status bar, onboarding, and stream normalization now treat Pi as a first-class supported agent.
+- App-launched Pi sessions can use Tolaria vault MCP tools while remaining scoped to the selected vault.
+- Pi support stays isolated in Pi-specific modules instead of expanding the shared `ai_agents.rs` hotspot.
+- Users still need Pi itself, a configured Pi model/provider, and the Pi MCP adapter extension path available to the Pi CLI.

docs/adr/README.md

@@ -89,7 +89,7 @@ proposed → active → superseded
 | [0031](0031-full-app-for-note-windows.md) | Full App instance for secondary note windows | active |
 | [0032](0032-status-bar-for-git-actions.md) | Git actions (Changes, Pulse, Commit) in status bar, not sidebar | active |
 | [0033](0033-subfolder-scanning-and-folder-tree.md) | Subfolder scanning and folder tree navigation | active |
-| [0034](0034-git-repo-required-for-vault.md) | Git repo required — blocking modal enforces vault prerequisite | active |
+| [0034](0034-git-repo-required-for-vault.md) | Git repo required — blocking modal enforces vault prerequisite | superseded → [0085](0085-non-git-vault-support.md) |
 | [0035](0035-path-suffix-wikilink-resolution.md) | Path-suffix wikilink resolution for subfolder vaults | active |
 | [0036](0036-external-rename-detection-via-git-diff.md) | External rename detection via git diff on focus regain | active |
 | [0037](0037-codemirror-language-markdown-highlighting.md) | Language-based markdown syntax highlighting in raw editor | active |
@@ -135,5 +135,10 @@ proposed → active → superseded
 | [0077](0077-concurrent-safe-vault-cache-replacement.md) | Concurrent-safe vault cache replacement | active |
 | [0078](0078-scoped-unsigned-fallback-for-app-managed-git-commits.md) | Scoped unsigned fallback for app-managed git commits | active |
 | [0079](0079-linux-window-chrome-and-menu-reuse.md) | Linux window chrome and menu reuse | active |
-| [0080](0080-cross-platform-desktop-release-artifacts-and-portable-vault-names.md) | Cross-platform desktop release artifacts and portable vault names | active |
+| [0080](0080-cross-platform-desktop-release-artifacts-and-portable-vault-names.md) | Cross-platform desktop release artifacts and portable vault names | superseded → [0083](0083-dual-architecture-macos-release-artifacts.md) |
 | [0081](0081-internal-light-dark-theme-runtime.md) | Internal light and dark theme runtime | active |
+| [0082](0082-markdown-durable-math-notes.md) | Markdown-durable math in notes | active |
+| [0083](0083-dual-architecture-macos-release-artifacts.md) | Dual-architecture macOS release artifacts | active |
+| [0085](0085-non-git-vault-support.md) | Non-git vaults open with explicit later Git initialization | active |
+| [0088](0088-markdown-durable-mermaid-diagrams.md) | Markdown-durable Mermaid diagrams in notes | active |
+| [0089](0089-active-vault-filesystem-watcher.md) | Active vault filesystem watcher | active |

lara.lock

@@ -0,0 +1,406 @@
+version: 1.1.0
+files:
+  e6ab9bf36c30b9d72bc97897e0d89a16:
+    command.noMatches: a2a97d96e196148e04c51c47d985e327
+    command.palettePlaceholder: 6d6b61b4c08ed382ad7ba406a9ba395d
+    command.footerNavigate: e3808db59d29bcfc91532d6539c4f9ae
+    command.footerSelect: 6d73339906ed42e20f6be91bf7f5f4a9
+    command.footerClose: dcf77460e548fe215ef28583f092a496
+    command.footerSend: 6b19fc9694fd8b7b3f1aafaca83db864
+    command.aiMode: 7197e3c5f9afd24022377176611f35cb
+    command.openSettings: 638c05f4f159a403e04aebe94b46a2a8
+    command.openSettings.keywords: ab6b5e03395f4db955ed9cbfd4de33b7
+    command.openLanguageSettings: e5a425aa6222fab3df66c0e1e0ca4183
+    command.openLanguageSettings.keywords: 68efcb7e847b1a9d472baa609824be80
+    command.useSystemLanguage: b7f0315c47d4a59faa2a49571fcf1fca
+    command.openH1Setting: 05b4f6edc0e98b29670e8ee902cdb9bf
+    command.contribute: 9887a4451812854f0f1b6f669a874307
+    command.checkUpdates: f77f38f684c8b974dd4a56bb321cfd5f
+    command.group.navigation: 846495f9ceed11accf8879f555936a7d
+    command.group.note: 3b0649c72650c313a357338dcdfb64ec
+    command.group.git: 0bcc70105ad279503e31fe7b3f47b665
+    command.group.view: 4351cfebe4b61d8aa5efa1d020710005
+    command.group.settings: f4f70727dc34561dfde1a3c529b6205c
+    command.navigation.searchNotes: d8002e888293774162e43b263658cbb5
+    command.navigation.goAllNotes: 7030dcbbb85b6f01d3c8b2fdcb6a5cff
+    command.navigation.goArchived: b620b8cb8fef8a287b986ff83a992a2a
+    command.navigation.goChanges: c6dd094ce55f8a765b68cef40a1c6bd9
+    command.navigation.goHistory: 39b86b661267053a240ffe89b9eca847
+    command.navigation.goBack: 4f2f5e1d6e2a13469ad431474a68ab82
+    command.navigation.goForward: d13c318438f67d749cfc0904e3fafcda
+    command.navigation.goInbox: 522af71c26bc7e3ce1dae6204c2fbe9f
+    command.navigation.renameFolder: a3d3b0f787c52a984af61085c577bff2
+    command.navigation.deleteFolder: 991e322cd8225c369a963bb60b0a9688
+    command.navigation.showOpenNotes: bd1905c340d0518187865f4a6694e14d
+    command.navigation.showArchivedNotes: 241399b908884adfe8608a3ab827ca74
+    command.navigation.listType: 4f70c27c6826a37543c8ada561397c22
+    command.note.newNote: 23c4edda8b815f750782f01870d27271
+    command.note.newType: adce5108f18945cc502a06c02445e32d
+    command.note.newTypedNote: 1493eda772c2179cb6247169d00723b2
+    command.note.saveNote: 2a309cda46e95b00d2a5a8afb3cc0047
+    command.note.findInNote: f72f8f93d8e6119d5d08b60eb3a7b3bc
+    command.note.replaceInNote: b008e2e20c5e4cd202f4386271d6bed1
+    command.note.deleteNote: 56f727a2ee11d15159f1aa6373314cb6
+    command.note.archiveNote: 6043509fda6dd7f6f167e4108033f8e8
+    command.note.unarchiveNote: 6937fb694d00b11d579c21cd4bf103a2
+    command.note.addFavorite: 782d6b28dce4e5d0b2ac92142c6624ba
+    command.note.removeFavorite: 4f9b5fa08f2ef86fdc5d0ceefc271981
+    command.note.markOrganized: 505ad63357f533fb39e4276a2bfb9496
+    command.note.markUnorganized: 1c62f1bffcb793c63d729096d2794ced
+    command.note.restoreDeleted: d704f8283ca322a9b3713d2ccf9a6cd4
+    command.note.setIcon: 99b81d2663266c53e45e4d9c62c87a29
+    command.note.removeIcon: 4bccbad66025e506b37b4218498b299c
+    command.note.changeType: 4a54ffd47ed1f65ee97f34bfe8c3de14
+    command.note.moveToFolder: 3a0f26c42b9168ad839960d134065905
+    command.note.openNewWindow: 6f67b2857093fa0fd45b1122dff4865d
+    command.git.initialize: 54a57cdc7105db6fb22dca661ce01ad6
+    command.git.commitPush: 8cb5faa4019716f43dd69c41496b1d46
+    command.git.addRemote: 7eef951b3f909340a68dc9811be83e9e
+    command.git.pull: 3988d61f4a4546381f61a4eaf61315b4
+    command.git.resolveConflicts: 871ac36968cfca3d2297a89b28b25dee
+    command.git.viewChanges: b2699edf69d8e1031afce2b2f94e5c8d
+    command.view.editorOnly: 8355e056b32086b9190d639be290dda8
+    command.view.editorNoteList: b9604b1609eb6f581cd9570dca72d3f0
+    command.view.fullLayout: 1cebdf839eee2b1713828731aaa3b507
+    command.view.toggleProperties: 54f12756a363401243d82cbd0466117e
+    command.view.toggleDiff: 148a10ef6f04f897e73289f529ecae86
+    command.view.toggleRaw: 9b622257cd6345ceaf58e42b1410899b
+    command.view.leftLayout: 5046a7166675e2d0175b9da3befdcaca
+    command.view.centerLayout: 3bc6759c005178aae519aa3dd227cb74
+    command.view.toggleAiPanel: 4279cbf31767465f25feff6e7bdd336e
+    command.view.newAiChat: 1b0a886d6e77f628ec96c2d71cdb0a9b
+    command.view.toggleBacklinks: b3c4be2d2c07bb8df181355a2c3658a7
+    command.view.zoomIn: ae4a8e406b707636392b6673fca0e6a6
+    command.view.zoomOut: 97326f8cd9df886a6b19af180fb7dcc9
+    command.view.resetZoom: 193ee8c32391fc5cc303a51617cfd046
+    command.settings.createEmptyVault: d7c9673bb6c62a2b8aef009546ce8b23
+    command.settings.openVault: c40e74822da9417fdf52eb4a37bb23f2
+    command.settings.removeVault: 390e2b2031cde0dd18381efee0923bea
+    command.settings.restoreGettingStarted: b3358dc1c7b873b2a02ac6f05473fe4d
+    command.settings.manageExternalAi: c36b9bd171f11a18a1e624365d2b57ac
+    command.settings.setupExternalAi: 24eea679eb699763daa2e3f2a67fcf9a
+    command.settings.reloadVault: f6e506dad6b6cf2be24d9438d458ae54
+    command.settings.repairVault: cee560b1fd5ad9d1ff1c19a0a2afe77a
+    command.ai.openAgents: 612abe804edd0f5ae228a534f77f3d23
+    command.ai.restoreGuidance: 23331fecc692d11d85cf24838ed273f2
+    command.ai.switchToAgent: 5bb02187e653b360ab7ed661403271f2
+    command.ai.switchDefault: 42724de254240d598fbcc40fdb5b18a3
+    command.ai.switchDefaultWithAgent: d405f7914bb1cd86172f108f3c33d953
+    settings.title: f4f70727dc34561dfde1a3c529b6205c
+    settings.close: 7812b3644f897c5d3efb0dd63440e751
+    settings.sync.title: 36f62a237420dcdc7096ad3a9018c4d9
+    settings.sync.description: 06a6957c40867be2c28783183dc1bf5f
+    settings.pullInterval: 4f95ca677398604bca241427261ed07b
+    settings.releaseChannel: 2da37055e15a217f18bd403922085c3f
+    settings.releaseStable: fa3aff3c185c6dc7754235f397c2099a
+    settings.releaseAlpha: 6132295fcf5570fb8b0a944ef322a598
+    settings.appearance.title: a1c58e94227389415de133efdf78ea6e
+    settings.appearance.description: ca7b75a4c10ab8a540707e3a96cd3592
+    settings.theme.label: d721757161f7f70c5b0949fdb6ec2c30
+    settings.theme.light: 9914a0ce04a7b7b6a8e39bec55064b82
+    settings.theme.dark: a18366b217ebf811ad1886e4f4f865b2
+    settings.language.title: 4994a8ffeba4ac3140beb89e8d41f174
+    settings.language.description: e2bb9b523067fdc32a494b1d6fd97906
+    settings.language.label: 244c7b77926f077b863c33ff1244e1ec
+    settings.language.system: 41e2252344aa441e925589ddcb762e6d
+    settings.language.summary: edc83f1f48ce29bc80bf2f2f90e24997
+    settings.autogit.title: e59f720605ec1cfa42b3b97d89d7e883
+    settings.autogit.description.enabled: e65bec70ca4d7921be56f84d10836018
+    settings.autogit.description.disabled: 1143ef6ee00614816785e3c6fc299d51
+    settings.autogit.enable: 9b205a4ae0e3ad4e6708155880ce9c75
+    settings.autogit.enableDescription: a7424a8f90c0b7f290a8144d12374554
+    settings.autogit.idleThreshold: 28016cc6fccd951a904ee3020cd733b6
+    settings.autogit.inactiveThreshold: d28cb60d1e70e020ae8d1294e32dd474
+    settings.titles.title: 761443f70a5067ecf015c6fb3fae9cef
+    settings.titles.description: b94aeeca78dd376cc19b9aa019e53f6c
+    settings.titles.autoRename: 5383db8e790ebf5f956d9c59cb4c4f67
+    settings.titles.autoRenameDescription: cc28c28d8817736e658082a2261d9a6e
+    settings.aiAgents.title: 27f08387b26e1ceeb1b60bd9c97e7a47
+    settings.aiAgents.description: a13222e67eb121676ff6dfc7b085f02d
+    settings.aiAgents.default: 6af573559fd05d8c35bc57b41cc78e24
+    settings.aiAgents.installed: 73329564760013a7824ff9d5d1af91ff
+    settings.aiAgents.missing: ea21841da70e6405af19fabc4ff8bdd9
+    settings.aiAgents.ready: 909a648c713be25fcd050725d0a41e37
+    settings.aiAgents.notInstalled: 0ac3f76ef78bfdbab6331731ee56ba22
+    settings.workflow.title: 24f47cdbe9ddba774a7cc53e51d9032e
+    settings.workflow.description: aa9a07539b87cf407c3edc8a22732d45
+    settings.workflow.explicit: 54a5b5c27937d25271c3127d093e8361
+    settings.workflow.explicitDescription: ce523427b5dd0f9895f63d1fbb90ad24
+    settings.workflow.autoAdvance: 9ed337f5bc61603d19a1ef35f3a3a243
+    settings.workflow.autoAdvanceDescription: ae58ad8abf03df7cbdae8c3a725258f7
+    settings.privacy.title: 0dd6c14e00cc9f45a68c1bca88d1317d
+    settings.privacy.description: 33d53059be620b58e38b8e5c5ab26b27
+    settings.privacy.crashReporting: b4efc5b61526566d431e99242f5c21b4
+    settings.privacy.crashReportingDescription: e9d7c7efce44adc08d0460be1aad5c42
+    settings.privacy.analytics: 29d55bb222ea76e1a17396375dfab228
+    settings.privacy.analyticsDescription: a0f8b61d555d6d3fd279de2f47aaca76
+    settings.footerShortcut: 7dc840d6b0ef9f422a663ba41975871e
+    settings.cancel: ea4788705e6873b424c65e91c2846b19
+    settings.save: c9cc8cce247e49bae79f15173ce97354
+    common.cancel: ea4788705e6873b424c65e91c2846b19
+    locale.en: 78463a384a5aa4fad5fa73e2f506ecfc
+    sidebar.nav.inbox: 3882d32c66e7e768145ecd8f104b0c08
+    sidebar.nav.allNotes: cd76cf851b08a9d2feafaf255bc1f4d5
+    sidebar.nav.archive: e727b00944f81e1d0a95c12886ac4641
+    sidebar.group.favorites: 953bf4d5e8a1807c15dec4e255384b1d
+    sidebar.group.views: 8f56a72923a6ca8ff53462533d89e567
+    sidebar.group.types: 6b20155008db90cf7589c07baa7334e9
+    sidebar.group.folders: d86e2756f698bea5aac3e2276639f042
+    sidebar.action.createView: ba019414ea8c7fcdb4a83a70ec1bb639
+    sidebar.action.editView: acdf34bd08b0692b906d446e590b1eb9
+    sidebar.action.deleteView: c8f4f9cd8ff820f955474e5c9f70ff39
+    sidebar.action.customizeSections: 050a134cad1e9c6f04abe5d635592703
+    sidebar.action.renameSection: 8936914051df04e7550d0eeb4a31e0e0
+    sidebar.action.customizeIconColor: 9a2f685c74d261ab483ef00dee5314fe
+    sidebar.action.createType: 6cfb8b8aa3fdce38e675819691b48f5c
+    sidebar.action.collapse: 00873bdddd457791609bff1243c40a6b
+    sidebar.action.expand: 8f98e9696f6eed958573012f52710faa
+    sidebar.action.createFolder: 5dc1e97c14fbe72d8b566ce29c39f010
+    sidebar.action.renameFolder: db76034f8218cda07dadb746a5643019
+    sidebar.action.deleteFolder: 2a2f15300f6f7c81d69860ac1796b517
+    sidebar.action.revealFolderMenu: 76f4ed52da9937ae432dcf5a108fabb4
+    sidebar.action.copyFolderPathMenu: 1779ec6018a385912c1a5499a1bbf2b2
+    sidebar.action.renameFolderMenu: deb1d8fa030292e7eda2c244b313aca2
+    sidebar.action.deleteFolderMenu: c78c889ac7396dc148fc859c9221e545
+    sidebar.folder.name: 710417c4e57a6a01500fe4c0c448ce3d
+    sidebar.folder.newName: e0ad5b2db20359a85de80c1231323bea
+    sidebar.folder.expand: b7545cb143816942ff096d890090fb6f
+    sidebar.folder.collapse: e9f8c6da708219313d72d99cc3998388
+    sidebar.section.name: c3642037e309db278bbbfe0590114c02
+    sidebar.section.showInSidebar: e38d073926d6fb3dfc4d4347708e3cf5
+    sidebar.section.toggle: 2992ffbc76e607a2dc0e99781f101637
+    sidebar.disabled.comingSoon: 81151a1669ebd695e837f304a0d8ec79
+    noteList.title.archive: e727b00944f81e1d0a95c12886ac4641
+    noteList.title.changes: c112bb3542e98308d12d5ecb10a67abc
+    noteList.title.inbox: 3882d32c66e7e768145ecd8f104b0c08
+    noteList.title.history: 16d2b386b2034b9488996466aaae0b57
+    noteList.title.view: 4351cfebe4b61d8aa5efa1d020710005
+    noteList.title.notes: f4c6f851b00d5518bf888815de279aba
+    noteList.searchPlaceholder: 4857cd2689a0a40eb4a77cdc745c518e
+    noteList.searchAction: 5012120fc480c67686dd22ee2f9493cd
+    noteList.createNote: f1484bc40bd3fe3430c13fb89e2ce1af
+    noteList.empty.changesError: 4fca500c4b70f61f7d9413c57c34bdc4
+    noteList.empty.noChanges: ad82ac153532f5625760c29c176c5d5f
+    noteList.empty.noArchived: 75fa9e2aaa902f65d433be856a2e8331
+    noteList.empty.noMatching: 22838e3b8d3d174d33d7986ab6bdd693
+    noteList.empty.allOrganized: ea8fbb54d21c03fae1469635e7043b9b
+    noteList.empty.noNotes: 910bd677fdd52f3e6edb4abc1d03ade8
+    noteList.empty.noMatchingItems: 25cd76c4bbd00b682a45687705b41a14
+    noteList.empty.noRelatedItems: 67eecd103b56ef0e56fd892d379b5a5e
+    noteList.sort.modified: 35e0c8c0b180c95d4e122e55ed62cc64
+    noteList.sort.created: 0eceeb45861f9585dd7a97a3e36f85c6
+    noteList.sort.title: b78a3223503896721cca1303f776159b
+    noteList.sort.status: ec53a8c4f07baed5d8825072c89799be
+    noteList.sort.by: 5cd12b67b005056a94f06368a7645b8e
+    noteList.sort.menu: 62bfadcf958eb6ad238e6c71e312a0ce
+    noteList.sort.ascending: cf3fb1ff52ea1eed3347ac5401ee7f0c
+    noteList.sort.descending: e3cf5ac19407b1a62c6fccaff675a53b
+    noteList.filter.open: c3bf447eabe632720a3aa1a7ce401274
+    noteList.filter.archived: 7d69b3cb4cada18ae61811304f8fbcb5
+    noteList.filter.week: d2ce009594dcc60befa6a4e6cbeb71fc
+    noteList.filter.month: 7cbb885aa1164b390a0bc050a64e1812
+    noteList.filter.all: b1c94ca2fbc3e78fc30069c8d0f01680
+    noteList.properties.customizeColumns: be39bb193d872e11bb21388add6eca23
+    noteList.properties.customizeAllColumns: 0d382ece9a9d08bb9ddf10ed2c88d726
+    noteList.properties.customizeInboxColumns: e7cf53b914ce1079801eeee603875660
+    noteList.properties.customizeViewColumns: a5612e5d2aa2e86941d536a85b27c8b4
+    noteList.properties.showInNoteList: f22a57c5fc14ff477000cc66d837c344
+    noteList.properties.searchPlaceholder: 9c7569eb531ff041b2b7cf4de1e5a619
+    noteList.properties.searchLabel: de1bc9695d5e79a75296abf74dc25056
+    noteList.properties.noMatches: 1627ecc53b9e97c94b2b6b1b93a58721
+    noteList.properties.reorder: c0955c7efaa1ce90d449a23cbc52b553
+    noteList.changes.restoreNote: d6e99303c0e0b7b2abce06fe9214788b
+    noteList.changes.discardChanges: 98313f623bb6f464b9a154eca0b99bf3
+    noteList.changes.restoreDescription: 45e13380b0538e6cbff330f99c260c0a
+    noteList.changes.discardDescription: cd953f51a81e10f8c90135e0106a45d6
+    noteList.changes.thisFile: 976b976e66879a470635bf0f660e81fc
+    noteList.changes.restore: 2bd339d85ee3b33e513359ce781b60cc
+    noteList.changes.discard: d94b42030b9785fd754d5c1754961269
+    noteList.changes.cancel: ea4788705e6873b424c65e91c2846b19
+    editor.empty.selectNote: a71ec7c80aefe49c59f6aba033bf453e
+    editor.empty.shortcuts: 1133fdf3ecef6a09dd9e2a185e1bd4ec
+    editor.raw.label: 7a9754c15264b0604aa31dfea32321ea
+    editor.find.findLabel: 4cfa6c981549e990fe2344e4c805405e
+    editor.find.findPlaceholder: 4cfa6c981549e990fe2344e4c805405e
+    editor.find.replaceLabel: 0ebe6df8a3ac338e0512acc741823fdb
+    editor.find.replacePlaceholder: 0ebe6df8a3ac338e0512acc741823fdb
+    editor.find.matchCount: 29d3cd243c6850f5fbac283e79d6d6a7
+    editor.find.noMatches: 3b470c1f6a10f58c8a8cb6b904577786
+    editor.find.invalidRegex: 9704b2ccc6158864810a313702019d68
+    editor.find.regexMustMatchText: 267728c2e7f2889b39847ee9b9b38891
+    editor.find.previousMatch: afb1b7e6bbdfaa97114e1b519a817f13
+    editor.find.nextMatch: 7f4d218b4f566ea7ff69ab8d912ba7b9
+    editor.find.showReplace: 82c8fdb73dfe8baa1759a36c6c0fb282
+    editor.find.hideReplace: a85baf9735f9acf26aa15b70f2ee55fb
+    editor.find.regex: 7486f19f279f95357c84706dd09ce9da
+    editor.find.matchCase: ba945280b8802ee1a7a50140e2fe94e2
+    editor.find.close: b040fbda901d2135cad53e54e0127071
+    editor.find.replace: 0ebe6df8a3ac338e0512acc741823fdb
+    editor.find.replaceAll: b1c94ca2fbc3e78fc30069c8d0f01680
+    editor.toolbar.rawReturn: 5ddcf5e0dc8b933b344bb6ca3d8e131d
+    editor.toolbar.rawOpen: 89ad60735a649b60dacd2301cda0c4ec
+    editor.toolbar.centerLayout: 3fabf7e9b285eeec90704d271f1049b7
+    editor.toolbar.leftLayout: acab6c8612816e012ff9f4220a42e485
+    editor.toolbar.removeFavorite: 7188286e36fc6c1892dd53aaa54237fb
+    editor.toolbar.addFavorite: 910885435dbc44a22b68cb45c79e4a7e
+    editor.toolbar.markUnorganized: 83fb1b23a3609fab493737fe7af0a198
+    editor.toolbar.markOrganized: 9d170c916afae3d7a82456838728ffa5
+    editor.toolbar.noDiff: b2c4189f90648aaeb5cd2e81f9bd8d94
+    editor.toolbar.loadingDiff: 430386d6aae3570fd399a133e41c7372
+    editor.toolbar.showDiff: 08d579de8d3abdcdfce0953a797362c6
+    editor.toolbar.openAi: d2e93006570a66709c8ce0dc27082ef1
+    editor.toolbar.closeAi: cd46973ef73076d612dff9903ce54498
+    editor.toolbar.restoreArchived: 1bff5cf4943af64c05b2e9aeadccbc84
+    editor.toolbar.archive: 63dc964c32e715217b49f8739d49636b
+    editor.toolbar.delete: f48134a07b016a1de05d4ba6d2fbfb41
+    editor.toolbar.revealFile: 76f4ed52da9937ae432dcf5a108fabb4
+    editor.toolbar.copyFilePath: 64c6cec5ca57efbb8c9c93ae5fbccd27
+    editor.toolbar.openProperties: 948b90b60b8ce827f179e8c5b85b112e
+    editor.filename.rename: c31c2b468229232ad6287e734fe67d96
+    editor.filename.renameToTitle: bff34a6a2dd1eb87c59403946679237f
+    editor.filename.trigger: 4e9739c2f937c828bbf5d1f935fe7fb9
+    editor.banner.archived: 7d69b3cb4cada18ae61811304f8fbcb5
+    editor.banner.unarchive: 9fd02d2eb5ce348a74372eea202a0aec
+    editor.banner.conflict: 384fc5a4b31c662b1e3426a7ef56441e
+    editor.banner.keepMine: 544a2f2e8e09f93919f10e1920d1b69e
+    editor.banner.keepMineTooltip: 9988cb86b051dd728e2d2f852f0283e4
+    editor.banner.keepTheirs: 46131020af44cc6ec4bfa0a8ff39e044
+    editor.banner.keepTheirsTooltip: 9e5b845c4459747d6ab0df6438ccfac4
+    inspector.title.properties: 9fc2d28c05ed9eb1d75ba4465abf15a9
+    inspector.title.propertiesShortcut: 427d1cbdc813cf54c5fac2508d38d407
+    inspector.title.closePropertiesShortcut: 97b953e45042d4143dd19624dc345d29
+    inspector.empty.noNoteSelected: 046d95682b747a30ed8a7b0b1d581629
+    inspector.empty.noProperties: 6864166e0f65d81b1eb474e41fde8822
+    inspector.empty.initializeProperties: edf249d214b68f5afe8634c577b709c4
+    inspector.empty.invalidProperties: 2ee2429c1ffbabcda9f57f91fb6c0b9d
+    inspector.empty.fixInEditor: b86d4934630d68bc5333c0feb25e5f3f
+    inspector.properties.addProperty: 9820ade036bf1bdf80c0b7da24a4ce0a
+    inspector.properties.deleteProperty: f1d0ab48c8596108e949dfc90e13050b
+    inspector.properties.none: 6adf97f83acf6453d4a6a4b1070f3754
+    inspector.properties.missingType: 9179080e7bcc72408f3de7cb944ff400
+    inspector.properties.missingTypeAria: 582c2c46117cff0534d13e7c8a45a3ba
+    inspector.properties.searchTypes: 84c8d94846183a79444bf36667e8d7ea
+    inspector.properties.noMatchingTypes: 9b64c31214171ba3b2d591743990b840
+    inspector.properties.yes: 93cba07454f06a4a960172bbd6e2a435
+    inspector.properties.no: bafd7322c6e97d25b6299b5d6fe8920b
+    inspector.properties.pickDate: e8e91fbba934dc8adfd7e433f5193911
+    inspector.properties.valuePlaceholder: 689202409e48743b914713f96d93947c
+    inspector.properties.propertyName: 7e9982311d69d66d38809e5d85377a08
+    inspector.relationship.add: ec211f7c20af43e742bf2570c3cb84f9
+    inspector.relationship.addRelationship: d2b0cb45dcdbb00ee70db397c36f73ad
+    inspector.relationship.name: 7ed3fccc071d6939eff211b1a6fd9696
+    inspector.relationship.noteTitle: f72ea00f174785710f0369b23c53963c
+    inspector.relationship.createAndOpen: 55bb53fea743c584c4024e7439c55bfe
+    inspector.info.title: 4059b0251f66a18cb56f544728796875
+    inspector.info.modified: 35e0c8c0b180c95d4e122e55ed62cc64
+    inspector.info.created: 0eceeb45861f9585dd7a97a3e36f85c6
+    inspector.info.words: 6f15b8d4b7287d60a8ea3d1c5cbadc84
+    inspector.info.size: 6f6cb72d544962fa333e2e34ce64f719
+    update.available: 992477975168b876be8e77ce2975e390
+    update.releaseNotes: 5dd03e8d039863e563e049be198c3fd3
+    update.updateNow: 99b1054c0f320be9f109c877a5efd0b2
+    update.dismiss: c8a59e7135a20b362f9c768b09454fdb
+    update.downloading: 2c7fdcafb08f831420f661810f826549
+    update.readyRestart: 4d7487b02d955a44d599189ec383e469
+    update.restartNow: 2d9c2140c53daf05855033aaceeaa8fd
+    status.update.check: eb1b4bb3667dd670210c7822badc2f1d
+    status.zoom.reset: dbf36ab275e5fbd256590e65aa1ca9a3
+    status.feedback.contribute: 96ab5025e38aef43fdb73c9830795264
+    status.feedback.label: 9887a4451812854f0f1b6f669a874307
+    status.theme.light: 4abf27a209985375949aaa426c7c7f3d
+    status.theme.dark: 541be2a55a52b518b8e510c476c7cc95
+    status.settings.open: bae08226d065231df6f01b08cd681c9b
+    status.build.unknown: d250349dd489bdfeb0cb0750b8b3ff89
+    status.vault.switch: 8a2ad262643c556ff0cfa99497aaa529
+    status.vault.default: 5b70a213f150f01f0776fa9481ef2ddf
+    status.vault.createEmpty: f37c03f236fbf1516222360a936249e8
+    status.vault.openLocal: a367344e0429a12a5cc9a6cecbbfcde5
+    status.vault.cloneGit: a7d0aef7c6237a36e54fd5a26e9c23fe
+    status.vault.cloneGettingStarted: 9953a11a477b441976a626a9acf5d7df
+    status.vault.notFound: 3119b7fa94c96209bca571b7c7ed0b7e
+    status.vault.remove: 7f3b4f76df23626170940dbc55c70728
+    status.remote.noneConfigured: 18a4edd4e8d862ccb343937f45585fb1
+    status.remote.inSync: a56f571b4df55d88fb06e61e343b3c91
+    status.remote.aheadTitle: 1516f4b92671b83c17441b4cddf25a7a
+    status.remote.behindTitle: 55ee20469bc46b7c61e7515fbfdc0b5d
+    status.remote.ahead: 681557ace3a84e15060ffca1623b75e6
+    status.remote.behind: 1825bb12c857a71861280e490e29debd
+    status.remote.add: f292f8ef85219f0acde6b66eb9c9c0f4
+    status.remote.none: ed3f2ebe0d847584fd62fc9e0db2df33
+    status.remote.noneDescription: f47636010c21c88a6f81cc41a962b26c
+    status.sync.syncing: b21888f3f83c224b3451901da243d00a
+    status.sync.conflict: f1d4ac54357cc0932f385d56814ba7e4
+    status.sync.failed: 85b08b086888f8ee2680ddd3398f3574
+    status.sync.pullRequired: 1ea27a2d3048b078a18665b24e8dcd91
+    status.sync.notSynced: d18d6927f7ffe96f72e18b4da12e306b
+    status.sync.justNow: 7b9275ee2786ef410555041b92b36bb3
+    status.sync.minutesAgo: b3ac76d1e2595531940035a8e2e2d13c
+    status.sync.resolveConflicts: b9f44cc5ee01c964f004f16e3a2833ca
+    status.sync.inProgress: 278d2bf6768809fbf6e97e7bb319a7c0
+    status.sync.pullAndPush: e07c084a9e734a54bd079d5327a924e7
+    status.sync.retry: ca43e18d4f930e8a3e6d403f31d30a39
+    status.sync.now: c03fafa3a653240e6104348e1293bb88
+    status.sync.synced: 5befab0dde764b6dd8b24a34dc30afa7
+    status.sync.conflicts: d35cef9595a935771f5e8158f387227b
+    status.sync.error: 902b0d55fddef6f8d651fe1035b7d4bd
+    status.sync.status: 76590d5f9708692e3735891bdca40903
+    status.sync.pull: 718f59718640c6506b3721fbc8bf3a4d
+    status.conflict.count: 46293d20ed2071fb30762b71fdaa5894
+    status.offline.title: 3bf45a7003646cc4f963810b0b7ac0f5
+    status.offline.label: 8d9da4bc0e49a50e09ac9f7e56789d39
+    status.changes.view: 6d60d24d8f475ddaef94bbbc58514b5a
+    status.changes.label: c112bb3542e98308d12d5ecb10a67abc
+    status.commit.local: 6474fe7e2ed525df3da3eb447943bfcd
+    status.commit.push: a4aaf10ef20cf17a982bb5b6dad198e0
+    status.commit.label: 59d5b10c3a447f036d85cb5ce524c96c
+    status.commit.openOnGitHub: 445ad18680a573c2aab062c3273ae16a
+    status.git.disabledTooltip: 6981fe5b4993e4b3299c774b185ecd70
+    status.git.disabled: 7f822b0ee91b8922b0c41723da867bd1
+    status.history.onlyGit: 7da5397c33ada1b73a81c5a449cbab16
+    status.history.open: 802ec1fd97592612c19ebef7bebbb5c2
+    status.history.label: 16d2b386b2034b9488996466aaae0b57
+    status.mcp.notConnected: 7e8850f4a564088ced4f592996a39309
+    status.mcp.unknown: 051ff29ff900592f75974d0ef554c2eb
+    status.claude.missing: 89021856e6152467f54ed33faed55e2f
+    status.claude.label: 38c66b824d5769e42c3866005296525b
+    status.claude.install: 1f4688bc2a2acc268811c9edcec810a1
+    status.ai.noAgents: 0876a176a6297e79366d0a2935851f81
+    status.ai.noAgentsTooltip: 1bdc02ec2dd7f9701b4371ffd5770318
+    status.ai.selectedMissing: a37f3dbc73725219e90d709fe0d3ad97
+    status.ai.defaultAgent: 79650d57d1678e56c75dbbcba6ea87f7
+    status.ai.restoreDetails: 47a913b58ce40add6521bc93e807476f
+    status.ai.withGuidance: 1eafd34810db6bba54dac7aa549b5182
+    status.ai.active: 059e3a3167c2ab00f4ca872e82a48d98
+    status.ai.unavailable: 0d3e6e3afef545710aa24ed2ea4990af
+    status.ai.install: 349838fb1d851d3e2014b9fe39203275
+    status.ai.installAgent: 78ac3395d977f8b86ca9a02f781f4af8
+    status.ai.vaultGuidance: 7bb4644efe6ae7cec9993c8bd85f1519
+    status.ai.restoreGuidance: 23331fecc692d11d85cf24838ed273f2
+    status.ai.openOptions: d387b1ab67586c7a2d83db8900a4dd8e
+    pulse.title: 16d2b386b2034b9488996466aaae0b57
+    pulse.today: 1dd1c5fb7f25cd41b291d43a89e3aefd
+    pulse.yesterday: ebfe9ce86e6e9fb953aa7a25b59c1956
+    pulse.commitCount: 17dc5f11868c946f55ff8164d318856d
+    pulse.commitSingular: fffca4d67ea0a788813031b8bbc3b329
+    pulse.commitPlural: a90814b38bbdfe717205f6d24183f6a7
+    pulse.openOnGitHub: ddab0146d46f585f2ab36072c92a0048
+    pulse.expandFiles: 53c567ce9f999dd937fc954c39853e81
+    pulse.collapseFiles: 0ae74096d72faf840cd7d35635aa0cf9
+    pulse.noActivity: cfbd8245c849f5f00b495d61ea14dfdf
+    pulse.emptyDescription: b5ee4968b62908444166182fe8e593c1
+    pulse.retry: 6327b4e59f58137083214a1fec358855
+    pulse.loadingActivity: 26bf6a6bc2fd8148cd8753542a0ddf86
+    pulse.loading: 5f02f05c744a0f875aebb8625ae1486f
+    pulse.loadError: 63c17996fe219e6bd33b27d2b7ce0c96
+    command.switchLanguage: 60f1a6760c7d1da0b1f7f6d0529608ee
+    locale.itIT: 4be8e06d27bca7e1828f2fa9a49ca985
+    locale.frFR: ad225f707802ba118c22987186dd38e8
+    locale.deDE: 86bc3115eb4e9873ac96904a4a68e19e
+    locale.ruRU: deba6920e70615401385fe1fb5a379ec
+    locale.esES: cdbe021be1976335ab583a845edf7ed6
+    locale.ptBR: 26d5352ead4a731f3d11eb2e85d0e297
+    locale.ptPT: 71bfc0d79772120b52c1c0782450ff84
+    locale.es419: edbf64ac382b82a54795fb409beb54be
+    locale.zhCN: 1e81fc32fea0e9f3a978661e4b5e484d
+    locale.jaJP: f32ced6a9ba164c4b3c047fd1d7c882e
+    locale.koKR: d0bdb3cde477d82e766da05ebda50ccb

lara.yaml

@@ -0,0 +1,30 @@
+version: "1.0.0"
+
+project:
+  instruction: >
+    Tolaria is a desktop knowledge-management app. Keep product names, CLI names,
+    markdown wikilinks, frontmatter keys, file paths, and placeholders like
+    {agent}, {zoom}, {language}, {name}, {label}, {file}, and {count} unchanged.
+
+locales:
+  source: en
+  target:
+    - it-IT
+    - fr-FR
+    - de-DE
+    - ru-RU
+    - es-ES
+    - pt-BR
+    - pt-PT
+    - es-419
+    - zh-CN
+    - ja-JP
+    - ko-KR
+
+files:
+  json:
+    include:
+      - "src/lib/locales/[locale].json"
+    exclude: []
+    lockedKeys: []
+    ignoredKeys: []

mcp-server/index.js

@@ -21,8 +21,9 @@ import {
 } from '@modelcontextprotocol/sdk/types.js'
 import WebSocket from 'ws'
 import { searchNotes, getNote, vaultContext } from './vault.js'
+import { requireVaultPath } from './vault-path.js'
 
-const VAULT_PATH = process.env.VAULT_PATH || process.env.HOME + '/Laputa'
+const VAULT_PATH = requireVaultPath()
 const WS_UI_PORT = parseInt(process.env.WS_UI_PORT || '9711', 10)
 const WS_UI_URL = `ws://localhost:${WS_UI_PORT}`
 

mcp-server/test.js

@@ -6,6 +6,7 @@ import os from 'node:os'
 import {
   findMarkdownFiles, getNote, searchNotes, vaultContext,
 } from './vault.js'
+import { requireVaultPath } from './vault-path.js'
 import { evaluateBridgeRequest } from './ws-bridge.js'
 
 let tmpDir
@@ -191,6 +192,22 @@ describe('evaluateBridgeRequest', () => {
   })
 })
 
+describe('requireVaultPath', () => {
+  it('returns the explicit configured vault path', () => {
+    assert.equal(
+      requireVaultPath({ VAULT_PATH: '/tmp/Selected Vault' }),
+      '/tmp/Selected Vault',
+    )
+  })
+
+  it('rejects missing vault paths instead of falling back to ~/Laputa', () => {
+    assert.throws(
+      () => requireVaultPath({}),
+      /VAULT_PATH is required/,
+    )
+  })
+})
+
 async function assertRejectsOutsideVault(prefix, resolveNotePath) {
   const outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), prefix))
   const outsideNote = path.join(outsideDir, 'outside.md')

mcp-server/vault-path.js

@@ -0,0 +1,7 @@
+export function requireVaultPath(env = process.env) {
+  const vaultPath = env.VAULT_PATH?.trim()
+  if (!vaultPath) {
+    throw new Error('VAULT_PATH is required. Open a vault in Tolaria before starting MCP tools.')
+  }
+  return vaultPath
+}

mcp-server/ws-bridge.js

@@ -24,8 +24,8 @@ import { WebSocketServer } from 'ws'
 import {
   getNote, searchNotes, vaultContext,
 } from './vault.js'
+import { requireVaultPath } from './vault-path.js'
 
-const VAULT_PATH = process.env.VAULT_PATH || process.env.HOME + '/Laputa'
 const WS_PORT = parseInt(process.env.WS_PORT || '9710', 10)
 const WS_UI_PORT = parseInt(process.env.WS_UI_PORT || '9711', 10)
 const LOOPBACK_HOST = 'localhost'
@@ -37,6 +37,12 @@ const TRUSTED_UI_ORIGINS = new Set([
 
 /** @type {WebSocketServer | null} */
 let uiBridge = null
+let vaultPath = null
+
+function activeVaultPath() {
+  vaultPath ??= requireVaultPath()
+  return vaultPath
+}
 
 function broadcastUiAction(action, payload) {
   if (!uiBridge) return
@@ -48,10 +54,10 @@ function broadcastUiAction(action, payload) {
 
 
 const TOOL_HANDLERS = {
-  open_note: (args) => getNote(VAULT_PATH, args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
-  read_note: (args) => getNote(VAULT_PATH, args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
-  search_notes: (args) => searchNotes(VAULT_PATH, args.query, args.limit),
-  vault_context: () => vaultContext(VAULT_PATH),
+  open_note: (args) => getNote(activeVaultPath(), args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
+  read_note: (args) => getNote(activeVaultPath(), args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
+  search_notes: (args) => searchNotes(activeVaultPath(), args.query, args.limit),
+  vault_context: () => vaultContext(activeVaultPath()),
   ui_open_note: (args) => { broadcastUiAction('vault_changed', { path: args.path }); broadcastUiAction('open_note', { path: args.path }); return { ok: true } },
   ui_open_tab: (args) => { broadcastUiAction('vault_changed', { path: args.path }); broadcastUiAction('open_tab', { path: args.path }); return { ok: true } },
   ui_highlight: (args) => { broadcastUiAction('highlight', { element: args.element, path: args.path }); return { ok: true } },
@@ -164,6 +170,7 @@ export function startUiBridge(port = WS_UI_PORT) {
 }
 
 export function startBridge(port = WS_PORT) {
+  const currentVaultPath = activeVaultPath()
   const wss = new WebSocketServer({
     port,
     host: LOOPBACK_HOST,
@@ -171,7 +178,7 @@ export function startBridge(port = WS_PORT) {
   })
 
   wss.on('connection', (ws) => {
-    console.error(`[ws-bridge] Client connected (vault: ${VAULT_PATH})`)
+    console.error(`[ws-bridge] Client connected (vault: ${currentVaultPath})`)
 
     ws.on('message', async (raw) => {
       try {
@@ -192,5 +199,11 @@ export function startBridge(port = WS_PORT) {
 // Run directly if invoked as main module
 const isMain = process.argv[1]?.endsWith('ws-bridge.js')
 if (isMain) {
-  startUiBridge().then(() => startBridge())
+  try {
+    activeVaultPath()
+    startUiBridge().then(() => startBridge())
+  } catch (err) {
+    console.error(`[ws-bridge] ${err.message}`)
+    process.exit(1)
+  }
 }

package.json

@@ -8,13 +8,19 @@
     "dev": "vite",
     "build": "tsc -b && vite build",
     "bundle-mcp": "node scripts/bundle-mcp-server.mjs",
+    "docs:dev": "vitepress dev site --host 127.0.0.1",
+    "docs:build": "vitepress build site",
+    "docs:preview": "vitepress preview site --host 127.0.0.1",
     "lint": "eslint .",
+    "l10n:translate": "lara-cli translate",
+    "l10n:translate:force": "lara-cli translate --force",
+    "l10n:validate": "node scripts/validate-locales.mjs",
     "preview": "vite preview",
     "tauri": "tauri",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:e2e": "playwright test",
-    "playwright:smoke": "playwright test --config playwright.smoke.config.ts tests/smoke/example.spec.ts tests/smoke/fix-ai-chat-empty-body-v3.spec.ts tests/smoke/fix-crash-create-note.spec.ts tests/smoke/fresh-start-telemetry-onboarding.spec.ts tests/smoke/getting-started-template.spec.ts tests/smoke/h1-title-decoupled.spec.ts tests/smoke/h1-untitled-auto-rename.spec.ts tests/smoke/keyboard-command-routing.spec.ts tests/smoke/linkify-init-warnings.spec.ts tests/smoke/multi-selection-shortcuts.spec.ts tests/smoke/wikilink-path-fix.spec.ts",
+    "playwright:smoke": "playwright test --config playwright.smoke.config.ts tests/smoke/delete-note-nonblocking.spec.ts tests/smoke/example.spec.ts tests/smoke/fix-ai-chat-empty-body-v3.spec.ts tests/smoke/fix-crash-create-note.spec.ts tests/smoke/fresh-start-telemetry-onboarding.spec.ts tests/smoke/getting-started-template.spec.ts tests/smoke/h1-title-decoupled.spec.ts tests/smoke/h1-untitled-auto-rename.spec.ts tests/smoke/keyboard-command-routing.spec.ts tests/smoke/linkify-init-warnings.spec.ts tests/smoke/multi-selection-shortcuts.spec.ts tests/smoke/wikilink-path-fix.spec.ts",
     "playwright:regression": "playwright test tests/smoke/",
     "playwright:integration": "playwright test --config playwright.integration.config.ts",
     "test:coverage": "node scripts/run-vitest-coverage.mjs",
@@ -57,6 +63,7 @@
     "date-fns": "^4.1.0",
     "katex": "^0.16.28",
     "lucide-react": "^0.564.0",
+    "mermaid": "^11.14.0",
     "posthog-js": "^1.363.5",
     "radix-ui": "^1.4.3",
     "react": "^19.2.0",
@@ -77,6 +84,7 @@
     "@tauri-apps/cli": "^2.10.0",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
+    "@translated/lara-cli": "^1.3.2",
     "@types/node": "^24.10.1",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",
@@ -94,6 +102,7 @@
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.48.0",
     "vite": "^7.3.1",
+    "vitepress": "^1.6.4",
     "vitest": "^4.0.18",
     "ws": "^8.19.0"
   }

playwright.smoke.config.ts

@@ -30,7 +30,7 @@ export default defineConfig({
   },
   projects: [{ name: 'chromium', use: { browserName: 'chromium' } }],
   webServer: {
-    command: `pnpm dev --host 127.0.0.1 --port ${port} --strictPort`,
+    command: `node scripts/playwright-smoke-server.mjs ${port}`,
     url: baseURL,
     reuseExistingServer,
     timeout: 30_000,

scripts/playwright-smoke-server.mjs

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+import { spawn } from 'node:child_process'
+
+const port = process.argv[2] ?? process.env.PORT ?? '41741'
+
+const child = spawn(
+  'pnpm',
+  ['dev', '--host', '127.0.0.1', '--port', port, '--strictPort'],
+  {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: ['pipe', 'inherit', 'inherit'],
+  },
+)
+
+function forwardSignal(signal) {
+  if (child.killed) return
+  child.kill(signal)
+}
+
+process.on('SIGINT', () => forwardSignal('SIGINT'))
+process.on('SIGTERM', () => forwardSignal('SIGTERM'))
+
+child.on('exit', (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal)
+    return
+  }
+
+  process.exit(code ?? 1)
+})

scripts/validate-locales.mjs

@@ -0,0 +1,111 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const localesDir = path.join(root, 'src/lib/locales')
+const sourcePath = path.join(localesDir, 'en.json')
+
+function readCatalog(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'))
+}
+
+function isFlatObject(value) {
+  if (!value) return false
+  if (typeof value !== 'object') return false
+  return !Array.isArray(value)
+}
+
+function assertFlatStringCatalog(locale, catalog) {
+  if (!isFlatObject(catalog)) {
+    throw new Error(`${locale}: expected a flat object of translation keys`)
+  }
+
+  for (const [key, value] of Object.entries(catalog)) {
+    if (typeof value !== 'string') {
+      throw new Error(`${locale}: key "${key}" must map to a string`)
+    }
+  }
+}
+
+function missingKeys(sourceKeys, localeKeys) {
+  const localeKeySet = new Set(localeKeys)
+  return sourceKeys.filter((key) => !localeKeySet.has(key))
+}
+
+function extraKeys(sourceKeys, localeKeys) {
+  const sourceKeySet = new Set(sourceKeys)
+  return localeKeys.filter((key) => !sourceKeySet.has(key))
+}
+
+function placeholders(value) {
+  return Array.from(value.matchAll(/\{(\w+)\}/g), (match) => match[1]).sort()
+}
+
+function sameValues(left, right) {
+  if (left.length !== right.length) return false
+  return left.every((value, index) => value === right[index])
+}
+
+function formatValues(values) {
+  return values.length === 0 ? 'none' : values.join(', ')
+}
+
+function placeholderIssues(locale, sourceCatalog, catalog) {
+  const issues = []
+
+  for (const [key, sourceValue] of Object.entries(sourceCatalog)) {
+    if (!(key in catalog)) continue
+
+    const sourcePlaceholders = placeholders(sourceValue)
+    const localePlaceholders = placeholders(catalog[key])
+    if (sameValues(sourcePlaceholders, localePlaceholders)) continue
+
+    issues.push(
+      `${locale}: key "${key}" placeholders differ ` +
+        `(expected ${formatValues(sourcePlaceholders)}, found ${formatValues(localePlaceholders)})`,
+    )
+  }
+
+  return issues
+}
+
+const sourceCatalog = readCatalog(sourcePath)
+assertFlatStringCatalog('en', sourceCatalog)
+
+const sourceKeys = Object.keys(sourceCatalog).sort()
+const localeFiles = fs.readdirSync(localesDir).filter((file) => file.endsWith('.json'))
+const issues = []
+
+for (const file of localeFiles) {
+  const locale = file.replace(/\.json$/, '')
+  const filePath = path.join(localesDir, file)
+  const catalog = readCatalog(filePath)
+
+  assertFlatStringCatalog(locale, catalog)
+
+  if (locale === 'en') continue
+
+  const keys = Object.keys(catalog).sort()
+  const missing = missingKeys(sourceKeys, keys)
+  const extra = extraKeys(sourceKeys, keys)
+
+  if (missing.length > 0) {
+    issues.push(`${locale}: missing ${missing.length} key(s)`)
+  }
+  if (extra.length > 0) {
+    issues.push(`${locale}: extra ${extra.length} key(s)`)
+  }
+
+  issues.push(...placeholderIssues(locale, sourceCatalog, catalog))
+}
+
+if (issues.length > 0) {
+  console.error('Locale validation failed:')
+  for (const issue of issues) {
+    console.error(`- ${issue}`)
+  }
+  process.exit(1)
+}
+
+console.log(`Validated ${localeFiles.length} locale catalog(s) against ${sourceKeys.length} English keys.`)

site/.vitepress/config.ts

@@ -0,0 +1,101 @@
+import { defineConfig } from "vitepress";
+
+const base = process.env.VITEPRESS_BASE ?? "/";
+
+export default defineConfig({
+  title: "Tolaria",
+  description:
+    "Tolaria is a local-first Markdown knowledge base with native relationships, Git history, and AI workflows.",
+  base,
+  cleanUrls: true,
+  head: [
+    ["link", { rel: "icon", type: "image/png", href: `${base}landing/favicon.png` }],
+    ["meta", { property: "og:title", content: "Tolaria" }],
+    [
+      "meta",
+      {
+        property: "og:description",
+        content:
+          "A second brain for the AI era. Free forever, local-first, Markdown-based, Git-ready, and AI-friendly.",
+      },
+    ],
+  ],
+  themeConfig: {
+    logo: { src: "/landing/tolaria-icon.png", alt: "Tolaria" },
+    nav: [
+      { text: "Features", link: "/#features" },
+      { text: "Start", link: "/start/install" },
+      { text: "Concepts", link: "/concepts/vaults" },
+      { text: "Guides", link: "/guides/capture-a-note" },
+      { text: "Reference", link: "/reference/supported-platforms" },
+      { text: "Releases", link: "/releases/" },
+    ],
+    search: {
+      provider: "local",
+    },
+    socialLinks: [{ icon: "github", link: "https://github.com/refactoringhq/tolaria" }],
+    sidebar: [
+      {
+        text: "Start Here",
+        items: [
+          { text: "Install Tolaria", link: "/start/install" },
+          { text: "First Launch", link: "/start/first-launch" },
+          { text: "Getting Started Vault", link: "/start/getting-started-vault" },
+          { text: "Open Or Create A Vault", link: "/start/open-or-create-vault" },
+        ],
+      },
+      {
+        text: "Concepts",
+        items: [
+          { text: "Vaults", link: "/concepts/vaults" },
+          { text: "Notes", link: "/concepts/notes" },
+          { text: "Properties", link: "/concepts/properties" },
+          { text: "Types", link: "/concepts/types" },
+          { text: "Relationships", link: "/concepts/relationships" },
+          { text: "Inbox", link: "/concepts/inbox" },
+          { text: "Git", link: "/concepts/git" },
+          { text: "AI", link: "/concepts/ai" },
+        ],
+      },
+      {
+        text: "Guides",
+        items: [
+          { text: "Capture A Note", link: "/guides/capture-a-note" },
+          { text: "Organize The Inbox", link: "/guides/organize-inbox" },
+          { text: "Use Wikilinks", link: "/guides/use-wikilinks" },
+          { text: "Create Types", link: "/guides/create-types" },
+          { text: "Build Custom Views", link: "/guides/build-custom-views" },
+          { text: "Connect A Git Remote", link: "/guides/connect-a-git-remote" },
+          { text: "Commit And Push", link: "/guides/commit-and-push" },
+          { text: "Use The AI Panel", link: "/guides/use-ai-panel" },
+          { text: "Use The Command Palette", link: "/guides/use-command-palette" },
+        ],
+      },
+      {
+        text: "Reference",
+        items: [
+          { text: "Supported Platforms", link: "/reference/supported-platforms" },
+          { text: "File Layout", link: "/reference/file-layout" },
+          { text: "Frontmatter Fields", link: "/reference/frontmatter-fields" },
+          { text: "View Filters", link: "/reference/view-filters" },
+          { text: "Keyboard Shortcuts", link: "/reference/keyboard-shortcuts" },
+          { text: "Docs Maintenance", link: "/reference/docs-maintenance" },
+        ],
+      },
+      {
+        text: "Troubleshooting",
+        items: [
+          { text: "Vault Not Loading", link: "/troubleshooting/vault-not-loading" },
+          { text: "Git Authentication", link: "/troubleshooting/git-auth" },
+          { text: "AI Agent Not Found", link: "/troubleshooting/ai-agent-not-found" },
+          { text: "Sync Conflicts", link: "/troubleshooting/sync-conflicts" },
+        ],
+      },
+    ],
+    footer: {
+      message: "Free and open source. Local-first, Git-first, and Markdown-based.",
+      copyright:
+        "Tolaria is AGPL-3.0-or-later. The Tolaria name and logo remain covered by the project trademark policy.",
+    },
+  },
+});

site/.vitepress/theme/Layout.vue

@@ -0,0 +1,28 @@
+<script setup lang="ts">
+import DefaultTheme from "vitepress/theme";
+import { onBeforeUnmount, onMounted } from "vue";
+import { useData } from "vitepress";
+
+const { frontmatter } = useData();
+
+const scrollClass = "tolaria-scrolled";
+const updateScrollClass = () => {
+  document.documentElement.classList.toggle(scrollClass, window.scrollY > 8);
+};
+
+onMounted(() => {
+  updateScrollClass();
+  window.addEventListener("scroll", updateScrollClass, { passive: true });
+});
+
+onBeforeUnmount(() => {
+  window.removeEventListener("scroll", updateScrollClass);
+  document.documentElement.classList.remove(scrollClass);
+});
+</script>
+
+<template>
+  <div :class="{ 'tolaria-landing-shell': frontmatter.landing }">
+    <DefaultTheme.Layout />
+  </div>
+</template>

site/.vitepress/theme/index.ts

@@ -0,0 +1,12 @@
+import DefaultTheme from "vitepress/theme";
+import LandingHome from "./LandingHome.vue";
+import Layout from "./Layout.vue";
+import "./styles.css";
+
+export default {
+  extends: DefaultTheme,
+  Layout,
+  enhanceApp({ app }) {
+    app.component("LandingHome", LandingHome);
+  },
+};

site/.vitepress/theme/styles.css

@@ -0,0 +1,171 @@
+@font-face {
+  font-family: "RefactoringSans";
+  src: url("./assets/RefactoringSans.otf") format("opentype");
+  font-display: swap;
+  font-style: normal;
+  font-weight: 400 900;
+}
+
+:root {
+  --vp-font-family-base:
+    "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+  --vp-font-family-mono: "SF Mono", "Fira Code", ui-monospace, monospace;
+  --tolaria-font-brand:
+    "RefactoringSans", "Inter", -apple-system, BlinkMacSystemFont, sans-serif;
+  --tolaria-bg: #faf9f5;
+  --tolaria-surface: #ffffff;
+  --tolaria-surface-muted: #f7f6f3;
+  --tolaria-text: #1a1a18;
+  --tolaria-text-secondary: #6b6b60;
+  --tolaria-text-muted: #9b9b90;
+  --tolaria-border: #e5e5e0;
+  --tolaria-blue: #155dff;
+  --tolaria-blue-hover: #4a5ad6;
+  --tolaria-blue-soft: #e8eeff;
+  --vp-c-bg: var(--tolaria-surface);
+  --vp-c-bg-alt: var(--tolaria-surface-muted);
+  --vp-c-bg-elv: var(--tolaria-surface);
+  --vp-c-bg-soft: var(--tolaria-surface-muted);
+  --vp-c-text-1: var(--tolaria-text);
+  --vp-c-text-2: var(--tolaria-text-secondary);
+  --vp-c-text-3: var(--tolaria-text-muted);
+  --vp-c-border: var(--tolaria-border);
+  --vp-c-divider: var(--tolaria-border);
+  --vp-c-brand-1: var(--tolaria-blue);
+  --vp-c-brand-2: var(--tolaria-blue-hover);
+  --vp-c-brand-3: var(--tolaria-blue);
+  --vp-c-brand-soft: var(--tolaria-blue-soft);
+  --vp-button-brand-bg: var(--tolaria-blue);
+  --vp-button-brand-hover-bg: var(--tolaria-blue-hover);
+  --vp-button-brand-border: var(--tolaria-blue);
+  --vp-code-bg: #eeeeea;
+  --vp-code-color: var(--tolaria-text-secondary);
+}
+
+.dark {
+  --vp-c-bg: #1f1e1b;
+  --vp-c-bg-alt: #191814;
+  --vp-c-bg-elv: #23221f;
+  --vp-c-bg-soft: #23221f;
+  --vp-c-text-1: #e6e1d8;
+  --vp-c-text-2: #b8b1a6;
+  --vp-c-text-3: #7f776d;
+  --vp-c-border: #34322d;
+  --vp-c-divider: #34322d;
+  --vp-c-brand-1: #78a4ff;
+  --vp-c-brand-2: #9bbeff;
+  --vp-c-brand-3: #78a4ff;
+  --vp-c-brand-soft: rgba(120, 164, 255, 0.16);
+  --vp-code-bg: #2d2b27;
+  --vp-code-color: #d8d1c6;
+}
+
+.VPNavBarTitle .logo {
+  width: auto;
+  height: 28px;
+}
+
+.VPNavBarTitle .title {
+  color: var(--vp-c-text-1);
+  font-family: var(--tolaria-font-brand);
+  font-size: 22px;
+  font-weight: 800;
+  letter-spacing: 0;
+}
+
+.tolaria-landing-shell {
+  --vp-c-bg: var(--tolaria-bg);
+}
+
+.tolaria-landing-shell .VPNav,
+.tolaria-landing-shell .VPNavBar,
+.tolaria-landing-shell .VPNavBar .content-body {
+  background: color-mix(in srgb, var(--tolaria-bg) 94%, transparent);
+  backdrop-filter: blur(14px);
+}
+
+.tolaria-landing-shell .VPNavBar .divider,
+.tolaria-landing-shell .VPNavBar .divider-line {
+  background-color: transparent;
+}
+
+.tolaria-landing-shell .VPNavBar .divider-line {
+  opacity: 0;
+  transition: opacity 160ms ease;
+}
+
+.tolaria-landing-shell .VPLocalNav {
+  display: none;
+}
+
+.tolaria-scrolled .tolaria-landing-shell .VPNav {
+  box-shadow: 0 10px 24px rgba(26, 26, 24, 0.06);
+}
+
+.tolaria-scrolled .tolaria-landing-shell .VPNavBar .divider-line {
+  opacity: 1;
+}
+
+.DocSearch-Button {
+  border-radius: 999px;
+}
+
+.vp-doc h1,
+.vp-doc h2,
+.vp-doc h3 {
+  letter-spacing: 0;
+}
+
+.vp-doc a,
+.VPNavBarMenuLink.active,
+.VPLink.active {
+  color: var(--vp-c-brand-1);
+}
+
+.vp-doc table {
+  display: table;
+  width: 100%;
+}
+
+.vp-doc th {
+  color: var(--vp-c-text-1);
+  background: var(--vp-c-bg-soft);
+}
+
+.vp-doc td,
+.vp-doc th {
+  border-color: var(--vp-c-divider);
+}
+
+.tolaria-landing-shell .VPContent,
+.tolaria-landing-shell .VPPage,
+.tolaria-landing-shell .VPDoc,
+.tolaria-landing-shell .VPDoc .container,
+.tolaria-landing-shell .VPDoc .content,
+.tolaria-landing-shell .VPDoc .content-container,
+.tolaria-landing-shell .VPDoc .main,
+.tolaria-landing-shell .vp-doc {
+  max-width: none;
+  padding: 0;
+  margin: 0;
+}
+
+.tolaria-landing-shell .VPPage {
+  padding-top: var(--vp-nav-height);
+}
+
+.tolaria-landing-shell .VPDoc {
+  padding-top: var(--vp-nav-height);
+}
+
+.tolaria-landing-shell .vp-doc > div {
+  width: 100%;
+}
+
+.tolaria-landing-shell .vp-doc a {
+  text-decoration: none;
+}
+
+.tolaria-landing-shell .VPFooter {
+  display: none;
+}

site/concepts/ai.md

@@ -0,0 +1,20 @@
+# AI
+
+Tolaria is designed for local AI agents that can work with files and tools rather than a hidden cloud-only notes API.
+
+## Agent Panel
+
+The AI panel streams messages from supported local CLI agents. It shows reasoning, tool activity, and file changes in the app.
+
+## MCP Server
+
+Tolaria exposes an MCP server so tools such as Claude Code and Codex can search, read, and edit vault notes through explicit tools.
+
+## Why Git Matters For AI
+
+AI-generated changes should be inspectable. Git gives you diffs, history, rollback, and a clear boundary between suggestions and committed work.
+
+## Current Direction
+
+Claude Code is the primary integration. Codex and other CLI agents are supported through the shared agent architecture as the app evolves.
+

site/concepts/git.md

@@ -0,0 +1,21 @@
+# Git
+
+Git is Tolaria's history and sync layer. It keeps the model local-first while still supporting remote backup and multi-device workflows.
+
+## What Tolaria Uses Git For
+
+- Local commit history.
+- Diff views.
+- Per-note history.
+- Pull and push.
+- Conflict detection and resolution.
+- Remote connection for local-only vaults.
+
+## Local Commits
+
+You can commit changes inside Tolaria without leaving the app. This gives you useful restore points even before a remote is configured.
+
+## Remotes
+
+Connect a compatible Git remote when you want sync or backup. Tolaria relies on your system Git authentication, so GitHub CLI, SSH keys, credential helpers, and existing Git configuration can continue to work.
+

site/concepts/inbox.md

@@ -0,0 +1,22 @@
+# Inbox
+
+The Inbox is for notes that have been captured but not yet organized.
+
+## Why It Exists
+
+Fast capture should not require perfect structure. The Inbox gives you a place to put incomplete notes, then process them later.
+
+## Organizing Inbox Notes
+
+When reviewing the Inbox:
+
+1. Give the note a clear H1.
+2. Set its `type`.
+3. Add status, dates, or URL if useful.
+4. Add relationships with wikilinks or frontmatter fields.
+5. Move it into a folder only if the folder adds value.
+
+## Healthy Inbox Habit
+
+Keep the Inbox small enough that it can be reviewed in one focused pass. Tolaria works best when capture is fast and organization is deliberate.
+

site/concepts/notes.md

@@ -0,0 +1,31 @@
+# Notes
+
+A note is a Markdown file with optional YAML frontmatter. Tolaria reads the first H1 as the primary title and keeps the file on disk as the durable representation.
+
+## Anatomy
+
+```md
+---
+type: Project
+status: Active
+belongs_to:
+  - "[[workspace]]"
+---
+
+# Launch Documentation
+
+Draft the public Tolaria docs and keep them close to code changes.
+```
+
+## Titles
+
+The first H1 is the main title. Older notes can still use a `title:` frontmatter fallback, but new notes should rely on the H1.
+
+## Body Links
+
+Use `[[wikilinks]]` to connect notes from the body. Tolaria can resolve links by filename, title, and aliases.
+
+## Frontmatter
+
+Use frontmatter for structured fields such as type, status, date, URL, and relationships. Keep free-form thinking in the body.
+

site/concepts/properties.md

@@ -0,0 +1,25 @@
+# Properties
+
+Properties are frontmatter fields that Tolaria can display, filter, and edit.
+
+## Common Properties
+
+| Field | Purpose |
+| --- | --- |
+| `type` | Groups the note into a type such as Project, Person, or Topic. |
+| `status` | Tracks lifecycle state such as Active, Done, or Blocked. |
+| `url` | Stores a canonical external link. |
+| `date` | Represents a single date. |
+| `start_date`, `end_date` | Represents a date range. |
+| `aliases` | Gives a note alternative names for wikilink resolution. |
+
+## System Properties
+
+Fields that start with `_` are system properties. They remain in plain text but are hidden from normal property editing.
+
+Examples include `_icon`, `_color`, `_order`, and `_pinned_properties` on type documents.
+
+## Property Editing
+
+The Inspector is the safest place to edit structured properties. Use raw Markdown mode when you need direct control over YAML.
+

site/concepts/relationships.md

@@ -0,0 +1,27 @@
+# Relationships
+
+Relationships make a vault feel like a graph instead of a pile of documents.
+
+## Relationship Fields
+
+Any frontmatter field containing wikilinks can become a relationship.
+
+```yaml
+belongs_to:
+  - "[[product-work]]"
+related_to:
+  - "[[documentation]]"
+blocked_by:
+  - "[[release-process]]"
+```
+
+Tolaria does not need a hardcoded list of relationship names. It detects relationship fields dynamically.
+
+## Body Links Versus Relationship Fields
+
+Use body links when the relationship appears naturally in writing. Use frontmatter relationships when the connection is important enough to show in navigation, filters, or the Inspector.
+
+## Backlinks
+
+Tolaria can show incoming links and inverse relationships, making it easier to navigate from a note to the rest of its context.
+

site/concepts/types.md

@@ -0,0 +1,38 @@
+# Types
+
+Types describe what kind of thing a note represents: Project, Person, Topic, Procedure, Event, or any category you create.
+
+## Type Field
+
+The `type:` field assigns a note to a type.
+
+```yaml
+type: Project
+```
+
+Tolaria does not infer type from folder location. Moving a file into another folder does not change its type.
+
+## Type Documents
+
+Type documents live in the `type/` folder and describe how a type should appear.
+
+```yaml
+---
+type: Type
+icon: folder
+color: blue
+sidebar_label: Projects
+sort: modified:desc
+---
+
+# Project
+```
+
+## What Types Control
+
+- Sidebar grouping.
+- Type icon and color.
+- Default sort.
+- Pinned properties.
+- New-note templates.
+

site/concepts/vaults.md

@@ -0,0 +1,29 @@
+# Vaults
+
+A vault is the folder Tolaria reads and writes. The filesystem is the source of truth; the app state and cache are derived from files.
+
+## Core Rules
+
+- Notes are Markdown files.
+- YAML frontmatter provides structure.
+- Attachments are normal files inside the vault.
+- Type definitions and saved views are also files.
+- Git tracks history and supports remote sync.
+
+## Why Local Files Matter
+
+Local files keep your notes inspectable. You can open them in another editor, search with command-line tools, back them up with your own system, and version them with Git.
+
+Tolaria should never become the only way to read your data.
+
+## App State Versus Vault State
+
+Vault-level information should travel with the vault. Machine-specific preferences stay with the app installation.
+
+| Vault state | App state |
+| --- | --- |
+| Type icons and colors | Editor zoom |
+| Saved views | Window size |
+| Pinned properties | Recent vault list |
+| Relationship conventions | Local cache |
+

site/download/index.md

@@ -0,0 +1,17 @@
+# Download
+
+Download Tolaria from the latest stable release.
+
+## macOS
+
+[Download the latest stable build](https://refactoringhq.github.io/tolaria/download/)
+
+macOS is the primary supported platform.
+
+## Linux And Windows
+
+Linux and Windows builds are best effort for now. Check the [latest GitHub release](https://github.com/refactoringhq/tolaria/releases/latest) for available artifacts.
+
+## Verify The Version
+
+After launching the app, check the version shown in Tolaria's status bar or release surface.

site/guides/build-custom-views.md

@@ -0,0 +1,20 @@
+# Build Custom Views
+
+Custom views are saved filters for recurring questions.
+
+## Good View Candidates
+
+- Active projects.
+- People without a recent follow-up.
+- Drafts ready for review.
+- Notes changed this week.
+- Events in a date range.
+
+## View Definition
+
+Saved views live as files in the vault. They describe filters, sorting, and visible columns using structured data.
+
+## Design The Question First
+
+Before creating a view, write the question it answers. A good view is not "all fields with all filters"; it is a focused lens.
+

site/guides/capture-a-note.md

@@ -0,0 +1,20 @@
+# Capture A Note
+
+Use capture when you need to get an idea into the vault before you know where it belongs.
+
+## Steps
+
+1. Open the command palette with `Cmd+K` or `Ctrl+K`.
+2. Run `New Note`.
+3. Write a clear H1.
+4. Add the rough content.
+5. Leave structure for later if you are still thinking.
+
+## Capture Well
+
+Prefer a useful title over a perfect taxonomy. You can add type, status, and relationships during inbox review.
+
+## When To Add Structure Immediately
+
+Add structure while capturing if the note is obviously a Project, Person, Event, or Procedure and the context is already known.
+

site/guides/commit-and-push.md

@@ -0,0 +1,19 @@
+# Commit And Push
+
+Tolaria lets you commit and push vault changes from inside the app.
+
+## Commit
+
+1. Open the Git or changes surface.
+2. Review changed files.
+3. Write a short commit message.
+4. Commit locally.
+
+## Push
+
+Push after committing when a remote is configured. If the remote has changed, pull first and resolve any conflicts.
+
+## Use Small Commits
+
+Small commits make it easier to understand what changed, roll back safely, and review AI-generated edits.
+

site/guides/connect-a-git-remote.md

@@ -0,0 +1,23 @@
+# Connect A Git Remote
+
+Connect a remote when you want backup or sync beyond the current machine.
+
+## Before You Start
+
+Make sure the remote repository exists and your system Git can authenticate to it. Tolaria uses system Git rather than storing provider-specific credentials.
+
+## Steps
+
+1. Open the bottom status bar remote chip, or run `Add Remote` from the command palette.
+2. Paste the remote URL.
+3. Confirm the remote name.
+4. Fetch or push according to the app prompt.
+
+## Recommended Auth
+
+- SSH keys.
+- GitHub CLI authentication.
+- Existing Git credential helpers.
+
+If authentication fails, see [Git Authentication](/troubleshooting/git-auth).
+

site/guides/create-types.md

@@ -0,0 +1,27 @@
+# Create Types
+
+Create a type when several notes share the same role in your system.
+
+## Steps
+
+1. Create a note in the `type/` folder.
+2. Set `type: Type` in frontmatter.
+3. Give the document a clear H1.
+4. Add optional icon, color, sort, and sidebar label.
+
+```yaml
+---
+type: Type
+icon: briefcase
+color: blue
+sidebar_label: Projects
+sort: modified:desc
+---
+
+# Project
+```
+
+## Use Types Sparingly
+
+A type should represent a recurring category, not a one-off label. If you only need a temporary grouping, use a saved view or property instead.
+

site/guides/organize-inbox.md

@@ -0,0 +1,26 @@
+# Organize The Inbox
+
+Inbox review turns quick captures into usable knowledge.
+
+## Review Checklist
+
+- Rename unclear notes.
+- Add or correct the first H1.
+- Set `type`.
+- Add `status` for actionable notes.
+- Add `belongs_to`, `related_to`, or other relationship fields when useful.
+- Archive or delete notes that no longer matter.
+
+## Make Notes Navigable
+
+A note is organized when you can answer:
+
+- What kind of thing is this?
+- What is it connected to?
+- What should happen next?
+- Where would I expect to find it later?
+
+## Avoid Over-Structuring
+
+Do not add fields just because they exist. Add the structure that will help future navigation, review, or automation.
+

site/guides/use-ai-panel.md

@@ -0,0 +1,19 @@
+# Use The AI Panel
+
+The AI panel connects Tolaria to local CLI agents.
+
+## Before Using It
+
+Install a supported agent such as Claude Code and make sure it is available from your shell. Tolaria detects common install locations, but explicit shell availability is still the simplest setup.
+
+## Good Requests
+
+- "Find notes related to this project."
+- "Summarize what changed in this note."
+- "Draft a weekly review from these linked notes."
+- "Update this checklist based on the current project status."
+
+## Review Changes
+
+AI edits are file edits. Review them with Tolaria's diff and Git history before committing.
+

site/guides/use-command-palette.md

@@ -0,0 +1,24 @@
+# Use The Command Palette
+
+The command palette is the fastest way to move around Tolaria.
+
+Open it with:
+
+- `Cmd+K` on macOS.
+- `Ctrl+K` on Linux and Windows.
+
+## Common Commands
+
+- New Note.
+- Search.
+- Open Settings.
+- Reload Vault.
+- Add Remote.
+- Open Getting Started Vault.
+- Toggle Raw Mode.
+- Open in New Window.
+
+## Keyboard-First Workflow
+
+Use the palette when you know what you want to do but do not want to hunt through panels. It is also the best place to discover commands as the app grows.
+

site/guides/use-wikilinks.md

@@ -0,0 +1,25 @@
+# Use Wikilinks
+
+Wikilinks connect notes by name.
+
+```md
+This project belongs to [[content-systems]] and is related to [[git-workflows]].
+```
+
+## Link From The Body
+
+Use body links when the connection is part of the sentence you are writing.
+
+## Link From Frontmatter
+
+Use frontmatter links when the relationship should become structured metadata.
+
+```yaml
+related_to:
+  - "[[git-workflows]]"
+```
+
+## Keep Links Stable
+
+Prefer clear note titles and filenames. Use aliases when people or projects are known by multiple names.
+

site/index.md

@@ -0,0 +1,10 @@
+---
+layout: page
+sidebar: false
+aside: false
+landing: true
+title: Tolaria
+description: A second brain for the AI era. Free forever.
+---
+
+<LandingHome />

site/public/tolaria-icon.svg

@@ -0,0 +1,10 @@
+<svg width="266" height="363" viewBox="0 0 266 363" fill="none" xmlns="http://www.w3.org/2000/svg">
+<g clip-path="url(#clip0_111_151)">
+<path fill-rule="evenodd" clip-rule="evenodd" d="M119.524 5.31219C126.607 -1.77073 138.117 -1.77073 145.2 5.31219C178.844 40.7268 265.61 147.856 265.61 230.195C265.61 303.68 206.29 363 132.805 363C59.3195 363 0 303.68 0 230.195C0 147.856 86.7659 40.7268 119.524 5.31219ZM59.5947 242.88C58.1619 234.744 50.3952 229.074 42.2195 230.195C34.0438 231.316 28.5932 238.799 30.0259 246.935C37.6847 290.425 72.2734 325.622 116.094 334.485C117.821 334.836 119.552 334.864 121.178 334.641C127.269 333.806 132.289 329.26 133.371 322.934C134.756 314.893 129.25 307.054 121.086 305.401C89.7767 299.057 65.0615 273.923 59.5947 242.88Z" fill="#155DFF"/>
+</g>
+<defs>
+<clipPath id="clip0_111_151">
+<rect width="266" height="363" fill="white"/>
+</clipPath>
+</defs>
+</svg>

site/reference/docs-maintenance.md

@@ -0,0 +1,38 @@
+# Docs Maintenance
+
+The public docs live in the app repo so documentation changes can ship with behavior changes.
+
+## Update Docs When You Change
+
+- A Tauri command.
+- A new component or hook that changes user behavior.
+- A data model or frontmatter convention.
+- Git, AI, onboarding, or release behavior.
+- Platform support.
+- Keyboard shortcuts.
+
+## Suggested Workflow
+
+1. Make the code change.
+2. Update the matching concept, guide, or reference page.
+3. Add a troubleshooting page if the change creates a new failure mode.
+4. Run `pnpm docs:build`.
+5. Check the home page, search, and changed docs pages in a browser.
+
+## Page Types
+
+| Type | Purpose |
+| --- | --- |
+| Start | Helps a new user get into the app. |
+| Concepts | Explains mental models. |
+| Guides | Teaches workflows. |
+| Reference | Gives stable facts and tables. |
+| Troubleshooting | Starts from a symptom and ends with recovery. |
+
+## Review Checklist
+
+- Does the page describe current behavior?
+- Does it mention macOS primary and Linux/Windows best effort when platform support matters?
+- Are links relative and VitePress-compatible?
+- Can a user discover the page with local search?
+

site/reference/file-layout.md

@@ -0,0 +1,35 @@
+# File Layout
+
+A typical vault stays simple.
+
+```txt
+my-vault/
+  project-alpha.md
+  weekly-review.md
+  people/
+    ada-lovelace.md
+  attachments/
+    diagram.png
+  type/
+    project.md
+    person.md
+  views/
+    active-projects.yml
+```
+
+## Root Notes
+
+Tolaria can work with flat vaults and nested folders. Type is not inferred from folder location; it comes from frontmatter.
+
+## Special Folders
+
+| Folder | Purpose |
+| --- | --- |
+| `type/` | Type definition documents. |
+| `views/` | Saved custom views. |
+| `attachments/` | Images and other attached files. |
+
+## Git Files
+
+If the vault is a Git repository, `.git/` belongs to Git. Tolaria reads Git state but does not treat `.git/` as notes.
+

site/reference/frontmatter-fields.md

@@ -0,0 +1,26 @@
+# Frontmatter Fields
+
+Tolaria uses conventions instead of a required schema.
+
+| Field | Meaning |
+| --- | --- |
+| `type` | The note's entity type. |
+| `status` | Lifecycle state. |
+| `icon` | Per-note icon. |
+| `url` | External URL. |
+| `date` | Single date. |
+| `start_date` | Start of a date range. |
+| `end_date` | End of a date range. |
+| `aliases` | Alternative names for link resolution. |
+| `belongs_to` | Parent relationship. |
+| `related_to` | Lateral relationship. |
+| `has` | Contained relationship. |
+
+## Custom Fields
+
+You can add your own fields. If a field contains wikilinks, Tolaria can treat it as a relationship.
+
+## System Fields
+
+Fields starting with `_` are reserved for system behavior and hidden from standard property editing.
+

site/reference/keyboard-shortcuts.md

@@ -0,0 +1,15 @@
+# Keyboard Shortcuts
+
+| Shortcut | Action |
+| --- | --- |
+| `Cmd+K` / `Ctrl+K` | Open command palette. |
+| `Cmd+N` / `Ctrl+N` | Create a new note. |
+| `Cmd+S` / `Ctrl+S` | Save current note. |
+| `Cmd+[` / `Alt+Left` | Navigate back when available. |
+| `Cmd+]` / `Alt+Right` | Navigate forward when available. |
+| `Cmd+Shift+O` / `Ctrl+Shift+O` | Open current note in a new window. |
+
+Some shortcuts vary by platform because macOS, Linux, and Windows reserve different key combinations.
+
+Use the command palette to discover the current command set.
+

site/reference/supported-platforms.md

@@ -0,0 +1,24 @@
+# Supported Platforms
+
+Tolaria is a desktop app built with Tauri.
+
+| Platform | Current support | Notes |
+| --- | --- | --- |
+| macOS | Primary | Main development and QA target. Apple Silicon is first-class. |
+| Linux | Best effort | Depends on distribution WebKitGTK packaging and desktop integration behavior. |
+| Windows | Best effort | Builds exist, but platform-specific behavior may lag macOS. |
+
+## Support Policy
+
+Primary support means the platform is part of normal development and release validation. Best-effort support means builds may be available, but bugs can take longer to diagnose and fix.
+
+## Reporting Platform Bugs
+
+Include:
+
+- Tolaria version.
+- Operating system and version.
+- CPU architecture.
+- Whether the vault is local-only or connected to a remote.
+- Steps to reproduce.
+

site/reference/view-filters.md

@@ -0,0 +1,26 @@
+# View Filters
+
+View filters define saved lists of notes.
+
+## Common Filter Ideas
+
+| Goal | Filter direction |
+| --- | --- |
+| Active projects | `type` is Project and `status` is Active |
+| Drafts | `type` is Article and `status` is Draft |
+| People follow-up | `type` is Person and date is before today |
+| Recent work | modified date is within a recent range |
+
+## Sorting
+
+Useful sorts include:
+
+- Recently modified first.
+- Title ascending.
+- Status ascending.
+- A custom property ascending or descending.
+
+## Keep Views Focused
+
+A view should answer one recurring question. If it becomes too broad, split it into two views.
+

site/releases/index.md

@@ -0,0 +1,16 @@
+# Releases
+
+Tolaria releases are published on GitHub.
+
+- [Latest release](https://github.com/refactoringhq/tolaria/releases/latest)
+- [All releases](https://github.com/refactoringhq/tolaria/releases)
+- [Download page](/download/)
+
+## Release Channels
+
+Stable builds are intended for normal use. Pre-release builds may contain newer features and rougher edges.
+
+## Before Updating
+
+Commit or push important vault changes before updating the app. Your notes are local files, but having a clean Git state makes recovery easier.
+

site/start/first-launch.md

@@ -0,0 +1,32 @@
+# First Launch
+
+The first launch flow is designed to get you into a real vault quickly without hiding the local-first model.
+
+## What You Choose
+
+Tolaria asks whether you want to:
+
+- Create or clone the Getting Started vault.
+- Open an existing local vault.
+- Create a new empty vault.
+
+The Getting Started vault is cloned locally and then disconnected from its remote. That keeps the sample safe to edit without accidentally pushing tutorial changes.
+
+## What Tolaria Creates
+
+Tolaria stores app-level settings on the local machine. Your notes stay in the vault folder you choose.
+
+| Data | Stored in |
+| --- | --- |
+| Notes and attachments | Your vault folder |
+| Type definitions and saved views | Your vault folder |
+| Window size, zoom, recent vaults | Local app settings |
+| Cache data | Rebuildable local cache |
+
+## First Commands To Try
+
+- `Cmd+K` / `Ctrl+K`: open the command palette.
+- `New Note`: create a note in the current vault.
+- `Open Getting Started Vault`: clone the public sample vault.
+- `Reload Vault`: rescan files after external edits.
+

site/start/getting-started-vault.md

@@ -0,0 +1,24 @@
+# Getting Started Vault
+
+The Getting Started vault is a small public sample vault hosted at [refactoringhq/tolaria-getting-started](https://github.com/refactoringhq/tolaria-getting-started).
+
+It exists to show Tolaria's conventions without requiring you to restructure your own notes first.
+
+## What It Demonstrates
+
+- Markdown notes with YAML frontmatter.
+- Types such as Project, Person, Topic, and Procedure.
+- Wikilinks in note bodies.
+- Relationship fields in frontmatter.
+- A local Git repository that can be connected to a remote later.
+
+## Local-Only By Default
+
+When Tolaria clones the sample, it removes the remote from the local copy. This makes the sample vault disposable. You can edit it freely, commit locally, and delete it later.
+
+To connect a vault to your own remote, use the bottom status bar remote chip or run `Add Remote` from the command palette.
+
+## When To Move On
+
+After you understand the sample, open your own vault. Tolaria does not require a special folder structure: a folder of Markdown files is enough to start.
+

site/start/install.md

@@ -0,0 +1,28 @@
+# Install Tolaria
+
+Tolaria is developed and tested primarily on macOS. Linux and Windows builds are published on a best-effort basis while the app matures.
+
+## Download
+
+Use the latest stable release unless you are intentionally testing pre-release builds:
+
+- [Download the latest stable build](https://refactoringhq.github.io/tolaria/download/)
+- [Browse all GitHub releases](https://github.com/refactoringhq/tolaria/releases)
+- [Read the release notes](/releases/)
+
+## Platform Status
+
+| Platform | Status | Notes |
+| --- | --- | --- |
+| macOS | Primary | Apple Silicon is the first-class desktop target. |
+| Linux | Best effort | Builds exist, but desktop integration varies by distribution and WebKitGTK packaging. |
+| Windows | Best effort | Builds exist, but behavior may lag macOS while the app is still early. |
+
+See [Supported Platforms](/reference/supported-platforms) for the current support policy.
+
+## After Installing
+
+1. Open Tolaria.
+2. Choose the Getting Started vault if you want a guided sample.
+3. Or open an existing folder of Markdown files as a vault.
+4. Use the command palette with `Cmd+K` on macOS or `Ctrl+K` on Linux and Windows.

site/start/open-or-create-vault.md

@@ -0,0 +1,25 @@
+# Open Or Create A Vault
+
+A Tolaria vault is a folder on disk. The folder can contain Markdown notes, attachments, type definitions, saved views, and Git metadata.
+
+## Open An Existing Folder
+
+Choose an existing folder if you already have Markdown notes. Tolaria scans `.md` files and uses frontmatter when it exists.
+
+Good starting points:
+
+- A folder of plain Markdown files.
+- An Obsidian-style vault.
+- A Git repository containing notes.
+- A copy of the Getting Started vault.
+
+## Create A New Vault
+
+Choose a new empty folder if you want Tolaria conventions from the start. New notes are created as Markdown files, and optional type definitions live in the `type/` folder.
+
+## Git Repository Requirement
+
+Tolaria's history and sync features expect the vault to be a Git repository. If a vault is not already a repository, Tolaria can initialize one for you.
+
+Use Git because it gives Tolaria reliable local history, diff views, recovery, and remote sync without a proprietary backend.
+

site/troubleshooting/ai-agent-not-found.md

@@ -0,0 +1,23 @@
+# AI Agent Not Found
+
+Tolaria can only launch local CLI agents that are installed and discoverable.
+
+## Symptoms
+
+- The AI panel says no supported agent is available.
+- Claude Code or another agent works in one shell but not in Tolaria.
+
+## Checks
+
+Open a terminal and run the agent command directly. For Claude Code:
+
+```bash
+claude --version
+```
+
+If the command fails, install or repair the agent first.
+
+## Path Issues
+
+Desktop apps can inherit a different `PATH` from your interactive shell. Tolaria checks common install locations, but shell setup can still vary. Prefer installing CLI tools in standard locations or making them available from your login shell.
+

site/troubleshooting/git-auth.md

@@ -0,0 +1,26 @@
+# Git Authentication
+
+Tolaria uses system Git authentication. It does not manage provider passwords directly.
+
+## Symptoms
+
+- Push fails.
+- Pull asks for credentials repeatedly.
+- Remote fetch works in one terminal but not in Tolaria.
+
+## Checks
+
+1. Open a terminal.
+2. `cd` into the vault.
+3. Run `git remote -v`.
+4. Run `git fetch`.
+
+If `git fetch` fails in the terminal, fix system Git auth first.
+
+## Common Fixes
+
+- Sign in with GitHub CLI.
+- Configure SSH keys.
+- Update the remote URL.
+- Check your credential helper.
+

site/troubleshooting/sync-conflicts.md

@@ -0,0 +1,20 @@
+# Sync Conflicts
+
+Sync conflicts happen when local and remote changes touch the same content.
+
+## What To Do
+
+1. Stop editing the conflicted note.
+2. Open the conflict resolver if Tolaria presents it.
+3. Review both sides.
+4. Choose the correct content or merge manually.
+5. Commit the resolved file.
+6. Push again.
+
+## Prevent Conflicts
+
+- Pull before starting work on another device.
+- Push after meaningful sessions.
+- Keep AI-generated edits in small commits.
+- Avoid editing the same note on multiple devices at the same time.
+

site/troubleshooting/vault-not-loading.md

@@ -0,0 +1,25 @@
+# Vault Not Loading
+
+Use this checklist when Tolaria cannot open or refresh a vault.
+
+## Check The Folder
+
+- Confirm the folder exists.
+- Confirm the folder contains readable files.
+- Confirm Tolaria has permission to access the folder.
+- Try opening a smaller test vault to isolate the issue.
+
+## Check Git
+
+If the vault is a Git repository, verify it is not in a broken state:
+
+```bash
+git status
+```
+
+Resolve interrupted merges or corrupted repository state before retrying.
+
+## Reload
+
+Run `Reload Vault` from the command palette. This clears derived cache and rescans the filesystem.
+

src-tauri/Cargo.lock

@@ -1239,6 +1239,15 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fsevent-sys"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76ee7a02da4d231650c7cea31349b889be2f45ddb3ef3032d2ec8185f6313fd2"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "funty"
 version = "2.0.0"
@@ -2069,6 +2078,26 @@ dependencies = [
  "cfb",
 ]
 
+[[package]]
+name = "inotify"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
+dependencies = [
+ "bitflags 1.3.2",
+ "inotify-sys",
+ "libc",
+]
+
+[[package]]
+name = "inotify-sys"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.11.0"
@@ -2207,6 +2236,26 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "kqueue"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac30106d7dce88daf4a3fcb4879ea939476d5074a9b7ddd0fb97fa4bed5596a"
+dependencies = [
+ "kqueue-sys",
+ "libc",
+]
+
+[[package]]
+name = "kqueue-sys"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+]
+
 [[package]]
 name = "kuchikiki"
 version = "0.8.8-speedreader"
@@ -2386,6 +2435,18 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "mio"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+dependencies = [
+ "libc",
+ "log",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "mio"
 version = "1.1.1"
@@ -2489,6 +2550,25 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
 
+[[package]]
+name = "notify"
+version = "6.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
+dependencies = [
+ "bitflags 2.11.0",
+ "crossbeam-channel",
+ "filetime",
+ "fsevent-sys",
+ "inotify",
+ "kqueue",
+ "libc",
+ "log",
+ "mio 0.8.11",
+ "walkdir",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "num-conv"
 version = "0.2.0"
@@ -5042,7 +5122,7 @@ checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
 dependencies = [
  "bytes",
  "libc",
- "mio",
+ "mio 1.1.1",
  "pin-project-lite",
  "socket2",
  "tokio-macros",
@@ -5103,6 +5183,7 @@ dependencies = [
  "futures-util",
  "gray_matter",
  "log",
+ "notify",
  "regex",
  "sentry",
  "serde",

src-tauri/Cargo.toml

@@ -20,6 +20,7 @@ serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_yaml = "0.9"
 log = "0.4"
+notify = "6.1"
 tauri = { version = "2.10.0", features = ["protocol-asset", "devtools"] }
 tauri-plugin-log = "2"
 gray_matter = "0.2"

src-tauri/src/ai_agents.rs

@@ -1,13 +1,15 @@
 use serde::{Deserialize, Serialize};
 use std::io::BufRead;
-use std::path::PathBuf;
-use std::process::{Command, Stdio};
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
 
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum AiAgentId {
     ClaudeCode,
     Codex,
+    Opencode,
+    Pi,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -20,6 +22,8 @@ pub struct AiAgentAvailability {
 pub struct AiAgentsStatus {
     pub claude_code: AiAgentAvailability,
     pub codex: AiAgentAvailability,
+    pub opencode: AiAgentAvailability,
+    pub pi: AiAgentAvailability,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -63,6 +67,8 @@ pub fn get_ai_agents_status() -> AiAgentsStatus {
     AiAgentsStatus {
         claude_code: availability_from_claude(),
         codex: availability_from_codex(),
+        opencode: availability_from_opencode(),
+        pi: availability_from_pi(),
     }
 }
 
@@ -84,6 +90,22 @@ where
             })
         }
         AiAgentId::Codex => run_codex_agent_stream(request, emit),
+        AiAgentId::Opencode => {
+            let mapped = crate::opencode_cli::AgentStreamRequest {
+                message: request.message,
+                system_prompt: request.system_prompt,
+                vault_path: request.vault_path,
+            };
+            crate::opencode_cli::run_agent_stream(mapped, emit)
+        }
+        AiAgentId::Pi => {
+            let mapped = crate::pi_cli::AgentStreamRequest {
+                message: request.message,
+                system_prompt: request.system_prompt,
+                vault_path: request.vault_path,
+            };
+            crate::pi_cli::run_agent_stream(mapped, emit)
+        }
     }
 }
 
@@ -112,8 +134,16 @@ fn availability_from_codex() -> AiAgentAvailability {
     }
 }
 
+fn availability_from_opencode() -> AiAgentAvailability {
+    crate::opencode_cli::check_cli()
+}
+
+fn availability_from_pi() -> AiAgentAvailability {
+    crate::pi_cli::check_cli()
+}
+
 fn version_for_binary(binary: &PathBuf) -> Option<String> {
-    Command::new(binary)
+    crate::hidden_command(binary)
         .arg("--version")
         .output()
         .ok()
@@ -122,7 +152,11 @@ fn version_for_binary(binary: &PathBuf) -> Option<String> {
 }
 
 fn find_codex_binary() -> Result<PathBuf, String> {
-    if let Some(binary) = find_codex_binary_on_path()? {
+    if let Some(binary) = find_codex_binary_on_path() {
+        return Ok(binary);
+    }
+
+    if let Some(binary) = find_codex_binary_in_user_shell() {
         return Ok(binary);
     }
 
@@ -133,27 +167,76 @@ fn find_codex_binary() -> Result<PathBuf, String> {
     Err("Codex CLI not found. Install it: https://developers.openai.com/codex/cli".into())
 }
 
-fn find_codex_binary_on_path() -> Result<Option<PathBuf>, String> {
-    let output = Command::new("which")
+fn find_codex_binary_on_path() -> Option<PathBuf> {
+    crate::hidden_command("which")
         .arg("codex")
         .output()
-        .map_err(|error| format!("Failed to run `which codex`: {error}"))?;
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
 
-    if output.status.success() {
-        let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
-        if !path.is_empty() {
-            return Ok(Some(PathBuf::from(path)));
+fn find_codex_binary_in_user_shell() -> Option<PathBuf> {
+    user_shell_candidates()
+        .into_iter()
+        .filter(|shell| shell.exists())
+        .find_map(|shell| command_path_from_shell(&shell, "codex"))
+}
+
+fn user_shell_candidates() -> Vec<PathBuf> {
+    let mut shells = Vec::new();
+    if let Some(shell) = std::env::var_os("SHELL") {
+        if !shell.is_empty() {
+            shells.push(PathBuf::from(shell));
         }
     }
+    shells.push(PathBuf::from("/bin/zsh"));
+    shells.push(PathBuf::from("/bin/bash"));
+    shells
+}
 
-    Ok(None)
+fn command_path_from_shell(shell: &Path, command: &str) -> Option<PathBuf> {
+    crate::hidden_command(shell)
+        .arg("-lc")
+        .arg(format!("command -v {command}"))
+        .output()
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
+
+fn path_from_successful_output(output: &std::process::Output) -> Option<PathBuf> {
+    if output.status.success() {
+        first_existing_path(&String::from_utf8_lossy(&output.stdout))
+    } else {
+        None
+    }
+}
+
+fn first_existing_path(stdout: &str) -> Option<PathBuf> {
+    stdout.lines().find_map(|line| {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            return None;
+        }
+        let candidate = PathBuf::from(trimmed);
+        candidate.exists().then_some(candidate)
+    })
 }
 
 fn codex_binary_candidates() -> Vec<PathBuf> {
-    let home = dirs::home_dir().unwrap_or_default();
+    dirs::home_dir()
+        .map(|home| codex_binary_candidates_for_home(&home))
+        .unwrap_or_default()
+}
+
+fn codex_binary_candidates_for_home(home: &Path) -> Vec<PathBuf> {
     vec![
         home.join(".local/bin/codex"),
+        home.join(".codex/bin/codex"),
+        home.join(".local/share/mise/shims/codex"),
+        home.join(".asdf/shims/codex"),
+        home.join(".npm-global/bin/codex"),
         home.join(".npm/bin/codex"),
+        home.join(".bun/bin/codex"),
         PathBuf::from("/usr/local/bin/codex"),
         PathBuf::from("/opt/homebrew/bin/codex"),
         PathBuf::from("/Applications/Codex.app/Contents/Resources/codex"),
@@ -172,13 +255,7 @@ where
     let args = build_codex_args(&request)?;
     let prompt = build_codex_prompt(&request);
 
-    let mut command = Command::new(binary);
-    command
-        .args(args)
-        .arg(prompt)
-        .current_dir(&request.vault_path)
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
+    let mut command = build_codex_command(&binary, args, prompt, &request.vault_path);
 
     let mut child = command
         .spawn()
@@ -236,6 +313,22 @@ where
     Ok(thread_id)
 }
 
+fn build_codex_command(
+    binary: &Path,
+    args: Vec<String>,
+    prompt: String,
+    vault_path: &str,
+) -> std::process::Command {
+    let mut command = crate::hidden_command(binary);
+    command
+        .args(args)
+        .arg(prompt)
+        .current_dir(vault_path)
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    command
+}
+
 fn build_codex_args(request: &AiAgentStreamRequest) -> Result<Vec<String>, String> {
     let mcp_server = crate::mcp::mcp_server_dir()?.join("index.js");
     let mcp_server_path = mcp_server
@@ -244,6 +337,10 @@ fn build_codex_args(request: &AiAgentStreamRequest) -> Result<Vec<String>, Strin
         .to_string();
 
     Ok(vec![
+        "--sandbox".into(),
+        "workspace-write".into(),
+        "--ask-for-approval".into(),
+        "never".into(),
         "exec".into(),
         "--json".into(),
         "-C".into(),
@@ -337,6 +434,10 @@ fn format_codex_error(stderr_output: String, status: String) -> String {
         return "Codex CLI is not authenticated. Run `codex login` or launch `codex` in your terminal.".into();
     }
 
+    if is_codex_write_permission_error(&lower) {
+        return "Codex could not write to the active vault. Tolaria starts Codex with a workspace-write sandbox, so verify the selected vault folder is writable and retry; writes outside the active vault remain blocked.".into();
+    }
+
     if stderr_output.trim().is_empty() {
         format!("codex exited with status {status}")
     } else {
@@ -350,6 +451,17 @@ fn is_codex_auth_error(lower: &str) -> bool {
         .any(|pattern| lower.contains(pattern))
 }
 
+fn is_codex_write_permission_error(lower: &str) -> bool {
+    [
+        "read-only sandbox",
+        "writing is blocked",
+        "rejected by user approval",
+        "rejected by the environment",
+    ]
+    .iter()
+    .any(|pattern| lower.contains(pattern))
+}
+
 fn map_claude_event(event: crate::claude_cli::ClaudeStreamEvent) -> Option<AiAgentStreamEvent> {
     match event {
         crate::claude_cli::ClaudeStreamEvent::Init { session_id } => {
@@ -377,6 +489,9 @@ fn map_claude_event(event: crate::claude_cli::ClaudeStreamEvent) -> Option<AiAge
             Some(AiAgentStreamEvent::Error { message })
         }
         crate::claude_cli::ClaudeStreamEvent::Done => Some(AiAgentStreamEvent::Done),
+        crate::claude_cli::ClaudeStreamEvent::Result { text, .. } if !text.is_empty() => {
+            Some(AiAgentStreamEvent::TextDelta { text })
+        }
         crate::claude_cli::ClaudeStreamEvent::Result { .. } => None,
     }
 }
@@ -384,12 +499,15 @@ fn map_claude_event(event: crate::claude_cli::ClaudeStreamEvent) -> Option<AiAge
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::ffi::OsStr;
 
     #[test]
-    fn normalize_status_contains_both_agents() {
+    fn normalize_status_contains_all_agents() {
         let status = get_ai_agents_status();
         assert!(matches!(status.claude_code.installed, true | false));
         assert!(matches!(status.codex.installed, true | false));
+        assert!(matches!(status.opencode.installed, true | false));
+        assert!(matches!(status.pi.installed, true | false));
     }
 
     #[test]
@@ -413,12 +531,96 @@ mod tests {
             system_prompt: None,
             vault_path: "/tmp/vault".into(),
         }) {
+            assert_eq!(args[0], "--sandbox");
+            assert_eq!(args[1], "workspace-write");
+            assert_eq!(args[2], "--ask-for-approval");
+            assert_eq!(args[3], "never");
+            assert_eq!(args[4], "exec");
             assert!(!args.contains(&"--dangerously-bypass-approvals-and-sandbox".to_string()));
+            assert!(!args.contains(&"danger-full-access".to_string()));
             assert!(args.contains(&"--json".to_string()));
             assert!(args.contains(&"-C".to_string()));
         }
     }
 
+    #[test]
+    fn build_codex_command_keeps_agent_process_contract() {
+        let binary = PathBuf::from("codex");
+        let args = vec!["exec".to_string(), "--json".to_string()];
+        let command = build_codex_command(&binary, args, "Summarize".into(), "/tmp/vault");
+        let actual_args: Vec<&OsStr> = command.get_args().collect();
+
+        assert_eq!(command.get_program(), OsStr::new("codex"));
+        assert_eq!(
+            actual_args,
+            vec![
+                OsStr::new("exec"),
+                OsStr::new("--json"),
+                OsStr::new("Summarize")
+            ]
+        );
+        assert_eq!(command.get_current_dir(), Some(Path::new("/tmp/vault")));
+    }
+
+    #[test]
+    fn codex_binary_candidates_include_supported_macos_installs() {
+        let home = PathBuf::from("/Users/alex");
+        let candidates = codex_binary_candidates_for_home(&home);
+        let expected = [
+            home.join(".local/bin/codex"),
+            home.join(".codex/bin/codex"),
+            home.join(".local/share/mise/shims/codex"),
+            home.join(".asdf/shims/codex"),
+            home.join(".npm-global/bin/codex"),
+            home.join(".bun/bin/codex"),
+            PathBuf::from("/Applications/Codex.app/Contents/Resources/codex"),
+        ];
+
+        for candidate in expected {
+            assert!(
+                candidates.contains(&candidate),
+                "missing {}",
+                candidate.display()
+            );
+        }
+    }
+
+    #[test]
+    fn first_existing_path_skips_empty_and_missing_lines() {
+        let dir = tempfile::tempdir().unwrap();
+        let missing = dir.path().join("missing-codex");
+        let codex = dir.path().join("codex");
+        std::fs::write(&codex, "#!/bin/sh\n").unwrap();
+
+        let stdout = format!("\n{}\n{}\n", missing.display(), codex.display());
+
+        assert_eq!(first_existing_path(&stdout), Some(codex));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn command_path_from_shell_finds_codex_from_login_shell() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let codex = dir.path().join("codex");
+        std::fs::write(&codex, "#!/bin/sh\n").unwrap();
+        std::fs::set_permissions(&codex, std::fs::Permissions::from_mode(0o755)).unwrap();
+
+        let shell = dir.path().join("shell");
+        std::fs::write(
+            &shell,
+            format!(
+                "#!/bin/sh\nif [ \"$1\" = \"-lc\" ]; then echo '{}'; fi\n",
+                codex.display()
+            ),
+        )
+        .unwrap();
+        std::fs::set_permissions(&shell, std::fs::Permissions::from_mode(0o755)).unwrap();
+
+        assert_eq!(command_path_from_shell(&shell, "codex"), Some(codex));
+    }
+
     #[test]
     fn dispatch_codex_command_events_maps_to_bash_events() {
         let mut events = Vec::new();
@@ -474,10 +676,35 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn format_codex_error_explains_vault_write_permission_failures() {
+        let message = format_codex_error(
+            "The patch was rejected by the environment: writing is blocked by read-only sandbox; rejected by user approval settings".into(),
+            "exit status: 1".into(),
+        );
+
+        assert!(message.contains("active vault"));
+        assert!(message.contains("writable"));
+        assert!(message.contains("outside"));
+    }
+
     #[test]
     fn map_claude_done_event_preserves_completion_signal() {
         let mapped = map_claude_event(crate::claude_cli::ClaudeStreamEvent::Done);
 
         assert!(matches!(mapped, Some(AiAgentStreamEvent::Done)));
     }
+
+    #[test]
+    fn map_claude_result_event_preserves_final_text() {
+        let mapped = map_claude_event(crate::claude_cli::ClaudeStreamEvent::Result {
+            text: "Final answer from Claude".into(),
+            session_id: "session-1".into(),
+        });
+
+        assert!(matches!(
+            mapped,
+            Some(AiAgentStreamEvent::TextDelta { text }) if text == "Final answer from Claude"
+        ));
+    }
 }

src-tauri/src/claude_cli.rs

@@ -2,7 +2,7 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::io::BufRead;
 use std::path::{Path, PathBuf};
-use std::process::{Command, ExitStatus, Stdio};
+use std::process::{ExitStatus, Stdio};
 
 /// Status returned by `check_claude_cli`.
 #[derive(Debug, Serialize, Clone)]
@@ -50,7 +50,7 @@ pub struct ChatStreamRequest {
     pub session_id: Option<String>,
 }
 
-/// Parameters accepted by `stream_claude_agent`.
+/// Parameters accepted by Claude Code agent streams.
 #[derive(Debug, Deserialize)]
 pub struct AgentStreamRequest {
     pub message: String,
@@ -63,7 +63,7 @@ pub struct AgentStreamRequest {
 // ---------------------------------------------------------------------------
 
 pub(crate) fn find_claude_binary() -> Result<PathBuf, String> {
-    if let Some(binary) = find_claude_binary_on_path()? {
+    if let Some(binary) = find_claude_binary_on_path() {
         return Ok(binary);
     }
 
@@ -78,13 +78,20 @@ pub(crate) fn find_claude_binary() -> Result<PathBuf, String> {
     Err("Claude CLI not found. Install it: https://docs.anthropic.com/en/docs/claude-code".into())
 }
 
-fn find_claude_binary_on_path() -> Result<Option<PathBuf>, String> {
-    let output = Command::new("which")
+fn find_claude_binary_on_path() -> Option<PathBuf> {
+    crate::hidden_command(claude_path_lookup_command())
         .arg("claude")
         .output()
-        .map_err(|e| format!("Failed to run `which claude`: {e}"))?;
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
 
-    Ok(path_from_successful_output(&output))
+fn claude_path_lookup_command() -> &'static str {
+    if cfg!(windows) {
+        "where"
+    } else {
+        "which"
+    }
 }
 
 fn find_claude_binary_in_user_shell() -> Option<PathBuf> {
@@ -107,7 +114,7 @@ fn user_shell_candidates() -> Vec<PathBuf> {
 }
 
 fn command_path_from_shell(shell: &Path, command: &str) -> Option<PathBuf> {
-    Command::new(shell)
+    crate::hidden_command(shell)
         .arg("-lc")
         .arg(format!("command -v {command}"))
         .output()
@@ -143,11 +150,24 @@ fn claude_binary_candidates() -> Vec<PathBuf> {
 fn claude_binary_candidates_for_home(home: &Path) -> Vec<PathBuf> {
     vec![
         home.join(".local/bin/claude"),
+        home.join(".local/bin/claude.exe"),
         home.join(".claude/local/claude"),
+        home.join(".claude/local/claude.exe"),
         home.join(".local/share/mise/shims/claude"),
+        home.join(".local/share/mise/shims/claude.exe"),
         home.join(".asdf/shims/claude"),
+        home.join(".asdf/shims/claude.exe"),
         home.join(".npm-global/bin/claude"),
+        home.join(".npm-global/bin/claude.cmd"),
+        home.join(".npm-global/bin/claude.exe"),
         home.join(".npm/bin/claude"),
+        home.join(".npm/bin/claude.cmd"),
+        home.join(".npm/bin/claude.exe"),
+        home.join("AppData/Roaming/npm/claude.cmd"),
+        home.join("AppData/Roaming/npm/claude.exe"),
+        home.join("AppData/Local/pnpm/claude.cmd"),
+        home.join("AppData/Local/pnpm/claude.exe"),
+        home.join("scoop/shims/claude.exe"),
         PathBuf::from("/opt/homebrew/bin/claude"),
         PathBuf::from("/usr/local/bin/claude"),
     ]
@@ -173,7 +193,7 @@ pub fn check_cli() -> ClaudeCliStatus {
         }
     };
 
-    let version = Command::new(&bin)
+    let version = crate::hidden_command(&bin)
         .arg("--version")
         .output()
         .ok()
@@ -249,7 +269,11 @@ fn build_agent_args(req: &AgentStreamRequest) -> Result<Vec<String>, String> {
         "--include-partial-messages".into(),
         "--mcp-config".into(),
         mcp_config,
-        "--dangerously-skip-permissions".into(),
+        "--strict-mcp-config".into(),
+        "--permission-mode".into(),
+        "acceptEdits".into(),
+        "--tools".into(),
+        "Read,Edit,MultiEdit,Write,Glob,Grep,LS".into(),
         "--no-session-persistence".into(),
     ];
 
@@ -303,14 +327,7 @@ fn run_claude_subprocess<F>(
 where
     F: FnMut(ClaudeStreamEvent),
 {
-    let mut cmd = Command::new(bin);
-    cmd.args(args)
-        .env_remove("CLAUDECODE") // prevent "nested session" guard
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
-    if let Some(dir) = cwd {
-        cmd.current_dir(dir);
-    }
+    let mut cmd = build_claude_command(bin, args, cwd);
     let mut child = cmd
         .spawn()
         .map_err(|e| format!("Failed to spawn claude: {e}"))?;
@@ -367,6 +384,23 @@ where
     Ok(state.session_id)
 }
 
+fn build_claude_command(
+    bin: &PathBuf,
+    args: &[String],
+    cwd: Option<&str>,
+) -> std::process::Command {
+    let mut cmd = crate::hidden_command(bin);
+    cmd.args(args)
+        .env_remove("CLAUDECODE") // prevent "nested session" guard
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    if let Some(dir) = cwd {
+        cmd.current_dir(dir);
+    }
+    cmd
+}
+
 fn format_failed_claude_exit(stderr_output: &str, status: ExitStatus) -> String {
     if is_claude_auth_error(stderr_output) {
         return "Claude CLI is not authenticated. Run `claude auth login` in your terminal.".into();
@@ -569,6 +603,9 @@ fn extract_tool_result_text(json: &serde_json::Value) -> Option<String> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::ffi::OsStr;
+    use std::ffi::OsString;
+    use std::process::Command;
 
     #[test]
     fn check_cli_returns_status() {
@@ -882,6 +919,33 @@ mod tests {
 
     // --- run_claude_subprocess with mock scripts ---
 
+    #[test]
+    fn build_claude_command_keeps_streaming_process_contract() {
+        let bin = PathBuf::from("claude");
+        let args = vec!["-p".to_string(), "hello".to_string()];
+        let command = build_claude_command(&bin, &args, Some("/tmp/vault"));
+        let actual_args: Vec<OsString> = command.get_args().map(OsStr::to_os_string).collect();
+        let claude_code_env = command
+            .get_envs()
+            .find(|(key, _)| *key == OsStr::new("CLAUDECODE"))
+            .map(|(_, value)| value.map(OsStr::to_os_string));
+
+        assert_eq!(
+            (
+                command.get_program().to_os_string(),
+                actual_args,
+                command.get_current_dir().map(Path::to_path_buf),
+                claude_code_env,
+            ),
+            (
+                OsString::from("claude"),
+                vec![OsString::from("-p"), OsString::from("hello")],
+                Some(PathBuf::from("/tmp/vault")),
+                Some(None),
+            ),
+        );
+    }
+
     #[cfg(unix)]
     fn run_mock_script(script: &str) -> (Result<String, String>, Vec<ClaudeStreamEvent>) {
         run_mock_script_with_args(script, &[])
@@ -918,6 +982,99 @@ mod tests {
         assert!(matches!(&events[3], ClaudeStreamEvent::Done));
     }
 
+    #[test]
+    fn run_subprocess_closes_stdin_even_when_parent_stdin_pipe_is_open() {
+        use std::io::Read;
+        use std::time::{Duration, Instant};
+
+        let mut child = Command::new(std::env::current_exe().unwrap())
+            .arg("stdin_probe_parent_child")
+            .arg("--ignored")
+            .arg("--nocapture")
+            .env("TOLARIA_STDIN_PROBE_CHILD", "1")
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+        let child_stdin = child.stdin.take().unwrap();
+        let mut stdout = child.stdout.take().unwrap();
+        let mut stderr = child.stderr.take().unwrap();
+        let deadline = Instant::now() + Duration::from_secs(5);
+
+        let status = loop {
+            if let Some(status) = child.try_wait().unwrap() {
+                break status;
+            }
+            if Instant::now() >= deadline {
+                child.kill().unwrap();
+                drop(child_stdin);
+                panic!("stdin probe child timed out");
+            }
+            std::thread::sleep(Duration::from_millis(10));
+        };
+
+        drop(child_stdin);
+        let mut stdout_text = String::new();
+        let mut stderr_text = String::new();
+        stdout.read_to_string(&mut stdout_text).unwrap();
+        stderr.read_to_string(&mut stderr_text).unwrap();
+
+        assert!(
+            status.success(),
+            "stdin probe child failed with {status}\nstdout:\n{stdout_text}\nstderr:\n{stderr_text}"
+        );
+    }
+
+    #[ignore = "spawned by run_subprocess_closes_stdin_even_when_parent_stdin_pipe_is_open"]
+    #[test]
+    fn stdin_probe_parent_child() {
+        if std::env::var_os("TOLARIA_STDIN_PROBE_CHILD").is_none() {
+            return;
+        }
+
+        let fake_bin = std::env::current_exe().unwrap();
+        let args = vec![
+            "stdin_probe_mock_claude_child".to_string(),
+            "--ignored".to_string(),
+            "--nocapture".to_string(),
+        ];
+        std::env::set_var("TOLARIA_STDIN_PROBE_MOCK_CLAUDE_CHILD", "1");
+        let mut events = vec![];
+        let result = run_claude_subprocess(&fake_bin, &args, None, &mut |event| events.push(event));
+        std::env::remove_var("TOLARIA_STDIN_PROBE_MOCK_CLAUDE_CHILD");
+
+        assert_eq!(result.unwrap(), "stdin-ok");
+        assert!(matches!(
+            events.first(),
+            Some(ClaudeStreamEvent::Result { text, session_id })
+                if text == "stdin closed" && session_id == "stdin-ok"
+        ));
+        assert!(matches!(events.last(), Some(ClaudeStreamEvent::Done)));
+    }
+
+    #[ignore = "spawned by stdin_probe_parent_child"]
+    #[test]
+    fn stdin_probe_mock_claude_child() {
+        if std::env::var_os("TOLARIA_STDIN_PROBE_MOCK_CLAUDE_CHILD").is_none() {
+            return;
+        }
+
+        use std::io::Read;
+
+        let mut stdin = String::new();
+        std::io::stdin().read_to_string(&mut stdin).unwrap();
+        assert!(stdin.is_empty(), "stdin was not EOF");
+        println!(
+            "{}",
+            serde_json::json!({
+                "type": "result",
+                "result": "stdin closed",
+                "session_id": "stdin-ok"
+            })
+        );
+    }
+
     #[cfg(unix)]
     #[test]
     fn run_subprocess_skips_blank_and_non_json_lines() {
@@ -1046,11 +1203,16 @@ mod tests {
             assert!(args.contains(&"-p".to_string()));
             assert!(args.contains(&"create note".to_string()));
             assert!(args.contains(&"--mcp-config".to_string()));
-            assert!(args.contains(&"--dangerously-skip-permissions".to_string()));
+            assert!(args.contains(&"--strict-mcp-config".to_string()));
+            assert!(args.contains(&"--permission-mode".to_string()));
+            assert!(args.contains(&"acceptEdits".to_string()));
+            assert!(args.contains(&"--tools".to_string()));
+            assert!(args.contains(&"Read,Edit,MultiEdit,Write,Glob,Grep,LS".to_string()));
+            assert!(!args.contains(&"--dangerously-skip-permissions".to_string()));
+            assert!(!args.contains(&"bypassPermissions".to_string()));
+            assert!(!args.contains(&"Bash".to_string()));
             assert!(args.contains(&"--no-session-persistence".to_string()));
             assert!(!args.contains(&"--append-system-prompt".to_string()));
-            // Native tools must NOT be disabled
-            assert!(!args.contains(&"--tools".to_string()));
         }
     }
 
@@ -1099,6 +1261,45 @@ mod tests {
         }
     }
 
+    #[test]
+    fn claude_binary_candidates_include_windows_exe_installs() {
+        let home = PathBuf::from(r"C:\Users\alex");
+        let candidates = claude_binary_candidates_for_home(&home);
+        let expected = [
+            home.join(".local/bin/claude.exe"),
+            home.join(".claude/local/claude.exe"),
+            home.join("AppData/Roaming/npm/claude.cmd"),
+        ];
+
+        for candidate in expected {
+            assert!(
+                candidates.contains(&candidate),
+                "missing {}",
+                candidate.display()
+            );
+        }
+    }
+
+    #[test]
+    fn claude_path_lookup_command_matches_current_platform() {
+        let expected = if cfg!(windows) { "where" } else { "which" };
+
+        assert_eq!(claude_path_lookup_command(), expected);
+    }
+
+    #[test]
+    fn find_existing_binary_finds_windows_exe_candidate() {
+        let dir = tempfile::tempdir().unwrap();
+        let claude = dir.path().join(".local/bin/claude.exe");
+        std::fs::create_dir_all(claude.parent().unwrap()).unwrap();
+        std::fs::write(&claude, "").unwrap();
+
+        assert_eq!(
+            find_existing_binary(claude_binary_candidates_for_home(dir.path())),
+            Some(claude)
+        );
+    }
+
     #[test]
     fn find_claude_binary_returns_result() {
         let result = find_claude_binary();

src-tauri/src/commands/ai.rs

@@ -1,6 +1,6 @@
 #[cfg(desktop)]
 use crate::ai_agents::{AiAgentStreamRequest, AiAgentsStatus};
-use crate::claude_cli::{AgentStreamRequest, ChatStreamRequest, ClaudeCliStatus};
+use crate::claude_cli::{ChatStreamRequest, ClaudeCliStatus};
 use crate::vault::VaultAiGuidanceStatus;
 
 use super::expand_tilde;
@@ -81,14 +81,6 @@ define_desktop_stream_command!(
     crate::claude_cli::run_chat_stream
 );
 
-#[cfg(desktop)]
-define_desktop_stream_command!(
-    stream_claude_agent,
-    AgentStreamRequest,
-    "claude-agent-stream",
-    crate::claude_cli::run_agent_stream
-);
-
 #[cfg(desktop)]
 define_desktop_stream_command!(
     stream_ai_agent,
@@ -120,6 +112,14 @@ pub fn get_ai_agents_status() -> AiAgentsStatus {
             installed: false,
             version: None,
         },
+        opencode: crate::ai_agents::AiAgentAvailability {
+            installed: false,
+            version: None,
+        },
+        pi: crate::ai_agents::AiAgentAvailability {
+            installed: false,
+            version: None,
+        },
     }
 }
 
@@ -132,15 +132,6 @@ pub async fn stream_claude_chat(
     Err("Claude CLI is not available on mobile".into())
 }
 
-#[cfg(mobile)]
-#[tauri::command]
-pub async fn stream_claude_agent(
-    _app_handle: tauri::AppHandle,
-    _request: AgentStreamRequest,
-) -> Result<String, String> {
-    Err("Claude CLI is not available on mobile".into())
-}
-
 #[cfg(mobile)]
 #[tauri::command]
 pub async fn stream_ai_agent(

src-tauri/src/commands/git.rs

@@ -5,11 +5,22 @@ use crate::git::{
 
 use super::expand_tilde;
 
+type VaultPathArg = String;
+type NotePathArg = String;
+type CommitHashArg = String;
+type CommitMessageArg = String;
+type ConflictStrategyArg = String;
+type RemoteUrlArg = String;
+type LocalPathArg = String;
+
 // ── Git commands (desktop) ──────────────────────────────────────────────────
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_file_history(vault_path: String, path: String) -> Result<Vec<GitCommit>, String> {
+pub fn get_file_history(
+    vault_path: VaultPathArg,
+    path: NotePathArg,
+) -> Result<Vec<GitCommit>, String> {
     let vault_path = expand_tilde(&vault_path);
     let path = expand_tilde(&path);
     crate::git::get_file_history(&vault_path, &path)
@@ -17,14 +28,14 @@ pub fn get_file_history(vault_path: String, path: String) -> Result<Vec<GitCommi
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_modified_files(vault_path: String) -> Result<Vec<ModifiedFile>, String> {
+pub fn get_modified_files(vault_path: VaultPathArg) -> Result<Vec<ModifiedFile>, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::get_modified_files(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_file_diff(vault_path: String, path: String) -> Result<String, String> {
+pub fn get_file_diff(vault_path: VaultPathArg, path: NotePathArg) -> Result<String, String> {
     let vault_path = expand_tilde(&vault_path);
     let path = expand_tilde(&path);
     crate::git::get_file_diff(&vault_path, &path)
@@ -33,9 +44,9 @@ pub fn get_file_diff(vault_path: String, path: String) -> Result<String, String>
 #[cfg(desktop)]
 #[tauri::command]
 pub fn get_file_diff_at_commit(
-    vault_path: String,
-    path: String,
-    commit_hash: String,
+    vault_path: VaultPathArg,
+    path: NotePathArg,
+    commit_hash: CommitHashArg,
 ) -> Result<String, String> {
     let vault_path = expand_tilde(&vault_path);
     let path = expand_tilde(&path);
@@ -45,7 +56,7 @@ pub fn get_file_diff_at_commit(
 #[cfg(desktop)]
 #[tauri::command]
 pub fn get_vault_pulse(
-    vault_path: String,
+    vault_path: VaultPathArg,
     limit: Option<usize>,
     skip: Option<usize>,
 ) -> Result<Vec<PulseCommit>, String> {
@@ -57,21 +68,21 @@ pub fn get_vault_pulse(
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn git_commit(vault_path: String, message: String) -> Result<String, String> {
+pub fn git_commit(vault_path: VaultPathArg, message: CommitMessageArg) -> Result<String, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::git_commit(&vault_path, &message)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_last_commit_info(vault_path: String) -> Result<Option<LastCommitInfo>, String> {
+pub fn get_last_commit_info(vault_path: VaultPathArg) -> Result<Option<LastCommitInfo>, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::get_last_commit_info(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub async fn git_pull(vault_path: String) -> Result<GitPullResult, String> {
+pub async fn git_pull(vault_path: VaultPathArg) -> Result<GitPullResult, String> {
     let vault_path = expand_tilde(&vault_path).into_owned();
     tokio::task::spawn_blocking(move || crate::git::git_pull(&vault_path))
         .await
@@ -80,14 +91,14 @@ pub async fn git_pull(vault_path: String) -> Result<GitPullResult, String> {
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_conflict_files(vault_path: String) -> Result<Vec<String>, String> {
+pub fn get_conflict_files(vault_path: VaultPathArg) -> Result<Vec<String>, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::get_conflict_files(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_conflict_mode(vault_path: String) -> String {
+pub fn get_conflict_mode(vault_path: VaultPathArg) -> String {
     let vault_path = expand_tilde(&vault_path);
     crate::git::get_conflict_mode(&vault_path)
 }
@@ -95,9 +106,9 @@ pub fn get_conflict_mode(vault_path: String) -> String {
 #[cfg(desktop)]
 #[tauri::command]
 pub fn git_resolve_conflict(
-    vault_path: String,
-    file: String,
-    strategy: String,
+    vault_path: VaultPathArg,
+    file: NotePathArg,
+    strategy: ConflictStrategyArg,
 ) -> Result<(), String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::git_resolve_conflict(&vault_path, &file, &strategy)
@@ -105,14 +116,14 @@ pub fn git_resolve_conflict(
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn git_commit_conflict_resolution(vault_path: String) -> Result<String, String> {
+pub fn git_commit_conflict_resolution(vault_path: VaultPathArg) -> Result<String, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::git_commit_conflict_resolution(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub async fn git_push(vault_path: String) -> Result<GitPushResult, String> {
+pub async fn git_push(vault_path: VaultPathArg) -> Result<GitPushResult, String> {
     let vault_path = expand_tilde(&vault_path).into_owned();
     tokio::task::spawn_blocking(move || crate::git::git_push(&vault_path))
         .await
@@ -121,7 +132,7 @@ pub async fn git_push(vault_path: String) -> Result<GitPushResult, String> {
 
 #[cfg(desktop)]
 #[tauri::command]
-pub async fn git_remote_status(vault_path: String) -> Result<GitRemoteStatus, String> {
+pub async fn git_remote_status(vault_path: VaultPathArg) -> Result<GitRemoteStatus, String> {
     let vault_path = expand_tilde(&vault_path).into_owned();
     tokio::task::spawn_blocking(move || crate::git::git_remote_status(&vault_path))
         .await
@@ -130,30 +141,85 @@ pub async fn git_remote_status(vault_path: String) -> Result<GitRemoteStatus, St
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn git_discard_file(vault_path: String, relative_path: String) -> Result<(), String> {
+pub fn git_discard_file(
+    vault_path: VaultPathArg,
+    relative_path: NotePathArg,
+) -> Result<(), String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::discard_file_changes(&vault_path, &relative_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn is_git_repo(vault_path: String) -> bool {
+pub fn is_git_repo(vault_path: VaultPathArg) -> bool {
     let vault_path = expand_tilde(&vault_path);
     std::path::Path::new(vault_path.as_ref())
         .join(".git")
         .is_dir()
 }
 
+#[cfg(desktop)]
+fn validate_git_init_target(vault_path: &str) -> Result<(), String> {
+    let path = std::path::Path::new(vault_path);
+    if !path.exists() {
+        return Err("Choose an existing vault folder before initializing Git".to_string());
+    }
+    if !path.is_dir() {
+        return Err("Choose a folder before initializing Git".to_string());
+    }
+
+    if is_broad_personal_folder(path) && !has_tolaria_vault_marker(path) {
+        return Err(format!(
+            "Choose a dedicated vault folder before initializing Git. '{}' looks like a broad personal folder; create or select a subfolder such as '{}' instead.",
+            path.display(),
+            path.join("Tolaria").display()
+        ));
+    }
+
+    Ok(())
+}
+
+#[cfg(desktop)]
+fn is_broad_personal_folder(path: &std::path::Path) -> bool {
+    let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+        return false;
+    };
+
+    matches!(
+        name.to_ascii_lowercase().as_str(),
+        "desktop"
+            | "documents"
+            | "downloads"
+            | "movies"
+            | "music"
+            | "pictures"
+            | "public"
+            | "templates"
+            | "videos"
+    )
+}
+
+#[cfg(desktop)]
+fn has_tolaria_vault_marker(path: &std::path::Path) -> bool {
+    ["AGENTS.md", "CLAUDE.md", "type.md", "note.md"]
+        .iter()
+        .any(|file| path.join(file).is_file())
+        || ["attachments", "type", "views"]
+            .iter()
+            .any(|dir| path.join(dir).is_dir())
+}
+
 #[cfg(desktop)]
 #[tauri::command]
-pub fn init_git_repo(vault_path: String) -> Result<(), String> {
+pub fn init_git_repo(vault_path: VaultPathArg) -> Result<(), String> {
     let vault_path = expand_tilde(&vault_path);
+    validate_git_init_target(&vault_path)?;
     crate::git::init_repo(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn clone_repo(url: String, local_path: String) -> Result<String, String> {
+pub fn clone_repo(url: RemoteUrlArg, local_path: LocalPathArg) -> Result<String, String> {
     let local_path = expand_tilde(&local_path);
     crate::git::clone_repo(&url, &local_path)
 }
@@ -162,28 +228,31 @@ pub fn clone_repo(url: String, local_path: String) -> Result<String, String> {
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_file_history(_vault_path: String, _path: String) -> Result<Vec<GitCommit>, String> {
+pub fn get_file_history(
+    _vault_path: VaultPathArg,
+    _path: NotePathArg,
+) -> Result<Vec<GitCommit>, String> {
     Err("Git history is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_modified_files(_vault_path: String) -> Result<Vec<ModifiedFile>, String> {
+pub fn get_modified_files(_vault_path: VaultPathArg) -> Result<Vec<ModifiedFile>, String> {
     Ok(vec![])
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_file_diff(_vault_path: String, _path: String) -> Result<String, String> {
+pub fn get_file_diff(_vault_path: VaultPathArg, _path: NotePathArg) -> Result<String, String> {
     Err("Git diff is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
 pub fn get_file_diff_at_commit(
-    _vault_path: String,
-    _path: String,
-    _commit_hash: String,
+    _vault_path: VaultPathArg,
+    _path: NotePathArg,
+    _commit_hash: CommitHashArg,
 ) -> Result<String, String> {
     Err("Git diff is not available on mobile".into())
 }
@@ -191,7 +260,7 @@ pub fn get_file_diff_at_commit(
 #[cfg(mobile)]
 #[tauri::command]
 pub fn get_vault_pulse(
-    _vault_path: String,
+    _vault_path: VaultPathArg,
     _limit: Option<usize>,
     _skip: Option<usize>,
 ) -> Result<Vec<PulseCommit>, String> {
@@ -200,59 +269,59 @@ pub fn get_vault_pulse(
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn git_commit(_vault_path: String, _message: String) -> Result<String, String> {
+pub fn git_commit(_vault_path: VaultPathArg, _message: CommitMessageArg) -> Result<String, String> {
     Err("Git commit is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_last_commit_info(_vault_path: String) -> Result<Option<LastCommitInfo>, String> {
+pub fn get_last_commit_info(_vault_path: VaultPathArg) -> Result<Option<LastCommitInfo>, String> {
     Ok(None)
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub async fn git_pull(_vault_path: String) -> Result<GitPullResult, String> {
+pub async fn git_pull(_vault_path: VaultPathArg) -> Result<GitPullResult, String> {
     Err("Git pull is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_conflict_files(_vault_path: String) -> Result<Vec<String>, String> {
+pub fn get_conflict_files(_vault_path: VaultPathArg) -> Result<Vec<String>, String> {
     Ok(vec![])
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_conflict_mode(_vault_path: String) -> String {
+pub fn get_conflict_mode(_vault_path: VaultPathArg) -> String {
     "none".to_string()
 }
 
 #[cfg(mobile)]
 #[tauri::command]
 pub fn git_resolve_conflict(
-    _vault_path: String,
-    _file: String,
-    _strategy: String,
+    _vault_path: VaultPathArg,
+    _file: NotePathArg,
+    _strategy: ConflictStrategyArg,
 ) -> Result<(), String> {
     Err("Git conflict resolution is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn git_commit_conflict_resolution(_vault_path: String) -> Result<String, String> {
+pub fn git_commit_conflict_resolution(_vault_path: VaultPathArg) -> Result<String, String> {
     Err("Git conflict resolution is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub async fn git_push(_vault_path: String) -> Result<GitPushResult, String> {
+pub async fn git_push(_vault_path: VaultPathArg) -> Result<GitPushResult, String> {
     Err("Git push is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub async fn git_remote_status(_vault_path: String) -> Result<GitRemoteStatus, String> {
+pub async fn git_remote_status(_vault_path: VaultPathArg) -> Result<GitRemoteStatus, String> {
     Ok(GitRemoteStatus {
         branch: String::new(),
         has_remote: false,
@@ -263,24 +332,139 @@ pub async fn git_remote_status(_vault_path: String) -> Result<GitRemoteStatus, S
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn git_discard_file(_vault_path: String, _relative_path: String) -> Result<(), String> {
+pub fn git_discard_file(
+    _vault_path: VaultPathArg,
+    _relative_path: NotePathArg,
+) -> Result<(), String> {
     Err("Git discard is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn is_git_repo(_vault_path: String) -> bool {
+pub fn is_git_repo(_vault_path: VaultPathArg) -> bool {
     false
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn init_git_repo(_vault_path: String) -> Result<(), String> {
+pub fn init_git_repo(_vault_path: VaultPathArg) -> Result<(), String> {
     Err("Git init is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn clone_repo(_url: String, _local_path: String) -> Result<String, String> {
+pub fn clone_repo(_url: RemoteUrlArg, _local_path: LocalPathArg) -> Result<String, String> {
     Err("Git clone is not available on mobile".into())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use tempfile::TempDir;
+
+    fn vault_path(dir: &TempDir) -> String {
+        dir.path().to_string_lossy().into_owned()
+    }
+
+    fn note_path(dir: &TempDir, name: &str) -> String {
+        dir.path().join(name).to_string_lossy().into_owned()
+    }
+
+    fn create_initialized_vault() -> (TempDir, String) {
+        let dir = TempDir::new().unwrap();
+        fs::write(dir.path().join("note.md"), "# Note\n").unwrap();
+        let vault = vault_path(&dir);
+        init_git_repo(vault.clone()).unwrap();
+        (dir, vault)
+    }
+
+    #[test]
+    fn desktop_git_commands_route_to_git_backend() {
+        let (dir, vault) = create_initialized_vault();
+        let note = note_path(&dir, "note.md");
+
+        assert!(is_git_repo(vault.clone()));
+
+        fs::write(dir.path().join("note.md"), "# Updated\n").unwrap();
+        let modified = get_modified_files(vault.clone()).unwrap();
+        assert!(modified.iter().any(|file| file.relative_path == "note.md"));
+
+        let diff = get_file_diff(vault.clone(), note.clone()).unwrap();
+        assert!(diff.contains("# Updated"));
+
+        git_commit(vault.clone(), "Update note".to_string()).unwrap();
+        let history = get_file_history(vault.clone(), note.clone()).unwrap();
+        assert!(history.iter().any(|commit| commit.message == "Update note"));
+
+        let last_commit = get_last_commit_info(vault.clone()).unwrap().unwrap();
+        assert!(!last_commit.short_hash.is_empty());
+
+        let commit_diff = get_file_diff_at_commit(
+            vault.clone(),
+            note.clone(),
+            history.first().unwrap().hash.clone(),
+        )
+        .unwrap();
+        assert!(commit_diff.contains("# Updated"));
+
+        let pulse = get_vault_pulse(vault.clone(), Some(5), Some(0)).unwrap();
+        assert!(!pulse.is_empty());
+
+        fs::write(dir.path().join("note.md"), "# Discard me\n").unwrap();
+        git_discard_file(vault.clone(), "note.md".to_string()).unwrap();
+        assert_eq!(
+            fs::read_to_string(dir.path().join("note.md")).unwrap(),
+            "# Updated\n"
+        );
+
+        assert!(get_conflict_files(vault.clone()).unwrap().is_empty());
+        assert_eq!(get_conflict_mode(vault.clone()), "none");
+        assert!(
+            git_resolve_conflict(vault.clone(), "note.md".to_string(), "invalid".to_string(),)
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn init_git_repo_rejects_broad_personal_folders() {
+        let dir = TempDir::new().unwrap();
+        let documents = dir.path().join("Documents");
+        fs::create_dir_all(&documents).unwrap();
+        fs::write(documents.join("unrelated.txt"), "not a vault").unwrap();
+
+        let err = init_git_repo(documents.to_string_lossy().into_owned())
+            .expect_err("expected Documents itself to be rejected before git init");
+
+        assert!(err.contains("dedicated vault folder"));
+        assert!(!documents.join(".git").exists());
+    }
+
+    #[test]
+    fn init_git_repo_allows_named_vault_subfolder_under_documents() {
+        let dir = TempDir::new().unwrap();
+        let vault = dir.path().join("Documents").join("Tolaria");
+        fs::create_dir_all(&vault).unwrap();
+        fs::write(vault.join("note.md"), "# Note\n").unwrap();
+        let vault = vault.to_string_lossy().into_owned();
+
+        init_git_repo(vault.clone()).unwrap();
+
+        assert!(is_git_repo(vault));
+    }
+
+    #[tokio::test]
+    async fn desktop_remote_commands_report_no_remote() {
+        let (_dir, vault) = create_initialized_vault();
+
+        let pull = git_pull(vault.clone()).await.unwrap();
+        assert_eq!(pull.status, "no_remote");
+
+        let push = git_push(vault.clone()).await.unwrap();
+        assert_eq!(push.status, "error");
+
+        let status = git_remote_status(vault.clone()).await.unwrap();
+        assert!(!status.has_remote);
+        assert_eq!((status.ahead, status.behind), (0, 0));
+    }
+}

src-tauri/src/commands/system.rs

@@ -131,6 +131,22 @@ pub async fn check_mcp_status(vault_path: String) -> Result<crate::mcp::McpStatu
         .map_err(|e| format!("MCP status check failed: {e}"))
 }
 
+#[cfg(desktop)]
+#[tauri::command]
+pub async fn sync_mcp_bridge_vault(
+    app: tauri::AppHandle,
+    vault_path: Option<String>,
+) -> Result<String, String> {
+    let expanded_vault_path = vault_path
+        .as_deref()
+        .map(str::trim)
+        .filter(|path| !path.is_empty())
+        .map(|path| super::expand_tilde(path).into_owned());
+    let vault_path = expanded_vault_path.as_deref().map(std::path::Path::new);
+
+    crate::sync_ws_bridge_for_vault(&app, vault_path).map(str::to_string)
+}
+
 // ── MCP commands (mobile stubs) ─────────────────────────────────────────────
 
 #[cfg(mobile)]
@@ -151,6 +167,12 @@ pub async fn check_mcp_status(_vault_path: String) -> Result<crate::mcp::McpStat
     Ok(crate::mcp::McpStatus::NotInstalled)
 }
 
+#[cfg(mobile)]
+#[tauri::command]
+pub async fn sync_mcp_bridge_vault(_vault_path: Option<String>) -> Result<String, String> {
+    Err("MCP is not available on mobile".into())
+}
+
 // ── Menu commands ───────────────────────────────────────────────────────────
 
 #[derive(Debug, Deserialize)]
@@ -162,6 +184,7 @@ pub struct MenuStateUpdate {
     has_restorable_deleted_note: Option<bool>,
     has_no_remote: Option<bool>,
     note_list_search_enabled: Option<bool>,
+    editor_find_enabled: Option<bool>,
 }
 
 #[cfg(desktop)]
@@ -186,6 +209,9 @@ pub fn update_menu_state(
     if let Some(v) = state.note_list_search_enabled {
         menu::set_note_list_search_items_enabled(&app_handle, v);
     }
+    if let Some(v) = state.editor_find_enabled {
+        menu::set_editor_find_items_enabled(&app_handle, v);
+    }
     Ok(())
 }
 

src-tauri/src/commands/vault/file_cmds.rs

@@ -165,6 +165,24 @@ fn ensure_missing_folder(folder_path: &Path, folder_name: &str) -> Result<(), St
     Ok(())
 }
 
+fn scan_visible_vault_entries(vault_path: &Path) -> Result<Vec<VaultEntry>, String> {
+    let entries = vault::scan_vault_cached(vault_path)?;
+    Ok(vault::filter_gitignored_entries(
+        vault_path,
+        entries,
+        crate::settings::hide_gitignored_files_enabled(),
+    ))
+}
+
+fn scan_visible_vault_folders(vault_path: &Path) -> Result<Vec<FolderNode>, String> {
+    let folders = vault::scan_vault_folders(vault_path)?;
+    Ok(vault::filter_gitignored_folders(
+        vault_path,
+        folders,
+        crate::settings::hide_gitignored_files_enabled(),
+    ))
+}
+
 /// Sync the `title` frontmatter field with the filename on note open.
 /// Returns `true` if the file was modified (title was absent or desynced).
 #[tauri::command]
@@ -207,10 +225,120 @@ pub fn copy_image_to_vault(
 
 #[tauri::command]
 pub fn list_vault(path: PathBuf) -> Result<Vec<VaultEntry>, String> {
-    with_expanded_vault_root(path.as_path(), vault::scan_vault_cached)
+    with_expanded_vault_root(path.as_path(), scan_visible_vault_entries)
 }
 
 #[tauri::command]
 pub fn list_vault_folders(path: PathBuf) -> Result<Vec<FolderNode>, String> {
-    with_expanded_vault_root(path.as_path(), vault::scan_vault_folders)
+    with_expanded_vault_root(path.as_path(), scan_visible_vault_folders)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use tempfile::TempDir;
+
+    fn vault_root(dir: &TempDir) -> PathBuf {
+        dir.path().to_path_buf()
+    }
+
+    fn note_path(dir: &TempDir, name: &str) -> PathBuf {
+        dir.path().join(name)
+    }
+
+    #[test]
+    fn note_content_commands_roundtrip_with_requested_vault() {
+        let dir = TempDir::new().unwrap();
+        let root = vault_root(&dir);
+        let note = note_path(&dir, "notes/command-note.md");
+
+        create_note_content(
+            note.clone(),
+            "# Command Note\n".to_string(),
+            Some(root.clone()),
+        )
+        .unwrap();
+        assert_eq!(
+            get_note_content(note.clone(), Some(root.clone())).unwrap(),
+            "# Command Note\n"
+        );
+
+        save_note_content(
+            note.clone(),
+            "---\ntitle: Command Note\n---\n# Command Note\nBody\n".to_string(),
+            Some(root.clone()),
+        )
+        .unwrap();
+        assert!(!sync_note_title(note.clone(), Some(root.clone())).unwrap());
+
+        save_note_content(
+            note.clone(),
+            "# Updated Command Note\n".to_string(),
+            Some(root.clone()),
+        )
+        .unwrap();
+        assert!(sync_note_title(note.clone(), Some(root.clone())).unwrap());
+        assert!(get_note_content(note, Some(root))
+            .unwrap()
+            .contains("title: Command Note"));
+    }
+
+    #[test]
+    fn note_content_commands_accept_windows_sensitive_valid_segments() {
+        let dir = TempDir::new().unwrap();
+        let root = vault_root(&dir);
+        let note = root
+            .join("@raflymln")
+            .join("notes with spaces")
+            .join("résumé note.md");
+
+        save_note_content(
+            note.clone(),
+            "# Windows-Sensitive Path\n\nBody\n".to_string(),
+            Some(root.clone()),
+        )
+        .unwrap();
+
+        assert_eq!(
+            get_note_content(note, Some(root)).unwrap(),
+            "# Windows-Sensitive Path\n\nBody\n"
+        );
+    }
+
+    #[test]
+    fn folder_and_listing_commands_use_expanded_vault_root() {
+        let dir = TempDir::new().unwrap();
+        let root = vault_root(&dir);
+        fs::write(dir.path().join("root.md"), "# Root\n").unwrap();
+
+        assert_eq!(
+            create_vault_folder(root.clone(), PathBuf::from("Projects")).unwrap(),
+            "Projects"
+        );
+        fs::write(dir.path().join("Projects/project.md"), "# Project\n").unwrap();
+
+        let entries = list_vault(root.clone()).unwrap();
+        assert!(entries.iter().any(|entry| entry.filename == "root.md"));
+        assert!(entries.iter().any(|entry| entry.filename == "project.md"));
+
+        let folders = list_vault_folders(root).unwrap();
+        assert!(folders.iter().any(|folder| folder.name == "Projects"));
+    }
+
+    #[test]
+    fn commands_reject_paths_outside_requested_vault() {
+        let vault = TempDir::new().unwrap();
+        let outside = TempDir::new().unwrap();
+        let outside_note = outside.path().join("outside.md");
+        fs::write(&outside_note, "# Outside\n").unwrap();
+
+        let error = get_note_content(outside_note, Some(vault.path().to_path_buf())).unwrap_err();
+        assert!(error.contains("Path must stay inside the active vault"));
+
+        let folder_error =
+            create_vault_folder(vault.path().to_path_buf(), PathBuf::from("../escape"))
+                .unwrap_err();
+        assert!(folder_error.contains("Path must stay inside the active vault"));
+    }
 }

src-tauri/src/commands/vault/rename_cmds.rs

@@ -113,3 +113,118 @@ pub fn update_wikilinks_for_renames(
     let vault_path = expand_tilde(&vault_path);
     vault::update_wikilinks_for_renames(Path::new(vault_path.as_ref()), &renames)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use tempfile::TempDir;
+
+    fn vault_path(dir: &TempDir) -> String {
+        dir.path().to_string_lossy().into_owned()
+    }
+
+    fn write_note(dir: &TempDir, relative_path: &str, content: &str) -> String {
+        let path = dir.path().join(relative_path);
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent).unwrap();
+        }
+        fs::write(&path, content).unwrap();
+        path.to_string_lossy().into_owned()
+    }
+
+    #[test]
+    fn rename_note_command_updates_title_file_and_links() {
+        let dir = TempDir::new().unwrap();
+        let vault = vault_path(&dir);
+        let old_path = write_note(
+            &dir,
+            "old-title.md",
+            "---\ntitle: Old Title\n---\n# Old Title\n",
+        );
+        let linked_path = write_note(&dir, "linked.md", "See [[Old Title]].\n");
+
+        let result = rename_note(
+            vault.clone(),
+            old_path.clone(),
+            "New Title".to_string(),
+            None,
+        )
+        .unwrap();
+
+        assert!(result.new_path.ends_with("new-title.md"));
+        assert!(!Path::new(&old_path).exists());
+        assert!(Path::new(&result.new_path).exists());
+        assert!(fs::read_to_string(linked_path)
+            .unwrap()
+            .contains("[[new-title]]"));
+        assert_eq!(result.failed_updates, 0);
+    }
+
+    #[test]
+    fn filename_and_folder_commands_preserve_note_content() {
+        let dir = TempDir::new().unwrap();
+        let vault = vault_path(&dir);
+        let old_path = write_note(
+            &dir,
+            "draft.md",
+            "---\ntitle: Draft Title\n---\n# Draft Title\n",
+        );
+
+        let renamed =
+            rename_note_filename(vault.clone(), old_path, "custom-name".to_string()).unwrap();
+        assert!(renamed.new_path.ends_with("custom-name.md"));
+
+        fs::create_dir(dir.path().join("Projects")).unwrap();
+        let moved = move_note_to_folder(
+            vault.clone(),
+            renamed.new_path.clone(),
+            "Projects".to_string(),
+        )
+        .unwrap();
+
+        assert!(moved.new_path.ends_with("Projects/custom-name.md"));
+        assert!(fs::read_to_string(moved.new_path)
+            .unwrap()
+            .contains("Draft Title"));
+    }
+
+    #[test]
+    fn auto_rename_and_detected_rename_commands_route_through_vault() {
+        let dir = TempDir::new().unwrap();
+        let vault = vault_path(&dir);
+        let untitled = write_note(&dir, "untitled-note-123.md", "# Project Plan\n");
+
+        let auto = auto_rename_untitled(vault.clone(), untitled)
+            .unwrap()
+            .unwrap();
+        assert!(auto.new_path.ends_with("project-plan.md"));
+
+        crate::git::init_repo(&vault).unwrap();
+        let old_path = dir.path().join("project-plan.md");
+        let new_path = dir.path().join("plans.md");
+        fs::rename(&old_path, &new_path).unwrap();
+        crate::hidden_command("git")
+            .args(["add", "-A"])
+            .current_dir(dir.path())
+            .output()
+            .unwrap();
+
+        let renames = detect_renames(vault.clone()).unwrap();
+        assert_eq!(renames.len(), 1);
+        assert_eq!(renames[0].old_path, "project-plan.md");
+        assert_eq!(renames[0].new_path, "plans.md");
+
+        assert_eq!(update_wikilinks_for_renames(vault, renames).unwrap(), 0);
+    }
+
+    #[test]
+    fn move_note_to_folder_rejects_empty_folder() {
+        let dir = TempDir::new().unwrap();
+        let vault = vault_path(&dir);
+        let note = write_note(&dir, "note.md", "# Note\n");
+
+        let error = move_note_to_folder(vault, note, "  ".to_string()).unwrap_err();
+        assert!(error.contains("Folder path cannot be empty"));
+    }
+}