fix: detect nvm pi installs

.codescene-thresholds

@@ -1,2 +1,2 @@
-HOTSPOT_THRESHOLD=9.94
-AVERAGE_THRESHOLD=9.83
+HOTSPOT_THRESHOLD=10.0
+AVERAGE_THRESHOLD=9.89

.env.example

@@ -12,3 +12,7 @@ VITE_SENTRY_DSN=
 # PostHog (https://posthog.com → Project → Settings → Project API Key)
 VITE_POSTHOG_KEY=
 VITE_POSTHOG_HOST=https://eu.i.posthog.com
+
+# Lara CLI (https://github.com/translated/lara-cli)
+LARA_ACCESS_KEY_ID=
+LARA_ACCESS_KEY_SECRET=

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+custom: https://refactoring.fm/

.github/workflows/ci.yml

@@ -65,22 +65,18 @@ jobs:
       - name: Vite build check
         run: pnpm build
 
-      # ── 1. Tests ──────────────────────────────────────────────────────────
-      - name: Run frontend tests
-        run: pnpm test
-
+      # ── 1. Coverage-backed tests ──────────────────────────────────────────
+      # The coverage commands run the same frontend and Rust test suites, so keep
+      # them as the canonical test lane instead of running every suite twice.
       - name: Bundle MCP server resources (required by Tauri build)
         run: node scripts/bundle-mcp-server.mjs
 
-      - name: Run Rust tests
-        run: cargo test --manifest-path=src-tauri/Cargo.toml
-
-      # ── 2. Coverage (enforced — fails build if thresholds not met) ────────
-      - name: Frontend coverage (≥70% lines/functions/branches/statements)
+      # ── 2. Tests + coverage (enforced — fails build if thresholds not met) ─
+      - name: Frontend tests + coverage (≥70% lines/functions/branches/statements)
         run: pnpm test:coverage
         # Thresholds configured in vite.config.ts — exits non-zero if coverage drops
 
-      - name: Rust coverage (≥85% lines)
+      - name: Rust tests + coverage (≥85% lines)
         run: |
           cargo llvm-cov \
             --manifest-path src-tauri/Cargo.toml \
@@ -167,3 +163,63 @@ jobs:
 
       - name: Format check (Rust)
         run: cargo fmt --manifest-path=src-tauri/Cargo.toml -- --check
+
+  linux-build:
+    name: Linux build verification
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Tauri Linux system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libsoup-3.0-dev \
+            libxdo-dev \
+            libssl-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            build-essential \
+            file
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            src-tauri/target
+          key: ${{ runner.os }}-cargo-${{ env.RUST_TARGET_CACHE_VERSION }}-${{ hashFiles('src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-${{ env.RUST_TARGET_CACHE_VERSION }}-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Frontend build
+        run: pnpm build
+
+      - name: Cargo check
+        run: cargo check --manifest-path=src-tauri/Cargo.toml
+
+      - name: Clippy
+        run: cargo clippy --manifest-path=src-tauri/Cargo.toml -- -D warnings

.github/workflows/release-stable.yml

@@ -50,7 +50,7 @@ jobs:
           echo "### Stable version: \`$DISPLAY_VERSION\`" >> "$GITHUB_STEP_SUMMARY"
 
   # ─────────────────────────────────────────────────────────────
-  # Phase 2: Build each architecture in parallel
+  # Phase 2: Build release bundles in parallel
   # ─────────────────────────────────────────────────────────────
   build:
     name: Build (${{ matrix.arch }})
@@ -62,6 +62,8 @@ jobs:
         include:
           - arch: aarch64
             target: aarch64-apple-darwin
+          - arch: x86_64
+            target: x86_64-apple-darwin
     steps:
       - uses: actions/checkout@v4
 
@@ -227,6 +229,7 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
           VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
@@ -249,12 +252,245 @@ jobs:
             src-tauri/target/${{ matrix.target }}/release/bundle/macos/*.app.tar.gz.sig
           retention-days: 1
 
+  build-linux:
+    name: Build (linux-x86_64)
+    needs: version
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Tauri Linux system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libsoup-3.0-dev \
+            libxdo-dev \
+            libssl-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            curl \
+            wget \
+            patchelf \
+            build-essential \
+            file
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-unknown-linux-gnu
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            src-tauri/target
+          key: ${{ runner.os }}-release-cargo-x86_64-unknown-linux-gnu-${{ env.RUST_TARGET_CACHE_VERSION }}-${{ hashFiles('src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-release-cargo-x86_64-unknown-linux-gnu-${{ env.RUST_TARGET_CACHE_VERSION }}-
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Clear cached bundle artifacts
+        run: |
+          rm -rf src-tauri/target/x86_64-unknown-linux-gnu/release/bundle
+
+      - name: Set version
+        run: |
+          VERSION="${{ needs.version.outputs.version }}"
+          jq --arg v "$VERSION" '.version = $v' src-tauri/tauri.conf.json > tmp.json && mv tmp.json src-tauri/tauri.conf.json
+          sed -i "s/^version = \".*\"/version = \"$VERSION\"/" src-tauri/Cargo.toml
+
+      - name: Build Tauri app (Linux bundles)
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+          VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+          VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
+          VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
+        run: |
+          pnpm tauri build --target x86_64-unknown-linux-gnu --bundles deb,appimage
+
+      - name: Validate Linux bundles
+        run: |
+          shopt -s nullglob
+          installers=(
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/deb/*.deb
+          )
+          signatures=(
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.sig
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.tar.gz.sig
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/deb/*.deb.sig
+          )
+          if [ ${#installers[@]} -eq 0 ]; then
+            echo "::error::Linux build produced no AppImage or deb bundle."
+            exit 1
+          fi
+          if [ ${#signatures[@]} -eq 0 ]; then
+            echo "::error::Linux build produced no updater signature (.sig) artifact."
+            exit 1
+          fi
+
+      - name: Upload Linux bundles
+        uses: actions/upload-artifact@v4
+        with:
+          name: linux-x86_64-bundles
+          path: |
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/deb/*.deb
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/deb/*.deb.sig
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.sig
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.tar.gz
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.tar.gz.sig
+          if-no-files-found: error
+          retention-days: 1
+
+  build-windows:
+    name: Build (windows-x86_64)
+    needs: version
+    runs-on: windows-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            src-tauri\target
+          key: ${{ runner.os }}-release-cargo-x86_64-pc-windows-msvc-${{ env.RUST_TARGET_CACHE_VERSION }}-${{ hashFiles('src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-release-cargo-x86_64-pc-windows-msvc-${{ env.RUST_TARGET_CACHE_VERSION }}-
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Clear cached Windows bundle artifacts
+        shell: pwsh
+        run: |
+          Remove-Item -Recurse -Force -ErrorAction SilentlyContinue "src-tauri/target/x86_64-pc-windows-msvc/release/bundle"
+
+      - name: Set version
+        shell: pwsh
+        run: |
+          $version = "${{ needs.version.outputs.version }}"
+          $tauri = Get-Content "src-tauri/tauri.conf.json" | ConvertFrom-Json
+          $tauri.version = $version
+          $tauri | ConvertTo-Json -Depth 100 | Set-Content "src-tauri/tauri.conf.json"
+          (Get-Content "src-tauri/Cargo.toml") -replace '^version = ".*"$', "version = `"$version`"" | Set-Content "src-tauri/Cargo.toml"
+
+      - name: Validate Windows release env
+        shell: bash
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+        run: |
+          for name in TAURI_SIGNING_PRIVATE_KEY TAURI_KEY_PASSWORD; do
+            if [ -z "${!name}" ]; then
+              echo "::error::$name is required to build signed Windows updater artifacts."
+              exit 1
+            fi
+          done
+
+      - name: Build Tauri app (Windows bundles)
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+          VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+          VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
+          VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
+        run: |
+          pnpm tauri build --target x86_64-pc-windows-msvc --bundles nsis
+
+      - name: Validate Windows bundles
+        shell: bash
+        run: |
+          shopt -s nullglob
+          installers=(
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi
+          )
+          signatures=(
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.nsis.zip.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi.zip.sig
+          )
+          if [ ${#installers[@]} -eq 0 ]; then
+            echo "::error::Windows build produced no installable NSIS or MSI bundle."
+            exit 1
+          fi
+          for installer in "${installers[@]}"; do
+            if [[ "$(basename "$installer")" != *"${{ needs.version.outputs.version }}"* ]]; then
+              echo "::error::Windows build produced an installer for a different version: $(basename "$installer")"
+              exit 1
+            fi
+          done
+          if [ ${#signatures[@]} -eq 0 ]; then
+            echo "::error::Windows build produced no updater signature (.sig) artifact."
+            exit 1
+          fi
+
+      - name: Upload Windows bundles
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-x86_64-bundles
+          path: |
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.zip
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.zip.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.zip
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.zip.sig
+          if-no-files-found: error
+          retention-days: 1
+
   # ─────────────────────────────────────────────────────────────
   # Phase 3: Publish GitHub Release
   # ─────────────────────────────────────────────────────────────
   release:
     name: GitHub Release (stable)
-    needs: [version, build]
+    needs: [version, build, build-linux, build-windows]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -266,6 +502,54 @@ jobs:
       - name: Download all artifacts
         uses: actions/download-artifact@v4
 
+      - name: Normalize macOS release artifact names
+        run: |
+          normalize_macos_artifacts() {
+            local arch="$1"
+            local normalized_updater="$2"
+            local normalized_dmg="$3"
+            local updater_dir="updater-${arch}"
+            local updater_file
+            updater_file=$(find "$updater_dir" -maxdepth 1 -name "*.app.tar.gz" -print -quit)
+            if [ -z "$updater_file" ]; then
+              echo "::error::Missing macOS updater artifact in ${updater_dir}" >&2
+              return 1
+            fi
+
+            local sig_file="${updater_file}.sig"
+            if [ ! -f "$sig_file" ]; then
+              echo "::error::Missing macOS updater signature for ${updater_file}" >&2
+              return 1
+            fi
+
+            local normalized_sig="${normalized_updater}.sig"
+            if [ "$updater_file" != "$normalized_updater" ]; then
+              mv "$updater_file" "$normalized_updater"
+            fi
+            if [ "$sig_file" != "$normalized_sig" ]; then
+              mv "$sig_file" "$normalized_sig"
+            fi
+
+            local dmg_dir="dmg-${arch}"
+            local dmg_file
+            dmg_file=$(find "$dmg_dir" -maxdepth 1 -name "*.dmg" -print -quit)
+            if [ -z "$dmg_file" ]; then
+              echo "::error::Missing macOS DMG artifact in ${dmg_dir}" >&2
+              return 1
+            fi
+
+            if [ "$dmg_file" != "$normalized_dmg" ]; then
+              mv "$dmg_file" "$normalized_dmg"
+            fi
+          }
+
+          normalize_macos_artifacts aarch64 \
+            "updater-aarch64/Tolaria_${{ needs.version.outputs.version }}_macOS_Silicon.app.tar.gz" \
+            "dmg-aarch64/Tolaria_${{ needs.version.outputs.version }}_macOS_Silicon.dmg"
+          normalize_macos_artifacts x86_64 \
+            "updater-x86_64/Tolaria_${{ needs.version.outputs.version }}_macOS_Intel.app.tar.gz" \
+            "dmg-x86_64/Tolaria_${{ needs.version.outputs.version }}_macOS_Intel.dmg"
+
       - name: Generate release notes
         run: |
           PREV_TAG=$(git tag --list 'stable-v*' --sort=-version:refname | grep -vx "${{ needs.version.outputs.tag }}" | head -n 1 || echo "")
@@ -282,7 +566,7 @@ jobs:
             echo "---"
             echo "**Stable release — manually promoted from \`main\`**"
             echo ""
-            echo "**Requires Apple Silicon (M1/M2/M3)**"
+            echo "**Includes macOS (Apple Silicon and Intel), Windows x64, and Linux x64 bundles**"
             echo ""
             echo "*Built from \`$(git rev-parse --short ${{ needs.version.outputs.tag }})\` on $(date -u +%Y-%m-%d)*"
           } > release_notes.md
@@ -295,9 +579,42 @@ jobs:
           REPO_NAME="${REPO#*/}"
           PAGES_URL="https://refactoringhq.github.io/${REPO_NAME}/"
 
-          ARM_SIG=$(cat updater-aarch64/*.app.tar.gz.sig)
-          ARM_TARBALL=$(ls updater-aarch64/*.app.tar.gz | xargs basename)
-          ARM_DMG=$(ls dmg-aarch64/*.dmg | xargs basename)
+          find_required() {
+            local patterns=("$@")
+            for pattern in "${patterns[@]}"; do
+              set -- $pattern
+              if [ -e "$1" ]; then
+                printf '%s\n' "$1"
+                return 0
+              fi
+            done
+            echo "::error::Missing required artifact matching one of: ${patterns[*]}" >&2
+            return 1
+          }
+
+          ARM_SIG_FILE=$(find_required "updater-aarch64/*.app.tar.gz.sig")
+          ARM_UPDATER_FILE="${ARM_SIG_FILE%.sig}"
+          ARM_SIG=$(cat "$ARM_SIG_FILE")
+          ARM_TARBALL=$(basename "$ARM_UPDATER_FILE")
+          ARM_DMG=$(basename "$(find_required "dmg-aarch64/*.dmg")")
+
+          INTEL_SIG_FILE=$(find_required "updater-x86_64/*.app.tar.gz.sig")
+          INTEL_UPDATER_FILE="${INTEL_SIG_FILE%.sig}"
+          INTEL_SIG=$(cat "$INTEL_SIG_FILE")
+          INTEL_TARBALL=$(basename "$INTEL_UPDATER_FILE")
+          INTEL_DMG=$(basename "$(find_required "dmg-x86_64/*.dmg")")
+
+          LINUX_SIG_FILE=$(find_required "linux-x86_64-bundles/*/*.AppImage.sig" "linux-x86_64-bundles/*/*.AppImage.tar.gz.sig" "linux-x86_64-bundles/*/*.deb.sig" "linux-x86_64-bundles/*.AppImage.sig" "linux-x86_64-bundles/*.AppImage.tar.gz.sig" "linux-x86_64-bundles/*.deb.sig")
+          LINUX_UPDATER_FILE="${LINUX_SIG_FILE%.sig}"
+          LINUX_SIG=$(cat "$LINUX_SIG_FILE")
+          LINUX_UPDATER=$(basename "$LINUX_UPDATER_FILE")
+          LINUX_DOWNLOAD=$(basename "$(find_required "linux-x86_64-bundles/*/*.AppImage" "linux-x86_64-bundles/*/*.deb" "linux-x86_64-bundles/*/*.AppImage.tar.gz" "linux-x86_64-bundles/*.AppImage" "linux-x86_64-bundles/*.deb" "linux-x86_64-bundles/*.AppImage.tar.gz")")
+
+          WINDOWS_SIG_FILE=$(find_required "windows-x86_64-bundles/*/*-setup.exe.sig" "windows-x86_64-bundles/*/*.msi.sig" "windows-x86_64-bundles/*/*.nsis.zip.sig" "windows-x86_64-bundles/*/*.msi.zip.sig" "windows-x86_64-bundles/*-setup.exe.sig" "windows-x86_64-bundles/*.msi.sig" "windows-x86_64-bundles/*.nsis.zip.sig" "windows-x86_64-bundles/*.msi.zip.sig")
+          WINDOWS_UPDATER_FILE="${WINDOWS_SIG_FILE%.sig}"
+          WINDOWS_SIG=$(cat "$WINDOWS_SIG_FILE")
+          WINDOWS_UPDATER=$(basename "$WINDOWS_UPDATER_FILE")
+          WINDOWS_DOWNLOAD=$(basename "$(find_required "windows-x86_64-bundles/*/*-setup.exe" "windows-x86_64-bundles/*/*.msi" "windows-x86_64-bundles/*/*.nsis.zip" "windows-x86_64-bundles/*/*.msi.zip" "windows-x86_64-bundles/*-setup.exe" "windows-x86_64-bundles/*.msi" "windows-x86_64-bundles/*.nsis.zip" "windows-x86_64-bundles/*.msi.zip")")
 
           cat > stable-latest.json << EOF
           {
@@ -309,6 +626,21 @@ jobs:
                 "signature": "${ARM_SIG}",
                 "url": "https://github.com/${REPO}/releases/download/${TAG}/${ARM_TARBALL}",
                 "dmg_url": "https://github.com/${REPO}/releases/download/${TAG}/${ARM_DMG}"
+              },
+              "darwin-x86_64": {
+                "signature": "${INTEL_SIG}",
+                "url": "https://github.com/${REPO}/releases/download/${TAG}/${INTEL_TARBALL}",
+                "dmg_url": "https://github.com/${REPO}/releases/download/${TAG}/${INTEL_DMG}"
+              },
+              "linux-x86_64": {
+                "signature": "${LINUX_SIG}",
+                "url": "https://github.com/${REPO}/releases/download/${TAG}/${LINUX_UPDATER}",
+                "download_url": "https://github.com/${REPO}/releases/download/${TAG}/${LINUX_DOWNLOAD}"
+              },
+              "windows-x86_64": {
+                "signature": "${WINDOWS_SIG}",
+                "url": "https://github.com/${REPO}/releases/download/${TAG}/${WINDOWS_UPDATER}",
+                "download_url": "https://github.com/${REPO}/releases/download/${TAG}/${WINDOWS_DOWNLOAD}"
               }
             }
           }
@@ -327,6 +659,33 @@ jobs:
             dmg-aarch64/*.dmg
             updater-aarch64/*.app.tar.gz
             updater-aarch64/*.app.tar.gz.sig
+            dmg-x86_64/*.dmg
+            updater-x86_64/*.app.tar.gz
+            updater-x86_64/*.app.tar.gz.sig
+            linux-x86_64-bundles/*.deb
+            linux-x86_64-bundles/*.deb.sig
+            linux-x86_64-bundles/*.AppImage
+            linux-x86_64-bundles/*.AppImage.sig
+            linux-x86_64-bundles/*.AppImage.tar.gz
+            linux-x86_64-bundles/*.AppImage.tar.gz.sig
+            linux-x86_64-bundles/*/*.deb
+            linux-x86_64-bundles/*/*.deb.sig
+            linux-x86_64-bundles/*/*.AppImage
+            linux-x86_64-bundles/*/*.AppImage.sig
+            linux-x86_64-bundles/*/*.AppImage.tar.gz
+            linux-x86_64-bundles/*/*.AppImage.tar.gz.sig
+            windows-x86_64-bundles/*.exe
+            windows-x86_64-bundles/*.exe.sig
+            windows-x86_64-bundles/*.msi
+            windows-x86_64-bundles/*.msi.sig
+            windows-x86_64-bundles/*.zip
+            windows-x86_64-bundles/*.zip.sig
+            windows-x86_64-bundles/*/*.exe
+            windows-x86_64-bundles/*/*.exe.sig
+            windows-x86_64-bundles/*/*.msi
+            windows-x86_64-bundles/*/*.msi.sig
+            windows-x86_64-bundles/*/*.zip
+            windows-x86_64-bundles/*/*.zip.sig
             stable-latest.json
 
   # ─────────────────────────────────────────────────────────────

.github/workflows/release.yml

@@ -121,6 +121,8 @@ jobs:
         include:
           - arch: aarch64
             target: aarch64-apple-darwin
+          - arch: x86_64
+            target: x86_64-apple-darwin
     steps:
       - uses: actions/checkout@v4
 
@@ -286,6 +288,7 @@ jobs:
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
           SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
           VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
           VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
@@ -303,13 +306,245 @@ jobs:
             src-tauri/target/${{ matrix.target }}/release/bundle/macos/*.app.tar.gz.sig
           retention-days: 1
 
+  build-linux:
+    name: Build (linux-x86_64)
+    needs: version
+    runs-on: ubuntu-22.04
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Tauri Linux system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libsoup-3.0-dev \
+            libxdo-dev \
+            libssl-dev \
+            libayatana-appindicator3-dev \
+            librsvg2-dev \
+            curl \
+            wget \
+            patchelf \
+            build-essential \
+            file
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-unknown-linux-gnu
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            src-tauri/target
+          key: ${{ runner.os }}-release-cargo-x86_64-unknown-linux-gnu-${{ env.RUST_TARGET_CACHE_VERSION }}-${{ hashFiles('src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-release-cargo-x86_64-unknown-linux-gnu-${{ env.RUST_TARGET_CACHE_VERSION }}-
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Clear cached bundle artifacts
+        run: |
+          rm -rf src-tauri/target/x86_64-unknown-linux-gnu/release/bundle
+
+      - name: Set version
+        run: |
+          VERSION="${{ needs.version.outputs.version }}"
+          jq --arg v "$VERSION" '.version = $v' src-tauri/tauri.conf.json > tmp.json && mv tmp.json src-tauri/tauri.conf.json
+          sed -i "s/^version = \".*\"/version = \"$VERSION\"/" src-tauri/Cargo.toml
+
+      - name: Build Tauri app (Linux bundles)
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+          VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+          VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
+          VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
+        run: |
+          pnpm tauri build --target x86_64-unknown-linux-gnu --bundles deb,appimage
+
+      - name: Validate Linux bundles
+        run: |
+          shopt -s nullglob
+          installers=(
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/deb/*.deb
+          )
+          signatures=(
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.sig
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.tar.gz.sig
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/deb/*.deb.sig
+          )
+          if [ ${#installers[@]} -eq 0 ]; then
+            echo "::error::Linux build produced no AppImage or deb bundle."
+            exit 1
+          fi
+          if [ ${#signatures[@]} -eq 0 ]; then
+            echo "::error::Linux build produced no updater signature (.sig) artifact."
+            exit 1
+          fi
+
+      - name: Upload Linux bundles
+        uses: actions/upload-artifact@v4
+        with:
+          name: linux-x86_64-bundles
+          path: |
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/deb/*.deb
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/deb/*.deb.sig
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.sig
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.tar.gz
+            src-tauri/target/x86_64-unknown-linux-gnu/release/bundle/appimage/*.AppImage.tar.gz.sig
+          if-no-files-found: error
+          retention-days: 1
+
+  build-windows:
+    name: Build (windows-x86_64)
+    needs: version
+    runs-on: windows-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'pnpm'
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: x86_64-pc-windows-msvc
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~\.cargo\registry
+            ~\.cargo\git
+            src-tauri\target
+          key: ${{ runner.os }}-release-cargo-x86_64-pc-windows-msvc-${{ env.RUST_TARGET_CACHE_VERSION }}-${{ hashFiles('src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-release-cargo-x86_64-pc-windows-msvc-${{ env.RUST_TARGET_CACHE_VERSION }}-
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Clear cached Windows bundle artifacts
+        shell: pwsh
+        run: |
+          Remove-Item -Recurse -Force -ErrorAction SilentlyContinue "src-tauri/target/x86_64-pc-windows-msvc/release/bundle"
+
+      - name: Set version
+        shell: pwsh
+        run: |
+          $version = "${{ needs.version.outputs.version }}"
+          $tauri = Get-Content "src-tauri/tauri.conf.json" | ConvertFrom-Json
+          $tauri.version = $version
+          $tauri | ConvertTo-Json -Depth 100 | Set-Content "src-tauri/tauri.conf.json"
+          (Get-Content "src-tauri/Cargo.toml") -replace '^version = ".*"$', "version = `"$version`"" | Set-Content "src-tauri/Cargo.toml"
+
+      - name: Validate Windows release env
+        shell: bash
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+        run: |
+          for name in TAURI_SIGNING_PRIVATE_KEY TAURI_KEY_PASSWORD; do
+            if [ -z "${!name}" ]; then
+              echo "::error::$name is required to build signed Windows updater artifacts."
+              exit 1
+            fi
+          done
+
+      - name: Build Tauri app (Windows bundles)
+        env:
+          TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_KEY_PASSWORD }}
+          VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+          VITE_SENTRY_RELEASE: ${{ needs.version.outputs.version }}
+          SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+          VITE_POSTHOG_KEY: ${{ secrets.VITE_POSTHOG_KEY }}
+          VITE_POSTHOG_HOST: ${{ secrets.VITE_POSTHOG_HOST }}
+        run: |
+          pnpm tauri build --target x86_64-pc-windows-msvc --bundles nsis
+
+      - name: Validate Windows bundles
+        shell: bash
+        run: |
+          shopt -s nullglob
+          installers=(
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi
+          )
+          signatures=(
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*-setup.exe.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.nsis.zip.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi.zip.sig
+          )
+          if [ ${#installers[@]} -eq 0 ]; then
+            echo "::error::Windows build produced no installable NSIS or MSI bundle."
+            exit 1
+          fi
+          for installer in "${installers[@]}"; do
+            if [[ "$(basename "$installer")" != *"${{ needs.version.outputs.version }}"* ]]; then
+              echo "::error::Windows build produced an installer for a different version: $(basename "$installer")"
+              exit 1
+            fi
+          done
+          if [ ${#signatures[@]} -eq 0 ]; then
+            echo "::error::Windows build produced no updater signature (.sig) artifact."
+            exit 1
+          fi
+
+      - name: Upload Windows bundles
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-x86_64-bundles
+          path: |
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.exe.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.zip
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/nsis/*.zip.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.msi.sig
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.zip
+            src-tauri/target/x86_64-pc-windows-msvc/release/bundle/msi/*.zip.sig
+          if-no-files-found: error
+          retention-days: 1
   # ─────────────────────────────────────────────────────────────
   # Phase 3: Publish GitHub Release
   # No lipo/re-signing — use the per-arch artifacts directly
   # ─────────────────────────────────────────────────────────────
   release:
     name: GitHub Release (alpha)
-    needs: [version, build]
+    needs: [version, build, build-linux, build-windows]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -321,6 +556,37 @@ jobs:
       - name: Download all artifacts
         uses: actions/download-artifact@v4
 
+      - name: Normalize macOS updater artifact names
+        run: |
+          normalize_updater() {
+            local arch="$1"
+            local normalized_updater="$2"
+            local artifact_dir="updater-${arch}"
+            local updater_file
+            updater_file=$(find "$artifact_dir" -maxdepth 1 -name "*.app.tar.gz" -print -quit)
+            if [ -z "$updater_file" ]; then
+              echo "::error::Missing macOS updater artifact in ${artifact_dir}" >&2
+              return 1
+            fi
+
+            local sig_file="${updater_file}.sig"
+            if [ ! -f "$sig_file" ]; then
+              echo "::error::Missing macOS updater signature for ${updater_file}" >&2
+              return 1
+            fi
+
+            local normalized_sig="${normalized_updater}.sig"
+            if [ "$updater_file" != "$normalized_updater" ]; then
+              mv "$updater_file" "$normalized_updater"
+            fi
+            if [ "$sig_file" != "$normalized_sig" ]; then
+              mv "$sig_file" "$normalized_sig"
+            fi
+          }
+
+          normalize_updater aarch64 "updater-aarch64/Tolaria_${{ needs.version.outputs.version }}_macOS_Silicon.app.tar.gz"
+          normalize_updater x86_64 "updater-x86_64/Tolaria_${{ needs.version.outputs.version }}_macOS_Intel.app.tar.gz"
+
       - name: Generate release notes
         run: |
           PREV_TAG=$(python3 <<'PY'
@@ -357,7 +623,7 @@ jobs:
             echo "---"
             echo "**Alpha build — updated on every push to \`main\`**"
             echo ""
-            echo "**Requires Apple Silicon (M1/M2/M3)**"
+            echo "**Includes macOS (Apple Silicon and Intel), Linux x64, and Windows x64 bundles**"
             echo ""
             echo "*Built from \`$(git rev-parse --short HEAD)\` on $(date -u +%Y-%m-%d)*"
           } > release_notes.md
@@ -370,8 +636,38 @@ jobs:
           REPO_NAME="${REPO#*/}"
           PAGES_URL="https://refactoringhq.github.io/${REPO_NAME}/"
 
-          ARM_SIG=$(cat updater-aarch64/*.app.tar.gz.sig)
-          ARM_TARBALL=$(ls updater-aarch64/*.app.tar.gz | xargs basename)
+          find_required() {
+            for pattern in "$@"; do
+              set -- $pattern
+              if [ -e "$1" ]; then
+                printf '%s\n' "$1"
+                return 0
+              fi
+            done
+            return 1
+          }
+
+          ARM_SIG_FILE=$(find_required "updater-aarch64/*.app.tar.gz.sig")
+          ARM_UPDATER_FILE="${ARM_SIG_FILE%.sig}"
+          ARM_SIG=$(cat "$ARM_SIG_FILE")
+          ARM_UPDATER=$(basename "$ARM_UPDATER_FILE")
+
+          INTEL_SIG_FILE=$(find_required "updater-x86_64/*.app.tar.gz.sig")
+          INTEL_UPDATER_FILE="${INTEL_SIG_FILE%.sig}"
+          INTEL_SIG=$(cat "$INTEL_SIG_FILE")
+          INTEL_UPDATER=$(basename "$INTEL_UPDATER_FILE")
+
+          LINUX_SIG_FILE=$(find_required "linux-x86_64-bundles/*/*.AppImage.sig" "linux-x86_64-bundles/*/*.AppImage.tar.gz.sig" "linux-x86_64-bundles/*/*.deb.sig" "linux-x86_64-bundles/*.AppImage.sig" "linux-x86_64-bundles/*.AppImage.tar.gz.sig" "linux-x86_64-bundles/*.deb.sig")
+          LINUX_UPDATER_FILE="${LINUX_SIG_FILE%.sig}"
+          LINUX_SIG=$(cat "$LINUX_SIG_FILE")
+          LINUX_UPDATER=$(basename "$LINUX_UPDATER_FILE")
+          LINUX_DOWNLOAD=$(basename "$(find_required "linux-x86_64-bundles/*/*.AppImage" "linux-x86_64-bundles/*/*.deb" "linux-x86_64-bundles/*/*.AppImage.tar.gz" "linux-x86_64-bundles/*.AppImage" "linux-x86_64-bundles/*.deb" "linux-x86_64-bundles/*.AppImage.tar.gz")")
+
+          WINDOWS_SIG_FILE=$(find_required "windows-x86_64-bundles/*/*-setup.exe.sig" "windows-x86_64-bundles/*/*.msi.sig" "windows-x86_64-bundles/*/*.nsis.zip.sig" "windows-x86_64-bundles/*/*.msi.zip.sig" "windows-x86_64-bundles/*-setup.exe.sig" "windows-x86_64-bundles/*.msi.sig" "windows-x86_64-bundles/*.nsis.zip.sig" "windows-x86_64-bundles/*.msi.zip.sig")
+          WINDOWS_UPDATER_FILE="${WINDOWS_SIG_FILE%.sig}"
+          WINDOWS_SIG=$(cat "$WINDOWS_SIG_FILE")
+          WINDOWS_UPDATER=$(basename "$WINDOWS_UPDATER_FILE")
+          WINDOWS_DOWNLOAD=$(basename "$(find_required "windows-x86_64-bundles/*/*-setup.exe" "windows-x86_64-bundles/*/*.msi" "windows-x86_64-bundles/*/*.nsis.zip" "windows-x86_64-bundles/*/*.msi.zip" "windows-x86_64-bundles/*-setup.exe" "windows-x86_64-bundles/*.msi" "windows-x86_64-bundles/*.nsis.zip" "windows-x86_64-bundles/*.msi.zip")")
 
           cat > alpha-latest.json << EOF
           {
@@ -381,7 +677,23 @@ jobs:
             "platforms": {
               "darwin-aarch64": {
                 "signature": "${ARM_SIG}",
-                "url": "https://github.com/${REPO}/releases/download/${TAG}/${ARM_TARBALL}"
+                "url": "https://github.com/${REPO}/releases/download/${TAG}/${ARM_UPDATER}",
+                "download_url": "https://github.com/${REPO}/releases/download/${TAG}/${ARM_UPDATER}"
+              },
+              "darwin-x86_64": {
+                "signature": "${INTEL_SIG}",
+                "url": "https://github.com/${REPO}/releases/download/${TAG}/${INTEL_UPDATER}",
+                "download_url": "https://github.com/${REPO}/releases/download/${TAG}/${INTEL_UPDATER}"
+              },
+              "linux-x86_64": {
+                "signature": "${LINUX_SIG}",
+                "url": "https://github.com/${REPO}/releases/download/${TAG}/${LINUX_UPDATER}",
+                "download_url": "https://github.com/${REPO}/releases/download/${TAG}/${LINUX_DOWNLOAD}"
+              },
+              "windows-x86_64": {
+                "signature": "${WINDOWS_SIG}",
+                "url": "https://github.com/${REPO}/releases/download/${TAG}/${WINDOWS_UPDATER}",
+                "download_url": "https://github.com/${REPO}/releases/download/${TAG}/${WINDOWS_DOWNLOAD}"
               }
             }
           }
@@ -399,6 +711,32 @@ jobs:
           files: |
             updater-aarch64/*.app.tar.gz
             updater-aarch64/*.app.tar.gz.sig
+            updater-x86_64/*.app.tar.gz
+            updater-x86_64/*.app.tar.gz.sig
+            linux-x86_64-bundles/*.deb
+            linux-x86_64-bundles/*.deb.sig
+            linux-x86_64-bundles/*.AppImage
+            linux-x86_64-bundles/*.AppImage.sig
+            linux-x86_64-bundles/*.AppImage.tar.gz
+            linux-x86_64-bundles/*.AppImage.tar.gz.sig
+            linux-x86_64-bundles/*/*.deb
+            linux-x86_64-bundles/*/*.deb.sig
+            linux-x86_64-bundles/*/*.AppImage
+            linux-x86_64-bundles/*/*.AppImage.sig
+            linux-x86_64-bundles/*/*.AppImage.tar.gz
+            linux-x86_64-bundles/*/*.AppImage.tar.gz.sig
+            windows-x86_64-bundles/*.exe
+            windows-x86_64-bundles/*.exe.sig
+            windows-x86_64-bundles/*.msi
+            windows-x86_64-bundles/*.msi.sig
+            windows-x86_64-bundles/*.zip
+            windows-x86_64-bundles/*.zip.sig
+            windows-x86_64-bundles/*/*.exe
+            windows-x86_64-bundles/*/*.exe.sig
+            windows-x86_64-bundles/*/*.msi
+            windows-x86_64-bundles/*/*.msi.sig
+            windows-x86_64-bundles/*/*.zip
+            windows-x86_64-bundles/*/*.zip.sig
             alpha-latest.json
 
   # ─────────────────────────────────────────────────────────────

.gitignore

@@ -70,5 +70,6 @@ CODE-HEALTH-REPORT.md
 *.key.pub
 
 # Local environment variables (never commit)
+.env
 .env.local
 .env.*.local

CONTRIBUTING.md

@@ -0,0 +1,49 @@
+# Contributing to Tolaria
+
+Thanks for being here! Tolaria is still early, and every bug report, idea, and contribution genuinely helps shape the app.
+
+## 🗳️ Where to share what
+
+To keep things clean:
+
+- 🐛 Bugs → GitHub Issues
+- 💡 Feature requests / ideas → Canny • <https://tolaria.canny.io/>
+
+If you have a feature idea, please check Canny first and upvote it if it already exists.
+
+## 📥 Pull requests are welcome
+
+PRs are very welcome.
+
+A few things to keep in mind before opening one:
+
+- Bug fixes are always great
+- Small improvements are great too
+- For bigger features, please check Canny first before building
+  - Try to avoid things that are already marked **in progress**
+  - Requests marked **planned** are usually great contribution targets
+- Keep PRs small, focused, and easy to review
+- Include a short explanation of the problem and your solution
+- Follow the dev process described in Tolaria’s `AGENTS.md` (tests, code health, etc.)
+- Avoid bundling unrelated refactors into the same PR
+
+If you want to contribute a feature, the best place to start is here: <https://tolaria.canny.io/>
+
+## 📋 What makes a good bug report
+
+If you open a bug report on GitHub, it really helps to include:
+
+- your Tolaria version
+- your OS version
+- steps to reproduce
+- what you expected to happen
+- what actually happened
+- screenshots or screen recordings if useful
+
+The clearer the report, the easier it is for us to reproduce and fix it.
+
+## 🙏 Thank you
+
+Tolaria is getting better because people care enough to try it, report what’s broken, suggest what’s missing, and contribute improvements.
+
+That means a lot. Thanks for helping build it.

README.md

@@ -2,7 +2,7 @@
 
 # 💧 Tolaria
 
-Tolaria is a desktop app for Mac for managing **markdown knowledge bases**. People use it for a variety of use cases:
+Tolaria is a desktop app for Mac and Linux for managing **markdown knowledge bases**. People use it for a variety of use cases:
 
 * Operate second brains and personal knowledge
 * Organize company docs as context for AI
@@ -27,7 +27,7 @@ You can find some Loom walkthroughs below — they are short and to the point:
 - 🔬 **Open source** — Tolaria is free and open source. I built this for [myself](https://x.com/lucaronin) and for sharing it with others.
 - 📋 **Standards-based** — Notes are markdown files with YAML frontmatter. No proprietary formats, no locked-in data. Everything works with standard tools if you decide to move away from Tolaria.
 - 🔍 **Types as lenses, not schemas** — Types in Tolaria are navigation aids, not enforcement mechanisms. There's no required fields, no validation, just helpful categories for finding notes.
-- 🪄**AI-first but not AI-only** — A vault of files works very well with AI agents, but you are free to use whatever you want. We support Claude Code and Codex CLI (for now), but you can edit the vault with any AI you want. We provide an AGENTS file for your agents to figure out.
+- 🪄**AI-first but not AI-only** — A vault of files works very well with AI agents, but you are free to use whatever you want. We support Claude Code, Codex CLI, and Gemini CLI setup paths, but you can edit the vault with any AI you want. We provide an AGENTS file for your agents to figure out.
 - ⌨️ **Keyboard-first** — Tolaria is designed for power-users who want to use keyboard as much as possible. A lot of how we designed the Editor and the Command Palette is based on this.
 - 💪 **Built from real use** — Tolaria was created for manage my personal vault of 10,000+ notes, and I use it every day. Every feature exists because it solved a real problem.
 
@@ -46,7 +46,36 @@ Tolaria is open source and built with Tauri, React, and TypeScript. If you want
 - Node.js 20+
 - pnpm 8+
 - Rust stable
-- macOS for development
+- macOS or Linux for development
+
+#### Linux system dependencies
+
+Tauri 2 on Linux requires WebKit2GTK 4.1 and GTK 3:
+
+- Arch / Manjaro:
+  ```bash
+  sudo pacman -S --needed webkit2gtk-4.1 base-devel curl wget file openssl \
+    appmenu-gtk-module libappindicator-gtk3 librsvg
+  ```
+- Debian / Ubuntu (22.04+):
+  ```bash
+  sudo apt install libwebkit2gtk-4.1-dev build-essential curl wget file \
+    libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev \
+    libsoup-3.0-dev patchelf
+  ```
+- Fedora 38+:
+  ```bash
+  sudo dnf install webkit2gtk4.1-devel openssl-devel curl wget file \
+    libappindicator-gtk3-devel librsvg2-devel
+  ```
+
+The bundled MCP server still spawns the system `node` binary at runtime on Linux, so install Node from your distro package manager if you want the external AI tooling flow.
+
+### Gemini CLI setup
+
+Tolaria can register the active vault's MCP server in `~/.gemini/settings.json` from the status bar or command palette action "Set Up External AI Tools". The generated entry is scoped to the selected vault with `VAULT_PATH` and requires Node.js 18+ plus a separately installed and signed-in Gemini CLI.
+
+Use "Restore Tolaria AI Guidance" if you also want Tolaria to create a non-destructive `GEMINI.md` compatibility shim in the vault root. The shim points Gemini back to the shared `AGENTS.md` instructions and is not written over custom `GEMINI.md` content.
 
 ### Quick start
 

docs/ABSTRACTIONS.md

@@ -57,6 +57,19 @@ The frontmatter parser (Rust: `vault/mod.rs`, TS: `utils/frontmatter.ts`) must f
 
 All data lives in markdown files with YAML frontmatter. There is no database — the filesystem is the source of truth.
 
+### Vault Git Capability
+
+Git is a per-vault capability, not a prerequisite for the document model. A vault can be:
+
+| State | Meaning | UI behavior |
+|---|---|---|
+| Git-backed | The vault path contains a Git repository | History, changes, commits, sync, conflict resolution, remotes, AutoGit, and auto-sync are available according to remote/config state |
+| Non-git | The vault path is a plain folder | Markdown scanning, editing, search, and navigation work; Git-dependent status-bar controls and command-palette entries are replaced by `Git disabled` + `Initialize Git for Current Vault` |
+
+Plain folders become Git-backed only when the user explicitly runs Git initialization from the setup dialog, status bar, or command palette. Features that depend on Git must check this capability instead of assuming every vault has `.git`.
+
+Git initialization is intentionally scoped to dedicated vault folders. When the current non-git folder looks like a broad personal root such as Documents, Desktop, or Downloads and does not already carry Tolaria-managed vault markers, `init_git_repo` refuses to run Git and asks the user to select or create a dedicated subfolder instead.
+
 ### VaultEntry
 
 The core data type representing a single note, defined in Rust (`src-tauri/src/vault/mod.rs`) and TypeScript (`src/types.ts`).
@@ -132,9 +145,22 @@ interface VaultEntry {
   trashed: boolean          // Kept for backward compatibility (Trash system removed — delete is permanent)
   trashedAt: number | null  // Kept for backward compatibility (Trash system removed)
   properties: Record<string, string>  // Scalar frontmatter fields (custom properties)
+  fileKind?: 'markdown' | 'text' | 'binary'  // Controls editor/raw/preview behavior
 }
 ```
 
+### File kinds and binary previews
+
+`VaultEntry.fileKind` comes from the Rust vault scanner and intentionally stays coarse-grained:
+
+| `fileKind` | Source files | UI behavior |
+|---|---|---|
+| `markdown` or absent | `.md`, `.markdown` | Full Tolaria note model: frontmatter, BlockNote, raw editor, relationships, title sync |
+| `text` | UTF-8 editable formats such as `.yml`, `.json`, `.ts`, `.py`, `.sh` | Opens through the raw editor without Markdown note semantics |
+| `binary` | Images, PDFs, archives, other non-text files | Stays a normal vault file; previewable images open in `FilePreview`, unsupported or broken binaries show an explicit fallback |
+
+Image previewability is inferred in the renderer from the filename extension (`src/utils/filePreview.ts`) rather than stored as a new persisted kind. This keeps the filesystem as source of truth and avoids converting assets into proprietary objects.
+
 ### Entity Types (isA / type)
 
 Entity type is stored in the `type:` frontmatter field (e.g. `type: Quarter`). The legacy field name `Is A:` is still accepted as an alias for backwards compatibility but new notes use `type:`. The `VaultEntry.isA` property in TypeScript/Rust holds the resolved value.
@@ -149,6 +175,7 @@ Type is determined **purely** from the `type:` frontmatter field — it is never
 ├── some-topic.md          ← type: Topic
 ├── AGENTS.md              ← canonical Tolaria AI guidance
 ├── CLAUDE.md              ← compatibility shim pointing at AGENTS.md
+├── GEMINI.md              ← optional Gemini CLI shim pointing at AGENTS.md
 ├── ...
 └── type/                  ← type definition documents
 ```
@@ -240,6 +267,9 @@ Tolaria separates **display title** from the file identifier:
 - **Display title resolution** (`extract_title` in `vault/parsing.rs`): first `# H1` on the first non-empty body line, then legacy frontmatter `title:`, then slug-to-title from the filename stem.
 - **Opening a note is read-only**: selecting a note does not inject or auto-correct `title:` frontmatter.
 - **Explicit filename actions** (`rename_note`): breadcrumb rename/sync actions stage crash-safe note renames through a hidden `.tolaria-rename-txn/` transaction directory, recover unfinished renames on the next vault scan, update wikilinks across the vault, and surface any failed backlink rewrites instead of silently reporting partial success. The editor body remains the title editing surface.
+- **Unicode-aware note stems** (`src/utils/noteSlug.ts`, `vault/rename.rs`): frontend and backend slugging preserve Unicode letters/digits in note filenames, untitled-rename detection, and fallback wikilink targets while still collapsing symbol-only titles to `untitled`.
+- **Portable filename validation** (`vault/filename_rules.rs`): note filenames, folder names, and custom view filenames all reject Windows-reserved device names, invalid characters, and trailing dot/space suffixes so a vault created on macOS/Linux still clones and syncs cleanly on Windows.
+- **Recoverable save failures** (`useEditorSave`, `vault/file.rs`): invalid platform path syntax is reported as a clear retryable save error, while the editor keeps the unsaved buffer intact for another attempt.
 - **Untitled drafts** start as `untitled-*.md` and are auto-renamed on save once the note gains an H1.
 
 ### Title Surface (UI)
@@ -268,7 +298,7 @@ type SidebarSelection =
 
 `SidebarSelection.kind === 'folder'` is a first-class navigation target, not just a visual highlight.
 
-- `FolderTree` keeps the folder interaction surface decomposed into `FolderTreeRow`, `FolderNameInput`, `FolderContextMenu`, and disclosure/context-menu hooks so nested row rendering, inline rename, and right-click actions stay isolated.
+- `FolderTree` keeps the folder interaction surface decomposed into `FolderTreeRow`, `FolderNameInput`, `FolderContextMenu`, and disclosure/context-menu hooks so nested row rendering, inline rename, and right-click actions stay isolated. Non-mutating reveal/copy-path menu items stay callback-driven from `App` so filesystem convenience actions do not leak into folder mutation hooks.
 - `useFolderActions()` composes `useFolderRename()` and `useFolderDelete()` to keep folder mutations selection-aware while the rest of `App.tsx` only wires the resulting callbacks into `Sidebar` and the command registry.
 - `useNoteRetargeting()` is the shared retargeting abstraction for note drops and command-palette actions. It owns the "can drop here?" checks, updates `type:` via frontmatter when a note lands on a type section, and delegates folder moves through the same crash-safe rename pipeline used by the backend rename commands.
 - A successful folder rename reloads the folder tree plus vault entries, rewrites any affected folder-scoped tabs, and updates `SidebarSelection` to the new relative path when the renamed folder stays selected.
@@ -294,24 +324,29 @@ type SidebarSelection =
 `vault::scan_vault(path)` in `src-tauri/src/vault/mod.rs`:
 
 1. Validates the path exists and is a directory
-2. Scans root-level `.md` files (non-recursive)
-3. Recursively scans protected folders: `type/`, legacy `config/`, `attachments/`
-4. Files in non-protected subfolders are **not indexed** (flat vault enforcement)
-5. For each `.md` file, calls `parse_md_file()`:
+2. Recursively scans non-hidden files while skipping hidden directories such as `.git/`
+3. For each `.md` file, calls `parse_md_file()`:
    - Reads content with `fs::read_to_string()`
    - Parses frontmatter with `gray_matter::Matter::<YAML>`
    - Extracts title from first `#` heading
    - Reads entity type from `type:` frontmatter field (`Is A:` accepted as legacy alias); type is never inferred from folder
    - Parses dates as ISO 8601 to Unix timestamps
    - Extracts relationships, outgoing links, custom properties, word count, snippet
+4. For recognized non-markdown text and binary files, emits a minimal `VaultEntry` with `fileKind`
+5. Sorts by `modified_at` descending
+6. Skips unparseable files with a warning log
 
 The folder tree hides only the dedicated `type/` directory, since note types already have their own sidebar section. Default vault folders such as `attachments/` and `views/` remain visible alongside user-created folders.
-6. Sorts by `modified_at` descending
-7. Skips unparseable files with a warning log
+
+Command-facing vault content is filtered through `vault::filter_gitignored_entries`, `vault::filter_gitignored_folders`, and `vault::filter_gitignored_paths` when the app setting `hide_gitignored_files` is enabled. The cache still stores the complete scan; `list_vault`, `reload_vault`, `list_vault_folders`, and search apply the visibility filter at the boundary before React consumes entries. The filter batches paths through `git check-ignore --no-index --stdin`, so negated and specific `.gitignore` patterns follow Git semantics as closely as the app can reasonably support.
 
 A `vault_health_check` command detects stray files in non-protected subfolders and filename-title mismatches. On vault load, a migration banner offers to flatten stray files to the root via `flatten_vault`.
 
-Command-layer path access is fenced to the active vault before file operations reach the vault backend. `src-tauri/src/commands/vault/boundary.rs` canonicalizes the configured/requested vault root, rejects `..` escapes and absolute paths outside that root, and validates writable targets through the nearest existing ancestor so note reads, saves, deletes, view-file edits, and folder mutations cannot step outside the active vault.
+Command-layer path access is fenced to the active vault before file operations reach the vault backend. `src-tauri/src/commands/vault/boundary.rs` canonicalizes the configured/requested vault root, rejects `..` escapes and absolute paths outside that root, and validates writable targets through the nearest existing ancestor so note reads, saves, deletes, view-file edits, folder mutations, and image attachment writes cannot step outside the active vault. Image attachment commands refresh the runtime asset scope after saving so files created under a previously missing `attachments/` directory can render immediately.
+
+UI-only file actions operate on paths that are already selected or indexed in React state. Reveal-in-Finder and external-open calls route through the Tauri opener plugin, while copy-path uses the browser clipboard API; none of those actions mutate vault contents or bypass the backend write boundary.
+
+The local MCP WebSocket bridge follows the same active-vault boundary. `useVaultSwitcher` calls `sync_mcp_bridge_vault` after the persisted selection loads and after each vault switch; the desktop command starts/restarts the bridge with that vault's canonical path, or stops it when there is no selected vault. MCP Node entrypoints require `VAULT_PATH` and fail clearly instead of falling back to `~/Laputa`. Manual MCP config export uses the same generated stdio entry as registration, so the copied snippet remains scoped to the active vault without writing third-party config files.
 
 ### Vault Caching
 
@@ -415,6 +450,10 @@ interface PulseCommit {
 - `pullAndPush()`: pulls then auto-pushes for divergence recovery
 - `ConflictNoteBanner`: inline banner in editor for conflicted notes (Keep mine / Keep theirs)
 
+### External Vault Refresh
+
+External vault mutations are any disk writes Tolaria did not just perform through its own save path: Git pulls, AI-agent writes, filesystem watcher events, and edits from another app. These changes must route through `refreshPulledVaultState()` rather than calling `reloadVault()` in isolation. The shared refresh abstraction reloads entries, folders, and saved views together, preserves unsaved active-editor content, reopens a clean active note from disk, and closes the active tab if the file disappeared. `useVaultWatcher` supplies changed filesystem paths to this abstraction after debouncing and after filtering recent app-owned saves.
+
 `useGitRemoteStatus` is the commit-time companion to `useAutoSync`:
 - Re-checks `git_remote_status` when the Commit dialog opens and right before submit
 - Converts `hasRemote: false` into a local-only commit path
@@ -471,6 +510,24 @@ Defined in `src/components/editorSchema.tsx` and styled in `src/components/Edito
 - Tolaria keeps `defaultLanguage: "text"` so unlabeled code blocks do not silently become JavaScript while still supporting the packaged language aliases such as `ts` → `typescript`.
 - Inline-code chip styling remains scoped to `.bn-inline-content code`, so fenced `pre > code` nodes keep BlockNote's dark shell instead of inheriting the muted inline surface.
 
+### Markdown Math
+
+Defined in `src/utils/mathMarkdown.ts`, `src/components/editorSchema.tsx`, and styled in `src/components/EditorTheme.css`:
+
+- `$...$` becomes a `mathInline` schema node and line-owned `$$...$$` / multiline `$$` blocks become `mathBlock` nodes.
+- The rich editor renders both node types through KaTeX with `throwOnError: false`, so malformed formulas keep their source visible instead of breaking the note.
+- `serializeMathAwareBlocks()` converts math nodes back to Markdown delimiters before save, raw-mode entry, and editor-position snapshots.
+- Raw CodeMirror mode always shows the plain Markdown source, so imported technical notes stay editable outside Tolaria.
+
+### Mermaid Diagrams
+
+Defined in `src/utils/mermaidMarkdown.ts`, `src/components/MermaidDiagram.tsx`, `src/components/editorSchema.tsx`, and styled in `src/components/EditorTheme.css`:
+
+- Fenced `mermaid` blocks become `mermaidBlock` schema nodes before BlockNote sees the Markdown body.
+- Each `mermaidBlock` stores the original fenced Markdown plus the diagram body, so raw-mode entry and saves can restore the canonical source instead of serializing generated SVG.
+- The rich editor renders diagrams with the `mermaid` package and uses the original source as an inline fallback when rendering fails.
+- `serializeMermaidAwareBlocks()` wraps the math-aware serializer so math, wikilinks, and diagrams share the same Markdown-first save path.
+
 ### Formatting Surface Policy
 
 Defined in `src/components/tolariaEditorFormatting.tsx` and `src/components/tolariaEditorFormattingConfig.ts`:
@@ -480,29 +537,34 @@ Defined in `src/components/tolariaEditorFormatting.tsx` and `src/components/tola
 - Tolaria's formatting-toolbar controller also keeps file/image actions mounted across the tiny hover gap between an image block and the floating toolbar, and while the toolbar itself is hovered, so image controls remain usable instead of collapsing mid-interaction.
 - The `/` slash menu remains the supported path for markdown-safe block transformations such as headings, quotes, and list blocks. Tolaria filters out BlockNote's toggle-heading and toggle-list variants because those do not map cleanly to the markdown note model.
 - The block-handle side menu keeps only actions that survive Tolaria's markdown round-trip. Delete and table-header toggles remain available; BlockNote's `Colors` submenu is removed because block colors are not part of Tolaria's supported markdown surface.
+- `useNoteWikilinkDrop()` is the shared editor-drop abstraction for dragging note rows into either editor mode. It reads the existing note-retargeting drag payload, resolves the vault-relative stem, and inserts a canonical `[[wikilink]]` without hijacking unrelated plain-text drags.
+- `useTauriDragDropEvent()` owns the shared Tauri window drag/drop subscription and duplicate-unlisten cleanup used by native drop features.
+- `useNativePathDrop()` is the shared Tauri file/folder-drop abstraction for text inputs that need filesystem paths instead of attachment import. It consumes native window drag/drop events, gates them to the target element bounds or focused text selection, and lets AI composer / command-palette inputs insert formatted paths at the current cursor.
 
 ### Markdown-to-BlockNote Pipeline
 
 ```mermaid
 flowchart LR
     A["📄 Raw markdown\n(from disk)"] --> B["splitFrontmatter()\n→ yaml + body"]
-    B --> C["preProcessWikilinks(body)\n[[target]] → ‹token›"]
-    C --> D["tryParseMarkdownToBlocks()\n→ BlockNote block tree"]
-    D --> E["injectWikilinks(blocks)\n‹token› → WikiLink node"]
-    E --> F["editor.replaceBlocks()\n→ rendered editor"]
+    B --> C["preProcessMermaidMarkdown(body)\nmermaid fence → token"]
+    C --> D["preProcessWikilinks(body)\n[[target]] → ‹token›"]
+    D --> E["preProcessMathMarkdown(body)\n$...$ / $$...$$ → tokens"]
+    E --> F["tryParseMarkdownToBlocks()\n→ BlockNote block tree"]
+    F --> G["injectWikilinks + injectMathInBlocks + injectMermaidInBlocks\n tokens → schema nodes"]
+    G --> H["editor.replaceBlocks()\n→ rendered editor"]
 
     style A fill:#f8f9fa,stroke:#6c757d,color:#000
-    style F fill:#d4edda,stroke:#28a745,color:#000
+    style H fill:#d4edda,stroke:#28a745,color:#000
 ```
 
-> Placeholder tokens use `\u2039` and `\u203A` to avoid colliding with markdown syntax.
+> Wikilink placeholder tokens use `\u2039` and `\u203A`; math and Mermaid placeholder tokens use ASCII sentinels with URI-encoded payloads.
 
 ### BlockNote-to-Markdown Pipeline (Save)
 
 ```mermaid
 flowchart LR
     A["✏️ BlockNote blocks\n(editor state)"] --> B["blocksToMarkdownLossy()"]
-    B --> C["postProcessWikilinks()\nWikiLink node → [[target]]"]
+    B --> C["restoreWikilinks + serializeMermaidAwareBlocks()\nschema nodes → Markdown source"]
     C --> D["prepend frontmatter yaml"]
     D --> E["invoke('save_note_content')\n→ disk write"]
 
@@ -524,6 +586,8 @@ Wikilink resolution (`resolveEntry` in `src/utils/wikilink.ts`) uses multi-pass
 Toggle via Cmd+K → "Raw Editor" or breadcrumb bar button. Uses CodeMirror 6 (`useCodeMirror` hook) to edit the raw markdown + frontmatter directly. Changes saved via the same `save_note_content` command.
 While the user types, `useEditorSaveWithLinks` derives a transient `VaultEntry` patch from parseable frontmatter so the Inspector, relationship chips, and note-list-visible metadata stay in sync with the raw editor before the next vault reload. Temporarily invalid or half-typed frontmatter is ignored until it becomes parseable again, which avoids clobbering the last known good derived state.
 
+Current-note find/replace is intentionally backed by raw CodeMirror mode. `Cmd+F`, "Find in Note", and "Replace in Note" switch the active Markdown/text note to raw mode, show the compact find bar above CodeMirror, and operate on the current note only. Plain text matching is case-insensitive by default, `Aa` toggles case sensitivity, `.*` toggles JavaScript-regex matching, and regex replacement supports capture groups through JavaScript replacement syntax.
+
 ### Arrow Ligature Normalization
 
 Typed ASCII arrow sequences are normalized consistently in both editor modes:
@@ -534,10 +598,23 @@ Typed ASCII arrow sequences are normalized consistently in both editor modes:
 
 ## Styling
 
-The app uses a single light theme — the vault-based theming system was removed (see [ADR-0013](adr/0013-remove-theming-system.md)). Styling is defined in two layers:
+The app uses internal light and dark themes owned by Tolaria (see [ADR-0081](adr/0081-internal-light-dark-theme-runtime.md)). The previous vault-authored theming system remains removed; theme mode is an installation-local app preference.
 
-1. **Global CSS variables** (`src/index.css`): App-wide colors via `:root`, bridged to Tailwind v4
+1. **Global CSS variables** (`src/index.css`): Semantic app colors, borders, surfaces, and interaction states via `:root` / `[data-theme]`, bridged to Tailwind v4
 2. **Editor theme** (`src/theme.json`): BlockNote typography, flattened to CSS vars by `useEditorTheme`
+3. **Runtime theme bridge**: Applies `data-theme` and `.dark` for shadcn/ui, while CodeMirror and editor-specific consumers derive any non-CSS-variable values from the same semantic contract
+
+## Localization
+
+App UI strings are resolved through `src/lib/i18n.ts`, with flat JSON catalogs in `src/lib/locales/*.json` (see [ADR-0087](adr/0087-json-catalogs-and-lara-cli-localization.md)):
+
+- `AppLocale`: canonical locale tags such as `'en'`, `'zh-CN'`, `'fr-FR'`, `'es-419'`
+- `UiLanguagePreference`: `'system' | AppLocale`; persisted settings serialize `system` as `null`
+- `resolveEffectiveLocale()`: maps an explicit preference or system/browser language list to the effective supported locale, including legacy aliases
+- `translate()` / `createTranslator()`: resolve keys with English fallback and simple `{name}` interpolation
+- `scripts/validate-locales.mjs`: asserts every checked-in locale catalog matches the English keyset and stays flat-string-only
+
+`App.tsx` owns the effective locale and passes it to localized app chrome through props. Settings and command-palette language commands call back into `saveSettings`, so UI language changes update the current session without touching vault content or reopening the vault.
 
 ## Inspector Abstraction
 
@@ -559,7 +636,7 @@ The Inspector panel (`src/components/Inspector.tsx`) is composed of sub-panels:
 
 ### Search
 
-Keyword-based search scans all vault `.md` files using `walkdir`:
+Keyword-based search scans all vault `.md` files using `walkdir` and applies the same Gitignored-content visibility filter as vault loading:
 
 ```typescript
 interface SearchResult {
@@ -593,7 +670,7 @@ No indexing step required — search runs directly against the filesystem.
 
 Per-vault settings stored locally and scoped by vault path:
 - Managed by `useVaultConfig` hook and `vaultConfigStore`
-- Settings: zoom, view mode, tag colors, status colors, property display modes, Inbox note-list column overrides, explicit organization workflow toggle
+- Settings: zoom, view mode, editor mode, note layout, tag colors, status colors, property display modes, Inbox/All Notes note-list column overrides, explicit organization workflow toggle
 - One-time migration from localStorage (`configMigration.ts`)
 
 ### AI Guidance Files
@@ -601,8 +678,9 @@ Per-vault settings stored locally and scoped by vault path:
 Tolaria tracks managed vault-level AI guidance separately from normal note content:
 - `AGENTS.md` is the canonical managed guidance file for Tolaria-aware coding agents
 - `CLAUDE.md` is a compatibility shim that points Claude Code back to `AGENTS.md`
+- `GEMINI.md` is an optional Gemini CLI compatibility shim that points Gemini back to `AGENTS.md`
 - `useVaultAiGuidanceStatus` reads `get_vault_ai_guidance_status` and normalizes the backend state into four UI cases: `managed`, `missing`, `broken`, and `custom`
-- `restore_vault_ai_guidance` repairs only Tolaria-managed files; user-authored custom `AGENTS.md` / `CLAUDE.md` files are surfaced as custom and left untouched
+- `restore_vault_ai_guidance` repairs only Tolaria-managed files and creates the optional Gemini shim on explicit request; user-authored custom `AGENTS.md` / `CLAUDE.md` / `GEMINI.md` files are surfaced as custom and left untouched
 - The status bar AI badge and command palette consume that abstraction to expose restore actions only when the managed guidance is missing or broken
 
 ### Getting Started / Onboarding
@@ -621,15 +699,16 @@ Tolaria tracks managed vault-level AI guidance separately from normal note conte
 `useAiAgentsOnboarding(enabled)` adds a separate first-launch agent step:
 - Reads a local dismissal flag for the AI agents prompt (with a legacy fallback to the older Claude-only key)
 - Only shows after vault onboarding has already resolved to a ready state
+- Uses `get_ai_agents_status`, whose backend treats the app process path, login-shell path, and supported local/toolchain/app install locations, including Windows `.exe` and npm/pnpm/Scoop shim paths, as valid CLI-agent sources
 - Persists dismissal locally once the user continues
 
 ### Remote Git Operations
 
 Tolaria delegates remote auth to the user's system git setup:
 - `CloneVaultModal` captures a remote URL and local destination
-- `clone_repo` shells out to system git for clone operations
+- `clone_git_repo` and `create_getting_started_vault` both run system git clone work in blocking Tokio tasks so clone UIs stay responsive
 - `git_add_remote` uses the same system git path and refuses remotes whose history is unrelated or ahead of the local vault
-- Existing `git_pull` / `git_push` commands keep surfacing raw git errors
+- Existing `git_pull` / `git_push` commands keep surfacing raw git errors, and clone commands fail fast when git wants interactive terminal input
 - No provider-specific token or username is stored in app settings
 
 ## Settings
@@ -647,11 +726,14 @@ interface Settings {
   analytics_enabled: boolean | null
   anonymous_id: string | null
   release_channel: string | null // null = stable default, "alpha" = every-push prerelease feed
-  default_ai_agent: 'claude_code' | 'codex' | null
+  theme_mode: 'light' | 'dark' | null
+  ui_language: AppLocale | null
+  default_ai_agent: 'claude_code' | 'codex' | 'opencode' | 'pi' | null
+  hide_gitignored_files: boolean | null // null = default true
 }
 ```
 
-Managed by `useSettings` hook and `SettingsPanel` component. `default_ai_agent` is an installation-local preference that selects which supported CLI agent the AI panel, command palette AI mode, and status bar should target by default. The AutoGit fields are also installation-local: `useAutoGit` consumes them to schedule automatic checkpoints, while `useCommitFlow` and the status bar quick action reuse the same checkpoint runner and deterministic automatic commit message generation.
+Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is installation-local because it controls device comfort rather than vault structure. `ui_language` is also installation-local: `null` follows the supported system language with English fallback, while explicit values pin the UI language for this installation. Stored legacy aliases such as `zh-Hans` are normalized to canonical locale codes before the setting reaches React state. `default_ai_agent` is an installation-local preference that selects which supported CLI agent the AI panel, command palette AI mode, and status bar should target by default. `hide_gitignored_files` is also installation-local and defaults to `true`; changing it reloads entries, search, saved views, and folders without restarting. The AutoGit fields are also installation-local: `useAutoGit` consumes them to schedule automatic checkpoints, while `useCommitFlow` and the status bar quick action reuse the same checkpoint runner and deterministic automatic commit message generation.
 
 ## Telemetry
 
@@ -663,9 +745,9 @@ Managed by `useSettings` hook and `SettingsPanel` component. `default_ai_agent`
 - **`useTelemetry(settings, loaded)`** — Reactively initializes/tears down Sentry and PostHog based on settings. Called once in `App`.
 
 ### Libraries
-- **`src/lib/telemetry.ts`** — `initSentry()`, `teardownSentry()`, `initPostHog()`, `teardownPostHog()`, `trackEvent()`. Path scrubber via `beforeSend` hook. DSN/key from `VITE_SENTRY_DSN` / `VITE_POSTHOG_KEY` env vars.
+- **`src/lib/telemetry.ts`** — `initSentry()`, `teardownSentry()`, `initPostHog()`, `teardownPostHog()`, `trackEvent()`. Path scrubber via `beforeSend` hook. DSN/key from `VITE_SENTRY_DSN` and `VITE_POSTHOG_KEY`; `VITE_SENTRY_RELEASE` is treated as the build version and only becomes Sentry's `release` for stable calendar builds (`YYYY.M.D`). Alpha/prerelease/internal builds tag `tolaria.build_version` and `tolaria.release_kind` without creating normal Sentry Releases entries.
 - **`src/main.tsx`** — React root error callbacks (`onCaughtError`, `onUncaughtError`, `onRecoverableError`) forward component-stack context to `Sentry.reactErrorHandler()` for debuggable production React errors.
-- **`src-tauri/src/telemetry.rs`** — Rust-side Sentry init with `beforeSend` path scrubber. `init_sentry_from_settings()` reads settings and conditionally initializes. `reinit_sentry()` for runtime toggle.
+- **`src-tauri/src/telemetry.rs`** — Rust-side Sentry init with `beforeSend` path scrubber. `init_sentry_from_settings()` reads settings and conditionally initializes; stable calendar `CARGO_PKG_VERSION` values become Sentry releases, while alpha/prerelease/internal versions are kept as diagnostic tags only. `reinit_sentry()` for runtime toggle.
 
 ### Tauri Commands
 - **`reinit_telemetry`** — Re-reads settings and toggles Rust Sentry on/off. Called from frontend when user changes crash reporting setting.
@@ -691,6 +773,6 @@ Managed by `useSettings` hook and `SettingsPanel` component. `default_ai_agent`
 - **`download_and_install_app_update`** — Channel-aware download/install with streamed progress events.
 
 ### CI/CD
-- **`.github/workflows/release.yml`** — Alpha prereleases from every push to `main` using calendar-semver technical versions (`YYYY.M.D-alpha.N`) and clean `Alpha YYYY.M.D.N` release names. GitHub alpha tags zero-pad the prerelease sequence (`alpha-vYYYY.M.D-alpha.NNNN`) so GitHub release ordering stays chronological while the shipped app version remains `YYYY.M.D-alpha.N`. Publishes `alpha/latest.json` and refreshes the legacy `latest.json` / `latest-canary.json` aliases to the alpha feed.
-- **`.github/workflows/release-stable.yml`** — Stable releases from `stable-vYYYY.M.D` tags. Publishes `stable/latest.json`.
+- **`.github/workflows/release.yml`** — Alpha prereleases from every push to `main` using calendar-semver technical versions (`YYYY.M.D-alpha.N`) and clean `Alpha YYYY.M.D.N` release names. GitHub alpha tags zero-pad the prerelease sequence (`alpha-vYYYY.M.D-alpha.NNNN`) so GitHub release ordering stays chronological while the shipped app version remains `YYYY.M.D-alpha.N`. Publishes `alpha/latest.json` with macOS Apple Silicon/Intel, Linux x64, and Windows x64 updater entries, then refreshes the legacy `latest.json` / `latest-canary.json` aliases to the alpha feed. macOS release assets use `Tolaria_<version>_macOS_Silicon` and `Tolaria_<version>_macOS_Intel` base names. Packaged builds pass the computed version as `VITE_SENTRY_RELEASE`, which is retained as a diagnostic build-version tag but not registered as a normal Sentry release for alpha builds.
+- **`.github/workflows/release-stable.yml`** — Stable releases from `stable-vYYYY.M.D` tags. Publishes `stable/latest.json`, macOS Apple Silicon and Intel DMG/updater artifacts, Windows x64 installers/updater bundles, and Linux x86_64 `.deb` / AppImage artifacts. Stable macOS DMG/updater assets use the same `Tolaria_<version>_macOS_Silicon` and `Tolaria_<version>_macOS_Intel` base names. Packaged builds pass the computed stable version as `VITE_SENTRY_RELEASE`, which is registered as Sentry's release.
 - **Beta cohorts** are handled in PostHog targeting only. There is no beta updater feed.

docs/ARCHITECTURE.md

@@ -24,6 +24,7 @@ When deciding where to persist a piece of data, ask: **"Would the user want this
 | Pinned properties per type | API keys (OpenAI, Google) |
 | Sidebar label overrides | Auto-sync interval |
 | Property display order | Window size / position |
+| Vault-authored `.gitignore` patterns | Whether this installation hides Gitignored files |
 | Any user-visible customization of how content is organized or displayed | Any machine-specific or credential-type setting |
 
 **Rule:** If the information is about *how the content is structured or presented* and the user would expect it to be consistent wherever they open their vault, store it in the vault (frontmatter of the relevant note, using the `_field` underscore convention for system properties). If it's about *this specific installation of the app*, store it in `~/.config/com.tolaria.app/settings.json` or localStorage.
@@ -32,6 +33,7 @@ Examples:
 - ✅ Vault: `_pinned_properties` in a Type note (every device should show the same pinned properties)
 - ✅ Vault: `_icon: shapes` in a Type note (icon is part of the type's identity)
 - ✅ App settings: `zoom: 1.3` (machine-specific preference)
+- ✅ App settings: `ui_language: "zh-CN"` (installation-specific UI language)
 
 ### No hardcoded exceptions
 
@@ -81,6 +83,11 @@ flowchart LR
 3. **No orphan state updates**: Never call `updateEntry()` before the corresponding `handleUpdateFrontmatter()` or `handleDeleteProperty()` has resolved. The three functions in `useEntryActions` (`handleCustomizeType`, `handleRenameSection`, `handleToggleTypeVisibility`) follow this rule — disk write first, then state update.
 4. **Recovery via reload**: If state ever diverges from disk (crash, external edit, race condition), `Reload Vault` (Cmd+K → "Reload Vault") invalidates the cache and does a full filesystem rescan via the `reload_vault` Tauri command, replacing all React state. The `reload_vault_entry` command can re-read a single file.
 5. **Cache is disposable**: The `reload_vault` command deletes the cache file before rescanning, guaranteeing fresh data. The cache never contains data that doesn't exist on the filesystem.
+6. **Visibility filters are command-boundary concerns**: Gitignored-content visibility is applied after scanning/caching, before entries, folders, or search results reach React. The cache remains complete so toggling the setting can show ignored content again without rebuilding a different cache shape.
+
+#### External Change Detection
+
+The main window starts a native watcher for the active vault through `start_vault_watcher` / `stop_vault_watcher` (`src-tauri/src/vault_watcher.rs`, backed by Rust `notify`). The watcher emits `vault-changed` events for content paths and ignores churn from `.git/`, `node_modules/`, temp files, and `.tolaria-rename-txn`. `useVaultWatcher` batches those events, suppresses recent app-owned saves, and sends the remaining external paths through `refreshPulledVaultState()` so folders, saved views, note-list state, and the clean active editor all refresh under the ADR-0071 unsaved-edit rules. `useVaultLoader.isReloading` drives the status-bar reload spinner for both manual and watcher-triggered reloads.
 
 ## Tech Stack
 
@@ -90,6 +97,7 @@ flowchart LR
 | Frontend | React + TypeScript | React 19, TS 5.9 |
 | Editor | BlockNote | 0.46.2 |
 | Code block highlighting | @blocknote/code-block | 0.46.2 |
+| Diagram rendering | Mermaid | 11.14.0 |
 | Raw editor | CodeMirror 6 | - |
 | Styling | Tailwind CSS v4 + CSS variables | 4.1.18 |
 | UI primitives | Radix UI + shadcn/ui | - |
@@ -97,8 +105,10 @@ flowchart LR
 | Build | Vite | 7.3.1 |
 | Backend language | Rust (edition 2021) | 1.77.2 |
 | Frontmatter parsing | gray_matter | 0.2 |
-| AI (agent panel) | CLI agent adapters (Claude Code + Codex) | - |
+| Filesystem watcher | notify | 6.1 |
+| AI (agent panel) | CLI agent adapters (Claude Code + Codex + OpenCode + Pi) | - |
 | Search | Keyword (walkdir-based file scan) | - |
+| Localization | App-owned runtime + JSON catalogs (`src/lib/i18n.ts`, `src/lib/locales/*.json`, `lara.yaml`) | English fallback + Lara CLI sync |
 | MCP | @modelcontextprotocol/sdk | 1.0 |
 | Tests | Vitest (unit), Playwright (E2E/smoke), cargo test (Rust) | - |
 | Package manager | pnpm | - |
@@ -135,7 +145,7 @@ flowchart TD
         end
 
         subgraph EXT["External Services"]
-            CCLI["Claude CLI / Codex CLI\n(agent subprocesses)"]
+            CCLI["Claude / Codex / OpenCode / Pi CLI\n(agent subprocesses)"]
             MCP["MCP Server\n(ws://9710, 9711)"]
             GCLI["git CLI\n(system executable)"]
             REMOTE["Git remotes\n(GitHub/GitLab/Gitea/etc.)"]
@@ -176,15 +186,20 @@ flowchart TD
 └──────────────────────────────────────────────────────────────┘
 ```
 
-- **Sidebar** (150-400px, resizable): Top-level filters (All Notes, Changes, Pulse), collapsible type-based section groups, and a dedicated folder tree. The folder tree shows user-created folders plus default vault folders such as `attachments/` and `views/`; only the dedicated `type/` directory stays hidden because note types already have their own sidebar section. The folder tree supports inline folder creation and rename, exposes a right-click menu for rename/delete, and auto-expands ancestor folders when the current selection or rename target is nested. Type sections and folder rows also act as note drop targets: dropping a note on a type updates its `type:` frontmatter, while dropping it on a folder runs the same crash-safe move path as the command palette flow. Each type can have a custom icon, color, sort, and visibility set via its type document in `type/`.
-- **Note List / Pulse View** (200-500px, resizable): When a section group, filter, or saved view is selected, shows filtered notes with snippets, modified dates, status indicators, and per-context note-list controls. When `selection.kind === 'entity'`, the same pane enters **Neighborhood** mode: the source note is pinned at the top as a normal active row, outgoing relationship groups render first, inverse/backlink groups follow, empty groups stay visible with `0`, and duplicates across groups are allowed when multiple relationships are true. Plain click / `Enter` open the focused note without replacing the current Neighborhood, while Cmd/Ctrl-click and Cmd/Ctrl-`Enter` pivot the pane into the clicked note's Neighborhood. Saved views reuse the same sort and visible-column controls as the built-in lists, and those changes persist back into the view `.yml` definition (`sort`, `listPropertiesDisplay`). When Pulse filter is active, shows `PulseView` — a chronological git activity feed grouped by day.
-- **Editor** (flex, fills remaining space): Single note open at a time (no tabs — see ADR-0003). Breadcrumb bar with word count, BlockNote rich text editor with wikilink support, markdown-safe formatting controls, and schema-backed fenced code block highlighting via `@blocknote/code-block`. Can toggle to diff view (modified files) or raw CodeMirror view. Decomposed into `Editor` (orchestrator), `EditorContent`, `EditorRightPanel`, `SingleEditorView`, with hooks `useDiffMode`, `useEditorFocus`, and `useEditorSave`, plus the `useRawMode`/`RawEditorView` pair for markdown source editing. Rich BlockNote input and raw CodeMirror input both route typed `->`, `<-`, and `<->` through the shared `src/utils/arrowLigatures.ts` resolver so arrow ligatures stay consistent across mode switches while escaped ASCII sequences remain literal. Navigation history (Cmd+[/]) replaces tabs.
+- **Sidebar** (150-400px, resizable): Top-level filters (All Notes, Changes, Pulse), collapsible type-based section groups, and a dedicated folder tree. The folder tree shows user-created folders plus default vault folders such as `attachments/` and `views/`; only the dedicated `type/` directory stays hidden because note types already have their own sidebar section. The folder tree supports inline folder creation and rename, exposes a right-click menu for rename/delete plus filesystem reveal/copy-path actions, and auto-expands ancestor folders when the current selection or rename target is nested. Type sections and folder rows also act as note drop targets: dropping a note on a type updates its `type:` frontmatter, while dropping it on a folder runs the same crash-safe move path as the command palette flow. Each type can have a custom icon, color, sort, and visibility set via its type document in `type/`.
+- **Note List / Pulse View** (200-500px, resizable): When a section group, filter, or saved view is selected, shows filtered notes with snippets, modified dates, status indicators, and per-context note-list controls. When `selection.kind === 'entity'`, the same pane enters **Neighborhood** mode: the source note is pinned at the top as a normal active row, outgoing relationship groups render first, inverse/backlink groups follow, empty groups stay visible with `0`, and duplicates across groups are allowed when multiple relationships are true. Plain click / `Enter` open the focused note without replacing the current Neighborhood, while Cmd/Ctrl-click and Cmd/Ctrl-`Enter` pivot the pane into the clicked note's Neighborhood. Folder-backed lists also show non-Markdown files: previewable image binaries get an image indicator and open in the editor pane, while unsupported binaries remain muted instead of auto-launching an external app. Saved views reuse the same sort and visible-column controls as the built-in lists, and those changes persist back into the view `.yml` definition (`sort`, `listPropertiesDisplay`). When Pulse filter is active, shows `PulseView` — a chronological git activity feed grouped by day.
+- **Editor** (flex, fills remaining space): Single note open at a time (no tabs — see ADR-0003). Breadcrumb bar with word count and note-layout toggle, BlockNote rich text editor with wikilink support, Markdown-compatible inline/display math rendering, first-class Mermaid diagram blocks, markdown-safe formatting controls, and schema-backed fenced code block highlighting via `@blocknote/code-block`. Can toggle to diff view (modified files), raw CodeMirror view, or a wide-screen left-aligned note column while preserving the same readable max width. Binary image files render through `FilePreview` as ordinary vault files using Tauri asset URLs, with explicit unsupported/broken fallback states and keyboard focus returning to the note list on `Escape`. Decomposed into `Editor` (orchestrator), `EditorContent`, `FilePreview`, `EditorRightPanel`, `SingleEditorView`, with hooks `useDiffMode`, `useEditorFocus`, and `useEditorSave`, plus the `useRawMode`/`RawEditorView` pair for markdown source editing. Rich BlockNote input and raw CodeMirror input both route typed `->`, `<-`, and `<->` through the shared `src/utils/arrowLigatures.ts` resolver so arrow ligatures stay consistent across mode switches while escaped ASCII sequences remain literal. Navigation history (Cmd+[/]) replaces tabs.
 - **Inspector / AI Agent** (200-500px or 40px collapsed): Toggles between Inspector (frontmatter, relationships, instances, backlinks, git history) and AI Agent panel (the selected CLI agent with tool execution). The Sparkle icon in the breadcrumb bar toggles between them. Per-note `icon` is a suggested Inspector property and the command palette's "Set Note Icon" action opens that field directly. When viewing a Type note, the Inspector shows an **Instances** section listing all notes of that type (sorted by modified_at desc, capped at 50).
 
 Panels are separated by `ResizeHandle` components that support drag-to-resize.
 
 The main Tauri window derives its minimum width from the visible panes instead of a single fixed floor. `useMainWindowSizeConstraints` treats the editor-only shell as the 480px baseline, adds sidebar / note-list / expanded-inspector allowances on top, and calls the native `update_current_window_min_size` command whenever view mode or inspector visibility changes. That same native command also grows the current window back out when a wider pane combination is restored, while note windows skip this path and keep their dedicated 800×700 initial sizing.
 
+The main Tauri window also persists its last normal size and screen position in the app config directory as `window-state.json`. The state stores logical window points, while `window_state.rs` migrates older physical-pixel state on read so Retina and non-Retina launches restore the same user-facing bounds. On startup, the restored frame applies only to the main window and clamps to the currently available monitor work areas, so stale coordinates from a disconnected display fall back to a visible placement. Maximized, fullscreen, minimized, and detached note-window frames are not written as the restore baseline.
+
+Linux uses custom React-rendered window chrome instead of the native Tauri menu bar. `setup_linux_window_chrome()` drops server-side decorations on the main window, `openNoteInNewWindow()` does the same for detached note windows, and `LinuxTitlebar`/`LinuxMenuButton` route both window controls and menu actions back through the same shared command pipeline that macOS uses for native menu clicks.
+When Tolaria is launched from a Linux AppImage, `run()` also injects `WEBKIT_DISABLE_DMABUF_RENDERER=1` unless the user already set that variable. This keeps the workaround scoped to bundled WebKitGTK launches that are prone to Fedora/Wayland DMA-BUF crashes without changing native package installs.
+
 ## Multi-Window (Note Windows)
 
 Notes can be opened in separate Tauri windows for focused editing. Secondary windows show only the editor panel (no sidebar, no note list).
@@ -200,7 +215,7 @@ Notes can be opened in separate Tauri windows for focused editing. Secondary win
 - `main.tsx` checks `isNoteWindow()` at boot to route between `App` (main window) and `NoteWindow` (secondary window)
 - `NoteWindow` (`src/NoteWindow.tsx`) is a minimal shell that loads vault entries, fetches note content, applies the theme, and renders a single `Editor` instance
 - Each window has its own auto-save via `useEditorSaveWithLinks` (same 500ms debounce, same Rust `save_note_content` command), and raw-editor typing also derives frontmatter-backed `VaultEntry` state in the renderer so Inspector and note-list surfaces react immediately without waiting for a full reload
-- Secondary windows are sized 800×700 with overlay title bar
+- Secondary windows are sized 800×700; macOS keeps the overlay title bar, while Linux mounts the shared React titlebar on undecorated windows
 - Capabilities config (`src-tauri/capabilities/default.json`) grants permissions to both `main` and `note-*` window labels
 
 ## AI System
@@ -209,12 +224,12 @@ Notes can be opened in separate Tauri windows for focused editing. Secondary win
 
 Full agent mode — spawns the selected local CLI agent as a subprocess with tool access and MCP vault integration.
 
-1. **Frontend** (`AiPanel` + `useCliAiAgent` + `aiAgents.ts`) — streaming UI with reasoning blocks, tool action cards, response display, onboarding, and default-agent selection
+1. **Frontend** (`AiPanel` + `useCliAiAgent` + `aiAgentSession.ts` + `aiAgents.ts`) — one normalized session lifecycle for message state, reasoning blocks, tool action cards, response display, onboarding, and default-agent selection
 2. **Backend** (`ai_agents.rs`) — normalizes agent availability and streaming, dispatching to per-agent adapters
-3. **Agent adapters** — Claude Code still uses `claude_cli.rs`; Codex runs through `codex exec --json` with the CLI's normal approval / sandbox defaults
-4. **MCP Integration** — Claude receives the generated MCP config file path, while Codex receives the same Tolaria MCP server via transient `-c mcp_servers.tolaria.*` config overrides
+3. **Agent adapters** — Claude Code still uses `claude_cli.rs` with `acceptEdits`, strict Tolaria MCP config, a file/search-only built-in tool list, hidden Windows subprocess launches, and closed stdin for print-mode subprocesses so Windows launches receive EOF; Codex runs through `codex --sandbox workspace-write --ask-for-approval never exec --json`; OpenCode runs through `opencode run --format json`; Pi runs through `pi --mode json --no-session` with `npm:pi-mcp-adapter`. OpenCode and Pi both launch from the active vault cwd with closed stdin and transient MCP config. All app-launched paths use hidden Windows launches and avoid dangerous permission-bypass flags.
+4. **MCP Integration** — Claude receives the generated MCP config file path, Codex receives the same Tolaria MCP server via transient `-c mcp_servers.tolaria.*` config overrides, OpenCode receives it through `OPENCODE_CONFIG_CONTENT`, and Pi receives it through a temporary `PI_CODING_AGENT_DIR/mcp.json` consumed by `pi-mcp-adapter`
 
-Claude Code availability intentionally does not depend only on the desktop app's inherited `PATH`. The detector checks the current process path, the user's login shell, and supported local/toolchain install locations such as native `~/.local/bin`, local `~/.claude/local`, Mise/asdf shims, npm-global, and Homebrew paths so first-run onboarding works on fresh macOS installs.
+CLI-agent availability intentionally does not depend only on the desktop app's inherited `PATH`. The detectors check the current process path, the user's login shell, and supported local/toolchain install locations such as native `~/.local/bin`, local `~/.claude/local`, Mise/asdf shims, npm-global, Homebrew, Windows `%APPDATA%\npm`/pnpm/Scoop shims, Windows `.exe` launchers, and the macOS Codex app resource path so first-run onboarding works on fresh macOS and Windows installs.
 
 #### Agent Event Flow
 
@@ -229,11 +244,11 @@ sequenceDiagram
     U->>FE: sendMessage(text, references)
     FE->>FE: buildContextSnapshot(activeNote, linkedNotes, openTabs)
     FE->>R: invoke('stream_ai_agent', {agent, message, systemPrompt, vaultPath})
-    R->>R: pick adapter for claude_code or codex
+    R->>R: pick adapter for claude_code, codex, opencode, or pi
     R->>C: spawn agent with MCP-enabled config
 
     loop Normalized stream
-        C-->>R: Claude NDJSON or Codex JSONL events
+        C-->>R: Claude NDJSON, Codex JSONL, OpenCode JSON, or Pi JSON events
         R-->>FE: emit("ai-agent-stream", event)
         alt TextDelta
             FE->>FE: accumulate response (revealed on Done)
@@ -255,7 +270,7 @@ sequenceDiagram
 
 #### File Operation Detection
 
-When the agent writes or edits vault files, `useCliAiAgent` detects this from normalized tool inputs and calls `onFileCreated` or `onFileModified` callbacks to trigger vault reload.
+When the agent writes or edits vault files, `aiAgentFileOperations.ts` detects this from normalized tool inputs and calls `onFileCreated` or `onFileModified` callbacks to trigger vault reload. Unrecognized write-like operations fall back to a full vault refresh.
 
 ### Context Building
 
@@ -275,11 +290,11 @@ Token budget: 60% of 180k context limit (~108k tokens max). Active note gets pri
 
 ### Authentication
 
-Each CLI agent authenticates itself outside Tolaria. Claude Code uses its existing CLI login; Codex surfaces a friendly prompt to run `codex login` when needed. Tolaria does not store model-provider API keys in app settings.
+Each CLI agent authenticates itself outside Tolaria. Claude Code uses its existing CLI login; Codex surfaces a friendly prompt to run `codex login` when needed; OpenCode surfaces a friendly prompt to run `opencode auth login` or configure a provider when needed; Pi surfaces a friendly prompt to run `pi /login` or configure a provider API key when needed. Tolaria does not store model-provider API keys in app settings.
 
 ## MCP Server
 
-The MCP server (`mcp-server/`) exposes vault operations as tools for AI assistants (Claude Code, Cursor, or any MCP-compatible client).
+The MCP server (`mcp-server/`) exposes vault operations as tools for AI assistants (Claude Code, Gemini CLI, Cursor, or any MCP-compatible client).
 
 ### Tool Surface (14 tools)
 
@@ -310,16 +325,18 @@ The MCP server (`mcp-server/`) exposes vault operations as tools for AI assistan
 ### Explicit External Tool Setup
 
 Tolaria can register itself as an MCP server in:
-- `~/.claude/mcp.json` (Claude Code)
+- `~/.claude.json` and `~/.claude/mcp.json` (Claude Code compatibility across current CLI and legacy MCP-file setups)
+- `~/.gemini/settings.json` (Gemini CLI)
 - `~/.cursor/mcp.json` (Cursor)
+- `~/.config/mcp/mcp.json` (generic MCP-compatible clients)
 
-That setup is user-initiated through the status bar / command palette flow, not a startup side effect. Registration is non-destructive (additive, preserves other servers), uses `upsert` semantics, and can be reversed by removing Tolaria's entry again. The `useMcpStatus` hook tracks whether the active vault is explicitly connected (`checking | installed | not_installed`).
+That setup is user-initiated through the status bar / command palette flow, not a startup side effect. Registration is non-destructive (additive, preserves other servers and Gemini settings), uses `upsert` semantics, and can be reversed by removing Tolaria's entry again. Tolaria verifies Node.js is available before writing config, writes an explicit `type: "stdio"` entry, pins `VAULT_PATH` to the active vault, and sets `WS_UI_PORT=9711` so UI actions route back to the desktop app. The same generated entry is exposed as a manual JSON snippet in the MCP setup dialog and through the AI panel copy action, giving users a transparent fallback for MCP-compatible tools Tolaria does not auto-configure. Packaged builds resolve `mcp-server/` from the installed resource directory next to the executable before falling back to macOS `Resources`, Linux bundle paths, and AppImage paths. The `useMcpStatus` hook tracks whether the active vault is explicitly connected (`checking | installed | not_installed`) and owns connect, disconnect, exact-snippet load, and copy-to-clipboard actions. Gemini CLI still owns its own install and sign-in; Tolaria only writes the MCP entry and optional vault guidance shim. The desktop WebSocket bridge is started only when a persisted active vault exists and is resynced from React state on vault changes; no selected vault stops the bridge instead of falling back to `~/Laputa`.
 
 ### Architecture
 
 ```mermaid
 flowchart TD
-    subgraph MCP["MCP Server (Node.js) — spawned by Tauri on startup"]
+    subgraph MCP["MCP Server (Node.js) — selected-vault scoped"]
         IDX["index.js"]
         VAULT["vault.js\n(findMarkdownFiles, readNote, createNote,\nsearchNotes, appendToNote, editNoteFrontmatter,\ndeleteNote, linkNotes, listNotes, vaultContext)"]
         WSB["ws-bridge.js"]
@@ -331,8 +348,8 @@ flowchart TD
         WSB -->|"port 9711 — UI bridge"| FE["Frontend\n(useAiActivity)"]
     end
 
-    TAURI["Tauri (mcp.rs)"] -->|"spawn on startup"| MCP
-    UI["Status bar / Command Palette"] -->|"explicit setup or disconnect"| CFG["~/.claude/mcp.json\n~/.cursor/mcp.json"]
+    TAURI["Tauri bridge lifecycle"] -->|"start/stop/restart with active VAULT_PATH"| MCP
+    UI["Status bar / Command Palette"] -->|"explicit setup or disconnect"| CFG["~/.claude.json\n~/.claude/mcp.json\n~/.cursor/mcp.json\n~/.config/mcp/mcp.json"]
 ```
 
 ### WebSocket Bridge
@@ -359,11 +376,13 @@ flowchart LR
 | Function | Purpose |
 |----------|---------|
 | `spawn_ws_bridge(vault_path)` | Spawns `ws-bridge.js` as child process with VAULT_PATH env |
-| `register_mcp(vault_path)` | Writes Tolaria entry to Claude Code and Cursor MCP configs on explicit user request |
-| `remove_mcp()` | Removes Tolaria's MCP entry from Claude Code and Cursor configs |
+| `sync_mcp_bridge_vault(vault_path?)` | Starts, restarts, or stops the desktop WebSocket bridge as the selected vault changes |
+| `register_mcp(vault_path)` | Verifies Node.js, resolves the packaged `mcp-server/`, and writes Tolaria's explicit stdio entry to Claude Code, Gemini CLI, Cursor, and generic MCP configs on user request |
+| `mcp_config_snippet(vault_path)` | Builds the exact `mcpServers.tolaria` JSON users can copy into any compatible client without writing third-party config files |
+| `remove_mcp()` | Removes Tolaria's MCP entry from Claude Code, Gemini CLI, Cursor, and generic MCP configs |
 | `upsert_mcp_config(path, entry)` | Atomic config file update (create/merge, preserves others) |
 
-The `WsBridgeChild` state wrapper in `lib.rs` ensures the bridge process is killed on app exit via `RunEvent::Exit` handler. The same desktop layer now keeps the Tauri asset protocol scoped to the active vault instead of every filesystem path.
+The `WsBridgeChild` state wrapper in `lib.rs` ensures the bridge process is replaced on vault switches, stopped when no active vault is selected, and killed on app exit via the `RunEvent::Exit` handler. The same desktop layer now keeps the Tauri asset protocol scoped to the active vault instead of every filesystem path.
 
 ## Search
 
@@ -404,10 +423,17 @@ flowchart TD
 
 ## Styling
 
-The app uses a single light theme with no user-configurable theming (see [ADR-0013](adr/0013-remove-theming-system.md)).
+The app uses internal app-owned light and dark themes (see [ADR-0081](adr/0081-internal-light-dark-theme-runtime.md)). This is not the old vault-authored theming system from ADR-0013: users choose a mode, but themes are owned by the app.
 
-1. **Global CSS variables** (`src/index.css`): App-wide colors, borders, backgrounds. Bridged to Tailwind v4 via `@theme inline`.
-2. **Editor theme** (`src/theme.json`): BlockNote-specific typography. Flattened to CSS vars by `useEditorTheme`.
+1. **Global CSS variables** (`src/index.css`): Semantic app colors, borders, surfaces, and interaction states. Bridged to Tailwind v4 via `@theme inline`.
+2. **Editor theme** (`src/theme.json`): BlockNote-specific typography. Flattened to CSS vars by `useEditorTheme`; editor colors resolve through the same semantic app variables.
+3. **Theme runtime**: Applies `data-theme` and the shadcn-compatible `.dark` class before React consumers render, with a localStorage mirror to avoid startup flash when dark mode is selected.
+
+## Localization
+
+Tolaria's app chrome uses an app-owned localization runtime in `src/lib/i18n.ts`, backed by flat JSON catalogs in `src/lib/locales/` and Lara CLI synchronization through `lara.yaml` (see [ADR-0087](adr/0087-json-catalogs-and-lara-cli-localization.md)). `en.json` is the canonical source catalog, locale files are one file per locale, and English remains the fallback for any missing locale file or key. The installation-local `ui_language` setting stores an explicit locale when the user chooses one; `null` means "follow the system language when Tolaria supports it, otherwise English." Legacy stored values such as `zh-Hans` are normalized to canonical locale codes like `zh-CN`.
+
+`App.tsx` derives the effective locale from settings and browser/system language hints, then passes it down to localized surfaces. Settings exposes a keyboard-accessible shadcn `Select`, and the command palette includes actions to open language settings or switch directly to a supported language.
 
 ## Vault Management
 
@@ -430,6 +456,7 @@ Per-vault UI settings stored locally per vault path (currently in browser/Tauri
 - `zoom`: Float zoom level (0.8–1.5)
 - `view_mode`: "all" | "editor-list" | "editor-only"
 - `editor_mode`: "raw" | "preview" (persists across note switches and sessions)
+- `note_layout`: "centered" | "left" (wide-screen note column alignment for rich and raw editors)
 - `tag_colors`, `status_colors`: Custom color overrides
 - `property_display_modes`: Property display preferences
 - `inbox.noteListProperties`: Optional Inbox-only property chip override for the note list
@@ -440,16 +467,18 @@ Per-vault UI settings stored locally per vault path (currently in browser/Tauri
 
 On first launch, `useOnboarding` checks if the default vault exists. If not, it shows `WelcomeScreen` with three options:
 - **Create a new vault** → creates an empty git repo in a folder the user chooses
-- **Open an existing folder** → system file picker
+- **Open an existing folder** → system file picker; plain Markdown folders without `.git` open immediately in supported non-git mode
 - **Get started with a template** → pick a parent folder, then call `create_getting_started_vault()` with the derived `.../Getting Started` child path so the cloned vault opens into the populated repo root immediately
 
-When an opened folder is not yet a git repo, `init_git_repo` runs `git init`, ensures Tolaria's default `.gitignore`, stages the vault, and writes the initial `Initial vault setup` commit. That app-managed setup commit explicitly disables commit signing for the single command so inherited global or local `commit.gpgsign` preferences cannot strand onboarding when GPG is missing or misconfigured. Later `git_commit` calls honor the user's signing configuration first, then retry the same app-managed commit once with `commit.gpgsign=false` only when Git reports a signing-helper failure, so working GPG/SSH signing setups continue to sign while broken GPG setups do not create repeated opaque commit failures.
+When an opened folder is not yet a git repo, Tolaria shows a dismissible Git setup dialog and a persistent `Git disabled` status-bar warning. Markdown scanning, note browsing, note editing, and search continue normally. Git-dependent surfaces (history, changes, commit, sync, conflict resolution, remotes, AutoGit, and auto-sync) stay unavailable until the user explicitly initializes Git from the dialog, the status-bar warning, or the `Initialize Git for Current Vault` command-palette action.
 
-Once a vault is ready, `useAiAgentsOnboarding` can show a one-time `AiAgentsOnboardingPrompt`. That prompt reads `useAiAgentsStatus` so first launch surfaces whether Claude Code and Codex are installed, offers per-agent install links when they are missing, and stores local dismissal so the prompt does not repeat on every launch.
+When the user enables Git later, `init_git_repo` runs `git init`, ensures Tolaria's default `.gitignore`, stages the vault, and writes the initial `Initial vault setup` commit. Before app-managed setup and remote-connection commits, Tolaria ensures the vault has local `user.name` / `user.email` values, falling back to `Tolaria <vault@tolaria.md>` when the vault has no local Git identity yet. That app-managed setup commit explicitly disables commit signing for the single command so inherited global or local `commit.gpgsign` preferences cannot strand onboarding when GPG is missing or misconfigured. Later `git_commit` calls honor the user's signing configuration first, then retry the same app-managed commit once with `commit.gpgsign=false` only when Git reports a signing-helper failure, so working GPG/SSH signing setups continue to sign while broken GPG setups do not create repeated opaque commit failures.
+
+Once a vault is ready, `useAiAgentsOnboarding` can show a one-time `AiAgentsOnboardingPrompt`. That prompt reads `useAiAgentsStatus` so first launch surfaces whether Claude Code, Codex, OpenCode, and Pi are installed, offers per-agent install links when they are missing, and stores local dismissal so the prompt does not repeat on every launch.
 
 `useGettingStartedClone` reuses the same parent-folder semantics for the status-bar / command-palette clone action, and `Toast` is rendered through the AI-agents onboarding gate so the resolved destination path stays visible right after a successful clone.
 
-The starter content no longer lives in the app repo. `src-tauri/src/vault/getting_started.rs` holds the public starter repo URL (`refactoringhq/tolaria-getting-started`), delegates the clone to the git backend, then normalizes Tolaria-managed root guidance and type scaffolding (`AGENTS.md`, `CLAUDE.md`, `type.md`, `note.md`) so fresh starter vaults pick up the current defaults even when the remote starter repo still carries a legacy copy or an older pre-`type:` `is_a`-era template. `AGENTS.md` stays the canonical vault guidance file; `CLAUDE.md` is a compatibility shim that imports it for Claude Code without duplicating the instructions, and Tolaria seeds it as an organized `Note` so it stays out of the way in a fresh vault. The clone helper still accepts the legacy `LAPUTA_GETTING_STARTED_REPO_URL` environment override so older automation can continue to redirect the starter source during the transition.
+The starter content no longer lives in the app repo. `src-tauri/src/vault/getting_started.rs` holds the public starter repo URL (`refactoringhq/tolaria-getting-started`), delegates the clone to the git backend, then normalizes Tolaria-managed root guidance and type scaffolding (`AGENTS.md`, `CLAUDE.md`, `type.md`, `note.md`) so fresh starter vaults pick up the current defaults even when the remote starter repo still carries a legacy copy or an older pre-`type:` `is_a`-era template. `AGENTS.md` stays the canonical vault guidance file; `CLAUDE.md` is a compatibility shim that imports it for Claude Code without duplicating the instructions, and Tolaria seeds it as an organized `Note` so it stays out of the way in a fresh vault. Optional `GEMINI.md` guidance is created only by the explicit AI guidance restore action. The clone helper still accepts the legacy `LAPUTA_GETTING_STARTED_REPO_URL` environment override so older automation can continue to redirect the starter source during the transition.
 
 After the clone completes, Tolaria removes every configured git remote from the new starter vault. Getting Started vaults therefore open as local-only by default, and users opt into a remote later with the explicit Add Remote flow.
 
@@ -460,9 +489,9 @@ Tolaria no longer implements provider-specific OAuth or remote-repository APIs.
 **Flow:**
 1. User opens `CloneVaultModal` from onboarding or the vault menu
 2. User pastes any git URL and chooses a local destination
-3. `clone_repo()` shells out to `git clone`
+3. The `clone_git_repo()` Tauri command runs `git clone` inside a blocking Tokio task so the Tauri window stays responsive during slow or failing clones
 4. `git_push()` / `git_pull()` continue to use the same system git path
-5. If auth fails, the raw git stderr is surfaced in the UI
+5. Clone commands disable interactive terminal / askpass prompts and surface the git failure back to the UI instead of freezing the app waiting for input
 
 **Auth model:**
 - SSH keys, Git Credential Manager, macOS Keychain helpers, `gh auth`, and other git helpers all work without app-specific setup
@@ -493,6 +522,7 @@ sequenceDiagram
     participant MCP as MCP Server
     participant U as User
 
+    T->>T: apply Linux AppImage WebKit env override<br/>(AppImage only)
     T->>T: run_startup_tasks()<br/>(migrate + seed only)
     T->>MCP: spawn_ws_bridge() — ports 9710 + 9711
     T->>A: App mounts
@@ -566,7 +596,9 @@ flowchart TD
 
 `useGitRemoteStatus` re-checks `git_remote_status` when the commit dialog opens and again right before submit. If `hasRemote` is false, Tolaria keeps the flow local-only: the status bar shows a neutral `No remote` chip, the dialog copy switches from "Commit & Push" to "Commit", and no `git_push` call is attempted.
 
-The same local-only state enables the explicit Add Remote flow. `AddRemoteModal` is reachable from the `No remote` chip and the command palette. The backend `git_add_remote` command adds `origin`, fetches it, refuses incompatible histories, and only enables tracking after a safe push or fast-forward-compatible check succeeds.
+If the current vault is not a Git repository, Tolaria treats Git as disabled instead of degraded. The status bar replaces changes, commit, sync, remote, conflict, and history controls with a `Git disabled` warning that reopens Git setup. Command registration follows the same state: only `Initialize Git for Current Vault` is available in the Git group, while pull, commit, changes, conflict, and remote commands are hidden. `useAutoSync` is disabled for non-git vaults so the app does not run background Git commands against plain folders.
+
+The same local-only state enables the explicit Add Remote flow. `AddRemoteModal` is reachable from the `No remote` chip and the command palette. The backend `git_add_remote` command ensures the local author identity, adds `origin`, fetches it, refuses incompatible histories, and only enables tracking after a safe push or fast-forward-compatible check succeeds.
 
 `useCommitFlow` also exposes `runAutomaticCheckpoint()`, a dialog-free commit path shared by AutoGit and the bottom-bar Commit button. `useAutoGit` watches the last editor activity plus app focus/visibility state, and when the vault is git-backed, all saves are flushed, and no unsaved edits remain, it triggers the same deterministic `Updated N note(s)` / `Updated N file(s)` commit message path after the configured idle or inactive thresholds. The bottom-bar quick action reuses that checkpoint flow after forcing a save first, so manual quick commits and scheduled AutoGit commits stay aligned on message generation and push behavior.
 
@@ -590,10 +622,12 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 | `parsing.rs` | Text processing: snippet extraction, markdown stripping, ISO date parsing, `extract_title` (H1 → legacy frontmatter → filename), `slug_to_title` |
 | `title_sync.rs` | Legacy filename → `title` frontmatter sync helper; no longer used by the normal note-open flow |
 | `cache.rs` | Git-based incremental vault caching (`scan_vault_cached`), git helpers |
+| `ignored.rs` | Gitignored-content visibility filtering via batched `git check-ignore` |
+| `filename_rules.rs` | Cross-platform validation for note filenames, folder names, and custom view filenames |
 | `rename.rs` | `rename_note` / `rename_note_filename` / `move_note_to_folder` — stage crash-safe file moves, update `title` frontmatter when needed, recover unfinished rename transactions, and report backlink rewrite failures |
-| `image.rs` | `save_image` — saves base64-encoded attachments with sanitized filenames |
+| `image.rs` | `save_image` / `copy_image_to_vault` — save editor image attachments with sanitized filenames |
 | `migration.rs` | `flatten_vault`, `vault_health_check`, `migrate_is_a_to_type` |
-| `config_seed.rs` | Maintains vault AI guidance (`AGENTS.md` + `CLAUDE.md` shim), migrates legacy `config/agents.md`, and repairs missing root type scaffolding such as `type.md` and `note.md` |
+| `config_seed.rs` | Maintains vault AI guidance (`AGENTS.md`, `CLAUDE.md`, and optional `GEMINI.md` shims), migrates legacy `config/agents.md`, and repairs missing root type scaffolding such as `type.md` and `note.md` |
 | `getting_started.rs` | Clones and normalizes the public Getting Started starter vault |
 
 ## Rust Backend Modules
@@ -603,15 +637,16 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 | `vault/` | Vault scanning, caching, parsing, rename, image, migration |
 | `frontmatter/` | YAML frontmatter read/write (`mod.rs`, `yaml.rs`, `ops.rs`) |
 | `git/` | Git operations (`commit.rs`, `status.rs`, `history.rs`, `conflict.rs`, `remote.rs`, `pulse.rs`, `clone.rs`, `connect.rs`) |
-| `search.rs` | Keyword search — walkdir-based vault file scan |
+| `search.rs` | Keyword search — walkdir-based vault file scan with Gitignored-content visibility filtering |
 | `ai_agents.rs` | Shared CLI-agent detection, stream normalization, and adapter dispatch |
 | `claude_cli.rs` | Claude Code subprocess spawning + NDJSON stream parsing |
+| `pi_cli.rs`, `pi_config.rs`, `pi_discovery.rs`, `pi_events.rs` | Pi subprocess launch, transient MCP adapter config, discovery, and JSON stream parsing |
 | `mcp.rs` | MCP server spawning + explicit config registration/removal |
 | `commands/` | Tauri command handlers (split into submodules) |
 | `settings.rs` | App settings persistence |
 | `vault_config.rs` | Per-vault UI config |
 | `vault_list.rs` | Vault list persistence |
-| `menu.rs` | Native macOS menu bar |
+| `menu.rs` | Native desktop menu definitions and command IDs (not mounted on Linux) |
 
 ## Tauri IPC Commands
 
@@ -619,7 +654,7 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 
 | Command | Description |
 |---------|-------------|
-| `list_vault` | Scan vault (cached) → `Vec<VaultEntry>` |
+| `list_vault` | Scan vault (cached), then apply Gitignored-content visibility → `Vec<VaultEntry>` |
 | `get_note_content` | Read note file content |
 | `save_note_content` | Write note content to disk |
 | `delete_note` | Permanently delete note from disk (with confirm dialog) |
@@ -631,12 +666,13 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 | `sync_note_title` | Legacy helper: rewrite `title` frontmatter from filename → `bool` (modified); not used by the normal note-open flow |
 | `batch_archive_notes` | Archive multiple notes |
 | `batch_delete_notes` | Permanently delete notes from disk |
-| `reload_vault` | Sync the active vault asset scope, invalidate cache, and full rescan from filesystem → `Vec<VaultEntry>` |
+| `reload_vault` | Sync the active vault asset scope, invalidate cache, full rescan from filesystem, then apply Gitignored-content visibility → `Vec<VaultEntry>` |
 | `reload_vault_entry` | Re-read a single file from disk → `VaultEntry` |
+| `start_vault_watcher` / `stop_vault_watcher` | Start or stop native active-vault filesystem change events |
 | `check_vault_exists` | Check if vault path exists |
 | `create_empty_vault` | Create a git-backed vault, then seed root `AGENTS.md`, `CLAUDE.md`, `type.md`, and `note.md` defaults |
 | `create_getting_started_vault` | Clone the public Getting Started vault, refresh Tolaria-managed guidance/config defaults, and keep the cloned repo clean |
-| `get_vault_ai_guidance_status` | Report whether `AGENTS.md` and the `CLAUDE.md` shim are managed, missing, broken, or custom |
+| `get_vault_ai_guidance_status` | Report whether `AGENTS.md`, `CLAUDE.md`, and optional `GEMINI.md` guidance are managed, missing, broken, or custom |
 | `restore_vault_ai_guidance` | Restore any missing/broken Tolaria-managed guidance files without overwriting custom ones |
 
 ### Frontmatter
@@ -687,13 +723,14 @@ The vault backend (`src-tauri/src/vault/`) is split into focused submodules:
 | Command | Description |
 |---------|-------------|
 | `stream_claude_chat` | Claude CLI chat mode (streaming) |
-| `stream_claude_agent` | Claude CLI agent mode (streaming + tools) |
 | `check_claude_cli` | Check if Claude CLI is available |
-| `get_ai_agents_status` | Check Claude Code + Codex availability |
-| `stream_ai_agent` | Stream the selected CLI agent through the normalized event layer |
-| `register_mcp_tools` | Register MCP in Claude/Cursor config for the active vault |
-| `remove_mcp_tools` | Remove Tolaria's MCP entry from Claude/Cursor config |
-| `check_mcp_status` | Check whether the active vault is explicitly registered in Claude/Cursor config |
+| `get_ai_agents_status` | Check Claude Code + Codex + OpenCode + Pi availability |
+| `stream_ai_agent` | Stream Claude Code, Codex, OpenCode, or Pi through the normalized agent event layer |
+| `register_mcp_tools` | Register MCP in Claude/Gemini/Cursor/generic config for the active vault |
+| `remove_mcp_tools` | Remove Tolaria's MCP entry from Claude/Gemini/Cursor/generic config |
+| `check_mcp_status` | Check whether the active vault is explicitly registered in Claude/Gemini/Cursor/generic config |
+| `get_mcp_config_snippet` | Return the exact manual MCP JSON snippet for the active vault |
+| `sync_mcp_bridge_vault` | Sync the desktop WebSocket bridge process to the selected vault, or stop it when no vault is selected |
 
 The desktop MCP WebSocket bridge is intentionally local-only. `mcp-server/ws-bridge.js` binds both bridge ports to loopback, rejects non-loopback clients, accepts browser/Tauri origins only on the UI bridge, and rejects browser-origin requests on the tool bridge so remote pages cannot drive vault tools directly.
 
@@ -709,8 +746,8 @@ The desktop MCP WebSocket bridge is intentionally local-only. `mcp-server/ws-bri
 | `save_vault_config` | Save per-vault UI config |
 | `get_default_vault_path` | Get default vault path |
 | `get_build_number` | Get app build number |
-| `save_image` | Save base64 image to vault |
-| `copy_image_to_vault` | Copy image file to vault |
+| `save_image` | Save base64 image to `attachments/` and refresh the active vault asset scope |
+| `copy_image_to_vault` | Copy image file to `attachments/` and refresh the active vault asset scope |
 | `update_menu_state` | Update native menu checkmarks and enabled/disabled state for selection-dependent actions |
 | `trigger_menu_command` | Emit a native menu command ID for deterministic shortcut QA |
 | `update_current_window_min_size` | Update the active Tauri window's minimum size and optionally grow it to fit restored panes |
@@ -745,17 +782,19 @@ No Redux or global context. State lives in the root `App.tsx` and custom hooks:
 | `useNoteCreation` | — | Note/type creation with optimistic persistence |
 | `useNoteRename` | — | Note renaming and folder moves with wikilink update |
 | `useNoteRetargeting` | — | Shared note retargeting logic for drag/drop and command-palette actions |
+| `useTauriDragDropEvent` | — | Shared native window drag/drop event subscription and cleanup |
+| `useNativePathDrop` | — | Tauri-native file/folder path drops for AI and command text inputs |
 | `frontmatterOps` | — (pure functions) | Frontmatter CRUD: key→VaultEntry mapping, mock/Tauri dispatch |
 | `useTabManagement` | Navigation history, note switching | Note navigation lifecycle |
 | `useVaultSwitcher` | `vaultPath`, `extraVaults` | Vault switching |
-| `useTheme` | Editor theme CSS vars | Editor typography theme |
-| `useCliAiAgent` | `messages`, `status`, tool actions | Selected AI agent conversation |
+| `useTheme` | Editor theme CSS vars and theme-mode bridge | Editor typography and app theme runtime |
+| `useCliAiAgent` | `messages`, `status`, tool actions | Selected AI agent conversation backed by the shared session pipeline |
 | `useAutoSync` | Sync interval, pull/push state | Git auto-sync |
 | `useAutoGit` | Last activity timestamp, idle/inactive checkpoint triggers | Automatic commit/push checkpoints |
 | `useCommitFlow` | Commit dialog state, shared manual/automatic checkpoint runner | Git commit/push orchestration |
 | `useGitRemoteStatus` | `remoteStatus`, `refreshRemoteStatus()` | On-demand remote detection for commit UI |
 | `useUnifiedSearch` | Query, results, loading state | Keyword search |
-| `useSettings` | App settings (telemetry, release channel, auto-sync interval, AutoGit thresholds, default AI agent) | Persistent settings |
+| `useSettings` | App settings (telemetry, release channel, theme mode, UI language, auto-sync interval, AutoGit thresholds, default AI agent, Gitignored-content visibility) | Persistent settings |
 | `useVaultConfig` | Per-vault UI preferences | Vault-specific config |
 | `appCommandDispatcher` | Canonical shortcut/menu command IDs | Shared execution path for renderer and native menu commands |
 
@@ -769,20 +808,24 @@ Data flows unidirectionally: `App` passes data and callbacks as props to child c
 | Cmd+P / Cmd+O | Open quick open palette |
 | Cmd+N | Create new note |
 | Cmd+S | Save current note |
+| Cmd+F | Find in current note when the editor is focused; otherwise note-list search can claim it |
+| Cmd+Shift+F | Find in vault |
 | Cmd+[ / Cmd+] | Navigate back / forward (replaces tabs) |
 | Cmd+Z / Cmd+Shift+Z | Undo / Redo |
 | Cmd+1–9 | Switch to tab N |
 | Cmd+[ / Cmd+] | Navigate back / forward |
 | `[[` in editor | Open wikilink suggestion menu |
 
-Selection-dependent actions are wired through the command palette and the native menus. For example, a deleted file opened from Changes view becomes a read-only diff preview, and that state enables the "Restore Deleted Note" menu/command while normal note mutation actions stay disabled. Folder selection follows the same pattern: when `selection.kind === 'folder'`, the command palette exposes "Rename Folder" and "Delete Folder", and the sidebar row can launch the same flows directly through inline rename or the folder context menu. Active notes now follow the same shared-action model for retargeting: Cmd+K can open "Change Note Type…" and "Move Note to Folder…", and the sidebar drop targets call the same hook-backed implementations instead of maintaining separate mutation paths.
+Selection-dependent actions are wired through the command palette and the native menus. For example, a deleted file opened from Changes view becomes a read-only diff preview, and that state enables the "Restore Deleted Note" menu/command while normal note mutation actions stay disabled. Folder selection follows the same pattern: when `selection.kind === 'folder'`, the command palette exposes "Reveal Folder in Finder", "Copy Folder Path", "Rename Folder", and "Delete Folder", and the sidebar row can launch the same flows directly through inline rename or the folder context menu. Active files also expose "Reveal in Finder" and "Copy File Path" through the command palette; non-Markdown file tabs additionally expose "Open in Default App", matching the `FilePreview` header controls. Active notes now follow the same shared-action model for retargeting: Cmd+K can open "Change Note Type…" and "Move Note to Folder…", and the sidebar drop targets call the same hook-backed implementations instead of maintaining separate mutation paths.
 
 Shortcut routing is explicit:
 
 - `appCommandCatalog.ts` is the shared shortcut manifest for command IDs, modifier rules, and deterministic QA metadata
+- `formatShortcutDisplay()` derives platform-accurate visible shortcut labels (`⌘` on macOS, `Ctrl` on Windows/Linux) from that same manifest so menus, tooltips, and command-palette copy stay aligned with real accelerators
 - `useAppKeyboard` is the primary execution path for real shortcut keypresses, including Tauri runs
-- macOS browser-reserved chords such as `Cmd+O` and `Cmd+Shift+L` are unblocked at webview init via `tauri-plugin-prevent-default`, then continue through the same renderer-first command path
-- `menu.rs` and `useMenuEvents` emit the same command IDs for native menu clicks and accelerators
+- macOS browser-reserved chords such as `Cmd+O`, `Cmd+F`, and `Cmd+Shift+L` are unblocked at webview init via `tauri-plugin-prevent-default`, then continue through the same renderer-first command path
+- `Cmd+F` is surface-aware: editor focus opens current-note find/replace in raw CodeMirror, note-list focus preserves note-list search, and native menu enablement follows focus availability events so only one `Cmd+F` menu item is active
+- `menu.rs`, `useMenuEvents`, and Linux's `LinuxMenuButton` emit the same command IDs for native menu clicks, accelerators, and custom titlebar menu actions
 - `appCommandDispatcher.ts` suppresses the paired native-menu/renderer echo from a single shortcut so the command runs once
 - Deterministic QA uses two explicit proof paths from the shared manifest:
   - renderer shortcut-event proof through `window.__laputaTest.triggerShortcutCommand()`
@@ -803,9 +846,13 @@ push to main
       → if stable already uses today, advance alpha to the next calendar day so semver still increases
   → build job:
       → pnpm install, stamp version, pnpm build, tauri build --target aarch64-apple-darwin --bundles app
-      → upload signed .app.tar.gz + .sig updater artifacts
+      → pnpm install, stamp version, pnpm build, tauri build --target x86_64-apple-darwin --bundles app
+      → upload signed Apple Silicon and Intel .app.tar.gz + .sig updater artifacts named Tolaria_<version>_macOS_Silicon and Tolaria_<version>_macOS_Intel
+  → build-windows job:
+      → pnpm install, stamp version, tauri build --target x86_64-pc-windows-msvc --bundles nsis
+      → upload NSIS installer, optional MSI artifacts, and signed Windows updater bundles
   → release job:
-      → generate alpha-latest.json
+      → generate alpha-latest.json with darwin-aarch64, darwin-x86_64, Linux, and Windows updater URLs
       → publish GitHub prerelease alpha-vYYYY.M.D-alpha.NNNN named Tolaria Alpha YYYY.M.D.N
   → pages job:
       → build static HTML release history page
@@ -822,13 +869,20 @@ push stable-vYYYY.M.D tag
   → version job: validate YYYY.M.D from the tag
   → build job:
       → pnpm install, stamp version, pnpm build, tauri build --target aarch64-apple-darwin
-      → upload signed .app.tar.gz + .sig and .dmg artifacts
+      → pnpm install, stamp version, pnpm build, tauri build --target x86_64-apple-darwin
+      → upload signed Apple Silicon and Intel .app.tar.gz + .sig and .dmg artifacts named Tolaria_<version>_macOS_Silicon and Tolaria_<version>_macOS_Intel
+  → build-linux job:
+      → pnpm install, stamp version, tauri build --target x86_64-unknown-linux-gnu --bundles deb,appimage
+      → upload .deb, .AppImage, and signed Linux updater bundles
+  → build-windows job:
+      → pnpm install, stamp version, tauri build --target x86_64-pc-windows-msvc --bundles nsis
+      → upload NSIS installer, optional MSI artifacts, and signed Windows updater bundles
   → release job:
-      → generate stable-latest.json with both updater tarball and current stable DMG URLs
+      → generate stable-latest.json with macOS Apple Silicon, macOS Intel, Linux, and Windows updater URLs plus platform-specific manual download URLs
       → publish GitHub release Tolaria YYYY.M.D
   → pages job:
       → publish stable/latest.json
-      → publish stable/download/ and download/ as permanent redirect URLs for the latest stable DMG
+      → publish stable/download/ and download/ as permanent redirect URLs for the latest stable platform installer
       → preserve alpha/latest.json
       → deploy to gh-pages
 ```
@@ -869,7 +923,7 @@ sequenceDiagram
     App->>User: TelemetryConsentDialog
     alt Accept
         User->>Settings: telemetry_consent=true, anonymous_id=UUID
-        Settings->>Sentry: init(DSN, anonymous_id)
+        Settings->>Sentry: init(DSN, release, anonymous_id)
         Settings->>PostHog: init(key, anonymous_id)
     else Decline
         User->>Settings: telemetry_consent=false
@@ -891,6 +945,7 @@ sequenceDiagram
 **Architecture:**
 - **Rust:** `sentry` crate initialized in `lib.rs::setup()` via `telemetry::init_sentry_from_settings()`
 - **JS:** `@sentry/react` + `posthog-js` initialized lazily by `useTelemetry` hook; the React root also wires `onCaughtError`, `onUncaughtError`, and `onRecoverableError` through `Sentry.reactErrorHandler()` so production React invariants include component stack context when crash reporting is enabled.
+- **Release grouping:** packaged release workflows pass `VITE_SENTRY_RELEASE` from the computed build version, but the app only assigns Sentry's `release` field for stable calendar builds (`YYYY.M.D`). Alpha/prerelease/internal builds omit `release` so they do not create normal Sentry Releases entries, while both frontend and Rust Sentry scopes tag `tolaria.build_version` and `tolaria.release_kind` for diagnostics.
 - **Settings:** `telemetry_consent`, `crash_reporting_enabled`, `analytics_enabled`, `anonymous_id` in `Settings` struct
 - **Consent:** `TelemetryConsentDialog` shown when `telemetry_consent === null`
 
@@ -945,7 +1000,7 @@ Desktop-only modules gated at the crate level:
 Desktop-only features gated at the function level in `commands/`:
 - Git operations (commit, pull, push, status, history, diff, conflicts)
 - Clone-by-URL via system git (`clone_repo`)
-- CLI AI agent streaming (Claude, Codex)
+- CLI AI agent streaming (Claude, Codex, OpenCode, Pi)
 - MCP registration and status
 - Menu state updates
 

docs/GETTING-STARTED.md

@@ -8,6 +8,27 @@ How to navigate the codebase, run the app, and find what you need.
 - **Rust** 1.77.2+ (for the Tauri backend)
 - **git** CLI (required by the git integration features)
 
+### Linux system dependencies
+
+If you run the desktop app on Linux, install Tauri's WebKit2GTK 4.1 dependencies first:
+
+- Arch / Manjaro:
+  ```bash
+  sudo pacman -S --needed webkit2gtk-4.1 base-devel curl wget file openssl \
+    appmenu-gtk-module libappindicator-gtk3 librsvg
+  ```
+- Debian / Ubuntu (22.04+):
+  ```bash
+  sudo apt install libwebkit2gtk-4.1-dev build-essential curl wget file \
+    libxdo-dev libssl-dev libayatana-appindicator3-dev librsvg2-dev \
+    libsoup-3.0-dev patchelf
+  ```
+- Fedora 38+:
+  ```bash
+  sudo dnf install webkit2gtk4.1-devel openssl-devel curl wget file \
+    libappindicator-gtk3-devel librsvg2-devel
+  ```
+
 ## Quick Start
 
 ```bash
@@ -42,8 +63,8 @@ tolaria/
 │   ├── App.css                   # App shell layout styles
 │   ├── types.ts                  # Shared TS types (VaultEntry, Settings, etc.)
 │   ├── mock-tauri.ts             # Mock Tauri layer for browser testing
-│   ├── theme.json                # Editor theme configuration
-│   ├── index.css                 # Global CSS variables + Tailwind setup
+│   ├── theme.json                # Editor typography theme configuration
+│   ├── index.css                 # Semantic app theme variables + Tailwind setup
 │   │
 │   ├── components/               # UI components (~98 files)
 │   │   ├── Sidebar.tsx           # Left panel: filters + type groups
@@ -68,6 +89,8 @@ tolaria/
 │   │   ├── CommandPalette.tsx    # Cmd+K command launcher
 │   │   ├── BreadcrumbBar.tsx     # Breadcrumb + word count + actions
 │   │   ├── WelcomeScreen.tsx     # Onboarding screen
+│   │   ├── LinuxTitlebar.tsx     # Linux-only custom window chrome + controls
+│   │   ├── LinuxMenuButton.tsx   # Linux titlebar menu mirroring app commands
 │   │   ├── CloneVaultModal.tsx   # Clone a vault from any git URL
 │   │   ├── AddRemoteModal.tsx    # Connect a local-only vault to a remote later
 │   │   ├── ConflictResolverModal.tsx # Git conflict resolution
@@ -83,16 +106,15 @@ tolaria/
 │   │   └── ui/                   # shadcn/ui primitives
 │   │       ├── button.tsx, dialog.tsx, input.tsx, ...
 │   │
-│   ├── hooks/                    # Custom React hooks (~87 files)
+│   ├── hooks/                    # Custom React hooks (~86 files)
 │   │   ├── useVaultLoader.ts     # Loads vault entries + content
 │   │   ├── useVaultSwitcher.ts   # Multi-vault management
 │   │   ├── useVaultConfig.ts     # Per-vault UI settings
 │   │   ├── useNoteActions.ts     # Composes creation + rename + frontmatter
 │   │   ├── useNoteCreation.ts    # Note/type creation
 │   │   ├── useNoteRename.ts     # Note renaming + wikilink updates
-│   │   ├── useAiAgent.ts         # Legacy Claude-specific stream helpers reused by the shared agent hook
-│   │   ├── useCliAiAgent.ts      # Selected AI agent state + normalized tool tracking
-│   │   ├── useAiAgentsStatus.ts  # Claude/Codex availability polling
+│   │   ├── useCliAiAgent.ts      # Selected AI agent state + normalized session pipeline
+│   │   ├── useAiAgentsStatus.ts  # Claude/Codex/OpenCode/Pi availability polling
 │   │   ├── useAiAgentPreferences.ts # Default-agent persistence + cycling
 │   │   ├── useAiActivity.ts      # MCP UI bridge listener
 │   │   ├── useAutoSync.ts        # Auto git pull/push
@@ -118,6 +140,7 @@ tolaria/
 │   ├── utils/                    # Pure utility functions (~48 files)
 │   │   ├── wikilinks.ts          # Wikilink preprocessing pipeline
 │   │   ├── frontmatter.ts        # TypeScript YAML parser
+│   │   ├── platform.ts           # Runtime platform + Linux chrome gating helpers
 │   │   ├── ai-agent.ts           # Agent stream utilities
 │   │   ├── ai-chat.ts            # Token estimation utilities
 │   │   ├── ai-context.ts         # Context snapshot builder
@@ -133,6 +156,8 @@ tolaria/
 │   ├── lib/
 │   │   ├── aiAgents.ts           # Shared agent registry + status helpers
 │   │   ├── appUpdater.ts         # Frontend wrapper around channel-aware updater commands
+│   │   ├── i18n.ts               # App-owned localization runtime and locale resolution
+│   │   ├── locales/              # JSON locale catalogs (English source + translated locales)
 │   │   ├── releaseChannel.ts     # Alpha/stable normalization helpers
 │   │   └── utils.ts              # Tailwind merge + cn() helper
 │   │
@@ -165,6 +190,7 @@ tolaria/
 │   │   ├── search.rs             # Keyword search (walkdir-based)
 │   │   ├── ai_agents.rs          # Shared CLI-agent detection + stream adapters
 │   │   ├── claude_cli.rs         # Claude CLI subprocess management
+│   │   ├── pi_cli.rs             # Pi CLI subprocess management
 │   │   ├── mcp.rs                # MCP server lifecycle + explicit config registration/removal
 │   │   ├── app_updater.rs        # Alpha/stable updater endpoint selection
 │   │   ├── settings.rs           # App settings persistence
@@ -187,6 +213,7 @@ tolaria/
 ├── scripts/                      # Build/utility scripts
 │
 ├── package.json                  # Frontend dependencies + scripts
+├── lara.yaml                     # Lara CLI locale sync configuration
 ├── vite.config.ts                # Vite bundler config
 ├── tsconfig.json                 # TypeScript config
 ├── playwright.config.ts          # Full Playwright regression config
@@ -234,8 +261,9 @@ tolaria/
 | `src-tauri/src/frontmatter/ops.rs` | YAML manipulation — how properties are updated/deleted in files. |
 | `src-tauri/src/git/` | All git operations (clone, commit, pull, push, conflicts, pulse, add-remote). |
 | `src-tauri/src/search.rs` | Keyword search — scans vault files with walkdir. |
-| `src-tauri/src/ai_agents.rs` | Shared CLI-agent availability checks, safe-default Codex adapter, and stream normalization. |
+| `src-tauri/src/ai_agents.rs` | Shared CLI-agent availability checks, adapter dispatch, and stream normalization. |
 | `src-tauri/src/claude_cli.rs` | Claude CLI subprocess spawning + NDJSON stream parsing. |
+| `src-tauri/src/pi_cli.rs` | Pi subprocess spawning through JSON mode and transient MCP adapter config. |
 | `src-tauri/src/app_updater.rs` | Desktop updater bridge — selects alpha/stable manifests and streams install progress. |
 
 ### Editor
@@ -255,7 +283,9 @@ tolaria/
 | File | Why it matters |
 |------|---------------|
 | `src/components/AiPanel.tsx` | AI agent panel — selected CLI agent with tool execution, reasoning, and actions. |
-| `src/hooks/useCliAiAgent.ts` | Agent state: messages, streaming, tool tracking, file detection. |
+| `src/hooks/useCliAiAgent.ts` | Thin React owner for the selected CLI agent session state. |
+| `src/lib/aiAgentSession.ts` | Single message/session lifecycle for prompt normalization, history, streaming, and reset behavior. |
+| `src/lib/aiAgentFileOperations.ts` | Detects agent-created or modified vault files from normalized tool inputs. |
 | `src/lib/aiAgents.ts` | Supported agent definitions, status normalization, and default-agent helpers. |
 | `src/utils/ai-context.ts` | Context snapshot builder for AI conversations. |
 
@@ -263,19 +293,19 @@ tolaria/
 
 | File | Why it matters |
 |------|---------------|
-| `src/index.css` | All CSS custom properties. The design token source of truth. |
-| `src/theme.json` | Editor-specific theme (fonts, headings, lists, code blocks). |
+| `src/index.css` | Semantic CSS custom properties for app-owned light/dark themes. |
+| `src/theme.json` | Editor-specific typography theme (fonts, headings, lists, code blocks). |
 
 ### Settings & Config
 
 | File | Why it matters |
 |------|---------------|
-| `src/hooks/useSettings.ts` | App settings (telemetry, release channel, auto-sync interval, default AI agent). |
+| `src/hooks/useSettings.ts` | App settings (telemetry, release channel, theme mode, UI language, auto-sync interval, default AI agent). |
 | `src/lib/releaseChannel.ts` | Normalizes persisted updater-channel values (`stable` default, optional `alpha`). |
 | `src/lib/appUpdater.ts` | Frontend wrapper for channel-aware updater commands. |
 | `src/hooks/useMainWindowSizeConstraints.ts` | Derives the main-window minimum width from the visible panes and asks Tauri to grow back to fit wider layouts. |
 | `src/hooks/useVaultConfig.ts` | Per-vault local UI preferences (zoom, view mode, colors, Inbox columns, explicit organization workflow). |
-| `src/components/SettingsPanel.tsx` | Settings UI for telemetry, release channel, sync interval, default AI agent, and the vault-level explicit organization toggle. |
+| `src/components/SettingsPanel.tsx` | Settings UI for telemetry, release channel, sync interval, UI language, default AI agent, and the vault-level explicit organization toggle. |
 | `src/hooks/useUpdater.ts` | In-app updates using the selected alpha/stable feed. |
 
 ## Architecture Patterns
@@ -311,10 +341,12 @@ type SidebarSelection =
 
 ### Command Registry
 
-`useCommandRegistry` + `useAppCommands` build a centralized command registry. Commands are registered with labels, shortcuts, and handlers. The `CommandPalette` (Cmd+K) fuzzy-searches this registry. Shortcut combos live in `appCommandCatalog.ts`; real keypresses always flow through `useAppKeyboard`, native menu clicks emit the same command IDs through `useMenuEvents`, and `appCommandDispatcher.ts` suppresses the duplicate native/renderer echo from a single shortcut. On macOS, any browser-reserved chord that WKWebView swallows before that path must also be added to the narrow `tauri-plugin-prevent-default` registration in `src-tauri/src/lib.rs`. The same shortcut manifest also declares the deterministic QA mode for each shortcut-capable command.
+`useCommandRegistry` + `useAppCommands` build a centralized command registry. Commands are registered with labels, shortcuts, and handlers. The `CommandPalette` (Cmd+K) fuzzy-searches this registry. Shortcut combos live in `appCommandCatalog.ts`; real keypresses always flow through `useAppKeyboard`, native menu clicks emit the same command IDs through `useMenuEvents`, and `appCommandDispatcher.ts` suppresses the duplicate native/renderer echo from a single shortcut. On macOS, any browser-reserved chord that WKWebView swallows before that path must also be added to the narrow `tauri-plugin-prevent-default` registration in `src-tauri/src/lib.rs`. On Linux, `LinuxTitlebar.tsx` and `LinuxMenuButton.tsx` reuse the same command IDs through `trigger_menu_command` because the native GTK menu bar is intentionally not mounted. The same shortcut manifest also declares the deterministic QA mode for each shortcut-capable command.
 
 Commands whose availability depends on the current note or Git state must also flow through `update_menu_state` so the native menu stays in sync with the command palette. The deleted-note restore action in Changes view is the reference example: the row opens a deleted diff preview, the command palette exposes "Restore Deleted Note", and the Note menu enables the same action only while that preview is active.
 
+Current-note find/replace is a surface-aware command: editor focus enables "Find in Note" / "Replace in Note" and routes Cmd+F into raw CodeMirror mode; note-list focus enables existing note-list search instead. When adding another focus-dependent command, mirror this pattern with an availability event consumed by `useMenuEvents.ts` and `update_menu_state`.
+
 For automated shortcut QA, use the explicit proof path from `appCommandCatalog.ts`:
 
 - `window.__laputaTest.triggerShortcutCommand()` for deterministic renderer shortcut-event coverage
@@ -380,7 +412,7 @@ BASE_URL="http://localhost:5173" npx playwright test tests/smoke/<slug>.spec.ts
 
 ### Modify styling
 
-1. **Global CSS variables**: Edit `src/index.css`
+1. **Global app/theme variables**: Edit `src/index.css`
 2. **Editor typography**: Edit `src/theme.json`
 
 ### Work with the AI agent
@@ -388,5 +420,12 @@ BASE_URL="http://localhost:5173" npx playwright test tests/smoke/<slug>.spec.ts
 1. **Agent system prompt**: Edit `src/utils/ai-agent.ts` (inline system prompt string)
 2. **Context building**: Edit `src/utils/ai-context.ts` for what data is sent to the agent
 3. **Tool action display**: Edit `src/components/AiActionCard.tsx`
-4. **Claude CLI arguments**: Edit `src-tauri/src/claude_cli.rs` (`run_agent_stream()`)
-5. **Shared agent adapters / Codex args**: Edit `src-tauri/src/ai_agents.rs` (keep Codex on the normal approval/sandbox path unless you are intentionally designing an advanced mode)
+4. **Claude CLI arguments**: Edit `src-tauri/src/claude_cli.rs` (`run_agent_stream()`; keep app-managed launches on strict Tolaria MCP config, `acceptEdits`, and the scoped file/search tool list)
+5. **Shared agent adapters / Codex/Pi args**: Edit `src-tauri/src/ai_agents.rs` plus the per-agent adapter modules (keep Codex sandboxed with active-vault `workspace-write`, keep Pi on transient MCP config, and do not use dangerous permission bypasses unless an ADR explicitly designs a new mode)
+
+### Work with external MCP setup
+
+1. **Backend registration/status/snippets**: Edit `src-tauri/src/mcp.rs`; registration and manual config generation must verify Node.js first, resolve the packaged `mcp-server/` for macOS, Windows, Linux, and AppImage installs, and use an explicit stdio entry with `VAULT_PATH` plus `WS_UI_PORT=9711`
+2. **Setup dialog copy/actions**: Edit `src/components/McpSetupDialog.tsx` and `src/hooks/useMcpStatus.ts`; users should see the Node.js prerequisite, the exact generated manual config, and a copy action before Tolaria writes third-party config files
+3. **Status hook/toasts**: Edit `src/hooks/useMcpStatus.ts` when setup, reconnect, disconnect, or failure messaging changes
+4. **Gemini CLI compatibility**: Keep `~/.gemini/settings.json` in the registration path list and keep optional `GEMINI.md` generation behind `restore_vault_ai_guidance`; Gemini itself still needs its own install and sign-in outside Tolaria

docs/adr/0013-remove-theming-system.md

@@ -2,8 +2,9 @@
 type: ADR
 id: "0013"
 title: "Remove vault-based theming system"
-status: active
+status: superseded
 date: 2026-03-23
+superseded_by: "0081"
 ---
 
 ## Context

docs/adr/0079-linux-window-chrome-and-menu-reuse.md

@@ -0,0 +1,37 @@
+---
+type: ADR
+id: "0079"
+title: "Linux window chrome and menu reuse"
+status: active
+date: 2026-04-24
+---
+
+## Context
+
+Tolaria's desktop shell was designed around macOS window chrome. `titleBarStyle: "Overlay"` and `hiddenTitle: true` give the app a clean single-surface titlebar on macOS, but Linux ignores those flags and draws native GTK decorations and a native menu bar on top of the React UI. That creates a double-titlebar effect, mismatched theming, and inconsistent behavior between the main window and detached note windows.
+
+We still need Linux to reuse Tolaria's existing command palette, shortcut manifest, and deterministic menu-command routing instead of inventing a Linux-only command path.
+
+## Decision
+
+**Tolaria uses custom React-rendered window chrome on Linux and routes its menu through the existing shared command IDs.**
+
+- The main Tauri window disables server-side decorations on Linux during app setup.
+- Detached note windows set `decorations: false` when Linux chrome is active.
+- `LinuxTitlebar` renders the drag region, resize handles, and window controls for Linux windows.
+- `LinuxMenuButton` mirrors the app's File/Edit/View/Go/Note/Vault/Window menus, but dispatches the existing command IDs through `trigger_menu_command`.
+- The native Tauri menu bar is not mounted on Linux; macOS and other existing desktop targets keep the native menu.
+- Shared shortcuts remain defined in `appCommandCatalog.ts`, including `Cmd+Shift+L` on macOS and `Ctrl+Shift+L` on Linux through the same command manifest.
+
+## Options considered
+
+- **React-rendered Linux chrome with shared command IDs** (chosen): keeps Linux visually aligned with Tolaria's existing shell and preserves one command-routing model across keyboard shortcuts, menu clicks, and QA helpers. Cons: Tolaria now owns Linux window chrome behavior directly.
+- **Keep native GTK decorations and menu bar on Linux**: cheaper to ship, but it breaks visual consistency and produces overlapping titlebar/menu surfaces that do not match the rest of the app.
+- **Introduce Linux-only command wiring for the custom menu**: would allow a Linux-specific implementation, but it would fork the shortcut/menu architecture and weaken deterministic QA.
+
+## Consequences
+
+- Linux main windows and detached note windows now present one consistent titlebar surface controlled by Tolaria.
+- Menu commands, command palette actions, and deterministic QA still share the same command IDs, which limits platform-specific drift.
+- Linux packaging and CI must install WebKit2GTK 4.1 dependencies and produce Linux bundles explicitly.
+- Tolaria now owns Linux resize handles, maximize/minimize/close behavior, and titlebar drag-region behavior in the renderer, so regressions in those surfaces require direct tests.

docs/adr/0080-cross-platform-desktop-release-artifacts-and-portable-vault-names.md

@@ -0,0 +1,36 @@
+---
+type: ADR
+id: "0080"
+title: "Cross-platform desktop release artifacts and portable vault names"
+status: active
+date: 2026-04-24
+---
+
+## Context
+
+Tolaria's release pipeline and file validation rules were still biased toward macOS. Alpha/stable releases only produced first-class macOS artifacts, stable download redirects assumed a DMG-only world, and vault file/folder validation allowed names that work on macOS/Linux but break on Windows clones and sync targets.
+
+Shipping Windows as a supported desktop target requires both distribution and data portability to become explicit. A Windows installer is not enough if shared vault content can still produce invalid filenames on that platform, and cross-platform updater manifests must keep Tauri's signed updater artifact separate from the user-facing installer download.
+
+## Decision
+
+**Tolaria ships first-class macOS, Windows x64, and Linux x64 desktop artifacts, and its vault-facing filename rules are portable across those platforms by default.**
+
+- Alpha and stable release workflows build and publish macOS, Windows x64, and Linux x64 artifacts from the same release tag/version computation.
+- `latest.json` manifests continue to point Tauri updater clients at signed updater artifacts through `url`, while manual installer/download links are exposed separately via platform-specific fields such as `dmg_url` and `download_url`.
+- The stable download page resolves the best current platform download from that manifest plus release assets, instead of assuming macOS-only DMG delivery.
+- Note filename renames, folder creation/rename flows, and custom view filenames all share one portable validation rule set that rejects Windows reserved device names, invalid characters, and trailing dot/space suffixes.
+- Shortcut labels shown in the UI are derived from the shared command manifest so non-macOS builds display `Ctrl`-style accelerators instead of macOS glyphs.
+
+## Options considered
+
+- **Cross-platform artifacts + portable filename rules** (chosen): makes Windows support real instead of nominal, keeps updater behavior compatible with Tauri, and prevents cross-OS vault breakage at the point of write. Cons: more CI matrix surface area and more platform-specific packaging constraints.
+- **Ship Windows installers but keep existing filename validation**: lowers immediate implementation cost, but Windows users would still hit invalid vault content created elsewhere and trust in sync portability would stay weak.
+- **Keep macOS-first updater/download metadata and infer other platforms from release assets only**: cheaper in the short term, but it weakens in-app update guarantees and makes the public download page depend on ad hoc asset naming rather than an explicit manifest contract.
+
+## Consequences
+
+- Tolaria's release CI now owns packaging and artifact validation on three desktop platforms instead of one.
+- The public stable download page can redirect Windows/Linux users to real installers without special-case manual curation.
+- Vault content created through Tolaria stays portable across macOS, Linux, and Windows, which reduces sync-time surprises and broken clones.
+- Any future platform addition now needs both a release-artifact contract and an explicit portable-filename review instead of piggybacking on macOS assumptions.

docs/adr/0081-internal-light-dark-theme-runtime.md

@@ -0,0 +1,43 @@
+---
+type: ADR
+id: "0081"
+title: "Internal light and dark theme runtime"
+status: active
+date: 2026-04-24
+supersedes: "0013"
+---
+
+## Context
+
+ADR-0013 removed the vault-authored theming system and made Tolaria light-only. That kept the app simpler, but dark mode has become a product requirement for long writing sessions and accessibility.
+
+The previous theming system should not return in its old form: vault notes, live user-authored themes, and broad runtime editing created too much maintenance burden. Tolaria still needs a small app-owned theme architecture because the UI spans Tailwind/shadcn variables, BlockNote/Mantine surfaces, CodeMirror raw editing, syntax highlighting, and product-specific states such as selected rows, badges, warnings, and diff lines.
+
+## Decision
+
+**Tolaria will support internal app-owned light and dark themes through a semantic CSS-variable contract, with the user's theme mode persisted as installation-local app settings.**
+
+The v1 theme runtime is deliberately smaller than a general theming system:
+
+- Themes are defined by the app, not by vault-authored notes.
+- CSS custom properties remain the public runtime contract for product components, Tailwind v4, and shadcn/ui.
+- Typed TypeScript helpers may derive values for consumers that cannot read CSS variables directly, such as CodeMirror extensions.
+- Existing CSS variables stay available as compatibility aliases while the UI migrates toward semantic names.
+- The first persisted choices are `light` and `dark`; system-follow, high-contrast variants, custom themes, and per-vault themes are deferred.
+
+## Options considered
+
+- **Internal light/dark runtime with semantic tokens** (chosen): ships dark mode while keeping the product-owned theme surface small, testable, and compatible with existing CSS-variable usage.
+- **Reintroduce vault-authored theme notes**: flexible, but repeats the complexity removed by ADR-0013 and makes dark mode dependent on user-editable data.
+- **Ad hoc `.dark` overrides in components**: fastest initially, but would scatter color logic across the app and make future theme variants expensive.
+- **Single TypeScript theme object as source of truth**: attractive for validation, but the current app already relies on CSS variables for Tailwind, shadcn/ui, BlockNote CSS overrides, and many product components.
+
+## Consequences
+
+- `src/index.css` owns the stable CSS custom-property contract for app chrome and shared states.
+- `src/theme.json` continues to describe editor typography, but editor-facing colors should resolve through the same semantic CSS variables used by the app shell.
+- `useTheme` remains responsible for editor theme flattening and can grow into the bridge between app theme mode and editor consumers.
+- App settings, not vault frontmatter, store the selected theme mode because it is an installation-local comfort preference.
+- Startup must avoid a light-mode flash when dark mode is selected, so the runtime needs a pre-React localStorage mirror and a minimal `index.html` prepaint style in addition to persisted Tauri settings.
+- Domain tokens should be introduced only when a surface needs a role that generic semantic tokens cannot express clearly.
+- Re-evaluate if Tolaria decides to support user-authored custom themes, per-vault themes, or system-synchronized mode as a first-class product requirement.

docs/adr/0082-markdown-durable-math-notes.md

@@ -0,0 +1,40 @@
+---
+type: ADR
+id: "0082"
+title: "Markdown-durable math in notes"
+status: active
+date: 2026-04-26
+---
+
+## Context
+
+Tolaria notes are durable Markdown files, while the main editor uses BlockNote and raw mode uses CodeMirror. Users coming from technical note-taking tools expect inline math such as `$E=mc^2$` and display math such as `$$ ... $$` to render inside notes without turning the note into an app-only document format.
+
+BlockNote does not currently ship a first-party math block in the local editor package. Tiptap now offers an official Mathematics extension that renders KaTeX nodes, but Tolaria's save path still depends on BlockNote's Markdown parser and `blocksToMarkdownLossy()` serializer. Adding opaque ProseMirror math nodes without an explicit Tolaria serializer would risk losing or rewriting the original Markdown source.
+
+## Decision
+
+**Tolaria will support note math through a Markdown placeholder round-trip owned by the editor pipeline.**
+
+The initial implementation:
+
+- Treats `$...$` as inline math and line-owned `$$...$$` / multiline `$$` blocks as display math.
+- Converts math source to temporary placeholders before BlockNote parses Markdown.
+- Replaces placeholders with Tolaria schema nodes that render via the existing `katex` dependency.
+- Serializes those schema nodes back to the original Markdown delimiters before saving or entering raw mode.
+- Uses KaTeX with `throwOnError: false` and `trust: false` so malformed or untrusted formulas remain visible rather than breaking the note.
+
+## Options considered
+
+- **Tolaria-owned placeholder round-trip with KaTeX rendering** (chosen): matches the existing wikilink architecture, preserves plain-text source, and avoids depending on BlockNote support for non-default ProseMirror math nodes.
+- **Tiptap Mathematics extension directly in BlockNote**: attractive because it is official Tiptap and KaTeX-backed, but it does not by itself solve Tolaria's BlockNote Markdown serializer contract.
+- **Raw-mode-only math support**: preserves source but fails the rich editor reading experience users expect.
+- **Store formulas as custom JSON/frontmatter metadata**: richer structured editing later, but violates the Markdown-first durability requirement.
+
+## Consequences
+
+- `src/utils/mathMarkdown.ts` is the canonical parser/serializer bridge for note math.
+- The rich editor renders math as schema nodes; raw mode remains the most direct way to edit exact math source.
+- CodeMirror raw editing keeps the literal Markdown delimiters, so imported Obsidian-style notes remain understandable outside Tolaria.
+- Future equation editing helpers can be added on top of the same Markdown source contract instead of changing the storage model.
+- Re-evaluate direct Tiptap Mathematics integration only if it can be proven to preserve Tolaria's Markdown save path without custom lossy behavior.

docs/adr/0083-dual-architecture-macos-release-artifacts.md

@@ -0,0 +1,38 @@
+---
+type: ADR
+id: "0083"
+title: "Dual-architecture macOS release artifacts"
+status: active
+date: 2026-04-26
+supersedes: "0080"
+---
+
+## Context
+
+ADR-0080 made Tolaria's desktop release pipeline cross-platform, but the macOS leg still shipped only Apple Silicon artifacts. That left Intel Mac users without a compatible build in both the alpha feed and stable releases, even though Tauri and Rust can produce `x86_64-apple-darwin` bundles from the same release workflow.
+
+The updater manifest also needs to distinguish macOS CPU architectures. A generic `darwin` or macOS-only entry would make it too easy for an Intel installation to see an Apple Silicon updater bundle, and browser user agents cannot reliably tell Apple Silicon Macs apart from Intel Macs.
+
+## Decision
+
+**Tolaria publishes macOS release artifacts for both Apple Silicon (`darwin-aarch64`) and Intel (`darwin-x86_64`) in every alpha and stable release.**
+
+- Alpha and stable workflows build the macOS matrix for `aarch64-apple-darwin` and `x86_64-apple-darwin`.
+- Alpha manifests include signed updater tarballs for `darwin-aarch64` and `darwin-x86_64`.
+- Stable manifests include both macOS updater tarballs and both manual DMG downloads, alongside the existing Windows x64 and Linux x86_64 entries.
+- Release jobs normalize macOS artifact filenames with the architecture suffix before publishing so GitHub release assets stay unambiguous.
+- The stable download page exposes separate Apple Silicon and Intel Mac links. When both Mac links exist, a generic macOS browser is not auto-redirected because user-agent architecture detection is unreliable.
+- The cross-platform filename portability decisions from ADR-0080 remain in force.
+
+## Options considered
+
+- **Publish separate Apple Silicon and Intel Mac artifacts** (chosen): gives each updater client an architecture-specific manifest key and gives users explicit manual download links. Cons: doubles the macOS release matrix and signing/notarization surface.
+- **Publish a universal macOS binary**: gives users one download, but requires lipo/re-sign/notarize coordination and reintroduces the artifact-combining complexity the release pipeline intentionally avoided.
+- **Keep Apple Silicon-only macOS releases**: keeps CI cheaper, but leaves Intel Mac users unsupported and makes the release artifacts inconsistent with Tolaria's desktop support goals.
+
+## Consequences
+
+- macOS release jobs now run one matrix entry per CPU architecture.
+- Release manifest consumers must treat `darwin-aarch64` and `darwin-x86_64` as distinct platform keys.
+- Stable manual downloads show two Mac choices instead of pretending browser detection can select the right CPU architecture.
+- Future macOS release changes must validate both updater and manual-download artifacts for both architectures.

docs/adr/0084-app-localization-foundation.md

@@ -0,0 +1,35 @@
+---
+type: ADR
+id: "0084"
+title: "App-owned localization foundation"
+status: active
+date: 2026-04-26
+---
+
+## Context
+
+Tolaria was effectively English-only. Users requested a general i18n foundation and Chinese-language support. We need a path that lets the UI adopt additional locales without pushing UI-language preferences into vault files or making every partially translated string a runtime failure.
+
+## Decision
+
+Tolaria owns a dependency-free frontend localization layer in `src/lib/i18n.ts`.
+
+- English is the canonical fallback locale.
+- Simplified Chinese (`zh-Hans`) is the first additional locale.
+- `ui_language` is an installation-local app setting in `~/.config/com.tolaria.app/settings.json`; `null` means "follow system language when supported, otherwise English".
+- Missing translation keys fall back to English.
+- App-level chrome receives locale through props from `App.tsx`, following the existing props-down/callbacks-up architecture instead of introducing global React context.
+- Language switching is exposed in Settings and through command-palette actions.
+
+## Alternatives considered
+
+- **Add an i18n dependency now**: useful long term, but unnecessary for the first locale and would add framework surface before we know Tolaria's locale workflow.
+- **Store language in the vault**: rejected because UI language is an installation preference, not content structure.
+- **Translate ad hoc strings inline**: rejected because it would make fallback behavior inconsistent and future locales expensive.
+
+## Consequences
+
+- New UI strings should be added to `src/lib/i18n.ts` first and rendered through `translate()` / `createTranslator()` where the surface already receives locale.
+- Partially translated locales remain usable because English is the fallback for missing keys.
+- Locale choice changes UI chrome immediately after settings save or command-palette language commands without reopening the vault.
+- Larger feature surfaces can migrate to the shared localization module incrementally.

docs/adr/0085-non-git-vault-support.md

@@ -0,0 +1,39 @@
+---
+type: ADR
+id: "0085"
+title: "Non-git vaults open with explicit later Git initialization"
+status: active
+date: 2026-04-26
+supersedes: "0034"
+---
+
+## Context
+
+ADR-0034 made Git a hard prerequisite for opening a vault because Git-backed cache, history, change, and sync flows failed invisibly when users opened plain Markdown folders. That protected Git features, but it blocked the common adoption path of opening an existing folder from Obsidian, iCloud, Dropbox, or a manually maintained notes directory.
+
+Tolaria now needs the opposite default: browsing and editing Markdown should work immediately, while Git remains an explicit capability users can enable when they want history, sync, commits, or collaboration.
+
+## Decision
+
+**Open existing Markdown folders even when they are not Git repositories.** A non-git vault is a supported state, not an error state. On open, Tolaria asks whether to initialize Git; if the user dismisses the prompt, the app keeps working and the status bar permanently shows a `Git disabled` warning. Clicking that warning, or running `Initialize Git for Current Vault` from the command palette, reopens the setup action.
+
+While a vault is not Git-backed:
+
+- Git history, change, commit, sync, conflict, and remote actions are hidden or disabled.
+- Background auto-sync and AutoGit checkpoints do not run.
+- Markdown scanning, note browsing, note editing, search, and non-Git vault features continue normally.
+
+`init_git_repo` remains the single backend command for enabling Git later. It creates the repository, writes Tolaria's default `.gitignore`, stages the vault, and creates the unsigned setup commit.
+
+## Options considered
+
+- **Option A (chosen): Supported non-git mode with explicit later initialization.** Best adoption path; keeps Git capabilities visible without blocking the basic notes workflow.
+- **Option B: Keep the ADR-0034 blocking modal.** Prevents Git feature ambiguity, but rejects valid plain-folder workflows.
+- **Option C: Auto-initialize Git when opening a plain folder.** Low friction, but surprising for users who do not want Tolaria to mutate folder metadata.
+
+## Consequences
+
+- Existing Git-backed vaults keep the same history, commit, sync, and remote behavior.
+- UI surfaces must treat Git capability as stateful per vault, not as an app-wide invariant.
+- Tests need to cover both Git-backed and non-git vaults in browser mocks and native QA.
+- Future Git-dependent features must check the current vault's Git state before registering commands or running background work.

docs/adr/0086-in-app-image-file-preview.md

@@ -0,0 +1,32 @@
+---
+type: ADR
+id: "0086"
+title: "In-app image previews for binary vault files"
+status: active
+date: 2026-04-26
+supersedes: "0041"
+---
+
+## Context
+
+ADR-0041 made the vault scanner index all visible files and introduced `fileKind` as `"markdown"`, `"text"`, or `"binary"`. Binary files were deliberately shown as inert entries until Tolaria had a dedicated preview model.
+
+That made image references visible in folder views, but opening an image still felt outside the normal Tolaria workflow. Users need to inspect screenshots, diagrams, and other image assets while keeping their place in the vault.
+
+## Decision
+
+**Tolaria previews supported image files in the editor pane while keeping them as ordinary binary `VaultEntry` files.**
+
+- The scanner keeps the existing `fileKind: "binary"` representation. Image previewability is inferred in the renderer from the file extension, not by introducing a proprietary image document type.
+- Opening a binary entry creates the same single active-tab state used for notes, but with empty content and no `get_note_content` text read.
+- `FilePreview` renders supported image extensions through Tauri's asset protocol (`convertFileSrc`) so the original file remains on disk.
+- Broken images and unsupported binary files render an explicit fallback state with an intentional "Open in default app" action instead of launching another app automatically.
+- Note-list rows use an image indicator for previewable image binaries. Unsupported binary rows remain muted and non-clickable in the normal list surface.
+- The preview surface is keyboard focusable and `Escape` returns focus to the note list, matching the app's keyboard-first navigation model.
+
+## Consequences
+
+- The existing `VaultEntry` model and cache version do not need to change.
+- Supported image files can participate in normal selection/navigation context without being converted into Markdown notes.
+- Unsupported/broken binary files have a clear in-app state when reached through navigation paths that can select them.
+- Any future PDF, audio, or video preview should extend the same file-preview renderer rather than adding new vault-owned document representations.

docs/adr/0087-json-catalogs-and-lara-cli-localization.md

@@ -0,0 +1,39 @@
+---
+type: ADR
+id: "0087"
+title: "JSON locale catalogs with Lara CLI synchronization"
+status: active
+date: 2026-04-27
+supersedes:
+  - "0084"
+---
+
+## Context
+
+ADR-0084 established an app-owned localization layer in `src/lib/i18n.ts` with English fallback and hand-maintained TypeScript dictionaries. That was enough for the first localized UI surface, but it does not scale well to a broader locale matrix or machine-assisted translation workflows.
+
+We now want Tolaria to support a wider set of locales and to automate translation updates with Lara CLI while keeping the runtime dependency-light and preserving the existing English fallback behavior.
+
+## Decision
+
+Tolaria will keep its app-owned runtime localization layer, but the translation source-of-truth moves to flat JSON catalogs in `src/lib/locales/`.
+
+- `src/lib/locales/en.json` is the canonical source catalog.
+- Additional locale files use one JSON file per locale code (for example `zh-CN.json`, `fr-FR.json`).
+- `src/lib/i18n.ts` keeps fallback, interpolation, locale resolution, and props-down locale wiring, but it now loads locale catalogs from JSON files instead of TypeScript objects.
+- Lara CLI configuration lives in `lara.yaml`, and translation runs happen through repo scripts (`pnpm l10n:translate`, `pnpm l10n:translate:force`).
+- `scripts/validate-locales.mjs` verifies that every locale catalog present in the repo matches the English keyset and only contains flat string values.
+- Legacy stored preferences such as `zh-Hans` are normalized to the canonical `zh-CN` locale.
+
+## Alternatives considered
+
+- **Keep TypeScript dictionaries and point Lara at `.ts` files**: possible, but JSON is the more standard interchange format for translation tooling and keeps diffs simpler for translators and reviewers.
+- **Adopt a full frontend i18n framework now**: rejected because Tolaria already has working locale propagation and fallback behavior, and the immediate need is better content management plus translation automation.
+- **Store translated strings outside the app repo**: rejected because Tolaria's chrome localization should stay versioned with the app code that consumes it.
+
+## Consequences
+
+- Translators and automation tools now work against plain JSON catalogs instead of editing source code.
+- The runtime keeps English fallback behavior, so a missing locale file or missing key does not break app chrome.
+- Locale additions become a data/config change first: add the locale metadata, run Lara, review JSON output, then ship.
+- Localization work now has a dedicated validation step that can run in CI or before commit.

docs/adr/0088-markdown-durable-mermaid-diagrams.md

@@ -0,0 +1,40 @@
+---
+type: ADR
+id: "0088"
+title: "Markdown-durable Mermaid diagrams in notes"
+status: active
+date: 2026-04-27
+---
+
+## Context
+
+Tolaria notes are plain Markdown files, while the rich editor uses BlockNote and raw mode uses CodeMirror. Users need fenced `mermaid` blocks to render as diagrams in the note surface without changing the canonical file format or hiding the source from raw editing.
+
+BlockNote can parse fenced code blocks, but a generic highlighted code block does not provide diagram rendering. Rendering Mermaid directly from the Markdown fence also has to preserve the original fence source when notes are saved, copied through raw mode, closed, and reopened.
+
+## Decision
+
+**Tolaria will support Mermaid diagrams through a Markdown placeholder round-trip owned by the editor pipeline and rendered with the `mermaid` package.**
+
+The implementation:
+
+- Converts fenced `mermaid` blocks to temporary placeholders before BlockNote parses Markdown.
+- Replaces placeholders with a `mermaidBlock` schema block that stores both the original fenced source and the diagram body.
+- Renders the block through Mermaid in the rich editor.
+- Serializes `mermaidBlock` nodes back to their stored fenced Markdown before save, raw-mode entry, and editor-position snapshots.
+- Shows the original source as an inline fallback when Mermaid cannot render a diagram.
+
+## Options considered
+
+- **Tolaria-owned placeholder round-trip with Mermaid rendering** (chosen): matches the existing wikilink and math architecture, keeps Markdown as the source of truth, and gives Tolaria explicit control over serialization.
+- **Render all `mermaid` code blocks by overriding the generic code-block renderer**: smaller surface, but it couples diagram behavior to the code-highlighting package and makes exact source preservation harder.
+- **Raw-mode-only Mermaid support**: preserves source but fails the enhanced note reading experience users expect.
+- **Store parsed diagram metadata outside the Markdown body**: enables richer future editing, but violates the files-first model.
+
+## Consequences
+
+- `src/utils/mermaidMarkdown.ts` is the canonical parser/serializer bridge for note diagrams.
+- Rich mode renders diagrams as schema-backed blocks; raw mode remains the direct source editor.
+- Invalid Mermaid source remains visible instead of breaking the editor surface.
+- `mermaid` is now a runtime dependency and should be upgraded deliberately with rendering regression coverage.
+- Future diagram controls, such as copy source or expand, can attach to the same `mermaidBlock` without changing storage.

docs/adr/0089-active-vault-filesystem-watcher.md

@@ -0,0 +1,36 @@
+---
+type: ADR
+id: "0089"
+title: "Active vault filesystem watcher"
+status: active
+date: 2026-04-27
+---
+
+## Context
+
+Tolaria treats the filesystem as the source of truth, but before this decision the running app only noticed external file changes after a manual Reload Vault, a Git pull, or an AI-agent-specific refresh callback. Edits from another editor, terminal commands, another Tolaria window, or a non-pull Git operation could leave React state and the editor surface stale.
+
+ADR-0071 already defines the safe reconciliation policy for external vault mutations: reload vault-derived state, protect unsaved local edits, and reopen the clean active note from disk when needed. Filesystem watching needed to reuse that policy instead of adding another ad hoc reload path.
+
+## Decision
+
+**Tolaria watches the active desktop vault with a native filesystem watcher and routes external change batches through the shared external-refresh reconciler.**
+
+The desktop backend exposes `start_vault_watcher` and `stop_vault_watcher` commands backed by Rust `notify`. It watches the active vault recursively, ignores known non-content churn such as `.git/`, `node_modules/`, temp files, and `.tolaria-rename-txn`, then emits `vault-changed` events with the active vault path and changed paths.
+
+The renderer owns batching and reconciliation. `useVaultWatcher` starts the backend watcher for the active main-window vault, debounces native events into one refresh, filters out recent app-owned saves, and calls `refreshPulledVaultState()`. Manual Reload Vault still uses `reload_vault` directly, but now exposes visible reload feedback.
+
+## Options considered
+
+- **Native active-vault watcher plus shared reconciliation** (chosen): keeps external changes visible without polling and preserves ADR-0071 behavior for clean and unsaved tabs. Cons: adds one native dependency and a long-lived watcher state.
+- **Frontend-only polling**: simpler backend surface, but wastes work on idle vaults and still needs careful active-note reconciliation.
+- **Direct `reloadVault()` on every native event**: easy to implement, but bypasses clean-tab reopen handling and can clobber the user experience around unsaved edits.
+- **Watch every configured vault**: could pre-warm state, but burns resources for inactive vaults and complicates event ownership across windows.
+
+## Consequences
+
+- External writes converge automatically into the visible vault state after a short debounce.
+- Active clean notes are refreshed through the same path as pull and AI-agent updates; unsaved local edits remain protected.
+- Tolaria app-owned saves are suppressed briefly so autosave does not trigger a full external refresh loop.
+- The status bar can show reload progress for manual and automatic refreshes.
+- The watcher is a desktop-only integration; mobile builds keep no-op command stubs until a mobile-specific filesystem strategy exists.

docs/adr/0090-pi-cli-agent-adapter.md

@@ -0,0 +1,35 @@
+---
+type: ADR
+id: "0090"
+title: "Pi CLI agent adapter"
+status: active
+date: 2026-04-28
+---
+
+## Context
+
+Tolaria already supports Claude Code, Codex, and OpenCode as local CLI agents in the AI panel. The next provider request is Pi Coding Agent support with the same first-class availability, settings, status, streaming, and MCP vault access.
+
+Pi exposes non-interactive JSON events through `pi --mode json`, but Pi core intentionally does not include built-in MCP. Its supported MCP path is the `pi-mcp-adapter` extension, which reads MCP server definitions from Pi-compatible config files.
+
+## Decision
+
+Tolaria adds Pi as a supported CLI agent id (`pi`) and launches app-managed Pi sessions through a dedicated adapter module.
+
+The adapter runs `pi --mode json --no-session` from the active vault cwd, closes stdin, and points `PI_CODING_AGENT_DIR` at a temporary directory containing Tolaria's `mcp.json`. That config loads the Tolaria MCP server through `pi-mcp-adapter`, pins `VAULT_PATH` to the selected vault, sets `WS_UI_PORT=9711`, uses lazy server lifecycle, and exposes the small Tolaria tool set directly.
+
+Pi availability follows the existing desktop pattern: check the inherited `PATH`, the user's login shell, and common local/toolchain install locations. Pi authentication remains owned by the Pi CLI; Tolaria only surfaces setup errors and does not store provider API keys.
+
+## Options Considered
+
+- **Transient Pi adapter config** (chosen): gives app-launched Pi sessions Tolaria MCP access without mutating user or vault config files. Cons: requires the Pi MCP adapter extension path to be available to Pi.
+- **Write `.mcp.json` into the active vault**: simple for Pi discovery, but creates project files as a side effect of a chat session and can dirty user vaults.
+- **Rely on global `~/.pi/agent/mcp.json`**: matches Pi documentation, but silently retargets or depends on user-global state and conflicts with Tolaria's explicit integration boundary.
+- **Skip MCP for Pi**: easier to implement, but creates a weaker agent than the existing providers and violates the requirement for first-class MCP support.
+
+## Consequences
+
+- The AI panel, settings, command palette, status bar, onboarding, and stream normalization now treat Pi as a first-class supported agent.
+- App-launched Pi sessions can use Tolaria vault MCP tools while remaining scoped to the selected vault.
+- Pi support stays isolated in Pi-specific modules instead of expanding the shared `ai_agents.rs` hotspot.
+- Users still need Pi itself, a configured Pi model/provider, and the Pi MCP adapter extension path available to the Pi CLI.

docs/adr/0091-gemini-cli-external-ai-setup.md

@@ -0,0 +1,35 @@
+---
+type: ADR
+id: "0091"
+title: "Gemini CLI external AI setup"
+status: active
+date: 2026-04-28
+---
+
+## Context
+
+Tolaria already supports explicit MCP setup for external desktop AI tools. Users asked for Gemini CLI support so the same active-vault MCP server can be registered where Gemini reads tool configuration, with optional Gemini-specific vault guidance.
+
+Gemini CLI reads MCP server definitions from `~/.gemini/settings.json` and can load project guidance from `GEMINI.md`. Tolaria must support those conventions without silently rewriting global user settings or overwriting user-authored vault instructions.
+
+## Decision
+
+Tolaria adds `~/.gemini/settings.json` to the explicit external AI setup path list. The existing MCP entry shape is reused: `mcpServers.tolaria` runs the packaged stdio server through Node.js, pins `VAULT_PATH` to the selected vault, and sets `WS_UI_PORT=9711`.
+
+Vault guidance keeps `AGENTS.md` as the canonical shared source. `restore_vault_ai_guidance` can create or repair a managed `GEMINI.md` shim that imports `AGENTS.md`, while bootstrap and repair flows continue to seed only required Tolaria guidance (`AGENTS.md` and `CLAUDE.md`) plus type scaffolding. Custom `GEMINI.md` files are classified as custom and are not overwritten.
+
+The setup dialog documents that Gemini CLI still needs its own install and sign-in. Tolaria does not store Gemini credentials or model-provider API keys.
+
+## Options Considered
+
+- **Add Gemini to explicit MCP setup and optional guidance restore** (chosen): matches the existing consent boundary, preserves user settings, and gives Gemini the shared vault context.
+- **Generate `GEMINI.md` automatically for every vault**: simpler discovery, but turns an optional third-party compatibility file into startup side effect and dirties vaults for users who do not use Gemini.
+- **Document manual Gemini setup only**: avoids code changes, but leaves users to transpose paths and loses the active-vault safety already available for other MCP clients.
+- **Create a Gemini-specific MCP entry shape**: unnecessary because Gemini accepts the same `mcpServers` entry structure used by the existing Tolaria MCP server.
+
+## Consequences
+
+- External AI setup now writes/removes Tolaria's MCP entry in Claude, Gemini, Cursor, and generic MCP config files.
+- Gemini users can create a managed `GEMINI.md` shim without duplicating the canonical `AGENTS.md` guidance.
+- Existing vault bootstrap and repair remain non-invasive for users who do not use Gemini.
+- Native QA requires a local Gemini CLI install and authentication for an end-to-end Gemini prompt; otherwise the app can still verify the generated config and documentation paths.

docs/adr/README.md

@@ -68,7 +68,7 @@ proposed → active → superseded
 | [0010](0010-dynamic-wikilink-relationship-detection.md) | Dynamic wikilink relationship detection | active |
 | [0011](0011-mcp-server-for-ai-integration.md) | MCP server for AI tool integration | superseded → [0074](0074-explicit-external-ai-tool-setup-and-least-privilege-desktop-scope.md) |
 | [0012](0012-claude-cli-for-ai-agent.md) | Claude CLI subprocess for AI agent | active |
-| [0013](0013-remove-theming-system.md) | Remove vault-based theming system | active |
+| [0013](0013-remove-theming-system.md) | Remove vault-based theming system | superseded -> [0081](0081-internal-light-dark-theme-runtime.md) |
 | [0014](0014-git-based-vault-cache.md) | Git-based incremental vault cache | active |
 | [0015](0015-auto-save-with-debounce.md) | Auto-save with 500ms debounce | active |
 | [0016](0016-sentry-posthog-telemetry.md) | Sentry + PostHog telemetry with consent | active |
@@ -89,7 +89,7 @@ proposed → active → superseded
 | [0031](0031-full-app-for-note-windows.md) | Full App instance for secondary note windows | active |
 | [0032](0032-status-bar-for-git-actions.md) | Git actions (Changes, Pulse, Commit) in status bar, not sidebar | active |
 | [0033](0033-subfolder-scanning-and-folder-tree.md) | Subfolder scanning and folder tree navigation | active |
-| [0034](0034-git-repo-required-for-vault.md) | Git repo required — blocking modal enforces vault prerequisite | active |
+| [0034](0034-git-repo-required-for-vault.md) | Git repo required — blocking modal enforces vault prerequisite | superseded → [0085](0085-non-git-vault-support.md) |
 | [0035](0035-path-suffix-wikilink-resolution.md) | Path-suffix wikilink resolution for subfolder vaults | active |
 | [0036](0036-external-rename-detection-via-git-diff.md) | External rename detection via git diff on focus regain | active |
 | [0037](0037-codemirror-language-markdown-highlighting.md) | Language-based markdown syntax highlighting in raw editor | active |
@@ -134,3 +134,13 @@ proposed → active → superseded
 | [0076](0076-note-retargeting-separates-type-and-folder-moves.md) | Note retargeting separates type changes from folder moves | active |
 | [0077](0077-concurrent-safe-vault-cache-replacement.md) | Concurrent-safe vault cache replacement | active |
 | [0078](0078-scoped-unsigned-fallback-for-app-managed-git-commits.md) | Scoped unsigned fallback for app-managed git commits | active |
+| [0079](0079-linux-window-chrome-and-menu-reuse.md) | Linux window chrome and menu reuse | active |
+| [0080](0080-cross-platform-desktop-release-artifacts-and-portable-vault-names.md) | Cross-platform desktop release artifacts and portable vault names | superseded → [0083](0083-dual-architecture-macos-release-artifacts.md) |
+| [0081](0081-internal-light-dark-theme-runtime.md) | Internal light and dark theme runtime | active |
+| [0082](0082-markdown-durable-math-notes.md) | Markdown-durable math in notes | active |
+| [0083](0083-dual-architecture-macos-release-artifacts.md) | Dual-architecture macOS release artifacts | active |
+| [0085](0085-non-git-vault-support.md) | Non-git vaults open with explicit later Git initialization | active |
+| [0088](0088-markdown-durable-mermaid-diagrams.md) | Markdown-durable Mermaid diagrams in notes | active |
+| [0089](0089-active-vault-filesystem-watcher.md) | Active vault filesystem watcher | active |
+| [0090](0090-pi-cli-agent-adapter.md) | Pi CLI agent adapter | active |
+| [0091](0091-gemini-cli-external-ai-setup.md) | Gemini CLI external AI setup | active |

e2e/image-upload.spec.ts

@@ -1,6 +1,11 @@
-import { test, expect } from '@playwright/test'
+import { test, expect, type Page } from '@playwright/test'
 import * as path from 'path'
 import * as fs from 'fs'
+import {
+  createFixtureVaultCopy,
+  openFixtureVault,
+  removeFixtureVaultCopy,
+} from '../tests/helpers/fixtureVault'
 
 // Minimal valid PNG: 1x1 red pixel
 const TEST_PNG_BASE64 =
@@ -11,16 +16,28 @@ function createTestPng(filepath: string) {
   fs.writeFileSync(filepath, Buffer.from(TEST_PNG_BASE64, 'base64'))
 }
 
-test('image upload via file picker displays image with data URL', async ({ page }) => {
-  await page.goto('/')
-  await page.waitForTimeout(1000)
+let tempVaultDir: string
 
-  // Open a note
-  await page.locator('[data-testid="type-icon"]').first().click({ timeout: 10000 })
-  await page.waitForTimeout(500)
+async function openImageTestNote(page: Page) {
+  await page.locator('[data-testid="note-list-container"]').getByText('Alpha Project', { exact: true }).click()
 
   const editor = page.locator('.bn-editor')
   await expect(editor).toBeVisible({ timeout: 10000 })
+  return editor
+}
+
+test.beforeEach(async ({ page }, testInfo) => {
+  testInfo.setTimeout(60_000)
+  tempVaultDir = createFixtureVaultCopy()
+  await openFixtureVault(page, tempVaultDir)
+})
+
+test.afterEach(async () => {
+  removeFixtureVaultCopy(tempVaultDir)
+})
+
+test('image upload via file picker displays image with data URL', async ({ page }) => {
+  const editor = await openImageTestNote(page)
   await editor.click()
   await page.waitForTimeout(200)
 
@@ -63,16 +80,37 @@ test('image upload via file picker displays image with data URL', async ({ page
   if (fs.existsSync(testImagePath)) fs.unlinkSync(testImagePath)
 })
 
+test('image paste into editor inserts image block', async ({ page }) => {
+  const editor = await openImageTestNote(page)
+  await editor.click()
+
+  await page.evaluate((base64) => {
+    const editorElement = document.querySelector('.bn-editor')
+    if (!editorElement) throw new Error('Editor not found')
+
+    const binary = atob(base64)
+    const bytes = new Uint8Array(binary.length)
+    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)
+
+    const file = new File([bytes], 'pasted-image.png', { type: 'image/png' })
+    const clipboardData = new DataTransfer()
+    clipboardData.items.add(file)
+    editorElement.dispatchEvent(new ClipboardEvent('paste', {
+      clipboardData,
+      bubbles: true,
+      cancelable: true,
+    }))
+  }, TEST_PNG_BASE64)
+
+  const images = page.locator('.bn-editor img')
+  await expect(images.first()).toBeVisible({ timeout: 5000 })
+
+  const src = await images.first().getAttribute('src')
+  expect(src).toMatch(/^data:/)
+})
+
 test('editor has uploadFile configured (no error on image block insert)', async ({ page }) => {
-  await page.goto('/')
-  await page.waitForTimeout(1000)
-
-  // Click first note
-  await page.locator('[data-testid="type-icon"]').first().click({ timeout: 10000 })
-  await page.waitForTimeout(500)
-
-  const editor = page.locator('.bn-editor')
-  await expect(editor).toBeVisible({ timeout: 10000 })
+  const editor = await openImageTestNote(page)
 
   // Capture console errors
   const errors: string[] = []

index.html

@@ -7,17 +7,48 @@
     <link rel="preconnect" href="https://fonts.googleapis.com" />
     <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
     <link href="https://fonts.googleapis.com/css2?family=IBM+Plex+Mono:wght@400;500;600&family=Inter:wght@400;500;600;700&family=JetBrains+Mono&display=swap" rel="stylesheet" />
+    <style>
+      :root {
+        color-scheme: light;
+        background: #FFFFFF;
+        color: #37352F;
+      }
+      :root[data-theme="dark"] {
+        color-scheme: dark;
+        background: #1F1E1B;
+        color: #E6E1D8;
+      }
+      body {
+        background: inherit;
+        color: inherit;
+      }
+    </style>
     <title>Tolaria</title>
   </head>
   <body>
     <script>
-      // Apply saved theme before React mounts to prevent flash
-      var t = localStorage.getItem('tolaria-theme');
-      if (t === null) {
-        t = localStorage.getItem('laputa-theme');
-        if (t !== null) localStorage.setItem('tolaria-theme', t);
-      }
-      if (t === 'light') document.documentElement.setAttribute('data-theme', 'light');
+      (function () {
+        var key = 'tolaria-theme';
+        var legacyKey = 'laputa-theme';
+        function normalizeTheme(value) {
+          return value === 'dark' || value === 'light' ? value : null;
+        }
+        function applyTheme(value) {
+          var mode = normalizeTheme(value) || 'light';
+          document.documentElement.setAttribute('data-theme', mode);
+          document.documentElement.classList.toggle('dark', mode === 'dark');
+        }
+        try {
+          var mode = normalizeTheme(localStorage.getItem(key));
+          if (mode === null) {
+            mode = normalizeTheme(localStorage.getItem(legacyKey));
+            if (mode !== null) localStorage.setItem(key, mode);
+          }
+          applyTheme(mode);
+        } catch (err) {
+          applyTheme('light');
+        }
+      })();
     </script>
     <div id="root"></div>
     <script type="module" src="/src/main.tsx"></script>

lara.lock

@@ -0,0 +1,406 @@
+version: 1.1.0
+files:
+  e6ab9bf36c30b9d72bc97897e0d89a16:
+    command.noMatches: a2a97d96e196148e04c51c47d985e327
+    command.palettePlaceholder: 6d6b61b4c08ed382ad7ba406a9ba395d
+    command.footerNavigate: e3808db59d29bcfc91532d6539c4f9ae
+    command.footerSelect: 6d73339906ed42e20f6be91bf7f5f4a9
+    command.footerClose: dcf77460e548fe215ef28583f092a496
+    command.footerSend: 6b19fc9694fd8b7b3f1aafaca83db864
+    command.aiMode: 7197e3c5f9afd24022377176611f35cb
+    command.openSettings: 638c05f4f159a403e04aebe94b46a2a8
+    command.openSettings.keywords: ab6b5e03395f4db955ed9cbfd4de33b7
+    command.openLanguageSettings: e5a425aa6222fab3df66c0e1e0ca4183
+    command.openLanguageSettings.keywords: 68efcb7e847b1a9d472baa609824be80
+    command.useSystemLanguage: b7f0315c47d4a59faa2a49571fcf1fca
+    command.openH1Setting: 05b4f6edc0e98b29670e8ee902cdb9bf
+    command.contribute: 9887a4451812854f0f1b6f669a874307
+    command.checkUpdates: f77f38f684c8b974dd4a56bb321cfd5f
+    command.group.navigation: 846495f9ceed11accf8879f555936a7d
+    command.group.note: 3b0649c72650c313a357338dcdfb64ec
+    command.group.git: 0bcc70105ad279503e31fe7b3f47b665
+    command.group.view: 4351cfebe4b61d8aa5efa1d020710005
+    command.group.settings: f4f70727dc34561dfde1a3c529b6205c
+    command.navigation.searchNotes: d8002e888293774162e43b263658cbb5
+    command.navigation.goAllNotes: 7030dcbbb85b6f01d3c8b2fdcb6a5cff
+    command.navigation.goArchived: b620b8cb8fef8a287b986ff83a992a2a
+    command.navigation.goChanges: c6dd094ce55f8a765b68cef40a1c6bd9
+    command.navigation.goHistory: 39b86b661267053a240ffe89b9eca847
+    command.navigation.goBack: 4f2f5e1d6e2a13469ad431474a68ab82
+    command.navigation.goForward: d13c318438f67d749cfc0904e3fafcda
+    command.navigation.goInbox: 522af71c26bc7e3ce1dae6204c2fbe9f
+    command.navigation.renameFolder: a3d3b0f787c52a984af61085c577bff2
+    command.navigation.deleteFolder: 991e322cd8225c369a963bb60b0a9688
+    command.navigation.showOpenNotes: bd1905c340d0518187865f4a6694e14d
+    command.navigation.showArchivedNotes: 241399b908884adfe8608a3ab827ca74
+    command.navigation.listType: 4f70c27c6826a37543c8ada561397c22
+    command.note.newNote: 23c4edda8b815f750782f01870d27271
+    command.note.newType: adce5108f18945cc502a06c02445e32d
+    command.note.newTypedNote: 1493eda772c2179cb6247169d00723b2
+    command.note.saveNote: 2a309cda46e95b00d2a5a8afb3cc0047
+    command.note.findInNote: f72f8f93d8e6119d5d08b60eb3a7b3bc
+    command.note.replaceInNote: b008e2e20c5e4cd202f4386271d6bed1
+    command.note.deleteNote: 56f727a2ee11d15159f1aa6373314cb6
+    command.note.archiveNote: 6043509fda6dd7f6f167e4108033f8e8
+    command.note.unarchiveNote: 6937fb694d00b11d579c21cd4bf103a2
+    command.note.addFavorite: 782d6b28dce4e5d0b2ac92142c6624ba
+    command.note.removeFavorite: 4f9b5fa08f2ef86fdc5d0ceefc271981
+    command.note.markOrganized: 505ad63357f533fb39e4276a2bfb9496
+    command.note.markUnorganized: 1c62f1bffcb793c63d729096d2794ced
+    command.note.restoreDeleted: d704f8283ca322a9b3713d2ccf9a6cd4
+    command.note.setIcon: 99b81d2663266c53e45e4d9c62c87a29
+    command.note.removeIcon: 4bccbad66025e506b37b4218498b299c
+    command.note.changeType: 4a54ffd47ed1f65ee97f34bfe8c3de14
+    command.note.moveToFolder: 3a0f26c42b9168ad839960d134065905
+    command.note.openNewWindow: 6f67b2857093fa0fd45b1122dff4865d
+    command.git.initialize: 54a57cdc7105db6fb22dca661ce01ad6
+    command.git.commitPush: 8cb5faa4019716f43dd69c41496b1d46
+    command.git.addRemote: 7eef951b3f909340a68dc9811be83e9e
+    command.git.pull: 3988d61f4a4546381f61a4eaf61315b4
+    command.git.resolveConflicts: 871ac36968cfca3d2297a89b28b25dee
+    command.git.viewChanges: b2699edf69d8e1031afce2b2f94e5c8d
+    command.view.editorOnly: 8355e056b32086b9190d639be290dda8
+    command.view.editorNoteList: b9604b1609eb6f581cd9570dca72d3f0
+    command.view.fullLayout: 1cebdf839eee2b1713828731aaa3b507
+    command.view.toggleProperties: 54f12756a363401243d82cbd0466117e
+    command.view.toggleDiff: 148a10ef6f04f897e73289f529ecae86
+    command.view.toggleRaw: 9b622257cd6345ceaf58e42b1410899b
+    command.view.leftLayout: 5046a7166675e2d0175b9da3befdcaca
+    command.view.centerLayout: 3bc6759c005178aae519aa3dd227cb74
+    command.view.toggleAiPanel: 4279cbf31767465f25feff6e7bdd336e
+    command.view.newAiChat: 1b0a886d6e77f628ec96c2d71cdb0a9b
+    command.view.toggleBacklinks: b3c4be2d2c07bb8df181355a2c3658a7
+    command.view.zoomIn: ae4a8e406b707636392b6673fca0e6a6
+    command.view.zoomOut: 97326f8cd9df886a6b19af180fb7dcc9
+    command.view.resetZoom: 193ee8c32391fc5cc303a51617cfd046
+    command.settings.createEmptyVault: d7c9673bb6c62a2b8aef009546ce8b23
+    command.settings.openVault: c40e74822da9417fdf52eb4a37bb23f2
+    command.settings.removeVault: 390e2b2031cde0dd18381efee0923bea
+    command.settings.restoreGettingStarted: b3358dc1c7b873b2a02ac6f05473fe4d
+    command.settings.manageExternalAi: c36b9bd171f11a18a1e624365d2b57ac
+    command.settings.setupExternalAi: 24eea679eb699763daa2e3f2a67fcf9a
+    command.settings.reloadVault: f6e506dad6b6cf2be24d9438d458ae54
+    command.settings.repairVault: cee560b1fd5ad9d1ff1c19a0a2afe77a
+    command.ai.openAgents: 612abe804edd0f5ae228a534f77f3d23
+    command.ai.restoreGuidance: 23331fecc692d11d85cf24838ed273f2
+    command.ai.switchToAgent: 5bb02187e653b360ab7ed661403271f2
+    command.ai.switchDefault: 42724de254240d598fbcc40fdb5b18a3
+    command.ai.switchDefaultWithAgent: d405f7914bb1cd86172f108f3c33d953
+    settings.title: f4f70727dc34561dfde1a3c529b6205c
+    settings.close: 7812b3644f897c5d3efb0dd63440e751
+    settings.sync.title: 36f62a237420dcdc7096ad3a9018c4d9
+    settings.sync.description: 06a6957c40867be2c28783183dc1bf5f
+    settings.pullInterval: 4f95ca677398604bca241427261ed07b
+    settings.releaseChannel: 2da37055e15a217f18bd403922085c3f
+    settings.releaseStable: fa3aff3c185c6dc7754235f397c2099a
+    settings.releaseAlpha: 6132295fcf5570fb8b0a944ef322a598
+    settings.appearance.title: a1c58e94227389415de133efdf78ea6e
+    settings.appearance.description: ca7b75a4c10ab8a540707e3a96cd3592
+    settings.theme.label: d721757161f7f70c5b0949fdb6ec2c30
+    settings.theme.light: 9914a0ce04a7b7b6a8e39bec55064b82
+    settings.theme.dark: a18366b217ebf811ad1886e4f4f865b2
+    settings.language.title: 4994a8ffeba4ac3140beb89e8d41f174
+    settings.language.description: e2bb9b523067fdc32a494b1d6fd97906
+    settings.language.label: 244c7b77926f077b863c33ff1244e1ec
+    settings.language.system: 41e2252344aa441e925589ddcb762e6d
+    settings.language.summary: edc83f1f48ce29bc80bf2f2f90e24997
+    settings.autogit.title: e59f720605ec1cfa42b3b97d89d7e883
+    settings.autogit.description.enabled: e65bec70ca4d7921be56f84d10836018
+    settings.autogit.description.disabled: 1143ef6ee00614816785e3c6fc299d51
+    settings.autogit.enable: 9b205a4ae0e3ad4e6708155880ce9c75
+    settings.autogit.enableDescription: a7424a8f90c0b7f290a8144d12374554
+    settings.autogit.idleThreshold: 28016cc6fccd951a904ee3020cd733b6
+    settings.autogit.inactiveThreshold: d28cb60d1e70e020ae8d1294e32dd474
+    settings.titles.title: 761443f70a5067ecf015c6fb3fae9cef
+    settings.titles.description: b94aeeca78dd376cc19b9aa019e53f6c
+    settings.titles.autoRename: 5383db8e790ebf5f956d9c59cb4c4f67
+    settings.titles.autoRenameDescription: cc28c28d8817736e658082a2261d9a6e
+    settings.aiAgents.title: 27f08387b26e1ceeb1b60bd9c97e7a47
+    settings.aiAgents.description: a13222e67eb121676ff6dfc7b085f02d
+    settings.aiAgents.default: 6af573559fd05d8c35bc57b41cc78e24
+    settings.aiAgents.installed: 73329564760013a7824ff9d5d1af91ff
+    settings.aiAgents.missing: ea21841da70e6405af19fabc4ff8bdd9
+    settings.aiAgents.ready: 909a648c713be25fcd050725d0a41e37
+    settings.aiAgents.notInstalled: 0ac3f76ef78bfdbab6331731ee56ba22
+    settings.workflow.title: 24f47cdbe9ddba774a7cc53e51d9032e
+    settings.workflow.description: aa9a07539b87cf407c3edc8a22732d45
+    settings.workflow.explicit: 54a5b5c27937d25271c3127d093e8361
+    settings.workflow.explicitDescription: ce523427b5dd0f9895f63d1fbb90ad24
+    settings.workflow.autoAdvance: 9ed337f5bc61603d19a1ef35f3a3a243
+    settings.workflow.autoAdvanceDescription: ae58ad8abf03df7cbdae8c3a725258f7
+    settings.privacy.title: 0dd6c14e00cc9f45a68c1bca88d1317d
+    settings.privacy.description: 33d53059be620b58e38b8e5c5ab26b27
+    settings.privacy.crashReporting: b4efc5b61526566d431e99242f5c21b4
+    settings.privacy.crashReportingDescription: e9d7c7efce44adc08d0460be1aad5c42
+    settings.privacy.analytics: 29d55bb222ea76e1a17396375dfab228
+    settings.privacy.analyticsDescription: a0f8b61d555d6d3fd279de2f47aaca76
+    settings.footerShortcut: 7dc840d6b0ef9f422a663ba41975871e
+    settings.cancel: ea4788705e6873b424c65e91c2846b19
+    settings.save: c9cc8cce247e49bae79f15173ce97354
+    common.cancel: ea4788705e6873b424c65e91c2846b19
+    locale.en: 78463a384a5aa4fad5fa73e2f506ecfc
+    sidebar.nav.inbox: 3882d32c66e7e768145ecd8f104b0c08
+    sidebar.nav.allNotes: cd76cf851b08a9d2feafaf255bc1f4d5
+    sidebar.nav.archive: e727b00944f81e1d0a95c12886ac4641
+    sidebar.group.favorites: 953bf4d5e8a1807c15dec4e255384b1d
+    sidebar.group.views: 8f56a72923a6ca8ff53462533d89e567
+    sidebar.group.types: 6b20155008db90cf7589c07baa7334e9
+    sidebar.group.folders: d86e2756f698bea5aac3e2276639f042
+    sidebar.action.createView: ba019414ea8c7fcdb4a83a70ec1bb639
+    sidebar.action.editView: acdf34bd08b0692b906d446e590b1eb9
+    sidebar.action.deleteView: c8f4f9cd8ff820f955474e5c9f70ff39
+    sidebar.action.customizeSections: 050a134cad1e9c6f04abe5d635592703
+    sidebar.action.renameSection: 8936914051df04e7550d0eeb4a31e0e0
+    sidebar.action.customizeIconColor: 9a2f685c74d261ab483ef00dee5314fe
+    sidebar.action.createType: 6cfb8b8aa3fdce38e675819691b48f5c
+    sidebar.action.collapse: 00873bdddd457791609bff1243c40a6b
+    sidebar.action.expand: 8f98e9696f6eed958573012f52710faa
+    sidebar.action.createFolder: 5dc1e97c14fbe72d8b566ce29c39f010
+    sidebar.action.renameFolder: db76034f8218cda07dadb746a5643019
+    sidebar.action.deleteFolder: 2a2f15300f6f7c81d69860ac1796b517
+    sidebar.action.revealFolderMenu: 76f4ed52da9937ae432dcf5a108fabb4
+    sidebar.action.copyFolderPathMenu: 1779ec6018a385912c1a5499a1bbf2b2
+    sidebar.action.renameFolderMenu: deb1d8fa030292e7eda2c244b313aca2
+    sidebar.action.deleteFolderMenu: c78c889ac7396dc148fc859c9221e545
+    sidebar.folder.name: 710417c4e57a6a01500fe4c0c448ce3d
+    sidebar.folder.newName: e0ad5b2db20359a85de80c1231323bea
+    sidebar.folder.expand: b7545cb143816942ff096d890090fb6f
+    sidebar.folder.collapse: e9f8c6da708219313d72d99cc3998388
+    sidebar.section.name: c3642037e309db278bbbfe0590114c02
+    sidebar.section.showInSidebar: e38d073926d6fb3dfc4d4347708e3cf5
+    sidebar.section.toggle: 2992ffbc76e607a2dc0e99781f101637
+    sidebar.disabled.comingSoon: 81151a1669ebd695e837f304a0d8ec79
+    noteList.title.archive: e727b00944f81e1d0a95c12886ac4641
+    noteList.title.changes: c112bb3542e98308d12d5ecb10a67abc
+    noteList.title.inbox: 3882d32c66e7e768145ecd8f104b0c08
+    noteList.title.history: 16d2b386b2034b9488996466aaae0b57
+    noteList.title.view: 4351cfebe4b61d8aa5efa1d020710005
+    noteList.title.notes: f4c6f851b00d5518bf888815de279aba
+    noteList.searchPlaceholder: 4857cd2689a0a40eb4a77cdc745c518e
+    noteList.searchAction: 5012120fc480c67686dd22ee2f9493cd
+    noteList.createNote: f1484bc40bd3fe3430c13fb89e2ce1af
+    noteList.empty.changesError: 4fca500c4b70f61f7d9413c57c34bdc4
+    noteList.empty.noChanges: ad82ac153532f5625760c29c176c5d5f
+    noteList.empty.noArchived: 75fa9e2aaa902f65d433be856a2e8331
+    noteList.empty.noMatching: 22838e3b8d3d174d33d7986ab6bdd693
+    noteList.empty.allOrganized: ea8fbb54d21c03fae1469635e7043b9b
+    noteList.empty.noNotes: 910bd677fdd52f3e6edb4abc1d03ade8
+    noteList.empty.noMatchingItems: 25cd76c4bbd00b682a45687705b41a14
+    noteList.empty.noRelatedItems: 67eecd103b56ef0e56fd892d379b5a5e
+    noteList.sort.modified: 35e0c8c0b180c95d4e122e55ed62cc64
+    noteList.sort.created: 0eceeb45861f9585dd7a97a3e36f85c6
+    noteList.sort.title: b78a3223503896721cca1303f776159b
+    noteList.sort.status: ec53a8c4f07baed5d8825072c89799be
+    noteList.sort.by: 5cd12b67b005056a94f06368a7645b8e
+    noteList.sort.menu: 62bfadcf958eb6ad238e6c71e312a0ce
+    noteList.sort.ascending: cf3fb1ff52ea1eed3347ac5401ee7f0c
+    noteList.sort.descending: e3cf5ac19407b1a62c6fccaff675a53b
+    noteList.filter.open: c3bf447eabe632720a3aa1a7ce401274
+    noteList.filter.archived: 7d69b3cb4cada18ae61811304f8fbcb5
+    noteList.filter.week: d2ce009594dcc60befa6a4e6cbeb71fc
+    noteList.filter.month: 7cbb885aa1164b390a0bc050a64e1812
+    noteList.filter.all: b1c94ca2fbc3e78fc30069c8d0f01680
+    noteList.properties.customizeColumns: be39bb193d872e11bb21388add6eca23
+    noteList.properties.customizeAllColumns: 0d382ece9a9d08bb9ddf10ed2c88d726
+    noteList.properties.customizeInboxColumns: e7cf53b914ce1079801eeee603875660
+    noteList.properties.customizeViewColumns: a5612e5d2aa2e86941d536a85b27c8b4
+    noteList.properties.showInNoteList: f22a57c5fc14ff477000cc66d837c344
+    noteList.properties.searchPlaceholder: 9c7569eb531ff041b2b7cf4de1e5a619
+    noteList.properties.searchLabel: de1bc9695d5e79a75296abf74dc25056
+    noteList.properties.noMatches: 1627ecc53b9e97c94b2b6b1b93a58721
+    noteList.properties.reorder: c0955c7efaa1ce90d449a23cbc52b553
+    noteList.changes.restoreNote: d6e99303c0e0b7b2abce06fe9214788b
+    noteList.changes.discardChanges: 98313f623bb6f464b9a154eca0b99bf3
+    noteList.changes.restoreDescription: 45e13380b0538e6cbff330f99c260c0a
+    noteList.changes.discardDescription: cd953f51a81e10f8c90135e0106a45d6
+    noteList.changes.thisFile: 976b976e66879a470635bf0f660e81fc
+    noteList.changes.restore: 2bd339d85ee3b33e513359ce781b60cc
+    noteList.changes.discard: d94b42030b9785fd754d5c1754961269
+    noteList.changes.cancel: ea4788705e6873b424c65e91c2846b19
+    editor.empty.selectNote: a71ec7c80aefe49c59f6aba033bf453e
+    editor.empty.shortcuts: 1133fdf3ecef6a09dd9e2a185e1bd4ec
+    editor.raw.label: 7a9754c15264b0604aa31dfea32321ea
+    editor.find.findLabel: 4cfa6c981549e990fe2344e4c805405e
+    editor.find.findPlaceholder: 4cfa6c981549e990fe2344e4c805405e
+    editor.find.replaceLabel: 0ebe6df8a3ac338e0512acc741823fdb
+    editor.find.replacePlaceholder: 0ebe6df8a3ac338e0512acc741823fdb
+    editor.find.matchCount: 29d3cd243c6850f5fbac283e79d6d6a7
+    editor.find.noMatches: 3b470c1f6a10f58c8a8cb6b904577786
+    editor.find.invalidRegex: 9704b2ccc6158864810a313702019d68
+    editor.find.regexMustMatchText: 267728c2e7f2889b39847ee9b9b38891
+    editor.find.previousMatch: afb1b7e6bbdfaa97114e1b519a817f13
+    editor.find.nextMatch: 7f4d218b4f566ea7ff69ab8d912ba7b9
+    editor.find.showReplace: 82c8fdb73dfe8baa1759a36c6c0fb282
+    editor.find.hideReplace: a85baf9735f9acf26aa15b70f2ee55fb
+    editor.find.regex: 7486f19f279f95357c84706dd09ce9da
+    editor.find.matchCase: ba945280b8802ee1a7a50140e2fe94e2
+    editor.find.close: b040fbda901d2135cad53e54e0127071
+    editor.find.replace: 0ebe6df8a3ac338e0512acc741823fdb
+    editor.find.replaceAll: b1c94ca2fbc3e78fc30069c8d0f01680
+    editor.toolbar.rawReturn: 5ddcf5e0dc8b933b344bb6ca3d8e131d
+    editor.toolbar.rawOpen: 89ad60735a649b60dacd2301cda0c4ec
+    editor.toolbar.centerLayout: 3fabf7e9b285eeec90704d271f1049b7
+    editor.toolbar.leftLayout: acab6c8612816e012ff9f4220a42e485
+    editor.toolbar.removeFavorite: 7188286e36fc6c1892dd53aaa54237fb
+    editor.toolbar.addFavorite: 910885435dbc44a22b68cb45c79e4a7e
+    editor.toolbar.markUnorganized: 83fb1b23a3609fab493737fe7af0a198
+    editor.toolbar.markOrganized: 9d170c916afae3d7a82456838728ffa5
+    editor.toolbar.noDiff: b2c4189f90648aaeb5cd2e81f9bd8d94
+    editor.toolbar.loadingDiff: 430386d6aae3570fd399a133e41c7372
+    editor.toolbar.showDiff: 08d579de8d3abdcdfce0953a797362c6
+    editor.toolbar.openAi: d2e93006570a66709c8ce0dc27082ef1
+    editor.toolbar.closeAi: cd46973ef73076d612dff9903ce54498
+    editor.toolbar.restoreArchived: 1bff5cf4943af64c05b2e9aeadccbc84
+    editor.toolbar.archive: 63dc964c32e715217b49f8739d49636b
+    editor.toolbar.delete: f48134a07b016a1de05d4ba6d2fbfb41
+    editor.toolbar.revealFile: 76f4ed52da9937ae432dcf5a108fabb4
+    editor.toolbar.copyFilePath: 64c6cec5ca57efbb8c9c93ae5fbccd27
+    editor.toolbar.openProperties: 948b90b60b8ce827f179e8c5b85b112e
+    editor.filename.rename: c31c2b468229232ad6287e734fe67d96
+    editor.filename.renameToTitle: bff34a6a2dd1eb87c59403946679237f
+    editor.filename.trigger: 4e9739c2f937c828bbf5d1f935fe7fb9
+    editor.banner.archived: 7d69b3cb4cada18ae61811304f8fbcb5
+    editor.banner.unarchive: 9fd02d2eb5ce348a74372eea202a0aec
+    editor.banner.conflict: 384fc5a4b31c662b1e3426a7ef56441e
+    editor.banner.keepMine: 544a2f2e8e09f93919f10e1920d1b69e
+    editor.banner.keepMineTooltip: 9988cb86b051dd728e2d2f852f0283e4
+    editor.banner.keepTheirs: 46131020af44cc6ec4bfa0a8ff39e044
+    editor.banner.keepTheirsTooltip: 9e5b845c4459747d6ab0df6438ccfac4
+    inspector.title.properties: 9fc2d28c05ed9eb1d75ba4465abf15a9
+    inspector.title.propertiesShortcut: 427d1cbdc813cf54c5fac2508d38d407
+    inspector.title.closePropertiesShortcut: 97b953e45042d4143dd19624dc345d29
+    inspector.empty.noNoteSelected: 046d95682b747a30ed8a7b0b1d581629
+    inspector.empty.noProperties: 6864166e0f65d81b1eb474e41fde8822
+    inspector.empty.initializeProperties: edf249d214b68f5afe8634c577b709c4
+    inspector.empty.invalidProperties: 2ee2429c1ffbabcda9f57f91fb6c0b9d
+    inspector.empty.fixInEditor: b86d4934630d68bc5333c0feb25e5f3f
+    inspector.properties.addProperty: 9820ade036bf1bdf80c0b7da24a4ce0a
+    inspector.properties.deleteProperty: f1d0ab48c8596108e949dfc90e13050b
+    inspector.properties.none: 6adf97f83acf6453d4a6a4b1070f3754
+    inspector.properties.missingType: 9179080e7bcc72408f3de7cb944ff400
+    inspector.properties.missingTypeAria: 582c2c46117cff0534d13e7c8a45a3ba
+    inspector.properties.searchTypes: 84c8d94846183a79444bf36667e8d7ea
+    inspector.properties.noMatchingTypes: 9b64c31214171ba3b2d591743990b840
+    inspector.properties.yes: 93cba07454f06a4a960172bbd6e2a435
+    inspector.properties.no: bafd7322c6e97d25b6299b5d6fe8920b
+    inspector.properties.pickDate: e8e91fbba934dc8adfd7e433f5193911
+    inspector.properties.valuePlaceholder: 689202409e48743b914713f96d93947c
+    inspector.properties.propertyName: 7e9982311d69d66d38809e5d85377a08
+    inspector.relationship.add: ec211f7c20af43e742bf2570c3cb84f9
+    inspector.relationship.addRelationship: d2b0cb45dcdbb00ee70db397c36f73ad
+    inspector.relationship.name: 7ed3fccc071d6939eff211b1a6fd9696
+    inspector.relationship.noteTitle: f72ea00f174785710f0369b23c53963c
+    inspector.relationship.createAndOpen: 55bb53fea743c584c4024e7439c55bfe
+    inspector.info.title: 4059b0251f66a18cb56f544728796875
+    inspector.info.modified: 35e0c8c0b180c95d4e122e55ed62cc64
+    inspector.info.created: 0eceeb45861f9585dd7a97a3e36f85c6
+    inspector.info.words: 6f15b8d4b7287d60a8ea3d1c5cbadc84
+    inspector.info.size: 6f6cb72d544962fa333e2e34ce64f719
+    update.available: 992477975168b876be8e77ce2975e390
+    update.releaseNotes: 5dd03e8d039863e563e049be198c3fd3
+    update.updateNow: 99b1054c0f320be9f109c877a5efd0b2
+    update.dismiss: c8a59e7135a20b362f9c768b09454fdb
+    update.downloading: 2c7fdcafb08f831420f661810f826549
+    update.readyRestart: 4d7487b02d955a44d599189ec383e469
+    update.restartNow: 2d9c2140c53daf05855033aaceeaa8fd
+    status.update.check: eb1b4bb3667dd670210c7822badc2f1d
+    status.zoom.reset: dbf36ab275e5fbd256590e65aa1ca9a3
+    status.feedback.contribute: 96ab5025e38aef43fdb73c9830795264
+    status.feedback.label: 9887a4451812854f0f1b6f669a874307
+    status.theme.light: 4abf27a209985375949aaa426c7c7f3d
+    status.theme.dark: 541be2a55a52b518b8e510c476c7cc95
+    status.settings.open: bae08226d065231df6f01b08cd681c9b
+    status.build.unknown: d250349dd489bdfeb0cb0750b8b3ff89
+    status.vault.switch: 8a2ad262643c556ff0cfa99497aaa529
+    status.vault.default: 5b70a213f150f01f0776fa9481ef2ddf
+    status.vault.createEmpty: f37c03f236fbf1516222360a936249e8
+    status.vault.openLocal: a367344e0429a12a5cc9a6cecbbfcde5
+    status.vault.cloneGit: a7d0aef7c6237a36e54fd5a26e9c23fe
+    status.vault.cloneGettingStarted: 9953a11a477b441976a626a9acf5d7df
+    status.vault.notFound: 3119b7fa94c96209bca571b7c7ed0b7e
+    status.vault.remove: 7f3b4f76df23626170940dbc55c70728
+    status.remote.noneConfigured: 18a4edd4e8d862ccb343937f45585fb1
+    status.remote.inSync: a56f571b4df55d88fb06e61e343b3c91
+    status.remote.aheadTitle: 1516f4b92671b83c17441b4cddf25a7a
+    status.remote.behindTitle: 55ee20469bc46b7c61e7515fbfdc0b5d
+    status.remote.ahead: 681557ace3a84e15060ffca1623b75e6
+    status.remote.behind: 1825bb12c857a71861280e490e29debd
+    status.remote.add: f292f8ef85219f0acde6b66eb9c9c0f4
+    status.remote.none: ed3f2ebe0d847584fd62fc9e0db2df33
+    status.remote.noneDescription: f47636010c21c88a6f81cc41a962b26c
+    status.sync.syncing: b21888f3f83c224b3451901da243d00a
+    status.sync.conflict: f1d4ac54357cc0932f385d56814ba7e4
+    status.sync.failed: 85b08b086888f8ee2680ddd3398f3574
+    status.sync.pullRequired: 1ea27a2d3048b078a18665b24e8dcd91
+    status.sync.notSynced: d18d6927f7ffe96f72e18b4da12e306b
+    status.sync.justNow: 7b9275ee2786ef410555041b92b36bb3
+    status.sync.minutesAgo: b3ac76d1e2595531940035a8e2e2d13c
+    status.sync.resolveConflicts: b9f44cc5ee01c964f004f16e3a2833ca
+    status.sync.inProgress: 278d2bf6768809fbf6e97e7bb319a7c0
+    status.sync.pullAndPush: e07c084a9e734a54bd079d5327a924e7
+    status.sync.retry: ca43e18d4f930e8a3e6d403f31d30a39
+    status.sync.now: c03fafa3a653240e6104348e1293bb88
+    status.sync.synced: 5befab0dde764b6dd8b24a34dc30afa7
+    status.sync.conflicts: d35cef9595a935771f5e8158f387227b
+    status.sync.error: 902b0d55fddef6f8d651fe1035b7d4bd
+    status.sync.status: 76590d5f9708692e3735891bdca40903
+    status.sync.pull: 718f59718640c6506b3721fbc8bf3a4d
+    status.conflict.count: 46293d20ed2071fb30762b71fdaa5894
+    status.offline.title: 3bf45a7003646cc4f963810b0b7ac0f5
+    status.offline.label: 8d9da4bc0e49a50e09ac9f7e56789d39
+    status.changes.view: 6d60d24d8f475ddaef94bbbc58514b5a
+    status.changes.label: c112bb3542e98308d12d5ecb10a67abc
+    status.commit.local: 6474fe7e2ed525df3da3eb447943bfcd
+    status.commit.push: a4aaf10ef20cf17a982bb5b6dad198e0
+    status.commit.label: 59d5b10c3a447f036d85cb5ce524c96c
+    status.commit.openOnGitHub: 445ad18680a573c2aab062c3273ae16a
+    status.git.disabledTooltip: 6981fe5b4993e4b3299c774b185ecd70
+    status.git.disabled: 7f822b0ee91b8922b0c41723da867bd1
+    status.history.onlyGit: 7da5397c33ada1b73a81c5a449cbab16
+    status.history.open: 802ec1fd97592612c19ebef7bebbb5c2
+    status.history.label: 16d2b386b2034b9488996466aaae0b57
+    status.mcp.notConnected: 7e8850f4a564088ced4f592996a39309
+    status.mcp.unknown: 051ff29ff900592f75974d0ef554c2eb
+    status.claude.missing: 89021856e6152467f54ed33faed55e2f
+    status.claude.label: 38c66b824d5769e42c3866005296525b
+    status.claude.install: 1f4688bc2a2acc268811c9edcec810a1
+    status.ai.noAgents: 0876a176a6297e79366d0a2935851f81
+    status.ai.noAgentsTooltip: 1bdc02ec2dd7f9701b4371ffd5770318
+    status.ai.selectedMissing: a37f3dbc73725219e90d709fe0d3ad97
+    status.ai.defaultAgent: 79650d57d1678e56c75dbbcba6ea87f7
+    status.ai.restoreDetails: 47a913b58ce40add6521bc93e807476f
+    status.ai.withGuidance: 1eafd34810db6bba54dac7aa549b5182
+    status.ai.active: 059e3a3167c2ab00f4ca872e82a48d98
+    status.ai.unavailable: 0d3e6e3afef545710aa24ed2ea4990af
+    status.ai.install: 349838fb1d851d3e2014b9fe39203275
+    status.ai.installAgent: 78ac3395d977f8b86ca9a02f781f4af8
+    status.ai.vaultGuidance: 7bb4644efe6ae7cec9993c8bd85f1519
+    status.ai.restoreGuidance: 23331fecc692d11d85cf24838ed273f2
+    status.ai.openOptions: d387b1ab67586c7a2d83db8900a4dd8e
+    pulse.title: 16d2b386b2034b9488996466aaae0b57
+    pulse.today: 1dd1c5fb7f25cd41b291d43a89e3aefd
+    pulse.yesterday: ebfe9ce86e6e9fb953aa7a25b59c1956
+    pulse.commitCount: 17dc5f11868c946f55ff8164d318856d
+    pulse.commitSingular: fffca4d67ea0a788813031b8bbc3b329
+    pulse.commitPlural: a90814b38bbdfe717205f6d24183f6a7
+    pulse.openOnGitHub: ddab0146d46f585f2ab36072c92a0048
+    pulse.expandFiles: 53c567ce9f999dd937fc954c39853e81
+    pulse.collapseFiles: 0ae74096d72faf840cd7d35635aa0cf9
+    pulse.noActivity: cfbd8245c849f5f00b495d61ea14dfdf
+    pulse.emptyDescription: b5ee4968b62908444166182fe8e593c1
+    pulse.retry: 6327b4e59f58137083214a1fec358855
+    pulse.loadingActivity: 26bf6a6bc2fd8148cd8753542a0ddf86
+    pulse.loading: 5f02f05c744a0f875aebb8625ae1486f
+    pulse.loadError: 63c17996fe219e6bd33b27d2b7ce0c96
+    command.switchLanguage: 60f1a6760c7d1da0b1f7f6d0529608ee
+    locale.itIT: 4be8e06d27bca7e1828f2fa9a49ca985
+    locale.frFR: ad225f707802ba118c22987186dd38e8
+    locale.deDE: 86bc3115eb4e9873ac96904a4a68e19e
+    locale.ruRU: deba6920e70615401385fe1fb5a379ec
+    locale.esES: cdbe021be1976335ab583a845edf7ed6
+    locale.ptBR: 26d5352ead4a731f3d11eb2e85d0e297
+    locale.ptPT: 71bfc0d79772120b52c1c0782450ff84
+    locale.es419: edbf64ac382b82a54795fb409beb54be
+    locale.zhCN: 1e81fc32fea0e9f3a978661e4b5e484d
+    locale.jaJP: f32ced6a9ba164c4b3c047fd1d7c882e
+    locale.koKR: d0bdb3cde477d82e766da05ebda50ccb

lara.yaml

@@ -0,0 +1,30 @@
+version: "1.0.0"
+
+project:
+  instruction: >
+    Tolaria is a desktop knowledge-management app. Keep product names, CLI names,
+    markdown wikilinks, frontmatter keys, file paths, and placeholders like
+    {agent}, {zoom}, {language}, {name}, {label}, {file}, and {count} unchanged.
+
+locales:
+  source: en
+  target:
+    - it-IT
+    - fr-FR
+    - de-DE
+    - ru-RU
+    - es-ES
+    - pt-BR
+    - pt-PT
+    - es-419
+    - zh-CN
+    - ja-JP
+    - ko-KR
+
+files:
+  json:
+    include:
+      - "src/lib/locales/[locale].json"
+    exclude: []
+    lockedKeys: []
+    ignoredKeys: []

mcp-server/index.js

@@ -21,8 +21,9 @@ import {
 } from '@modelcontextprotocol/sdk/types.js'
 import WebSocket from 'ws'
 import { searchNotes, getNote, vaultContext } from './vault.js'
+import { requireVaultPath } from './vault-path.js'
 
-const VAULT_PATH = process.env.VAULT_PATH || process.env.HOME + '/Laputa'
+const VAULT_PATH = requireVaultPath()
 const WS_UI_PORT = parseInt(process.env.WS_UI_PORT || '9711', 10)
 const WS_UI_URL = `ws://localhost:${WS_UI_PORT}`
 

mcp-server/test.js

@@ -6,6 +6,7 @@ import os from 'node:os'
 import {
   findMarkdownFiles, getNote, searchNotes, vaultContext,
 } from './vault.js'
+import { requireVaultPath } from './vault-path.js'
 import { evaluateBridgeRequest } from './ws-bridge.js'
 
 let tmpDir
@@ -191,6 +192,22 @@ describe('evaluateBridgeRequest', () => {
   })
 })
 
+describe('requireVaultPath', () => {
+  it('returns the explicit configured vault path', () => {
+    assert.equal(
+      requireVaultPath({ VAULT_PATH: '/tmp/Selected Vault' }),
+      '/tmp/Selected Vault',
+    )
+  })
+
+  it('rejects missing vault paths instead of falling back to ~/Laputa', () => {
+    assert.throws(
+      () => requireVaultPath({}),
+      /VAULT_PATH is required/,
+    )
+  })
+})
+
 async function assertRejectsOutsideVault(prefix, resolveNotePath) {
   const outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), prefix))
   const outsideNote = path.join(outsideDir, 'outside.md')

mcp-server/vault-path.js

@@ -0,0 +1,7 @@
+export function requireVaultPath(env = process.env) {
+  const vaultPath = env.VAULT_PATH?.trim()
+  if (!vaultPath) {
+    throw new Error('VAULT_PATH is required. Open a vault in Tolaria before starting MCP tools.')
+  }
+  return vaultPath
+}

mcp-server/ws-bridge.js

@@ -24,8 +24,8 @@ import { WebSocketServer } from 'ws'
 import {
   getNote, searchNotes, vaultContext,
 } from './vault.js'
+import { requireVaultPath } from './vault-path.js'
 
-const VAULT_PATH = process.env.VAULT_PATH || process.env.HOME + '/Laputa'
 const WS_PORT = parseInt(process.env.WS_PORT || '9710', 10)
 const WS_UI_PORT = parseInt(process.env.WS_UI_PORT || '9711', 10)
 const LOOPBACK_HOST = 'localhost'
@@ -37,6 +37,12 @@ const TRUSTED_UI_ORIGINS = new Set([
 
 /** @type {WebSocketServer | null} */
 let uiBridge = null
+let vaultPath = null
+
+function activeVaultPath() {
+  vaultPath ??= requireVaultPath()
+  return vaultPath
+}
 
 function broadcastUiAction(action, payload) {
   if (!uiBridge) return
@@ -48,10 +54,10 @@ function broadcastUiAction(action, payload) {
 
 
 const TOOL_HANDLERS = {
-  open_note: (args) => getNote(VAULT_PATH, args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
-  read_note: (args) => getNote(VAULT_PATH, args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
-  search_notes: (args) => searchNotes(VAULT_PATH, args.query, args.limit),
-  vault_context: () => vaultContext(VAULT_PATH),
+  open_note: (args) => getNote(activeVaultPath(), args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
+  read_note: (args) => getNote(activeVaultPath(), args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
+  search_notes: (args) => searchNotes(activeVaultPath(), args.query, args.limit),
+  vault_context: () => vaultContext(activeVaultPath()),
   ui_open_note: (args) => { broadcastUiAction('vault_changed', { path: args.path }); broadcastUiAction('open_note', { path: args.path }); return { ok: true } },
   ui_open_tab: (args) => { broadcastUiAction('vault_changed', { path: args.path }); broadcastUiAction('open_tab', { path: args.path }); return { ok: true } },
   ui_highlight: (args) => { broadcastUiAction('highlight', { element: args.element, path: args.path }); return { ok: true } },
@@ -164,6 +170,7 @@ export function startUiBridge(port = WS_UI_PORT) {
 }
 
 export function startBridge(port = WS_PORT) {
+  const currentVaultPath = activeVaultPath()
   const wss = new WebSocketServer({
     port,
     host: LOOPBACK_HOST,
@@ -171,7 +178,7 @@ export function startBridge(port = WS_PORT) {
   })
 
   wss.on('connection', (ws) => {
-    console.error(`[ws-bridge] Client connected (vault: ${VAULT_PATH})`)
+    console.error(`[ws-bridge] Client connected (vault: ${currentVaultPath})`)
 
     ws.on('message', async (raw) => {
       try {
@@ -192,5 +199,11 @@ export function startBridge(port = WS_PORT) {
 // Run directly if invoked as main module
 const isMain = process.argv[1]?.endsWith('ws-bridge.js')
 if (isMain) {
-  startUiBridge().then(() => startBridge())
+  try {
+    activeVaultPath()
+    startUiBridge().then(() => startBridge())
+  } catch (err) {
+    console.error(`[ws-bridge] ${err.message}`)
+    process.exit(1)
+  }
 }

package.json

@@ -9,12 +9,15 @@
     "build": "tsc -b && vite build",
     "bundle-mcp": "node scripts/bundle-mcp-server.mjs",
     "lint": "eslint .",
+    "l10n:translate": "lara-cli translate",
+    "l10n:translate:force": "lara-cli translate --force",
+    "l10n:validate": "node scripts/validate-locales.mjs",
     "preview": "vite preview",
     "tauri": "tauri",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:e2e": "playwright test",
-    "playwright:smoke": "playwright test --config playwright.smoke.config.ts tests/smoke/example.spec.ts tests/smoke/fix-ai-chat-empty-body-v3.spec.ts tests/smoke/fix-crash-create-note.spec.ts tests/smoke/fresh-start-telemetry-onboarding.spec.ts tests/smoke/getting-started-template.spec.ts tests/smoke/h1-title-decoupled.spec.ts tests/smoke/h1-untitled-auto-rename.spec.ts tests/smoke/keyboard-command-routing.spec.ts tests/smoke/linkify-init-warnings.spec.ts tests/smoke/multi-selection-shortcuts.spec.ts tests/smoke/wikilink-path-fix.spec.ts",
+    "playwright:smoke": "playwright test --config playwright.smoke.config.ts tests/smoke/create-note-backing-file.spec.ts tests/smoke/delete-note-nonblocking.spec.ts tests/smoke/example.spec.ts tests/smoke/fix-ai-chat-empty-body-v3.spec.ts tests/smoke/fix-crash-create-note.spec.ts tests/smoke/fresh-start-telemetry-onboarding.spec.ts tests/smoke/getting-started-template.spec.ts tests/smoke/h1-title-decoupled.spec.ts tests/smoke/h1-untitled-auto-rename.spec.ts tests/smoke/keyboard-command-routing.spec.ts tests/smoke/linkify-init-warnings.spec.ts tests/smoke/multi-selection-shortcuts.spec.ts tests/smoke/wikilink-path-fix.spec.ts",
     "playwright:regression": "playwright test tests/smoke/",
     "playwright:integration": "playwright test --config playwright.integration.config.ts",
     "test:coverage": "node scripts/run-vitest-coverage.mjs",
@@ -57,6 +60,7 @@
     "date-fns": "^4.1.0",
     "katex": "^0.16.28",
     "lucide-react": "^0.564.0",
+    "mermaid": "^11.14.0",
     "posthog-js": "^1.363.5",
     "radix-ui": "^1.4.3",
     "react": "^19.2.0",
@@ -77,6 +81,7 @@
     "@tauri-apps/cli": "^2.10.0",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
+    "@translated/lara-cli": "^1.3.2",
     "@types/node": "^24.10.1",
     "@types/react": "^19.2.7",
     "@types/react-dom": "^19.2.3",

playwright.smoke.config.ts

@@ -30,7 +30,7 @@ export default defineConfig({
   },
   projects: [{ name: 'chromium', use: { browserName: 'chromium' } }],
   webServer: {
-    command: `pnpm dev --host 127.0.0.1 --port ${port} --strictPort`,
+    command: `node scripts/playwright-smoke-server.mjs ${port}`,
     url: baseURL,
     reuseExistingServer,
     timeout: 30_000,

scripts/build-release-download-page.ts

@@ -3,7 +3,7 @@ import { dirname, resolve } from 'node:path'
 
 import {
   buildStableDownloadRedirectPage,
-  resolveStableDmgUrl,
+  resolveStableDownloadTargets,
 } from '../src/utils/releaseDownloadPage'
 
 function getArg(flag: string): string {
@@ -30,8 +30,8 @@ const releasesJsonPath = resolve(getArg('--releases-json'))
 const outputFilePath = resolve(getArg('--output-file'))
 const latestPayload = readLatestReleasePayload(latestJsonPath)
 const releasesPayload = readLatestReleasePayload(releasesJsonPath)
-const dmgUrl = resolveStableDmgUrl(latestPayload, releasesPayload)
-const html = buildStableDownloadRedirectPage(dmgUrl)
+const downloads = resolveStableDownloadTargets(latestPayload, releasesPayload)
+const html = buildStableDownloadRedirectPage(downloads)
 
 mkdirSync(dirname(outputFilePath), { recursive: true })
 writeFileSync(outputFilePath, html)

scripts/playwright-smoke-server.mjs

@@ -0,0 +1,32 @@
+#!/usr/bin/env node
+
+import { spawn } from 'node:child_process'
+
+const port = process.argv[2] ?? process.env.PORT ?? '41741'
+
+const child = spawn(
+  'pnpm',
+  ['dev', '--host', '127.0.0.1', '--port', port, '--strictPort'],
+  {
+    cwd: process.cwd(),
+    env: process.env,
+    stdio: ['pipe', 'inherit', 'inherit'],
+  },
+)
+
+function forwardSignal(signal) {
+  if (child.killed) return
+  child.kill(signal)
+}
+
+process.on('SIGINT', () => forwardSignal('SIGINT'))
+process.on('SIGTERM', () => forwardSignal('SIGTERM'))
+
+child.on('exit', (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal)
+    return
+  }
+
+  process.exit(code ?? 1)
+})

scripts/validate-locales.mjs

@@ -0,0 +1,111 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
+const localesDir = path.join(root, 'src/lib/locales')
+const sourcePath = path.join(localesDir, 'en.json')
+
+function readCatalog(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'))
+}
+
+function isFlatObject(value) {
+  if (!value) return false
+  if (typeof value !== 'object') return false
+  return !Array.isArray(value)
+}
+
+function assertFlatStringCatalog(locale, catalog) {
+  if (!isFlatObject(catalog)) {
+    throw new Error(`${locale}: expected a flat object of translation keys`)
+  }
+
+  for (const [key, value] of Object.entries(catalog)) {
+    if (typeof value !== 'string') {
+      throw new Error(`${locale}: key "${key}" must map to a string`)
+    }
+  }
+}
+
+function missingKeys(sourceKeys, localeKeys) {
+  const localeKeySet = new Set(localeKeys)
+  return sourceKeys.filter((key) => !localeKeySet.has(key))
+}
+
+function extraKeys(sourceKeys, localeKeys) {
+  const sourceKeySet = new Set(sourceKeys)
+  return localeKeys.filter((key) => !sourceKeySet.has(key))
+}
+
+function placeholders(value) {
+  return Array.from(value.matchAll(/\{(\w+)\}/g), (match) => match[1]).sort()
+}
+
+function sameValues(left, right) {
+  if (left.length !== right.length) return false
+  return left.every((value, index) => value === right[index])
+}
+
+function formatValues(values) {
+  return values.length === 0 ? 'none' : values.join(', ')
+}
+
+function placeholderIssues(locale, sourceCatalog, catalog) {
+  const issues = []
+
+  for (const [key, sourceValue] of Object.entries(sourceCatalog)) {
+    if (!(key in catalog)) continue
+
+    const sourcePlaceholders = placeholders(sourceValue)
+    const localePlaceholders = placeholders(catalog[key])
+    if (sameValues(sourcePlaceholders, localePlaceholders)) continue
+
+    issues.push(
+      `${locale}: key "${key}" placeholders differ ` +
+        `(expected ${formatValues(sourcePlaceholders)}, found ${formatValues(localePlaceholders)})`,
+    )
+  }
+
+  return issues
+}
+
+const sourceCatalog = readCatalog(sourcePath)
+assertFlatStringCatalog('en', sourceCatalog)
+
+const sourceKeys = Object.keys(sourceCatalog).sort()
+const localeFiles = fs.readdirSync(localesDir).filter((file) => file.endsWith('.json'))
+const issues = []
+
+for (const file of localeFiles) {
+  const locale = file.replace(/\.json$/, '')
+  const filePath = path.join(localesDir, file)
+  const catalog = readCatalog(filePath)
+
+  assertFlatStringCatalog(locale, catalog)
+
+  if (locale === 'en') continue
+
+  const keys = Object.keys(catalog).sort()
+  const missing = missingKeys(sourceKeys, keys)
+  const extra = extraKeys(sourceKeys, keys)
+
+  if (missing.length > 0) {
+    issues.push(`${locale}: missing ${missing.length} key(s)`)
+  }
+  if (extra.length > 0) {
+    issues.push(`${locale}: extra ${extra.length} key(s)`)
+  }
+
+  issues.push(...placeholderIssues(locale, sourceCatalog, catalog))
+}
+
+if (issues.length > 0) {
+  console.error('Locale validation failed:')
+  for (const issue of issues) {
+    console.error(`- ${issue}`)
+  }
+  process.exit(1)
+}
+
+console.log(`Validated ${localeFiles.length} locale catalog(s) against ${sourceKeys.length} English keys.`)

src-tauri/Cargo.lock

@@ -1239,6 +1239,15 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fsevent-sys"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76ee7a02da4d231650c7cea31349b889be2f45ddb3ef3032d2ec8185f6313fd2"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "funty"
 version = "2.0.0"
@@ -2069,6 +2078,26 @@ dependencies = [
  "cfb",
 ]
 
+[[package]]
+name = "inotify"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8069d3ec154eb856955c1c0fbffefbf5f3c40a104ec912d4797314c1801abff"
+dependencies = [
+ "bitflags 1.3.2",
+ "inotify-sys",
+ "libc",
+]
+
+[[package]]
+name = "inotify-sys"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e05c02b5e89bff3b946cedeca278abc628fe811e604f027c45a8aa3cf793d0eb"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "ipnet"
 version = "2.11.0"
@@ -2207,6 +2236,26 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "kqueue"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eac30106d7dce88daf4a3fcb4879ea939476d5074a9b7ddd0fb97fa4bed5596a"
+dependencies = [
+ "kqueue-sys",
+ "libc",
+]
+
+[[package]]
+name = "kqueue-sys"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed9625ffda8729b85e45cf04090035ac368927b8cebc34898e7c120f52e4838b"
+dependencies = [
+ "bitflags 1.3.2",
+ "libc",
+]
+
 [[package]]
 name = "kuchikiki"
 version = "0.8.8-speedreader"
@@ -2386,6 +2435,18 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "mio"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4a650543ca06a924e8b371db273b2756685faae30f8487da1b56505a8f78b0c"
+dependencies = [
+ "libc",
+ "log",
+ "wasi 0.11.1+wasi-snapshot-preview1",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "mio"
 version = "1.1.1"
@@ -2489,6 +2550,25 @@ version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72ef4a56884ca558e5ddb05a1d1e7e1bfd9a68d9ed024c21704cc98872dae1bb"
 
+[[package]]
+name = "notify"
+version = "6.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6205bd8bb1e454ad2e27422015fb5e4f2bcc7e08fa8f27058670d208324a4d2d"
+dependencies = [
+ "bitflags 2.11.0",
+ "crossbeam-channel",
+ "filetime",
+ "fsevent-sys",
+ "inotify",
+ "kqueue",
+ "libc",
+ "log",
+ "mio 0.8.11",
+ "walkdir",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "num-conv"
 version = "0.2.0"
@@ -5042,7 +5122,7 @@ checksum = "72a2903cd7736441aac9df9d7688bd0ce48edccaadf181c3b90be801e81d3d86"
 dependencies = [
  "bytes",
  "libc",
- "mio",
+ "mio 1.1.1",
  "pin-project-lite",
  "socket2",
  "tokio-macros",
@@ -5103,6 +5183,7 @@ dependencies = [
  "futures-util",
  "gray_matter",
  "log",
+ "notify",
  "regex",
  "sentry",
  "serde",

src-tauri/Cargo.toml

@@ -20,6 +20,7 @@ serde_json = "1.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_yaml = "0.9"
 log = "0.4"
+notify = "6.1"
 tauri = { version = "2.10.0", features = ["protocol-asset", "devtools"] }
 tauri-plugin-log = "2"
 gray_matter = "0.2"

src-tauri/src/ai_agents.rs

@@ -1,13 +1,15 @@
 use serde::{Deserialize, Serialize};
 use std::io::BufRead;
-use std::path::PathBuf;
-use std::process::{Command, Stdio};
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
 
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case")]
 pub enum AiAgentId {
     ClaudeCode,
     Codex,
+    Opencode,
+    Pi,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -20,6 +22,8 @@ pub struct AiAgentAvailability {
 pub struct AiAgentsStatus {
     pub claude_code: AiAgentAvailability,
     pub codex: AiAgentAvailability,
+    pub opencode: AiAgentAvailability,
+    pub pi: AiAgentAvailability,
 }
 
 #[derive(Debug, Clone, Serialize)]
@@ -63,6 +67,8 @@ pub fn get_ai_agents_status() -> AiAgentsStatus {
     AiAgentsStatus {
         claude_code: availability_from_claude(),
         codex: availability_from_codex(),
+        opencode: availability_from_opencode(),
+        pi: availability_from_pi(),
     }
 }
 
@@ -84,6 +90,22 @@ where
             })
         }
         AiAgentId::Codex => run_codex_agent_stream(request, emit),
+        AiAgentId::Opencode => {
+            let mapped = crate::opencode_cli::AgentStreamRequest {
+                message: request.message,
+                system_prompt: request.system_prompt,
+                vault_path: request.vault_path,
+            };
+            crate::opencode_cli::run_agent_stream(mapped, emit)
+        }
+        AiAgentId::Pi => {
+            let mapped = crate::pi_cli::AgentStreamRequest {
+                message: request.message,
+                system_prompt: request.system_prompt,
+                vault_path: request.vault_path,
+            };
+            crate::pi_cli::run_agent_stream(mapped, emit)
+        }
     }
 }
 
@@ -112,8 +134,16 @@ fn availability_from_codex() -> AiAgentAvailability {
     }
 }
 
+fn availability_from_opencode() -> AiAgentAvailability {
+    crate::opencode_cli::check_cli()
+}
+
+fn availability_from_pi() -> AiAgentAvailability {
+    crate::pi_cli::check_cli()
+}
+
 fn version_for_binary(binary: &PathBuf) -> Option<String> {
-    Command::new(binary)
+    crate::hidden_command(binary)
         .arg("--version")
         .output()
         .ok()
@@ -122,7 +152,11 @@ fn version_for_binary(binary: &PathBuf) -> Option<String> {
 }
 
 fn find_codex_binary() -> Result<PathBuf, String> {
-    if let Some(binary) = find_codex_binary_on_path()? {
+    if let Some(binary) = find_codex_binary_on_path() {
+        return Ok(binary);
+    }
+
+    if let Some(binary) = find_codex_binary_in_user_shell() {
         return Ok(binary);
     }
 
@@ -133,27 +167,76 @@ fn find_codex_binary() -> Result<PathBuf, String> {
     Err("Codex CLI not found. Install it: https://developers.openai.com/codex/cli".into())
 }
 
-fn find_codex_binary_on_path() -> Result<Option<PathBuf>, String> {
-    let output = Command::new("which")
+fn find_codex_binary_on_path() -> Option<PathBuf> {
+    crate::hidden_command("which")
         .arg("codex")
         .output()
-        .map_err(|error| format!("Failed to run `which codex`: {error}"))?;
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
 
-    if output.status.success() {
-        let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
-        if !path.is_empty() {
-            return Ok(Some(PathBuf::from(path)));
+fn find_codex_binary_in_user_shell() -> Option<PathBuf> {
+    user_shell_candidates()
+        .into_iter()
+        .filter(|shell| shell.exists())
+        .find_map(|shell| command_path_from_shell(&shell, "codex"))
+}
+
+fn user_shell_candidates() -> Vec<PathBuf> {
+    let mut shells = Vec::new();
+    if let Some(shell) = std::env::var_os("SHELL") {
+        if !shell.is_empty() {
+            shells.push(PathBuf::from(shell));
         }
     }
+    shells.push(PathBuf::from("/bin/zsh"));
+    shells.push(PathBuf::from("/bin/bash"));
+    shells
+}
 
-    Ok(None)
+fn command_path_from_shell(shell: &Path, command: &str) -> Option<PathBuf> {
+    crate::hidden_command(shell)
+        .arg("-lc")
+        .arg(format!("command -v {command}"))
+        .output()
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
+
+fn path_from_successful_output(output: &std::process::Output) -> Option<PathBuf> {
+    if output.status.success() {
+        first_existing_path(&String::from_utf8_lossy(&output.stdout))
+    } else {
+        None
+    }
+}
+
+fn first_existing_path(stdout: &str) -> Option<PathBuf> {
+    stdout.lines().find_map(|line| {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            return None;
+        }
+        let candidate = PathBuf::from(trimmed);
+        candidate.exists().then_some(candidate)
+    })
 }
 
 fn codex_binary_candidates() -> Vec<PathBuf> {
-    let home = dirs::home_dir().unwrap_or_default();
+    dirs::home_dir()
+        .map(|home| codex_binary_candidates_for_home(&home))
+        .unwrap_or_default()
+}
+
+fn codex_binary_candidates_for_home(home: &Path) -> Vec<PathBuf> {
     vec![
         home.join(".local/bin/codex"),
+        home.join(".codex/bin/codex"),
+        home.join(".local/share/mise/shims/codex"),
+        home.join(".asdf/shims/codex"),
+        home.join(".npm-global/bin/codex"),
         home.join(".npm/bin/codex"),
+        home.join(".bun/bin/codex"),
         PathBuf::from("/usr/local/bin/codex"),
         PathBuf::from("/opt/homebrew/bin/codex"),
         PathBuf::from("/Applications/Codex.app/Contents/Resources/codex"),
@@ -172,13 +255,7 @@ where
     let args = build_codex_args(&request)?;
     let prompt = build_codex_prompt(&request);
 
-    let mut command = Command::new(binary);
-    command
-        .args(args)
-        .arg(prompt)
-        .current_dir(&request.vault_path)
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
+    let mut command = build_codex_command(&binary, args, prompt, &request.vault_path);
 
     let mut child = command
         .spawn()
@@ -236,6 +313,22 @@ where
     Ok(thread_id)
 }
 
+fn build_codex_command(
+    binary: &Path,
+    args: Vec<String>,
+    prompt: String,
+    vault_path: &str,
+) -> std::process::Command {
+    let mut command = crate::hidden_command(binary);
+    command
+        .args(args)
+        .arg(prompt)
+        .current_dir(vault_path)
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    command
+}
+
 fn build_codex_args(request: &AiAgentStreamRequest) -> Result<Vec<String>, String> {
     let mcp_server = crate::mcp::mcp_server_dir()?.join("index.js");
     let mcp_server_path = mcp_server
@@ -244,6 +337,10 @@ fn build_codex_args(request: &AiAgentStreamRequest) -> Result<Vec<String>, Strin
         .to_string();
 
     Ok(vec![
+        "--sandbox".into(),
+        "workspace-write".into(),
+        "--ask-for-approval".into(),
+        "never".into(),
         "exec".into(),
         "--json".into(),
         "-C".into(),
@@ -337,6 +434,10 @@ fn format_codex_error(stderr_output: String, status: String) -> String {
         return "Codex CLI is not authenticated. Run `codex login` or launch `codex` in your terminal.".into();
     }
 
+    if is_codex_write_permission_error(&lower) {
+        return "Codex could not write to the active vault. Tolaria starts Codex with a workspace-write sandbox, so verify the selected vault folder is writable and retry; writes outside the active vault remain blocked.".into();
+    }
+
     if stderr_output.trim().is_empty() {
         format!("codex exited with status {status}")
     } else {
@@ -350,6 +451,17 @@ fn is_codex_auth_error(lower: &str) -> bool {
         .any(|pattern| lower.contains(pattern))
 }
 
+fn is_codex_write_permission_error(lower: &str) -> bool {
+    [
+        "read-only sandbox",
+        "writing is blocked",
+        "rejected by user approval",
+        "rejected by the environment",
+    ]
+    .iter()
+    .any(|pattern| lower.contains(pattern))
+}
+
 fn map_claude_event(event: crate::claude_cli::ClaudeStreamEvent) -> Option<AiAgentStreamEvent> {
     match event {
         crate::claude_cli::ClaudeStreamEvent::Init { session_id } => {
@@ -377,6 +489,9 @@ fn map_claude_event(event: crate::claude_cli::ClaudeStreamEvent) -> Option<AiAge
             Some(AiAgentStreamEvent::Error { message })
         }
         crate::claude_cli::ClaudeStreamEvent::Done => Some(AiAgentStreamEvent::Done),
+        crate::claude_cli::ClaudeStreamEvent::Result { text, .. } if !text.is_empty() => {
+            Some(AiAgentStreamEvent::TextDelta { text })
+        }
         crate::claude_cli::ClaudeStreamEvent::Result { .. } => None,
     }
 }
@@ -384,12 +499,15 @@ fn map_claude_event(event: crate::claude_cli::ClaudeStreamEvent) -> Option<AiAge
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::ffi::OsStr;
 
     #[test]
-    fn normalize_status_contains_both_agents() {
+    fn normalize_status_contains_all_agents() {
         let status = get_ai_agents_status();
         assert!(matches!(status.claude_code.installed, true | false));
         assert!(matches!(status.codex.installed, true | false));
+        assert!(matches!(status.opencode.installed, true | false));
+        assert!(matches!(status.pi.installed, true | false));
     }
 
     #[test]
@@ -413,12 +531,96 @@ mod tests {
             system_prompt: None,
             vault_path: "/tmp/vault".into(),
         }) {
+            assert_eq!(args[0], "--sandbox");
+            assert_eq!(args[1], "workspace-write");
+            assert_eq!(args[2], "--ask-for-approval");
+            assert_eq!(args[3], "never");
+            assert_eq!(args[4], "exec");
             assert!(!args.contains(&"--dangerously-bypass-approvals-and-sandbox".to_string()));
+            assert!(!args.contains(&"danger-full-access".to_string()));
             assert!(args.contains(&"--json".to_string()));
             assert!(args.contains(&"-C".to_string()));
         }
     }
 
+    #[test]
+    fn build_codex_command_keeps_agent_process_contract() {
+        let binary = PathBuf::from("codex");
+        let args = vec!["exec".to_string(), "--json".to_string()];
+        let command = build_codex_command(&binary, args, "Summarize".into(), "/tmp/vault");
+        let actual_args: Vec<&OsStr> = command.get_args().collect();
+
+        assert_eq!(command.get_program(), OsStr::new("codex"));
+        assert_eq!(
+            actual_args,
+            vec![
+                OsStr::new("exec"),
+                OsStr::new("--json"),
+                OsStr::new("Summarize")
+            ]
+        );
+        assert_eq!(command.get_current_dir(), Some(Path::new("/tmp/vault")));
+    }
+
+    #[test]
+    fn codex_binary_candidates_include_supported_macos_installs() {
+        let home = PathBuf::from("/Users/alex");
+        let candidates = codex_binary_candidates_for_home(&home);
+        let expected = [
+            home.join(".local/bin/codex"),
+            home.join(".codex/bin/codex"),
+            home.join(".local/share/mise/shims/codex"),
+            home.join(".asdf/shims/codex"),
+            home.join(".npm-global/bin/codex"),
+            home.join(".bun/bin/codex"),
+            PathBuf::from("/Applications/Codex.app/Contents/Resources/codex"),
+        ];
+
+        for candidate in expected {
+            assert!(
+                candidates.contains(&candidate),
+                "missing {}",
+                candidate.display()
+            );
+        }
+    }
+
+    #[test]
+    fn first_existing_path_skips_empty_and_missing_lines() {
+        let dir = tempfile::tempdir().unwrap();
+        let missing = dir.path().join("missing-codex");
+        let codex = dir.path().join("codex");
+        std::fs::write(&codex, "#!/bin/sh\n").unwrap();
+
+        let stdout = format!("\n{}\n{}\n", missing.display(), codex.display());
+
+        assert_eq!(first_existing_path(&stdout), Some(codex));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn command_path_from_shell_finds_codex_from_login_shell() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let codex = dir.path().join("codex");
+        std::fs::write(&codex, "#!/bin/sh\n").unwrap();
+        std::fs::set_permissions(&codex, std::fs::Permissions::from_mode(0o755)).unwrap();
+
+        let shell = dir.path().join("shell");
+        std::fs::write(
+            &shell,
+            format!(
+                "#!/bin/sh\nif [ \"$1\" = \"-lc\" ]; then echo '{}'; fi\n",
+                codex.display()
+            ),
+        )
+        .unwrap();
+        std::fs::set_permissions(&shell, std::fs::Permissions::from_mode(0o755)).unwrap();
+
+        assert_eq!(command_path_from_shell(&shell, "codex"), Some(codex));
+    }
+
     #[test]
     fn dispatch_codex_command_events_maps_to_bash_events() {
         let mut events = Vec::new();
@@ -474,10 +676,35 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn format_codex_error_explains_vault_write_permission_failures() {
+        let message = format_codex_error(
+            "The patch was rejected by the environment: writing is blocked by read-only sandbox; rejected by user approval settings".into(),
+            "exit status: 1".into(),
+        );
+
+        assert!(message.contains("active vault"));
+        assert!(message.contains("writable"));
+        assert!(message.contains("outside"));
+    }
+
     #[test]
     fn map_claude_done_event_preserves_completion_signal() {
         let mapped = map_claude_event(crate::claude_cli::ClaudeStreamEvent::Done);
 
         assert!(matches!(mapped, Some(AiAgentStreamEvent::Done)));
     }
+
+    #[test]
+    fn map_claude_result_event_preserves_final_text() {
+        let mapped = map_claude_event(crate::claude_cli::ClaudeStreamEvent::Result {
+            text: "Final answer from Claude".into(),
+            session_id: "session-1".into(),
+        });
+
+        assert!(matches!(
+            mapped,
+            Some(AiAgentStreamEvent::TextDelta { text }) if text == "Final answer from Claude"
+        ));
+    }
 }

src-tauri/src/claude_cli.rs

@@ -2,7 +2,7 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::io::BufRead;
 use std::path::{Path, PathBuf};
-use std::process::{Command, ExitStatus, Stdio};
+use std::process::{ExitStatus, Stdio};
 
 /// Status returned by `check_claude_cli`.
 #[derive(Debug, Serialize, Clone)]
@@ -50,7 +50,7 @@ pub struct ChatStreamRequest {
     pub session_id: Option<String>,
 }
 
-/// Parameters accepted by `stream_claude_agent`.
+/// Parameters accepted by Claude Code agent streams.
 #[derive(Debug, Deserialize)]
 pub struct AgentStreamRequest {
     pub message: String,
@@ -63,7 +63,7 @@ pub struct AgentStreamRequest {
 // ---------------------------------------------------------------------------
 
 pub(crate) fn find_claude_binary() -> Result<PathBuf, String> {
-    if let Some(binary) = find_claude_binary_on_path()? {
+    if let Some(binary) = find_claude_binary_on_path() {
         return Ok(binary);
     }
 
@@ -78,13 +78,20 @@ pub(crate) fn find_claude_binary() -> Result<PathBuf, String> {
     Err("Claude CLI not found. Install it: https://docs.anthropic.com/en/docs/claude-code".into())
 }
 
-fn find_claude_binary_on_path() -> Result<Option<PathBuf>, String> {
-    let output = Command::new("which")
+fn find_claude_binary_on_path() -> Option<PathBuf> {
+    crate::hidden_command(claude_path_lookup_command())
         .arg("claude")
         .output()
-        .map_err(|e| format!("Failed to run `which claude`: {e}"))?;
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
 
-    Ok(path_from_successful_output(&output))
+fn claude_path_lookup_command() -> &'static str {
+    if cfg!(windows) {
+        "where"
+    } else {
+        "which"
+    }
 }
 
 fn find_claude_binary_in_user_shell() -> Option<PathBuf> {
@@ -107,7 +114,7 @@ fn user_shell_candidates() -> Vec<PathBuf> {
 }
 
 fn command_path_from_shell(shell: &Path, command: &str) -> Option<PathBuf> {
-    Command::new(shell)
+    crate::hidden_command(shell)
         .arg("-lc")
         .arg(format!("command -v {command}"))
         .output()
@@ -143,11 +150,24 @@ fn claude_binary_candidates() -> Vec<PathBuf> {
 fn claude_binary_candidates_for_home(home: &Path) -> Vec<PathBuf> {
     vec![
         home.join(".local/bin/claude"),
+        home.join(".local/bin/claude.exe"),
         home.join(".claude/local/claude"),
+        home.join(".claude/local/claude.exe"),
         home.join(".local/share/mise/shims/claude"),
+        home.join(".local/share/mise/shims/claude.exe"),
         home.join(".asdf/shims/claude"),
+        home.join(".asdf/shims/claude.exe"),
         home.join(".npm-global/bin/claude"),
+        home.join(".npm-global/bin/claude.cmd"),
+        home.join(".npm-global/bin/claude.exe"),
         home.join(".npm/bin/claude"),
+        home.join(".npm/bin/claude.cmd"),
+        home.join(".npm/bin/claude.exe"),
+        home.join("AppData/Roaming/npm/claude.cmd"),
+        home.join("AppData/Roaming/npm/claude.exe"),
+        home.join("AppData/Local/pnpm/claude.cmd"),
+        home.join("AppData/Local/pnpm/claude.exe"),
+        home.join("scoop/shims/claude.exe"),
         PathBuf::from("/opt/homebrew/bin/claude"),
         PathBuf::from("/usr/local/bin/claude"),
     ]
@@ -173,7 +193,7 @@ pub fn check_cli() -> ClaudeCliStatus {
         }
     };
 
-    let version = Command::new(&bin)
+    let version = crate::hidden_command(&bin)
         .arg("--version")
         .output()
         .ok()
@@ -249,7 +269,11 @@ fn build_agent_args(req: &AgentStreamRequest) -> Result<Vec<String>, String> {
         "--include-partial-messages".into(),
         "--mcp-config".into(),
         mcp_config,
-        "--dangerously-skip-permissions".into(),
+        "--strict-mcp-config".into(),
+        "--permission-mode".into(),
+        "acceptEdits".into(),
+        "--tools".into(),
+        "Read,Edit,MultiEdit,Write,Glob,Grep,LS".into(),
         "--no-session-persistence".into(),
     ];
 
@@ -303,14 +327,7 @@ fn run_claude_subprocess<F>(
 where
     F: FnMut(ClaudeStreamEvent),
 {
-    let mut cmd = Command::new(bin);
-    cmd.args(args)
-        .env_remove("CLAUDECODE") // prevent "nested session" guard
-        .stdout(Stdio::piped())
-        .stderr(Stdio::piped());
-    if let Some(dir) = cwd {
-        cmd.current_dir(dir);
-    }
+    let mut cmd = build_claude_command(bin, args, cwd);
     let mut child = cmd
         .spawn()
         .map_err(|e| format!("Failed to spawn claude: {e}"))?;
@@ -367,6 +384,23 @@ where
     Ok(state.session_id)
 }
 
+fn build_claude_command(
+    bin: &PathBuf,
+    args: &[String],
+    cwd: Option<&str>,
+) -> std::process::Command {
+    let mut cmd = crate::hidden_command(bin);
+    cmd.args(args)
+        .env_remove("CLAUDECODE") // prevent "nested session" guard
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    if let Some(dir) = cwd {
+        cmd.current_dir(dir);
+    }
+    cmd
+}
+
 fn format_failed_claude_exit(stderr_output: &str, status: ExitStatus) -> String {
     if is_claude_auth_error(stderr_output) {
         return "Claude CLI is not authenticated. Run `claude auth login` in your terminal.".into();
@@ -569,6 +603,9 @@ fn extract_tool_result_text(json: &serde_json::Value) -> Option<String> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::ffi::OsStr;
+    use std::ffi::OsString;
+    use std::process::Command;
 
     #[test]
     fn check_cli_returns_status() {
@@ -882,6 +919,33 @@ mod tests {
 
     // --- run_claude_subprocess with mock scripts ---
 
+    #[test]
+    fn build_claude_command_keeps_streaming_process_contract() {
+        let bin = PathBuf::from("claude");
+        let args = vec!["-p".to_string(), "hello".to_string()];
+        let command = build_claude_command(&bin, &args, Some("/tmp/vault"));
+        let actual_args: Vec<OsString> = command.get_args().map(OsStr::to_os_string).collect();
+        let claude_code_env = command
+            .get_envs()
+            .find(|(key, _)| *key == OsStr::new("CLAUDECODE"))
+            .map(|(_, value)| value.map(OsStr::to_os_string));
+
+        assert_eq!(
+            (
+                command.get_program().to_os_string(),
+                actual_args,
+                command.get_current_dir().map(Path::to_path_buf),
+                claude_code_env,
+            ),
+            (
+                OsString::from("claude"),
+                vec![OsString::from("-p"), OsString::from("hello")],
+                Some(PathBuf::from("/tmp/vault")),
+                Some(None),
+            ),
+        );
+    }
+
     #[cfg(unix)]
     fn run_mock_script(script: &str) -> (Result<String, String>, Vec<ClaudeStreamEvent>) {
         run_mock_script_with_args(script, &[])
@@ -918,6 +982,99 @@ mod tests {
         assert!(matches!(&events[3], ClaudeStreamEvent::Done));
     }
 
+    #[test]
+    fn run_subprocess_closes_stdin_even_when_parent_stdin_pipe_is_open() {
+        use std::io::Read;
+        use std::time::{Duration, Instant};
+
+        let mut child = Command::new(std::env::current_exe().unwrap())
+            .arg("stdin_probe_parent_child")
+            .arg("--ignored")
+            .arg("--nocapture")
+            .env("TOLARIA_STDIN_PROBE_CHILD", "1")
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+        let child_stdin = child.stdin.take().unwrap();
+        let mut stdout = child.stdout.take().unwrap();
+        let mut stderr = child.stderr.take().unwrap();
+        let deadline = Instant::now() + Duration::from_secs(5);
+
+        let status = loop {
+            if let Some(status) = child.try_wait().unwrap() {
+                break status;
+            }
+            if Instant::now() >= deadline {
+                child.kill().unwrap();
+                drop(child_stdin);
+                panic!("stdin probe child timed out");
+            }
+            std::thread::sleep(Duration::from_millis(10));
+        };
+
+        drop(child_stdin);
+        let mut stdout_text = String::new();
+        let mut stderr_text = String::new();
+        stdout.read_to_string(&mut stdout_text).unwrap();
+        stderr.read_to_string(&mut stderr_text).unwrap();
+
+        assert!(
+            status.success(),
+            "stdin probe child failed with {status}\nstdout:\n{stdout_text}\nstderr:\n{stderr_text}"
+        );
+    }
+
+    #[ignore = "spawned by run_subprocess_closes_stdin_even_when_parent_stdin_pipe_is_open"]
+    #[test]
+    fn stdin_probe_parent_child() {
+        if std::env::var_os("TOLARIA_STDIN_PROBE_CHILD").is_none() {
+            return;
+        }
+
+        let fake_bin = std::env::current_exe().unwrap();
+        let args = vec![
+            "stdin_probe_mock_claude_child".to_string(),
+            "--ignored".to_string(),
+            "--nocapture".to_string(),
+        ];
+        std::env::set_var("TOLARIA_STDIN_PROBE_MOCK_CLAUDE_CHILD", "1");
+        let mut events = vec![];
+        let result = run_claude_subprocess(&fake_bin, &args, None, &mut |event| events.push(event));
+        std::env::remove_var("TOLARIA_STDIN_PROBE_MOCK_CLAUDE_CHILD");
+
+        assert_eq!(result.unwrap(), "stdin-ok");
+        assert!(matches!(
+            events.first(),
+            Some(ClaudeStreamEvent::Result { text, session_id })
+                if text == "stdin closed" && session_id == "stdin-ok"
+        ));
+        assert!(matches!(events.last(), Some(ClaudeStreamEvent::Done)));
+    }
+
+    #[ignore = "spawned by stdin_probe_parent_child"]
+    #[test]
+    fn stdin_probe_mock_claude_child() {
+        if std::env::var_os("TOLARIA_STDIN_PROBE_MOCK_CLAUDE_CHILD").is_none() {
+            return;
+        }
+
+        use std::io::Read;
+
+        let mut stdin = String::new();
+        std::io::stdin().read_to_string(&mut stdin).unwrap();
+        assert!(stdin.is_empty(), "stdin was not EOF");
+        println!(
+            "{}",
+            serde_json::json!({
+                "type": "result",
+                "result": "stdin closed",
+                "session_id": "stdin-ok"
+            })
+        );
+    }
+
     #[cfg(unix)]
     #[test]
     fn run_subprocess_skips_blank_and_non_json_lines() {
@@ -1046,11 +1203,16 @@ mod tests {
             assert!(args.contains(&"-p".to_string()));
             assert!(args.contains(&"create note".to_string()));
             assert!(args.contains(&"--mcp-config".to_string()));
-            assert!(args.contains(&"--dangerously-skip-permissions".to_string()));
+            assert!(args.contains(&"--strict-mcp-config".to_string()));
+            assert!(args.contains(&"--permission-mode".to_string()));
+            assert!(args.contains(&"acceptEdits".to_string()));
+            assert!(args.contains(&"--tools".to_string()));
+            assert!(args.contains(&"Read,Edit,MultiEdit,Write,Glob,Grep,LS".to_string()));
+            assert!(!args.contains(&"--dangerously-skip-permissions".to_string()));
+            assert!(!args.contains(&"bypassPermissions".to_string()));
+            assert!(!args.contains(&"Bash".to_string()));
             assert!(args.contains(&"--no-session-persistence".to_string()));
             assert!(!args.contains(&"--append-system-prompt".to_string()));
-            // Native tools must NOT be disabled
-            assert!(!args.contains(&"--tools".to_string()));
         }
     }
 
@@ -1099,6 +1261,45 @@ mod tests {
         }
     }
 
+    #[test]
+    fn claude_binary_candidates_include_windows_exe_installs() {
+        let home = PathBuf::from(r"C:\Users\alex");
+        let candidates = claude_binary_candidates_for_home(&home);
+        let expected = [
+            home.join(".local/bin/claude.exe"),
+            home.join(".claude/local/claude.exe"),
+            home.join("AppData/Roaming/npm/claude.cmd"),
+        ];
+
+        for candidate in expected {
+            assert!(
+                candidates.contains(&candidate),
+                "missing {}",
+                candidate.display()
+            );
+        }
+    }
+
+    #[test]
+    fn claude_path_lookup_command_matches_current_platform() {
+        let expected = if cfg!(windows) { "where" } else { "which" };
+
+        assert_eq!(claude_path_lookup_command(), expected);
+    }
+
+    #[test]
+    fn find_existing_binary_finds_windows_exe_candidate() {
+        let dir = tempfile::tempdir().unwrap();
+        let claude = dir.path().join(".local/bin/claude.exe");
+        std::fs::create_dir_all(claude.parent().unwrap()).unwrap();
+        std::fs::write(&claude, "").unwrap();
+
+        assert_eq!(
+            find_existing_binary(claude_binary_candidates_for_home(dir.path())),
+            Some(claude)
+        );
+    }
+
     #[test]
     fn find_claude_binary_returns_result() {
         let result = find_claude_binary();

src-tauri/src/commands/ai.rs

@@ -1,6 +1,6 @@
 #[cfg(desktop)]
 use crate::ai_agents::{AiAgentStreamRequest, AiAgentsStatus};
-use crate::claude_cli::{AgentStreamRequest, ChatStreamRequest, ClaudeCliStatus};
+use crate::claude_cli::{ChatStreamRequest, ClaudeCliStatus};
 use crate::vault::VaultAiGuidanceStatus;
 
 use super::expand_tilde;
@@ -81,14 +81,6 @@ define_desktop_stream_command!(
     crate::claude_cli::run_chat_stream
 );
 
-#[cfg(desktop)]
-define_desktop_stream_command!(
-    stream_claude_agent,
-    AgentStreamRequest,
-    "claude-agent-stream",
-    crate::claude_cli::run_agent_stream
-);
-
 #[cfg(desktop)]
 define_desktop_stream_command!(
     stream_ai_agent,
@@ -120,6 +112,14 @@ pub fn get_ai_agents_status() -> AiAgentsStatus {
             installed: false,
             version: None,
         },
+        opencode: crate::ai_agents::AiAgentAvailability {
+            installed: false,
+            version: None,
+        },
+        pi: crate::ai_agents::AiAgentAvailability {
+            installed: false,
+            version: None,
+        },
     }
 }
 
@@ -132,15 +132,6 @@ pub async fn stream_claude_chat(
     Err("Claude CLI is not available on mobile".into())
 }
 
-#[cfg(mobile)]
-#[tauri::command]
-pub async fn stream_claude_agent(
-    _app_handle: tauri::AppHandle,
-    _request: AgentStreamRequest,
-) -> Result<String, String> {
-    Err("Claude CLI is not available on mobile".into())
-}
-
 #[cfg(mobile)]
 #[tauri::command]
 pub async fn stream_ai_agent(
@@ -149,3 +140,31 @@ pub async fn stream_ai_agent(
 ) -> Result<String, String> {
     Err("CLI AI agents are not available on mobile".into())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::vault::AiGuidanceFileState;
+
+    #[test]
+    fn guidance_commands_report_and_restore_vault_guidance_files() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let vault_path = dir.path().to_string_lossy().to_string();
+
+        let initial = get_vault_ai_guidance_status(vault_path.clone()).unwrap();
+        assert_eq!(initial.agents_state, AiGuidanceFileState::Missing);
+        assert_eq!(initial.claude_state, AiGuidanceFileState::Missing);
+        assert_eq!(initial.gemini_state, AiGuidanceFileState::Missing);
+        assert!(initial.can_restore);
+
+        let restored = restore_vault_ai_guidance(vault_path.clone()).unwrap();
+        assert_eq!(restored.agents_state, AiGuidanceFileState::Managed);
+        assert_eq!(restored.claude_state, AiGuidanceFileState::Managed);
+        assert_eq!(restored.gemini_state, AiGuidanceFileState::Managed);
+        assert!(!restored.can_restore);
+
+        assert!(dir.path().join("AGENTS.md").exists());
+        assert!(dir.path().join("CLAUDE.md").exists());
+        assert!(dir.path().join("GEMINI.md").exists());
+    }
+}

src-tauri/src/commands/delete.rs

@@ -13,3 +13,32 @@ pub async fn batch_delete_notes_async(
         .await
         .map_err(|e| format!("Task panicked: {e}"))?
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn batch_delete_notes_async_validates_and_deletes_inside_vault() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let first = dir.path().join("first.md");
+        let second = dir.path().join("nested/second.md");
+        std::fs::create_dir_all(second.parent().unwrap()).unwrap();
+        std::fs::write(&first, "# First\n").unwrap();
+        std::fs::write(&second, "# Second\n").unwrap();
+
+        let deleted = batch_delete_notes_async(
+            vec![
+                first.to_string_lossy().to_string(),
+                "nested/second.md".to_string(),
+            ],
+            Some(dir.path().to_string_lossy().to_string()),
+        )
+        .await
+        .unwrap();
+
+        assert_eq!(deleted.len(), 2);
+        assert!(!first.exists());
+        assert!(!second.exists());
+    }
+}

src-tauri/src/commands/folders.rs

@@ -21,3 +21,30 @@ pub fn delete_vault_folder(vault_path: String, folder_path: String) -> Result<St
     let vault_path = expand_tilde(&vault_path);
     vault::delete_folder(std::path::Path::new(vault_path.as_ref()), &folder_path)
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn folder_commands_route_through_vault_path_boundary() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let vault_path = dir.path().to_string_lossy().to_string();
+        let folder = dir.path().join("Inbox");
+        std::fs::create_dir(&folder).unwrap();
+        std::fs::write(folder.join("note.md"), "# Note\n").unwrap();
+
+        let renamed = rename_vault_folder(
+            vault_path.clone(),
+            "Inbox".to_string(),
+            "Organized".to_string(),
+        )
+        .unwrap();
+        assert!(renamed.new_path.ends_with("Organized"));
+        assert!(dir.path().join("Organized/note.md").exists());
+
+        let deleted = delete_vault_folder(vault_path, "Organized".to_string()).unwrap();
+        assert_eq!(deleted, "Organized");
+        assert!(!dir.path().join("Organized").exists());
+    }
+}

src-tauri/src/commands/git.rs

@@ -5,11 +5,22 @@ use crate::git::{
 
 use super::expand_tilde;
 
+type VaultPathArg = String;
+type NotePathArg = String;
+type CommitHashArg = String;
+type CommitMessageArg = String;
+type ConflictStrategyArg = String;
+type RemoteUrlArg = String;
+type LocalPathArg = String;
+
 // ── Git commands (desktop) ──────────────────────────────────────────────────
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_file_history(vault_path: String, path: String) -> Result<Vec<GitCommit>, String> {
+pub fn get_file_history(
+    vault_path: VaultPathArg,
+    path: NotePathArg,
+) -> Result<Vec<GitCommit>, String> {
     let vault_path = expand_tilde(&vault_path);
     let path = expand_tilde(&path);
     crate::git::get_file_history(&vault_path, &path)
@@ -17,14 +28,14 @@ pub fn get_file_history(vault_path: String, path: String) -> Result<Vec<GitCommi
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_modified_files(vault_path: String) -> Result<Vec<ModifiedFile>, String> {
+pub fn get_modified_files(vault_path: VaultPathArg) -> Result<Vec<ModifiedFile>, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::get_modified_files(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_file_diff(vault_path: String, path: String) -> Result<String, String> {
+pub fn get_file_diff(vault_path: VaultPathArg, path: NotePathArg) -> Result<String, String> {
     let vault_path = expand_tilde(&vault_path);
     let path = expand_tilde(&path);
     crate::git::get_file_diff(&vault_path, &path)
@@ -33,9 +44,9 @@ pub fn get_file_diff(vault_path: String, path: String) -> Result<String, String>
 #[cfg(desktop)]
 #[tauri::command]
 pub fn get_file_diff_at_commit(
-    vault_path: String,
-    path: String,
-    commit_hash: String,
+    vault_path: VaultPathArg,
+    path: NotePathArg,
+    commit_hash: CommitHashArg,
 ) -> Result<String, String> {
     let vault_path = expand_tilde(&vault_path);
     let path = expand_tilde(&path);
@@ -45,7 +56,7 @@ pub fn get_file_diff_at_commit(
 #[cfg(desktop)]
 #[tauri::command]
 pub fn get_vault_pulse(
-    vault_path: String,
+    vault_path: VaultPathArg,
     limit: Option<usize>,
     skip: Option<usize>,
 ) -> Result<Vec<PulseCommit>, String> {
@@ -57,21 +68,21 @@ pub fn get_vault_pulse(
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn git_commit(vault_path: String, message: String) -> Result<String, String> {
+pub fn git_commit(vault_path: VaultPathArg, message: CommitMessageArg) -> Result<String, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::git_commit(&vault_path, &message)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_last_commit_info(vault_path: String) -> Result<Option<LastCommitInfo>, String> {
+pub fn get_last_commit_info(vault_path: VaultPathArg) -> Result<Option<LastCommitInfo>, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::get_last_commit_info(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub async fn git_pull(vault_path: String) -> Result<GitPullResult, String> {
+pub async fn git_pull(vault_path: VaultPathArg) -> Result<GitPullResult, String> {
     let vault_path = expand_tilde(&vault_path).into_owned();
     tokio::task::spawn_blocking(move || crate::git::git_pull(&vault_path))
         .await
@@ -80,14 +91,14 @@ pub async fn git_pull(vault_path: String) -> Result<GitPullResult, String> {
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_conflict_files(vault_path: String) -> Result<Vec<String>, String> {
+pub fn get_conflict_files(vault_path: VaultPathArg) -> Result<Vec<String>, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::get_conflict_files(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn get_conflict_mode(vault_path: String) -> String {
+pub fn get_conflict_mode(vault_path: VaultPathArg) -> String {
     let vault_path = expand_tilde(&vault_path);
     crate::git::get_conflict_mode(&vault_path)
 }
@@ -95,9 +106,9 @@ pub fn get_conflict_mode(vault_path: String) -> String {
 #[cfg(desktop)]
 #[tauri::command]
 pub fn git_resolve_conflict(
-    vault_path: String,
-    file: String,
-    strategy: String,
+    vault_path: VaultPathArg,
+    file: NotePathArg,
+    strategy: ConflictStrategyArg,
 ) -> Result<(), String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::git_resolve_conflict(&vault_path, &file, &strategy)
@@ -105,14 +116,14 @@ pub fn git_resolve_conflict(
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn git_commit_conflict_resolution(vault_path: String) -> Result<String, String> {
+pub fn git_commit_conflict_resolution(vault_path: VaultPathArg) -> Result<String, String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::git_commit_conflict_resolution(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub async fn git_push(vault_path: String) -> Result<GitPushResult, String> {
+pub async fn git_push(vault_path: VaultPathArg) -> Result<GitPushResult, String> {
     let vault_path = expand_tilde(&vault_path).into_owned();
     tokio::task::spawn_blocking(move || crate::git::git_push(&vault_path))
         .await
@@ -121,7 +132,7 @@ pub async fn git_push(vault_path: String) -> Result<GitPushResult, String> {
 
 #[cfg(desktop)]
 #[tauri::command]
-pub async fn git_remote_status(vault_path: String) -> Result<GitRemoteStatus, String> {
+pub async fn git_remote_status(vault_path: VaultPathArg) -> Result<GitRemoteStatus, String> {
     let vault_path = expand_tilde(&vault_path).into_owned();
     tokio::task::spawn_blocking(move || crate::git::git_remote_status(&vault_path))
         .await
@@ -130,30 +141,85 @@ pub async fn git_remote_status(vault_path: String) -> Result<GitRemoteStatus, St
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn git_discard_file(vault_path: String, relative_path: String) -> Result<(), String> {
+pub fn git_discard_file(
+    vault_path: VaultPathArg,
+    relative_path: NotePathArg,
+) -> Result<(), String> {
     let vault_path = expand_tilde(&vault_path);
     crate::git::discard_file_changes(&vault_path, &relative_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn is_git_repo(vault_path: String) -> bool {
+pub fn is_git_repo(vault_path: VaultPathArg) -> bool {
     let vault_path = expand_tilde(&vault_path);
     std::path::Path::new(vault_path.as_ref())
         .join(".git")
         .is_dir()
 }
 
+#[cfg(desktop)]
+fn validate_git_init_target(vault_path: &str) -> Result<(), String> {
+    let path = std::path::Path::new(vault_path);
+    if !path.exists() {
+        return Err("Choose an existing vault folder before initializing Git".to_string());
+    }
+    if !path.is_dir() {
+        return Err("Choose a folder before initializing Git".to_string());
+    }
+
+    if is_broad_personal_folder(path) && !has_tolaria_vault_marker(path) {
+        return Err(format!(
+            "Choose a dedicated vault folder before initializing Git. '{}' looks like a broad personal folder; create or select a subfolder such as '{}' instead.",
+            path.display(),
+            path.join("Tolaria").display()
+        ));
+    }
+
+    Ok(())
+}
+
+#[cfg(desktop)]
+fn is_broad_personal_folder(path: &std::path::Path) -> bool {
+    let Some(name) = path.file_name().and_then(|name| name.to_str()) else {
+        return false;
+    };
+
+    matches!(
+        name.to_ascii_lowercase().as_str(),
+        "desktop"
+            | "documents"
+            | "downloads"
+            | "movies"
+            | "music"
+            | "pictures"
+            | "public"
+            | "templates"
+            | "videos"
+    )
+}
+
+#[cfg(desktop)]
+fn has_tolaria_vault_marker(path: &std::path::Path) -> bool {
+    ["AGENTS.md", "CLAUDE.md", "type.md", "note.md"]
+        .iter()
+        .any(|file| path.join(file).is_file())
+        || ["attachments", "type", "views"]
+            .iter()
+            .any(|dir| path.join(dir).is_dir())
+}
+
 #[cfg(desktop)]
 #[tauri::command]
-pub fn init_git_repo(vault_path: String) -> Result<(), String> {
+pub fn init_git_repo(vault_path: VaultPathArg) -> Result<(), String> {
     let vault_path = expand_tilde(&vault_path);
+    validate_git_init_target(&vault_path)?;
     crate::git::init_repo(&vault_path)
 }
 
 #[cfg(desktop)]
 #[tauri::command]
-pub fn clone_repo(url: String, local_path: String) -> Result<String, String> {
+pub fn clone_repo(url: RemoteUrlArg, local_path: LocalPathArg) -> Result<String, String> {
     let local_path = expand_tilde(&local_path);
     crate::git::clone_repo(&url, &local_path)
 }
@@ -162,28 +228,31 @@ pub fn clone_repo(url: String, local_path: String) -> Result<String, String> {
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_file_history(_vault_path: String, _path: String) -> Result<Vec<GitCommit>, String> {
+pub fn get_file_history(
+    _vault_path: VaultPathArg,
+    _path: NotePathArg,
+) -> Result<Vec<GitCommit>, String> {
     Err("Git history is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_modified_files(_vault_path: String) -> Result<Vec<ModifiedFile>, String> {
+pub fn get_modified_files(_vault_path: VaultPathArg) -> Result<Vec<ModifiedFile>, String> {
     Ok(vec![])
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_file_diff(_vault_path: String, _path: String) -> Result<String, String> {
+pub fn get_file_diff(_vault_path: VaultPathArg, _path: NotePathArg) -> Result<String, String> {
     Err("Git diff is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
 pub fn get_file_diff_at_commit(
-    _vault_path: String,
-    _path: String,
-    _commit_hash: String,
+    _vault_path: VaultPathArg,
+    _path: NotePathArg,
+    _commit_hash: CommitHashArg,
 ) -> Result<String, String> {
     Err("Git diff is not available on mobile".into())
 }
@@ -191,7 +260,7 @@ pub fn get_file_diff_at_commit(
 #[cfg(mobile)]
 #[tauri::command]
 pub fn get_vault_pulse(
-    _vault_path: String,
+    _vault_path: VaultPathArg,
     _limit: Option<usize>,
     _skip: Option<usize>,
 ) -> Result<Vec<PulseCommit>, String> {
@@ -200,59 +269,59 @@ pub fn get_vault_pulse(
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn git_commit(_vault_path: String, _message: String) -> Result<String, String> {
+pub fn git_commit(_vault_path: VaultPathArg, _message: CommitMessageArg) -> Result<String, String> {
     Err("Git commit is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_last_commit_info(_vault_path: String) -> Result<Option<LastCommitInfo>, String> {
+pub fn get_last_commit_info(_vault_path: VaultPathArg) -> Result<Option<LastCommitInfo>, String> {
     Ok(None)
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub async fn git_pull(_vault_path: String) -> Result<GitPullResult, String> {
+pub async fn git_pull(_vault_path: VaultPathArg) -> Result<GitPullResult, String> {
     Err("Git pull is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_conflict_files(_vault_path: String) -> Result<Vec<String>, String> {
+pub fn get_conflict_files(_vault_path: VaultPathArg) -> Result<Vec<String>, String> {
     Ok(vec![])
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn get_conflict_mode(_vault_path: String) -> String {
+pub fn get_conflict_mode(_vault_path: VaultPathArg) -> String {
     "none".to_string()
 }
 
 #[cfg(mobile)]
 #[tauri::command]
 pub fn git_resolve_conflict(
-    _vault_path: String,
-    _file: String,
-    _strategy: String,
+    _vault_path: VaultPathArg,
+    _file: NotePathArg,
+    _strategy: ConflictStrategyArg,
 ) -> Result<(), String> {
     Err("Git conflict resolution is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn git_commit_conflict_resolution(_vault_path: String) -> Result<String, String> {
+pub fn git_commit_conflict_resolution(_vault_path: VaultPathArg) -> Result<String, String> {
     Err("Git conflict resolution is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub async fn git_push(_vault_path: String) -> Result<GitPushResult, String> {
+pub async fn git_push(_vault_path: VaultPathArg) -> Result<GitPushResult, String> {
     Err("Git push is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub async fn git_remote_status(_vault_path: String) -> Result<GitRemoteStatus, String> {
+pub async fn git_remote_status(_vault_path: VaultPathArg) -> Result<GitRemoteStatus, String> {
     Ok(GitRemoteStatus {
         branch: String::new(),
         has_remote: false,
@@ -263,24 +332,139 @@ pub async fn git_remote_status(_vault_path: String) -> Result<GitRemoteStatus, S
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn git_discard_file(_vault_path: String, _relative_path: String) -> Result<(), String> {
+pub fn git_discard_file(
+    _vault_path: VaultPathArg,
+    _relative_path: NotePathArg,
+) -> Result<(), String> {
     Err("Git discard is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn is_git_repo(_vault_path: String) -> bool {
+pub fn is_git_repo(_vault_path: VaultPathArg) -> bool {
     false
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn init_git_repo(_vault_path: String) -> Result<(), String> {
+pub fn init_git_repo(_vault_path: VaultPathArg) -> Result<(), String> {
     Err("Git init is not available on mobile".into())
 }
 
 #[cfg(mobile)]
 #[tauri::command]
-pub fn clone_repo(_url: String, _local_path: String) -> Result<String, String> {
+pub fn clone_repo(_url: RemoteUrlArg, _local_path: LocalPathArg) -> Result<String, String> {
     Err("Git clone is not available on mobile".into())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use tempfile::TempDir;
+
+    fn vault_path(dir: &TempDir) -> String {
+        dir.path().to_string_lossy().into_owned()
+    }
+
+    fn note_path(dir: &TempDir, name: &str) -> String {
+        dir.path().join(name).to_string_lossy().into_owned()
+    }
+
+    fn create_initialized_vault() -> (TempDir, String) {
+        let dir = TempDir::new().unwrap();
+        fs::write(dir.path().join("note.md"), "# Note\n").unwrap();
+        let vault = vault_path(&dir);
+        init_git_repo(vault.clone()).unwrap();
+        (dir, vault)
+    }
+
+    #[test]
+    fn desktop_git_commands_route_to_git_backend() {
+        let (dir, vault) = create_initialized_vault();
+        let note = note_path(&dir, "note.md");
+
+        assert!(is_git_repo(vault.clone()));
+
+        fs::write(dir.path().join("note.md"), "# Updated\n").unwrap();
+        let modified = get_modified_files(vault.clone()).unwrap();
+        assert!(modified.iter().any(|file| file.relative_path == "note.md"));
+
+        let diff = get_file_diff(vault.clone(), note.clone()).unwrap();
+        assert!(diff.contains("# Updated"));
+
+        git_commit(vault.clone(), "Update note".to_string()).unwrap();
+        let history = get_file_history(vault.clone(), note.clone()).unwrap();
+        assert!(history.iter().any(|commit| commit.message == "Update note"));
+
+        let last_commit = get_last_commit_info(vault.clone()).unwrap().unwrap();
+        assert!(!last_commit.short_hash.is_empty());
+
+        let commit_diff = get_file_diff_at_commit(
+            vault.clone(),
+            note.clone(),
+            history.first().unwrap().hash.clone(),
+        )
+        .unwrap();
+        assert!(commit_diff.contains("# Updated"));
+
+        let pulse = get_vault_pulse(vault.clone(), Some(5), Some(0)).unwrap();
+        assert!(!pulse.is_empty());
+
+        fs::write(dir.path().join("note.md"), "# Discard me\n").unwrap();
+        git_discard_file(vault.clone(), "note.md".to_string()).unwrap();
+        assert_eq!(
+            fs::read_to_string(dir.path().join("note.md")).unwrap(),
+            "# Updated\n"
+        );
+
+        assert!(get_conflict_files(vault.clone()).unwrap().is_empty());
+        assert_eq!(get_conflict_mode(vault.clone()), "none");
+        assert!(
+            git_resolve_conflict(vault.clone(), "note.md".to_string(), "invalid".to_string(),)
+                .is_err()
+        );
+    }
+
+    #[test]
+    fn init_git_repo_rejects_broad_personal_folders() {
+        let dir = TempDir::new().unwrap();
+        let documents = dir.path().join("Documents");
+        fs::create_dir_all(&documents).unwrap();
+        fs::write(documents.join("unrelated.txt"), "not a vault").unwrap();
+
+        let err = init_git_repo(documents.to_string_lossy().into_owned())
+            .expect_err("expected Documents itself to be rejected before git init");
+
+        assert!(err.contains("dedicated vault folder"));
+        assert!(!documents.join(".git").exists());
+    }
+
+    #[test]
+    fn init_git_repo_allows_named_vault_subfolder_under_documents() {
+        let dir = TempDir::new().unwrap();
+        let vault = dir.path().join("Documents").join("Tolaria");
+        fs::create_dir_all(&vault).unwrap();
+        fs::write(vault.join("note.md"), "# Note\n").unwrap();
+        let vault = vault.to_string_lossy().into_owned();
+
+        init_git_repo(vault.clone()).unwrap();
+
+        assert!(is_git_repo(vault));
+    }
+
+    #[tokio::test]
+    async fn desktop_remote_commands_report_no_remote() {
+        let (_dir, vault) = create_initialized_vault();
+
+        let pull = git_pull(vault.clone()).await.unwrap();
+        assert_eq!(pull.status, "no_remote");
+
+        let push = git_push(vault.clone()).await.unwrap();
+        assert_eq!(push.status, "error");
+
+        let status = git_remote_status(vault.clone()).await.unwrap();
+        assert!(!status.has_remote);
+        assert_eq!((status.ahead, status.behind), (0, 0));
+    }
+}

src-tauri/src/commands/git_clone.rs

@@ -0,0 +1,18 @@
+use super::expand_tilde;
+
+#[cfg(desktop)]
+#[tauri::command]
+pub async fn clone_git_repo(url: String, local_path: String) -> Result<String, String> {
+    let url = url.trim().to_string();
+    let local_path = expand_tilde(&local_path).into_owned();
+
+    tokio::task::spawn_blocking(move || super::git::clone_repo(url, local_path))
+        .await
+        .map_err(|e| format!("Task panicked: {e}"))?
+}
+
+#[cfg(mobile)]
+#[tauri::command]
+pub async fn clone_git_repo(_url: String, _local_path: String) -> Result<String, String> {
+    Err("Git clone is not available on mobile".into())
+}

src-tauri/src/commands/mod.rs

@@ -2,6 +2,7 @@ mod ai;
 mod delete;
 mod folders;
 mod git;
+pub mod git_clone;
 mod git_connect;
 mod system;
 mod vault;

src-tauri/src/commands/system.rs

@@ -131,6 +131,31 @@ pub async fn check_mcp_status(vault_path: String) -> Result<crate::mcp::McpStatu
         .map_err(|e| format!("MCP status check failed: {e}"))
 }
 
+#[cfg(desktop)]
+#[tauri::command]
+pub async fn get_mcp_config_snippet(vault_path: String) -> Result<String, String> {
+    let vault_path = super::expand_tilde(&vault_path).into_owned();
+    tokio::task::spawn_blocking(move || crate::mcp::mcp_config_snippet(&vault_path))
+        .await
+        .map_err(|e| format!("MCP config task failed: {e}"))?
+}
+
+#[cfg(desktop)]
+#[tauri::command]
+pub async fn sync_mcp_bridge_vault(
+    app: tauri::AppHandle,
+    vault_path: Option<String>,
+) -> Result<String, String> {
+    let expanded_vault_path = vault_path
+        .as_deref()
+        .map(str::trim)
+        .filter(|path| !path.is_empty())
+        .map(|path| super::expand_tilde(path).into_owned());
+    let vault_path = expanded_vault_path.as_deref().map(std::path::Path::new);
+
+    crate::sync_ws_bridge_for_vault(&app, vault_path).map(str::to_string)
+}
+
 // ── MCP commands (mobile stubs) ─────────────────────────────────────────────
 
 #[cfg(mobile)]
@@ -151,6 +176,18 @@ pub async fn check_mcp_status(_vault_path: String) -> Result<crate::mcp::McpStat
     Ok(crate::mcp::McpStatus::NotInstalled)
 }
 
+#[cfg(mobile)]
+#[tauri::command]
+pub async fn get_mcp_config_snippet(_vault_path: String) -> Result<String, String> {
+    Err("MCP is not available on mobile".into())
+}
+
+#[cfg(mobile)]
+#[tauri::command]
+pub async fn sync_mcp_bridge_vault(_vault_path: Option<String>) -> Result<String, String> {
+    Err("MCP is not available on mobile".into())
+}
+
 // ── Menu commands ───────────────────────────────────────────────────────────
 
 #[derive(Debug, Deserialize)]
@@ -162,6 +199,7 @@ pub struct MenuStateUpdate {
     has_restorable_deleted_note: Option<bool>,
     has_no_remote: Option<bool>,
     note_list_search_enabled: Option<bool>,
+    editor_find_enabled: Option<bool>,
 }
 
 #[cfg(desktop)]
@@ -186,6 +224,9 @@ pub fn update_menu_state(
     if let Some(v) = state.note_list_search_enabled {
         menu::set_note_list_search_items_enabled(&app_handle, v);
     }
+    if let Some(v) = state.editor_find_enabled {
+        menu::set_editor_find_items_enabled(&app_handle, v);
+    }
     Ok(())
 }
 

src-tauri/src/commands/vault.rs

@@ -31,6 +31,47 @@ mod tests {
         Some(vault_path.to_string_lossy().to_string())
     }
 
+    fn assert_note_write_rejects_escape<T: std::fmt::Debug>(
+        action: impl FnOnce(std::path::PathBuf, String, Option<std::path::PathBuf>) -> Result<T, String>,
+    ) {
+        let dir = tempfile::TempDir::new().unwrap();
+        let vault_path = dir.path();
+        let escape_path = vault_path.join("../outside.md");
+
+        let err = action(
+            escape_path,
+            "# Outside\n".to_string(),
+            vault_path_arg(vault_path),
+        )
+        .expect_err("expected traversal write to be rejected");
+
+        assert_eq!(err, ACTIVE_VAULT_PATH_ERROR);
+    }
+
+    fn sample_view_definition() -> ViewDefinition {
+        ViewDefinition {
+            name: "Inbox".to_string(),
+            icon: None,
+            color: None,
+            sort: None,
+            list_properties_display: vec![],
+            filters: crate::vault::FilterGroup::All(vec![]),
+        }
+    }
+
+    fn assert_save_view_cmd_rejects_invalid_filename(filename: &str) {
+        let dir = tempfile::TempDir::new().unwrap();
+
+        let err = save_view_cmd(
+            dir.path().to_string_lossy().to_string(),
+            filename.to_string(),
+            sample_view_definition(),
+        )
+        .expect_err("expected invalid filename to be rejected");
+
+        assert_eq!(err, INVALID_VIEW_FILENAME_ERROR);
+    }
+
     fn temp_note(body: &str) -> (tempfile::TempDir, std::path::PathBuf) {
         let dir = tempfile::TempDir::new().unwrap();
         let note = dir.path().join("note.md");
@@ -125,34 +166,12 @@ mod tests {
 
     #[test]
     fn test_save_note_content_rejects_traversal_outside_active_vault() {
-        let dir = tempfile::TempDir::new().unwrap();
-        let vault_path = dir.path();
-        let escape_path = vault_path.join("../outside.md");
-
-        let err = save_note_content(
-            escape_path,
-            "# Outside\n".to_string(),
-            vault_path_arg(vault_path),
-        )
-        .expect_err("expected traversal write to be rejected");
-
-        assert_eq!(err, ACTIVE_VAULT_PATH_ERROR);
+        assert_note_write_rejects_escape(save_note_content);
     }
 
     #[test]
     fn test_create_note_content_rejects_traversal_outside_active_vault() {
-        let dir = tempfile::TempDir::new().unwrap();
-        let vault_path = dir.path();
-        let escape_path = vault_path.join("../outside.md");
-
-        let err = create_note_content(
-            escape_path,
-            "# Outside\n".to_string(),
-            vault_path_arg(vault_path),
-        )
-        .expect_err("expected traversal create to be rejected");
-
-        assert_eq!(err, ACTIVE_VAULT_PATH_ERROR);
+        assert_note_write_rejects_escape(create_note_content);
     }
 
     #[test]
@@ -166,25 +185,23 @@ mod tests {
     }
 
     #[test]
-    fn test_save_view_cmd_rejects_nested_filename() {
+    fn test_create_vault_folder_rejects_windows_invalid_names() {
         let dir = tempfile::TempDir::new().unwrap();
-        let definition = ViewDefinition {
-            name: "Inbox".to_string(),
-            icon: None,
-            color: None,
-            sort: None,
-            list_properties_display: vec![],
-            filters: crate::vault::FilterGroup::All(vec![]),
-        };
 
-        let err = save_view_cmd(
-            dir.path().to_string_lossy().to_string(),
-            "../escape.yml".to_string(),
-            definition,
-        )
-        .expect_err("expected nested filename to be rejected");
+        let err = create_vault_folder(dir.path().into(), "con".into())
+            .expect_err("expected Windows-invalid folder name to be rejected");
 
-        assert_eq!(err, INVALID_VIEW_FILENAME_ERROR);
+        assert_eq!(err, "Invalid folder name");
+    }
+
+    #[test]
+    fn test_save_view_cmd_rejects_nested_filename() {
+        assert_save_view_cmd_rejects_invalid_filename("../escape.yml");
+    }
+
+    #[test]
+    fn test_save_view_cmd_rejects_windows_invalid_filename() {
+        assert_save_view_cmd_rejects_invalid_filename("con.yml");
     }
 
     #[test]

src-tauri/src/commands/vault/boundary.rs

@@ -1,4 +1,5 @@
 use crate::commands::expand_tilde;
+use crate::vault::filename_rules::validate_view_filename_stem;
 use crate::vault_list;
 use std::ffi::OsString;
 use std::path::{Component, Path, PathBuf};
@@ -199,7 +200,11 @@ pub(crate) fn validate_view_filename(filename: &str) -> Result<(), String> {
     let path = Path::new(filename);
     let mut components = path.components();
     match (components.next(), components.next()) {
-        (Some(Component::Normal(_)), None) => Ok(()),
+        (Some(Component::Normal(value)), None) => {
+            let stem = value.to_string_lossy();
+            let stem = stem.strip_suffix(".yml").unwrap_or(&stem);
+            validate_view_filename_stem(stem)
+        }
         _ => Err(INVALID_VIEW_FILENAME_ERROR.to_string()),
     }
 }

src-tauri/src/commands/vault/file_cmds.rs

@@ -1,4 +1,5 @@
 use crate::commands::expand_tilde;
+use crate::vault::filename_rules::validate_folder_name;
 use crate::vault::{self, FolderNode, VaultEntry};
 use std::path::{Path, PathBuf};
 
@@ -39,6 +40,41 @@ fn with_requested_root_path<T>(
     with_requested_root(raw_vault_path.as_ref(), action)
 }
 
+fn sync_image_asset_scope(
+    app_handle: &tauri::AppHandle,
+    requested_root: &str,
+) -> Result<(), String> {
+    #[cfg(desktop)]
+    crate::sync_vault_asset_scope(app_handle, Path::new(requested_root))?;
+    #[cfg(not(desktop))]
+    let _ = requested_root;
+    #[cfg(not(desktop))]
+    let _ = app_handle;
+    Ok(())
+}
+
+fn with_image_asset_scope(
+    app_handle: &tauri::AppHandle,
+    vault_path: &Path,
+    action: impl FnOnce(&str) -> Result<String, String>,
+) -> Result<String, String> {
+    with_requested_root_path(vault_path, |requested_root| {
+        let saved_path = action(requested_root)?;
+        sync_image_asset_scope(app_handle, requested_root)?;
+        Ok(saved_path)
+    })
+}
+
+#[tauri::command]
+pub fn sync_vault_asset_scope_for_window(
+    app_handle: tauri::AppHandle,
+    vault_path: PathBuf,
+) -> Result<(), String> {
+    with_requested_root_path(vault_path.as_path(), |requested_root| {
+        sync_image_asset_scope(&app_handle, requested_root)
+    })
+}
+
 fn with_writable_note_path<T>(
     path: PathBuf,
     vault_path: Option<PathBuf>,
@@ -114,6 +150,7 @@ pub fn create_vault_folder(vault_path: PathBuf, folder_name: PathBuf) -> Result<
     with_boundary(Some(raw_vault_path.as_ref()), |boundary| {
         let folder_name = folder_name.to_string_lossy();
         let folder_path = boundary.child_path(folder_name.as_ref())?;
+        validate_folder_name(folder_name.as_ref())?;
         ensure_missing_folder(&folder_path, folder_name.as_ref())?;
         std::fs::create_dir_all(&folder_path)
             .map_err(|e| format!("Failed to create folder: {}", e))?;
@@ -128,6 +165,24 @@ fn ensure_missing_folder(folder_path: &Path, folder_name: &str) -> Result<(), St
     Ok(())
 }
 
+fn scan_visible_vault_entries(vault_path: &Path) -> Result<Vec<VaultEntry>, String> {
+    let entries = vault::scan_vault_cached(vault_path)?;
+    Ok(vault::filter_gitignored_entries(
+        vault_path,
+        entries,
+        crate::settings::hide_gitignored_files_enabled(),
+    ))
+}
+
+fn scan_visible_vault_folders(vault_path: &Path) -> Result<Vec<FolderNode>, String> {
+    let folders = vault::scan_vault_folders(vault_path)?;
+    Ok(vault::filter_gitignored_folders(
+        vault_path,
+        folders,
+        crate::settings::hide_gitignored_files_enabled(),
+    ))
+}
+
 /// Sync the `title` frontmatter field with the filename on note open.
 /// Returns `true` if the file was modified (title was absent or desynced).
 #[tauri::command]
@@ -146,25 +201,144 @@ pub fn sync_note_title(path: PathBuf, vault_path: Option<PathBuf>) -> Result<boo
 }
 
 #[tauri::command]
-pub fn save_image(vault_path: PathBuf, filename: String, data: String) -> Result<String, String> {
-    with_requested_root_path(vault_path.as_path(), |requested_root| {
+pub fn save_image(
+    app_handle: tauri::AppHandle,
+    vault_path: PathBuf,
+    filename: String,
+    data: String,
+) -> Result<String, String> {
+    with_image_asset_scope(&app_handle, vault_path.as_path(), |requested_root| {
         vault::save_image(requested_root, &filename, &data)
     })
 }
 
 #[tauri::command]
-pub fn copy_image_to_vault(vault_path: PathBuf, source_path: PathBuf) -> Result<String, String> {
-    with_requested_root_path(vault_path.as_path(), |requested_root| {
+pub fn copy_image_to_vault(
+    app_handle: tauri::AppHandle,
+    vault_path: PathBuf,
+    source_path: PathBuf,
+) -> Result<String, String> {
+    with_image_asset_scope(&app_handle, vault_path.as_path(), |requested_root| {
         vault::copy_image_to_vault(requested_root, source_path.to_string_lossy().as_ref())
     })
 }
 
 #[tauri::command]
 pub fn list_vault(path: PathBuf) -> Result<Vec<VaultEntry>, String> {
-    with_expanded_vault_root(path.as_path(), vault::scan_vault_cached)
+    with_expanded_vault_root(path.as_path(), scan_visible_vault_entries)
 }
 
 #[tauri::command]
 pub fn list_vault_folders(path: PathBuf) -> Result<Vec<FolderNode>, String> {
-    with_expanded_vault_root(path.as_path(), vault::scan_vault_folders)
+    with_expanded_vault_root(path.as_path(), scan_visible_vault_folders)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use tempfile::TempDir;
+
+    fn vault_root(dir: &TempDir) -> PathBuf {
+        dir.path().to_path_buf()
+    }
+
+    fn note_path(dir: &TempDir, name: &str) -> PathBuf {
+        dir.path().join(name)
+    }
+
+    #[test]
+    fn note_content_commands_roundtrip_with_requested_vault() {
+        let dir = TempDir::new().unwrap();
+        let root = vault_root(&dir);
+        let note = note_path(&dir, "notes/command-note.md");
+
+        create_note_content(
+            note.clone(),
+            "# Command Note\n".to_string(),
+            Some(root.clone()),
+        )
+        .unwrap();
+        assert_eq!(
+            get_note_content(note.clone(), Some(root.clone())).unwrap(),
+            "# Command Note\n"
+        );
+
+        save_note_content(
+            note.clone(),
+            "---\ntitle: Command Note\n---\n# Command Note\nBody\n".to_string(),
+            Some(root.clone()),
+        )
+        .unwrap();
+        assert!(!sync_note_title(note.clone(), Some(root.clone())).unwrap());
+
+        save_note_content(
+            note.clone(),
+            "# Updated Command Note\n".to_string(),
+            Some(root.clone()),
+        )
+        .unwrap();
+        assert!(sync_note_title(note.clone(), Some(root.clone())).unwrap());
+        assert!(get_note_content(note, Some(root))
+            .unwrap()
+            .contains("title: Command Note"));
+    }
+
+    #[test]
+    fn note_content_commands_accept_windows_sensitive_valid_segments() {
+        let dir = TempDir::new().unwrap();
+        let root = vault_root(&dir);
+        let note = root
+            .join("@raflymln")
+            .join("notes with spaces")
+            .join("résumé note.md");
+
+        save_note_content(
+            note.clone(),
+            "# Windows-Sensitive Path\n\nBody\n".to_string(),
+            Some(root.clone()),
+        )
+        .unwrap();
+
+        assert_eq!(
+            get_note_content(note, Some(root)).unwrap(),
+            "# Windows-Sensitive Path\n\nBody\n"
+        );
+    }
+
+    #[test]
+    fn folder_and_listing_commands_use_expanded_vault_root() {
+        let dir = TempDir::new().unwrap();
+        let root = vault_root(&dir);
+        fs::write(dir.path().join("root.md"), "# Root\n").unwrap();
+
+        assert_eq!(
+            create_vault_folder(root.clone(), PathBuf::from("Projects")).unwrap(),
+            "Projects"
+        );
+        fs::write(dir.path().join("Projects/project.md"), "# Project\n").unwrap();
+
+        let entries = list_vault(root.clone()).unwrap();
+        assert!(entries.iter().any(|entry| entry.filename == "root.md"));
+        assert!(entries.iter().any(|entry| entry.filename == "project.md"));
+
+        let folders = list_vault_folders(root).unwrap();
+        assert!(folders.iter().any(|folder| folder.name == "Projects"));
+    }
+
+    #[test]
+    fn commands_reject_paths_outside_requested_vault() {
+        let vault = TempDir::new().unwrap();
+        let outside = TempDir::new().unwrap();
+        let outside_note = outside.path().join("outside.md");
+        fs::write(&outside_note, "# Outside\n").unwrap();
+
+        let error = get_note_content(outside_note, Some(vault.path().to_path_buf())).unwrap_err();
+        assert!(error.contains("Path must stay inside the active vault"));
+
+        let folder_error =
+            create_vault_folder(vault.path().to_path_buf(), PathBuf::from("../escape"))
+                .unwrap_err();
+        assert!(folder_error.contains("Path must stay inside the active vault"));
+    }
 }

src-tauri/src/commands/vault/lifecycle_cmds.rs

@@ -57,9 +57,11 @@ fn canonical_vault_path_string(vault_dir: &Path) -> String {
 }
 
 #[tauri::command]
-pub fn create_getting_started_vault(target_path: Option<String>) -> Result<String, String> {
+pub async fn create_getting_started_vault(target_path: Option<String>) -> Result<String, String> {
     let path = resolve_getting_started_target(target_path.as_deref())?;
-    vault::create_getting_started_vault(&path)
+    tokio::task::spawn_blocking(move || vault::create_getting_started_vault(&path))
+        .await
+        .map_err(|e| format!("Task panicked: {e}"))?
 }
 
 fn resolve_getting_started_target(target_path: Option<&str>) -> Result<String, String> {

src-tauri/src/commands/vault/rename_cmds.rs

@@ -17,12 +17,12 @@ pub fn rename_note(
         &vault_path,
         &old_path,
         |requested_root, validated_path| {
-            vault::rename_note(
-                requested_root,
-                validated_path,
-                &new_title,
-                old_title.as_deref(),
-            )
+            vault::rename_note(vault::RenameNoteRequest {
+                vault_path: requested_root,
+                old_path: validated_path,
+                new_title: &new_title,
+                old_title_hint: old_title.as_deref(),
+            })
         },
     )
 }
@@ -37,7 +37,11 @@ pub fn rename_note_filename(
         &vault_path,
         &old_path,
         |requested_root, validated_path| {
-            vault::rename_note_filename(requested_root, validated_path, &new_filename_stem)
+            vault::rename_note_filename(vault::RenameNoteFilenameRequest {
+                vault_path: requested_root,
+                old_path: validated_path,
+                new_filename_stem: &new_filename_stem,
+            })
         },
     )
 }
@@ -67,11 +71,11 @@ pub fn move_note_to_folder(
                     if !validated_folder.is_dir() {
                         return Err(format!("Folder does not exist: {}", trimmed_folder_path));
                     }
-                    vault::move_note_to_folder(
-                        requested_root,
-                        validated_path,
-                        validated_folder_path,
-                    )
+                    vault::move_note_to_folder(vault::MoveNoteToFolderRequest {
+                        vault_path: requested_root,
+                        old_path: validated_path,
+                        destination_folder_path: validated_folder_path,
+                    })
                 },
             )
         },
@@ -87,7 +91,10 @@ pub fn auto_rename_untitled(
         &vault_path,
         &note_path,
         |requested_root, validated_path| {
-            vault::auto_rename_untitled(requested_root, validated_path)
+            vault::auto_rename_untitled(vault::AutoRenameUntitledRequest {
+                vault_path: requested_root,
+                note_path: validated_path,
+            })
         },
     )
 }
@@ -95,7 +102,7 @@ pub fn auto_rename_untitled(
 #[tauri::command]
 pub fn detect_renames(vault_path: String) -> Result<Vec<DetectedRename>, String> {
     let vault_path = expand_tilde(&vault_path);
-    vault::detect_renames(&vault_path)
+    vault::detect_renames(Path::new(vault_path.as_ref()))
 }
 
 #[tauri::command]
@@ -104,5 +111,120 @@ pub fn update_wikilinks_for_renames(
     renames: Vec<DetectedRename>,
 ) -> Result<usize, String> {
     let vault_path = expand_tilde(&vault_path);
-    vault::update_wikilinks_for_renames(&vault_path, &renames)
+    vault::update_wikilinks_for_renames(Path::new(vault_path.as_ref()), &renames)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use tempfile::TempDir;
+
+    fn vault_path(dir: &TempDir) -> String {
+        dir.path().to_string_lossy().into_owned()
+    }
+
+    fn write_note(dir: &TempDir, relative_path: &str, content: &str) -> String {
+        let path = dir.path().join(relative_path);
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent).unwrap();
+        }
+        fs::write(&path, content).unwrap();
+        path.to_string_lossy().into_owned()
+    }
+
+    #[test]
+    fn rename_note_command_updates_title_file_and_links() {
+        let dir = TempDir::new().unwrap();
+        let vault = vault_path(&dir);
+        let old_path = write_note(
+            &dir,
+            "old-title.md",
+            "---\ntitle: Old Title\n---\n# Old Title\n",
+        );
+        let linked_path = write_note(&dir, "linked.md", "See [[Old Title]].\n");
+
+        let result = rename_note(
+            vault.clone(),
+            old_path.clone(),
+            "New Title".to_string(),
+            None,
+        )
+        .unwrap();
+
+        assert!(result.new_path.ends_with("new-title.md"));
+        assert!(!Path::new(&old_path).exists());
+        assert!(Path::new(&result.new_path).exists());
+        assert!(fs::read_to_string(linked_path)
+            .unwrap()
+            .contains("[[new-title]]"));
+        assert_eq!(result.failed_updates, 0);
+    }
+
+    #[test]
+    fn filename_and_folder_commands_preserve_note_content() {
+        let dir = TempDir::new().unwrap();
+        let vault = vault_path(&dir);
+        let old_path = write_note(
+            &dir,
+            "draft.md",
+            "---\ntitle: Draft Title\n---\n# Draft Title\n",
+        );
+
+        let renamed =
+            rename_note_filename(vault.clone(), old_path, "custom-name".to_string()).unwrap();
+        assert!(renamed.new_path.ends_with("custom-name.md"));
+
+        fs::create_dir(dir.path().join("Projects")).unwrap();
+        let moved = move_note_to_folder(
+            vault.clone(),
+            renamed.new_path.clone(),
+            "Projects".to_string(),
+        )
+        .unwrap();
+
+        assert!(moved.new_path.ends_with("Projects/custom-name.md"));
+        assert!(fs::read_to_string(moved.new_path)
+            .unwrap()
+            .contains("Draft Title"));
+    }
+
+    #[test]
+    fn auto_rename_and_detected_rename_commands_route_through_vault() {
+        let dir = TempDir::new().unwrap();
+        let vault = vault_path(&dir);
+        let untitled = write_note(&dir, "untitled-note-123.md", "# Project Plan\n");
+
+        let auto = auto_rename_untitled(vault.clone(), untitled)
+            .unwrap()
+            .unwrap();
+        assert!(auto.new_path.ends_with("project-plan.md"));
+
+        crate::git::init_repo(&vault).unwrap();
+        let old_path = dir.path().join("project-plan.md");
+        let new_path = dir.path().join("plans.md");
+        fs::rename(&old_path, &new_path).unwrap();
+        crate::hidden_command("git")
+            .args(["add", "-A"])
+            .current_dir(dir.path())
+            .output()
+            .unwrap();
+
+        let renames = detect_renames(vault.clone()).unwrap();
+        assert_eq!(renames.len(), 1);
+        assert_eq!(renames[0].old_path, "project-plan.md");
+        assert_eq!(renames[0].new_path, "plans.md");
+
+        assert_eq!(update_wikilinks_for_renames(vault, renames).unwrap(), 0);
+    }
+
+    #[test]
+    fn move_note_to_folder_rejects_empty_folder() {
+        let dir = TempDir::new().unwrap();
+        let vault = vault_path(&dir);
+        let note = write_note(&dir, "note.md", "# Note\n");
+
+        let error = move_note_to_folder(vault, note, "  ".to_string()).unwrap_err();
+        assert!(error.contains("Folder path cannot be empty"));
+    }
 }

src-tauri/src/commands/vault/scan_cmds.rs

@@ -1,18 +1,72 @@
 use crate::commands::expand_tilde;
 use crate::search::SearchResponse;
 use crate::vault::VaultEntry;
-use crate::{search, vault};
+use crate::{search, vault, vault_list};
 use std::path::{Path, PathBuf};
 
 use super::boundary::{with_validated_path, ValidatedPathMode};
 
+fn collect_registered_vault_roots(vault_list: &vault_list::VaultList) -> Vec<PathBuf> {
+    let mut roots = vault_list
+        .vaults
+        .iter()
+        .map(|entry| PathBuf::from(expand_tilde(&entry.path).into_owned()))
+        .collect::<Vec<_>>();
+
+    if let Some(active_vault) = &vault_list.active_vault {
+        roots.push(PathBuf::from(expand_tilde(active_vault).into_owned()));
+    }
+
+    roots
+}
+
+fn find_registered_vault_root(path: &Path, registered_roots: &[PathBuf]) -> Option<PathBuf> {
+    registered_roots
+        .iter()
+        .filter_map(|root| {
+            let canonical_root = root.canonicalize().ok()?;
+            path.starts_with(&canonical_root)
+                .then_some((canonical_root.components().count(), root.clone()))
+        })
+        .max_by_key(|(depth, _)| *depth)
+        .map(|(_, root)| root)
+}
+
+fn resolve_reload_vault_path(
+    path: &Path,
+    vault_path: Option<&Path>,
+) -> Result<Option<PathBuf>, String> {
+    if let Some(vault_path) = vault_path {
+        return Ok(Some(vault_path.to_path_buf()));
+    }
+
+    if !path.is_absolute() {
+        return Ok(None);
+    }
+
+    let canonical_path = match path.canonicalize() {
+        Ok(canonical_path) => canonical_path,
+        Err(_) => return Ok(None),
+    };
+
+    let vault_list = vault_list::load_vault_list()?;
+    let registered_roots = collect_registered_vault_roots(&vault_list);
+    Ok(find_registered_vault_root(
+        canonical_path.as_path(),
+        &registered_roots,
+    ))
+}
+
 #[tauri::command]
 pub fn reload_vault_entry(
     path: PathBuf,
     vault_path: Option<PathBuf>,
 ) -> Result<VaultEntry, String> {
+    let resolved_vault_path = resolve_reload_vault_path(path.as_path(), vault_path.as_deref())?;
     let raw_path = path.to_string_lossy();
-    let raw_vault_path = vault_path.as_ref().map(|value| value.to_string_lossy());
+    let raw_vault_path = resolved_vault_path
+        .as_ref()
+        .map(|value| value.to_string_lossy().into_owned());
     with_validated_path(
         &raw_path,
         raw_vault_path.as_deref(),
@@ -29,8 +83,14 @@ pub async fn reload_vault(
     let path = expand_tilde(&path).into_owned();
     crate::sync_vault_asset_scope(&app_handle, Path::new(&path))?;
     tokio::task::spawn_blocking(move || {
-        vault::invalidate_cache(Path::new(&path));
-        vault::scan_vault_cached(Path::new(&path))
+        let vault_path = Path::new(&path);
+        vault::invalidate_cache(vault_path);
+        let entries = vault::scan_vault_cached(vault_path)?;
+        Ok(vault::filter_gitignored_entries(
+            vault_path,
+            entries,
+            crate::settings::hide_gitignored_files_enabled(),
+        ))
     })
     .await
     .map_err(|e| format!("Task panicked: {e}"))?
@@ -49,3 +109,68 @@ pub async fn search_vault(
         .await
         .map_err(|e| format!("Search task failed: {}", e))?
 }
+
+#[cfg(test)]
+mod tests {
+    use super::{collect_registered_vault_roots, find_registered_vault_root};
+    use crate::vault_list::{VaultEntry as VaultListEntry, VaultList};
+
+    #[test]
+    fn finds_registered_vault_root_for_an_absolute_note_path() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let vault_root = dir.path().join("vault");
+        let note_path = vault_root.join("note.md");
+        std::fs::create_dir_all(&vault_root).unwrap();
+        std::fs::write(&note_path, "# Note\n").unwrap();
+
+        let vault_list = VaultList {
+            vaults: vec![VaultListEntry {
+                label: "Test".to_string(),
+                path: vault_root.to_string_lossy().into_owned(),
+            }],
+            active_vault: None,
+            hidden_defaults: vec![],
+        };
+
+        let registered_roots = collect_registered_vault_roots(&vault_list);
+        let canonical_note_path = note_path.canonicalize().unwrap();
+
+        assert_eq!(
+            find_registered_vault_root(canonical_note_path.as_path(), &registered_roots),
+            Some(vault_root),
+        );
+    }
+
+    #[test]
+    fn prefers_the_deepest_registered_vault_root() {
+        let dir = tempfile::TempDir::new().unwrap();
+        let parent_root = dir.path().join("vault");
+        let nested_root = parent_root.join("projects");
+        let note_path = nested_root.join("note.md");
+        std::fs::create_dir_all(&nested_root).unwrap();
+        std::fs::write(&note_path, "# Note\n").unwrap();
+
+        let vault_list = VaultList {
+            vaults: vec![
+                VaultListEntry {
+                    label: "Parent".to_string(),
+                    path: parent_root.to_string_lossy().into_owned(),
+                },
+                VaultListEntry {
+                    label: "Nested".to_string(),
+                    path: nested_root.to_string_lossy().into_owned(),
+                },
+            ],
+            active_vault: None,
+            hidden_defaults: vec![],
+        };
+
+        let registered_roots = collect_registered_vault_roots(&vault_list);
+        let canonical_note_path = note_path.canonicalize().unwrap();
+
+        assert_eq!(
+            find_registered_vault_root(canonical_note_path.as_path(), &registered_roots),
+            Some(nested_root),
+        );
+    }
+}

src-tauri/src/git/clone.rs

@@ -1,12 +1,20 @@
 use std::path::Path;
-use std::process::Command;
+use std::process::{Command, Output, Stdio};
+
+use super::git_command;
+
+struct CloneRequest<'a> {
+    url: &'a str,
+    dest: &'a Path,
+}
 
 /// Clone a git repository to a local path using the system git configuration.
 pub fn clone_repo(url: &str, local_path: &str) -> Result<String, String> {
     let dest = Path::new(local_path);
+    let request = CloneRequest { url, dest };
     prepare_clone_destination(dest)?;
 
-    if let Err(err) = run_clone(url, dest) {
+    if let Err(err) = run_clone(&request) {
         cleanup_failed_clone(dest);
         return Err(err);
     }
@@ -64,12 +72,14 @@ fn directory_has_entries(dest: &Path) -> Result<bool, String> {
         .map(|mut entries| entries.next().is_some())
 }
 
-fn run_clone(url: &str, dest: &Path) -> Result<(), String> {
-    let destination = dest
-        .to_str()
-        .ok_or_else(|| format!("Destination '{}' is not valid UTF-8", dest.display()))?;
-    let output = Command::new("git")
-        .args(["clone", "--progress", url, destination])
+fn run_clone(request: &CloneRequest<'_>) -> Result<(), String> {
+    let destination = request.dest.to_str().ok_or_else(|| {
+        format!(
+            "Destination '{}' is not valid UTF-8",
+            request.dest.display()
+        )
+    })?;
+    let output = build_clone_command(request, destination)
         .output()
         .map_err(|e| format!("Failed to run git clone: {}", e))?;
 
@@ -77,8 +87,36 @@ fn run_clone(url: &str, dest: &Path) -> Result<(), String> {
         return Ok(());
     }
 
+    Err(format!(
+        "git clone failed: {}",
+        clone_failure_message(&output)
+    ))
+}
+
+fn build_clone_command(request: &CloneRequest<'_>, destination: &str) -> Command {
+    let mut command = git_command();
+    command
+        .args(["clone", "--quiet", request.url, destination])
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .env("SSH_ASKPASS_REQUIRE", "never")
+        .stdin(Stdio::null());
+    command
+}
+
+fn clone_failure_message(output: &Output) -> String {
     let stderr = String::from_utf8_lossy(&output.stderr);
-    Err(format!("git clone failed: {}", stderr.trim()))
+    let stderr = stderr.trim();
+    if !stderr.is_empty() {
+        return stderr.to_string();
+    }
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stdout = stdout.trim();
+    if !stdout.is_empty() {
+        return stdout.to_string();
+    }
+
+    format!("git clone exited with status {}", output.status)
 }
 
 fn cleanup_failed_clone(dest: &Path) {
@@ -91,6 +129,7 @@ fn cleanup_failed_clone(dest: &Path) {
 mod tests {
     use super::*;
     use std::fs;
+    use std::os::unix::process::ExitStatusExt;
     use std::path::Path;
     use std::process::Command as StdCommand;
 
@@ -160,4 +199,56 @@ mod tests {
         );
         assert!(result.unwrap_err().contains("git clone failed"));
     }
+
+    #[test]
+    fn test_clone_failure_message_falls_back_to_stdout() {
+        let output = Output {
+            status: std::process::ExitStatus::from_raw(128),
+            stdout: b"fatal: stdout only".to_vec(),
+            stderr: Vec::new(),
+        };
+
+        assert_eq!(clone_failure_message(&output), "fatal: stdout only");
+    }
+
+    #[test]
+    fn test_build_clone_command_disables_interactive_prompts() {
+        let dest = Path::new("/tmp/repo");
+        let request = CloneRequest {
+            url: "https://example.com/repo.git",
+            dest,
+        };
+        let command = build_clone_command(&request, "/tmp/repo");
+        let args = command
+            .get_args()
+            .map(|arg| arg.to_string_lossy().to_string())
+            .collect::<Vec<_>>();
+        let envs = command
+            .get_envs()
+            .map(|(key, value)| {
+                (
+                    key.to_string_lossy().to_string(),
+                    value.map(|entry| entry.to_string_lossy().to_string()),
+                )
+            })
+            .collect::<std::collections::HashMap<_, _>>();
+
+        assert_eq!(
+            envs.get("GIT_TERMINAL_PROMPT"),
+            Some(&Some("0".to_string()))
+        );
+        assert_eq!(
+            envs.get("SSH_ASKPASS_REQUIRE"),
+            Some(&Some("never".to_string()))
+        );
+        assert_eq!(
+            args,
+            vec![
+                "clone".to_string(),
+                "--quiet".to_string(),
+                "https://example.com/repo.git".to_string(),
+                "/tmp/repo".to_string(),
+            ]
+        );
+    }
 }

src-tauri/src/git/commit.rs

@@ -1,5 +1,5 @@
+use super::git_command;
 use std::path::Path;
-use std::process::Command;
 
 struct CommitFailure {
     stdout: String,
@@ -11,7 +11,7 @@ pub fn git_commit(vault_path: &str, message: &str) -> Result<String, String> {
     let vault = Path::new(vault_path);
 
     // Stage all changes
-    let add = Command::new("git")
+    let add = git_command()
         .args(["add", "-A"])
         .current_dir(vault)
         .output()
@@ -37,7 +37,7 @@ pub fn git_commit(vault_path: &str, message: &str) -> Result<String, String> {
 }
 
 fn run_commit(vault: &Path, message: &str, disable_signing: bool) -> Result<String, CommitFailure> {
-    let mut command = Command::new("git");
+    let mut command = git_command();
     if disable_signing {
         command.args(["-c", "commit.gpgsign=false"]);
     }
@@ -85,10 +85,10 @@ fn is_commit_signing_failure(detail: &str) -> bool {
 
 #[cfg(test)]
 mod tests {
+    use super::git_command;
     use super::*;
     use crate::git::tests::setup_git_repo;
     use std::fs;
-    use std::process::Command;
 
     #[test]
     fn test_git_commit() {
@@ -101,7 +101,7 @@ mod tests {
         assert!(result.is_ok());
 
         // Verify the commit exists
-        let log = Command::new("git")
+        let log = git_command()
             .args(["log", "--oneline", "-1"])
             .current_dir(vault)
             .output()
@@ -135,12 +135,12 @@ mod tests {
         let vault = dir.path();
         let vp = vault.to_str().unwrap();
 
-        Command::new("git")
+        git_command()
             .args(["config", "commit.gpgsign", "true"])
             .current_dir(vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["config", "gpg.program", "/missing/tolaria-test-gpg"])
             .current_dir(vault)
             .output()
@@ -153,14 +153,14 @@ mod tests {
             "commit should retry unsigned when signing helper is missing: {result:?}"
         );
 
-        let log = Command::new("git")
+        let log = git_command()
             .args(["log", "--oneline", "-1"])
             .current_dir(vault)
             .output()
             .unwrap();
         assert!(String::from_utf8_lossy(&log.stdout).contains("Commit with broken signing config"));
 
-        let config = Command::new("git")
+        let config = git_command()
             .args(["config", "commit.gpgsign"])
             .current_dir(vault)
             .output()

src-tauri/src/git/conflict.rs

@@ -1,7 +1,6 @@
 use std::path::Path;
-use std::process::Command;
 
-use super::run_git;
+use super::{git_command, run_git};
 
 /// List files with merge conflicts (unmerged paths).
 ///
@@ -10,7 +9,7 @@ use super::run_git;
 /// stale (e.g. after a reboot or when MERGE_HEAD is missing).
 pub fn get_conflict_files(vault_path: &str) -> Result<Vec<String>, String> {
     let vault = Path::new(vault_path);
-    let output = Command::new("git")
+    let output = git_command()
         .args(["ls-files", "--unmerged"])
         .current_dir(vault)
         .output()
@@ -93,13 +92,13 @@ pub fn git_commit_conflict_resolution(vault_path: &str) -> Result<String, String
 
     let mode = get_conflict_mode(vault_path);
     let output = match mode.as_str() {
-        "rebase" => Command::new("git")
+        "rebase" => git_command()
             .args(["rebase", "--continue"])
             .env("GIT_EDITOR", "true")
             .current_dir(vault)
             .output()
             .map_err(|e| format!("Failed to run git rebase --continue: {}", e))?,
-        _ => Command::new("git")
+        _ => git_command()
             .args(["commit", "-m", "Resolve merge conflicts"])
             .current_dir(vault)
             .output()
@@ -131,7 +130,6 @@ mod tests {
     use crate::git::tests::{setup_git_repo, setup_remote_pair};
     use crate::git::{git_commit, git_pull, git_push};
     use std::fs;
-    use std::process::Command;
     use tempfile::TempDir;
 
     #[test]
@@ -203,35 +201,30 @@ mod tests {
         (bare_dir, clone_a_dir, clone_b_dir)
     }
 
-    #[test]
-    fn test_resolve_conflict_ours() {
+    fn assert_resolve_conflict_strategy(strategy: &str, expected_content: &str) {
         let (_bare, _clone_a, clone_b) = setup_conflict_pair();
         let vp_b = clone_b.path().to_str().unwrap();
 
         let conflicts = get_conflict_files(vp_b).unwrap();
         assert!(conflicts.contains(&"conflict.md".to_string()));
 
-        git_resolve_conflict(vp_b, "conflict.md", "ours").unwrap();
+        git_resolve_conflict(vp_b, "conflict.md", strategy).unwrap();
 
         let remaining = get_conflict_files(vp_b).unwrap();
         assert!(remaining.is_empty());
 
         let content = fs::read_to_string(clone_b.path().join("conflict.md")).unwrap();
-        assert_eq!(content, "# Version B\n");
+        assert_eq!(content, expected_content);
+    }
+
+    #[test]
+    fn test_resolve_conflict_ours() {
+        assert_resolve_conflict_strategy("ours", "# Version B\n");
     }
 
     #[test]
     fn test_resolve_conflict_theirs() {
-        let (_bare, _clone_a, clone_b) = setup_conflict_pair();
-        let vp_b = clone_b.path().to_str().unwrap();
-
-        git_resolve_conflict(vp_b, "conflict.md", "theirs").unwrap();
-
-        let remaining = get_conflict_files(vp_b).unwrap();
-        assert!(remaining.is_empty());
-
-        let content = fs::read_to_string(clone_b.path().join("conflict.md")).unwrap();
-        assert_eq!(content, "# Version A\n");
+        assert_resolve_conflict_strategy("theirs", "# Version A\n");
     }
 
     #[test]
@@ -244,7 +237,7 @@ mod tests {
         let result = git_commit_conflict_resolution(vp_b);
         assert!(result.is_ok());
 
-        let log = Command::new("git")
+        let log = git_command()
             .args(["log", "--oneline", "-1"])
             .current_dir(clone_b.path())
             .output()
@@ -310,7 +303,7 @@ mod tests {
         fs::write(clone_b_dir.path().join("conflict.md"), "# Version B\n").unwrap();
         git_commit(vp_b, "B's change").unwrap();
 
-        let output = Command::new("git")
+        let output = git_command()
             .args(["pull", "--rebase"])
             .current_dir(clone_b_dir.path())
             .output()

src-tauri/src/git/connect.rs

@@ -1,6 +1,8 @@
 use serde::{Deserialize, Serialize};
 use std::path::Path;
-use std::process::{Command, Output};
+use std::process::Output;
+
+use super::{ensure_author_config, git_command};
 
 const DEFAULT_REMOTE_NAME: &str = "origin";
 
@@ -90,6 +92,8 @@ pub fn git_add_remote(vault_path: &str, remote_url: &str) -> Result<GitAddRemote
         ));
     }
 
+    ensure_author_config(vault)?;
+
     let branch = current_branch(vault)?;
     if branch.is_empty() {
         return Ok(connect_result(
@@ -192,14 +196,14 @@ fn list_remotes(vault: &Path) -> Result<Vec<String>, String> {
 }
 
 fn unset_upstream(vault: &Path) {
-    let _ = Command::new("git")
+    let _ = git_command()
         .args(["branch", "--unset-upstream"])
         .current_dir(vault)
         .output();
 }
 
 fn run_git(vault: &Path, args: &[&str]) -> Result<(), String> {
-    let output = Command::new("git")
+    let output = git_command()
         .args(args)
         .current_dir(vault)
         .output()
@@ -237,7 +241,7 @@ fn list_remote_branches(vault: &Path) -> Result<Vec<String>, String> {
 }
 
 fn histories_share_base(vault: &Path, connection: &RemoteConnection) -> bool {
-    Command::new("git")
+    git_command()
         .args(["merge-base", "HEAD", connection.remote_branch.as_str()])
         .current_dir(vault)
         .output()
@@ -315,7 +319,7 @@ fn classify_connect_error(stderr: &str) -> GitAddRemoteResult {
 }
 
 fn git_output(vault: &Path, args: &[&str]) -> Result<Output, String> {
-    Command::new("git")
+    git_command()
         .args(args)
         .current_dir(vault)
         .output()
@@ -442,6 +446,28 @@ mod tests {
         git_commit(path.to_str().unwrap(), message).unwrap();
     }
 
+    fn clear_local_author(path: &Path) {
+        for key in ["user.name", "user.email"] {
+            StdCommand::new("git")
+                .args(["config", "--local", "--unset-all", key])
+                .current_dir(path)
+                .output()
+                .unwrap();
+        }
+    }
+
+    fn local_author_is_configured(path: &Path) -> bool {
+        ["user.name", "user.email"].into_iter().all(|key| {
+            let output = StdCommand::new("git")
+                .args(["config", "--local", key])
+                .current_dir(path)
+                .output()
+                .unwrap();
+
+            output.status.success() && !String::from_utf8_lossy(&output.stdout).trim().is_empty()
+        })
+    }
+
     #[test]
     fn disconnect_all_remotes_removes_every_remote() {
         let dir = setup_git_repo();
@@ -487,6 +513,26 @@ mod tests {
         assert_eq!((status.ahead, status.behind), (0, 0));
     }
 
+    #[test]
+    fn git_add_remote_sets_local_identity_when_existing_repo_has_none() {
+        let local = setup_git_repo();
+        create_local_commit(local.path(), "note.md", "Local", "Initial local commit");
+        clear_local_author(local.path());
+        assert!(!local_author_is_configured(local.path()));
+
+        let bare = TempDir::new().unwrap();
+        init_bare_remote(bare.path());
+
+        let result = git_add_remote(
+            local.path().to_str().unwrap(),
+            bare.path().to_str().unwrap(),
+        )
+        .unwrap();
+
+        assert_eq!(result.status, "connected");
+        assert!(local_author_is_configured(local.path()));
+    }
+
     #[test]
     fn git_add_remote_pushes_when_remote_is_the_local_branch_ancestor() {
         let local = setup_git_repo();

src-tauri/src/git/dates.rs

@@ -1,7 +1,7 @@
+use super::git_command;
 use chrono::DateTime;
 use std::collections::HashMap;
 use std::path::Path;
-use std::process::Command;
 
 /// Git-derived creation and modification timestamps for a file.
 #[derive(Debug, Clone)]
@@ -19,7 +19,7 @@ pub struct GitDates {
 /// Files not yet committed (untracked / only staged) will not appear in the map;
 /// callers should fall back to filesystem metadata for those.
 pub fn get_all_file_dates(vault_path: &Path) -> HashMap<String, GitDates> {
-    let output = match Command::new("git")
+    let output = match git_command()
         .args(["log", "--format=COMMIT %aI", "--name-only"])
         .current_dir(vault_path)
         .output()

src-tauri/src/git/history.rs

@@ -1,5 +1,5 @@
+use super::git_command;
 use std::path::Path;
-use std::process::Command;
 
 use super::GitCommit;
 
@@ -16,7 +16,7 @@ pub fn get_file_history(vault_path: &str, file_path: &str) -> Result<Vec<GitComm
         .to_str()
         .ok_or_else(|| "Invalid UTF-8 in path".to_string())?;
 
-    let output = Command::new("git")
+    let output = git_command()
         .args([
             "log",
             "--format=%H|%h|%an|%aI|%s",
@@ -80,7 +80,7 @@ pub fn get_file_diff(vault_path: &str, file_path: &str) -> Result<String, String
         .ok_or_else(|| "Invalid UTF-8 in path".to_string())?;
 
     // First try tracked file diff
-    let output = Command::new("git")
+    let output = git_command()
         .args(["diff", "--", relative_str])
         .current_dir(vault)
         .output()
@@ -90,7 +90,7 @@ pub fn get_file_diff(vault_path: &str, file_path: &str) -> Result<String, String
 
     // If no diff (maybe staged or untracked), try diff --cached
     if stdout.is_empty() {
-        let cached = Command::new("git")
+        let cached = git_command()
             .args(["diff", "--cached", "--", relative_str])
             .current_dir(vault)
             .output()
@@ -102,7 +102,7 @@ pub fn get_file_diff(vault_path: &str, file_path: &str) -> Result<String, String
         }
 
         // Try showing untracked file as all-new
-        let status = Command::new("git")
+        let status = git_command()
             .args(["status", "--porcelain", "--", relative_str])
             .current_dir(vault)
             .output()
@@ -144,7 +144,7 @@ pub fn get_file_diff_at_commit(
         .ok_or_else(|| "Invalid UTF-8 in path".to_string())?;
 
     // Show diff between commit^ and commit for this file
-    let output = Command::new("git")
+    let output = git_command()
         .args([
             "diff",
             &format!("{}^", commit_hash),
@@ -161,7 +161,7 @@ pub fn get_file_diff_at_commit(
     // If diff is empty, it might be the initial commit (no parent).
     // Fall back to showing the full file content as added.
     if stdout.is_empty() {
-        let show = Command::new("git")
+        let show = git_command()
             .args(["show", &format!("{}:{}", commit_hash, relative_str)])
             .current_dir(vault)
             .output()
@@ -184,10 +184,10 @@ pub fn get_file_diff_at_commit(
 
 #[cfg(test)]
 mod tests {
+    use super::git_command;
     use super::*;
     use crate::git::tests::setup_git_repo;
     use std::fs;
-    use std::process::Command;
 
     #[test]
     fn test_get_file_history_with_commits() {
@@ -196,24 +196,24 @@ mod tests {
         let file = vault.join("test.md");
 
         fs::write(&file, "# Initial\n").unwrap();
-        Command::new("git")
+        git_command()
             .args(["add", "test.md"])
             .current_dir(vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["commit", "-m", "Initial commit"])
             .current_dir(vault)
             .output()
             .unwrap();
 
         fs::write(&file, "# Updated\n\nNew content.").unwrap();
-        Command::new("git")
+        git_command()
             .args(["add", "test.md"])
             .current_dir(vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["commit", "-m", "Update test"])
             .current_dir(vault)
             .output()
@@ -248,12 +248,12 @@ mod tests {
         let file = vault.join("diff-test.md");
 
         fs::write(&file, "# Test\n\nOriginal content.").unwrap();
-        Command::new("git")
+        git_command()
             .args(["add", "diff-test.md"])
             .current_dir(vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["commit", "-m", "Add diff-test"])
             .current_dir(vault)
             .output()
@@ -275,31 +275,31 @@ mod tests {
         let file = vault.join("diff-at-commit.md");
 
         fs::write(&file, "# First\n\nOriginal content.").unwrap();
-        Command::new("git")
+        git_command()
             .args(["add", "diff-at-commit.md"])
             .current_dir(vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["commit", "-m", "First commit"])
             .current_dir(vault)
             .output()
             .unwrap();
 
         fs::write(&file, "# First\n\nModified content.").unwrap();
-        Command::new("git")
+        git_command()
             .args(["add", "diff-at-commit.md"])
             .current_dir(vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["commit", "-m", "Second commit"])
             .current_dir(vault)
             .output()
             .unwrap();
 
         // Get hash of second commit
-        let log = Command::new("git")
+        let log = git_command()
             .args(["log", "--format=%H", "-1"])
             .current_dir(vault)
             .output()
@@ -321,18 +321,18 @@ mod tests {
         let file = vault.join("initial.md");
 
         fs::write(&file, "# Initial\n\nHello world.").unwrap();
-        Command::new("git")
+        git_command()
             .args(["add", "initial.md"])
             .current_dir(vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["commit", "-m", "Initial commit"])
             .current_dir(vault)
             .output()
             .unwrap();
 
-        let log = Command::new("git")
+        let log = git_command()
             .args(["log", "--format=%H", "-1"])
             .current_dir(vault)
             .output()

src-tauri/src/git/mod.rs

@@ -56,6 +56,10 @@ const DEFAULT_GITIGNORE: &str = "# Tolaria app files (machine-specific, never co
 *.swp\n\
 *.swo\n";
 
+fn git_command() -> Command {
+    crate::hidden_command("git")
+}
+
 /// Ensure a `.gitignore` with sensible defaults exists in the vault directory.
 /// Creates the file if missing; leaves existing `.gitignore` files untouched.
 pub fn ensure_gitignore(path: &str) -> Result<(), String> {
@@ -99,7 +103,7 @@ fn commit_initial_vault_setup(dir: &Path) -> Result<(), String> {
 
 /// Run a git command in the given directory, returning an error on failure.
 fn run_git(dir: &Path, args: &[&str]) -> Result<(), String> {
-    let output = Command::new("git")
+    let output = git_command()
         .args(args)
         .current_dir(dir)
         .output()
@@ -125,21 +129,20 @@ fn git_command_label<'a>(args: &'a [&'a str]) -> &'a str {
 }
 
 /// Set local user.name and user.email if not already configured.
-fn ensure_author_config(dir: &Path) -> Result<(), String> {
-    for (key, fallback) in [
-        ("user.name", "Tolaria"),
-        ("user.email", "vault@tolaria.app"),
-    ] {
-        let check = Command::new("git")
-            .args(["config", key])
+pub(crate) fn ensure_author_config(dir: &Path) -> Result<(), String> {
+    for (key, fallback) in [("user.name", "Tolaria"), ("user.email", "vault@tolaria.md")] {
+        let local = git_command()
+            .args(["config", "--local", key])
             .current_dir(dir)
             .output()
-            .map_err(|e| format!("Failed to check git config: {}", e))?;
+            .map_err(|e| format!("Failed to check git config {key}: {e}"))?;
 
-        let value = String::from_utf8_lossy(&check.stdout);
-        if !check.status.success() || value.trim().is_empty() {
-            run_git(dir, &["config", key, fallback])?;
+        let value = String::from_utf8_lossy(&local.stdout);
+        if local.status.success() && !value.trim().is_empty() {
+            continue;
         }
+
+        run_git(dir, &["config", "--local", key, fallback])?;
     }
     Ok(())
 }
@@ -174,7 +177,6 @@ fn parse_github_repo_path(url: &str) -> Option<String> {
 mod tests {
     use super::*;
     use std::fs;
-    use std::process::Command;
     use tempfile::TempDir;
 
     fn assert_repo_path(url: &str, expected: Option<&str>) {
@@ -188,19 +190,19 @@ mod tests {
         let dir = TempDir::new().unwrap();
         let path = dir.path();
 
-        Command::new("git")
+        git_command()
             .args(["init", "--initial-branch=main"])
             .current_dir(path)
             .output()
             .unwrap();
 
-        Command::new("git")
+        git_command()
             .args(["config", "user.email", "test@test.com"])
             .current_dir(path)
             .output()
             .unwrap();
 
-        Command::new("git")
+        git_command()
             .args(["config", "user.name", "Test User"])
             .current_dir(path)
             .output()
@@ -214,14 +216,14 @@ mod tests {
         let bare_dir = TempDir::new().unwrap();
         let bare = bare_dir.path();
 
-        Command::new("git")
+        git_command()
             .args(["init", "--bare"])
             .current_dir(bare)
             .output()
             .unwrap();
 
         let clone_a_dir = TempDir::new().unwrap();
-        Command::new("git")
+        git_command()
             .args(["clone", bare.to_str().unwrap(), "."])
             .current_dir(clone_a_dir.path())
             .output()
@@ -230,7 +232,7 @@ mod tests {
             &["config", "user.email", "a@test.com"][..],
             &["config", "user.name", "User A"][..],
         ] {
-            Command::new("git")
+            git_command()
                 .args(*cmd)
                 .current_dir(clone_a_dir.path())
                 .output()
@@ -238,7 +240,7 @@ mod tests {
         }
 
         let clone_b_dir = TempDir::new().unwrap();
-        Command::new("git")
+        git_command()
             .args(["clone", bare.to_str().unwrap(), "."])
             .current_dir(clone_b_dir.path())
             .output()
@@ -247,7 +249,7 @@ mod tests {
             &["config", "user.email", "b@test.com"][..],
             &["config", "user.name", "User B"][..],
         ] {
-            Command::new("git")
+            git_command()
                 .args(*cmd)
                 .current_dir(clone_b_dir.path())
                 .output()
@@ -301,7 +303,7 @@ mod tests {
 
         init_repo(vault.to_str().unwrap()).unwrap();
 
-        let log = Command::new("git")
+        let log = git_command()
             .args(["log", "--oneline"])
             .current_dir(&vault)
             .output()
@@ -317,17 +319,17 @@ mod tests {
         fs::create_dir_all(&vault).unwrap();
         fs::write(vault.join("note.md"), "# Test\n").unwrap();
 
-        Command::new("git")
+        git_command()
             .args(["init"])
             .current_dir(&vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["config", "commit.gpgsign", "true"])
             .current_dir(&vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["config", "gpg.program", "/missing/tolaria-test-gpg"])
             .current_dir(&vault)
             .output()
@@ -335,7 +337,7 @@ mod tests {
 
         init_repo(vault.to_str().unwrap()).unwrap();
 
-        let log = Command::new("git")
+        let log = git_command()
             .args(["log", "--oneline"])
             .current_dir(&vault)
             .output()
@@ -353,7 +355,7 @@ mod tests {
 
         init_repo(vault.to_str().unwrap()).unwrap();
 
-        let status = Command::new("git")
+        let status = git_command()
             .args(["status", "--porcelain"])
             .current_dir(&vault)
             .output()

src-tauri/src/git/pulse.rs

@@ -1,8 +1,7 @@
 use serde::Serialize;
 use std::path::Path;
-use std::process::Command;
 
-use super::parse_github_repo_path;
+use super::{git_command, parse_github_repo_path};
 
 #[derive(Debug, Serialize, Clone)]
 pub struct PulseFile {
@@ -67,7 +66,7 @@ pub fn get_vault_pulse(
 
     let limit_str = limit.to_string();
     let skip_str = skip.to_string();
-    let output = Command::new("git")
+    let output = git_command()
         .args([
             "log",
             "--name-status",
@@ -99,7 +98,7 @@ pub fn get_vault_pulse(
 
 fn get_github_base_url(vault_path: &str) -> Option<String> {
     let vault = Path::new(vault_path);
-    let output = Command::new("git")
+    let output = git_command()
         .args(["remote", "get-url", "origin"])
         .current_dir(vault)
         .output()
@@ -123,69 +122,90 @@ fn parse_pulse_output(stdout: &str, github_base: &Option<String>) -> Vec<PulseCo
             continue;
         }
 
-        if line.contains('|')
-            && !line.starts_with(|c: char| {
-                c.is_ascii_uppercase() && line.len() > 1 && line.as_bytes().get(1) == Some(&b'\t')
-            })
-        {
-            // Commit header line: hash|short_hash|message|date
-            if let Some(commit) = current.take() {
-                commits.push(commit);
-            }
-            let parts: Vec<&str> = line.splitn(4, '|').collect();
-            if parts.len() == 4 {
-                let hash = parts[0];
-                let date = chrono::DateTime::parse_from_rfc3339(parts[3])
-                    .map(|dt| dt.timestamp())
-                    .unwrap_or(0);
-                let github_url = github_base
-                    .as_ref()
-                    .map(|base| format!("{}/commit/{}", base, hash));
+        if is_commit_header(line) {
+            push_current_commit(&mut commits, &mut current);
+            current = parse_commit_header(line, github_base);
+            continue;
+        }
 
-                current = Some(PulseCommit {
-                    hash: hash.to_string(),
-                    short_hash: parts[1].to_string(),
-                    message: parts[2].to_string(),
-                    date,
-                    github_url,
-                    files: Vec::new(),
-                    added: 0,
-                    modified: 0,
-                    deleted: 0,
-                });
-            }
-        } else if let Some(ref mut commit) = current {
-            // File status line: A\tpath or M\tpath
-            let file_parts: Vec<&str> = line.splitn(2, '\t').collect();
-            if file_parts.len() == 2 {
-                let status = parse_file_status(file_parts[0].trim());
-                let path = file_parts[1].trim();
-                match status {
-                    "added" => commit.added += 1,
-                    "deleted" => commit.deleted += 1,
-                    _ => commit.modified += 1,
-                }
-                commit.files.push(PulseFile {
-                    path: path.to_string(),
-                    status: status.to_string(),
-                    title: title_from_path(path),
-                });
-            }
+        if let Some(ref mut commit) = current {
+            add_file_change(commit, line);
         }
     }
 
-    if let Some(commit) = current {
-        commits.push(commit);
-    }
+    push_current_commit(&mut commits, &mut current);
 
     commits
 }
 
+fn is_git_status_line(line: &str) -> bool {
+    line.starts_with(|c: char| {
+        c.is_ascii_uppercase() && line.len() > 1 && line.as_bytes().get(1) == Some(&b'\t')
+    })
+}
+
+fn is_commit_header(line: &str) -> bool {
+    line.contains('|') && !is_git_status_line(line)
+}
+
+fn push_current_commit(commits: &mut Vec<PulseCommit>, current: &mut Option<PulseCommit>) {
+    if let Some(commit) = current.take() {
+        commits.push(commit);
+    }
+}
+
+fn parse_commit_header(line: &str, github_base: &Option<String>) -> Option<PulseCommit> {
+    let parts: Vec<&str> = line.splitn(4, '|').collect();
+    if parts.len() != 4 {
+        return None;
+    }
+
+    let hash = parts[0];
+    let date = chrono::DateTime::parse_from_rfc3339(parts[3])
+        .map(|dt| dt.timestamp())
+        .unwrap_or(0);
+    let github_url = github_base
+        .as_ref()
+        .map(|base| format!("{}/commit/{}", base, hash));
+
+    Some(PulseCommit {
+        hash: hash.to_string(),
+        short_hash: parts[1].to_string(),
+        message: parts[2].to_string(),
+        date,
+        github_url,
+        files: Vec::new(),
+        added: 0,
+        modified: 0,
+        deleted: 0,
+    })
+}
+
+fn add_file_change(commit: &mut PulseCommit, line: &str) {
+    let file_parts: Vec<&str> = line.splitn(2, '\t').collect();
+    if file_parts.len() != 2 {
+        return;
+    }
+
+    let status = parse_file_status(file_parts[0].trim());
+    let path = file_parts[1].trim();
+    match status {
+        "added" => commit.added += 1,
+        "deleted" => commit.deleted += 1,
+        _ => commit.modified += 1,
+    }
+    commit.files.push(PulseFile {
+        path: path.to_string(),
+        status: status.to_string(),
+        title: title_from_path(path),
+    });
+}
+
 /// Get the last commit's short hash and a GitHub URL (if remote is GitHub).
 pub fn get_last_commit_info(vault_path: &str) -> Result<Option<LastCommitInfo>, String> {
     let vault = Path::new(vault_path);
 
-    let output = Command::new("git")
+    let output = git_command()
         .args(["log", "-1", "--format=%H|%h"])
         .current_dir(vault)
         .output()
@@ -223,23 +243,7 @@ pub fn get_last_commit_info(vault_path: &str) -> Result<Option<LastCommitInfo>,
 
 /// Try to build a GitHub commit URL from the origin remote URL.
 fn get_github_commit_url(vault_path: &str, full_hash: &str) -> Option<String> {
-    let vault = Path::new(vault_path);
-    let output = Command::new("git")
-        .args(["remote", "get-url", "origin"])
-        .current_dir(vault)
-        .output()
-        .ok()?;
-
-    if !output.status.success() {
-        return None;
-    }
-
-    let url = String::from_utf8_lossy(&output.stdout).trim().to_string();
-    let repo_path = parse_github_repo_path(&url)?;
-    Some(format!(
-        "https://github.com/{}/commit/{}",
-        repo_path, full_hash
-    ))
+    get_github_base_url(vault_path).map(|base| format!("{}/commit/{}", base, full_hash))
 }
 
 #[cfg(test)]

src-tauri/src/git/remote.rs

@@ -1,6 +1,6 @@
+use super::git_command;
 use serde::{Deserialize, Serialize};
 use std::path::Path;
-use std::process::Command;
 
 use super::conflict::get_conflict_files;
 
@@ -17,7 +17,7 @@ pub struct GitPullResult {
 /// Check whether the vault repo has at least one remote configured.
 pub fn has_remote(vault_path: &str) -> Result<bool, String> {
     let vault = Path::new(vault_path);
-    let output = Command::new("git")
+    let output = git_command()
         .args(["remote"])
         .current_dir(vault)
         .output()
@@ -40,7 +40,7 @@ pub fn git_pull(vault_path: &str) -> Result<GitPullResult, String> {
         });
     }
 
-    let output = Command::new("git")
+    let output = git_command()
         .args(["pull", "--no-rebase"])
         .current_dir(vault)
         .output()
@@ -134,14 +134,14 @@ pub fn git_remote_status(vault_path: &str) -> Result<GitRemoteStatus, String> {
     }
 
     // Fetch latest remote refs (silent, best-effort)
-    let _ = Command::new("git")
+    let _ = git_command()
         .args(["fetch", "--quiet"])
         .current_dir(vault)
         .output();
 
     let branch = current_branch(vault)?;
 
-    let output = Command::new("git")
+    let output = git_command()
         .args(["rev-list", "--left-right", "--count", "HEAD...@{upstream}"])
         .current_dir(vault)
         .output()
@@ -171,7 +171,7 @@ pub fn git_remote_status(vault_path: &str) -> Result<GitRemoteStatus, String> {
 }
 
 fn current_branch(vault: &Path) -> Result<String, String> {
-    let output = Command::new("git")
+    let output = git_command()
         .args(["branch", "--show-current"])
         .current_dir(vault)
         .output()
@@ -189,59 +189,93 @@ pub struct GitPushResult {
 pub fn classify_push_error(stderr: &str) -> GitPushResult {
     let lower = stderr.to_lowercase();
 
-    if lower.contains("non-fast-forward")
-        || lower.contains("[rejected]")
-        || lower.contains("fetch first")
-        || lower.contains("failed to push some refs")
-            && (lower.contains("updates were rejected") || lower.contains("non-fast-forward"))
-    {
-        return GitPushResult {
-            status: "rejected".to_string(),
-            message: "Push rejected: remote has new commits. Pull first, then push.".to_string(),
-        };
+    if is_rejected_push_error(&lower) {
+        return push_error(
+            "rejected",
+            "Push rejected: remote has new commits. Pull first, then push.",
+        );
     }
 
-    if lower.contains("authentication failed")
-        || lower.contains("could not read username")
-        || lower.contains("permission denied")
-        || lower.contains("403")
-        || lower.contains("invalid credentials")
-    {
-        return GitPushResult {
-            status: "auth_error".to_string(),
-            message: "Push failed: authentication error. Check your credentials.".to_string(),
-        };
+    if is_auth_push_error(&lower) {
+        return push_error(
+            "auth_error",
+            "Push failed: authentication error. Check your credentials.",
+        );
     }
 
-    if lower.contains("could not resolve host")
-        || lower.contains("unable to access")
-        || lower.contains("connection refused")
-        || lower.contains("network is unreachable")
-        || lower.contains("timed out")
-    {
-        return GitPushResult {
-            status: "network_error".to_string(),
-            message: "Push failed: network error. Check your connection and try again.".to_string(),
-        };
+    if is_network_push_error(&lower) {
+        return push_error(
+            "network_error",
+            "Push failed: network error. Check your connection and try again.",
+        );
     }
 
-    // Fallback: extract the hint line if present, otherwise use the full stderr
+    push_error(
+        "error",
+        format!("Push failed: {}", push_error_detail(stderr)),
+    )
+}
+
+fn push_error(status: &str, message: impl Into<String>) -> GitPushResult {
+    GitPushResult {
+        status: status.to_string(),
+        message: message.into(),
+    }
+}
+
+fn contains_any(haystack: &str, needles: &[&str]) -> bool {
+    needles.iter().any(|needle| haystack.contains(needle))
+}
+
+fn is_rejected_push_error(lower: &str) -> bool {
+    contains_any(lower, &["non-fast-forward", "[rejected]", "fetch first"])
+        || (lower.contains("failed to push some refs")
+            && contains_any(lower, &["updates were rejected", "non-fast-forward"]))
+}
+
+fn is_auth_push_error(lower: &str) -> bool {
+    contains_any(
+        lower,
+        &[
+            "authentication failed",
+            "could not read username",
+            "permission denied",
+            "403",
+            "invalid credentials",
+        ],
+    )
+}
+
+fn is_network_push_error(lower: &str) -> bool {
+    contains_any(
+        lower,
+        &[
+            "could not resolve host",
+            "unable to access",
+            "connection refused",
+            "network is unreachable",
+            "timed out",
+        ],
+    )
+}
+
+fn push_error_detail(stderr: &str) -> String {
     let hint_line = stderr
         .lines()
-        .find(|l| l.trim_start().starts_with("hint:"))
-        .map(|l| l.trim_start().strip_prefix("hint:").unwrap_or(l).trim())
+        .find(|line| line.trim_start().starts_with("hint:"))
+        .map(|line| {
+            line.trim_start()
+                .strip_prefix("hint:")
+                .unwrap_or(line)
+                .trim()
+        })
         .unwrap_or("")
         .to_string();
 
-    let detail = if hint_line.is_empty() {
+    if hint_line.is_empty() {
         stderr.trim().to_string()
     } else {
         hint_line
-    };
-
-    GitPushResult {
-        status: "error".to_string(),
-        message: format!("Push failed: {detail}"),
     }
 }
 
@@ -249,7 +283,7 @@ pub fn classify_push_error(stderr: &str) -> GitPushResult {
 pub fn git_push(vault_path: &str) -> Result<GitPushResult, String> {
     let vault = Path::new(vault_path);
 
-    let output = Command::new("git")
+    let output = git_command()
         .args(["push"])
         .current_dir(vault)
         .output()
@@ -272,7 +306,6 @@ mod tests {
     use crate::git::git_commit;
     use crate::git::tests::{setup_git_repo, setup_remote_pair};
     use std::fs;
-    use std::process::Command;
 
     #[test]
     fn test_has_remote_returns_false_for_local_repo() {
@@ -289,7 +322,7 @@ mod tests {
         let vault = dir.path();
         let vp = vault.to_str().unwrap();
 
-        Command::new("git")
+        git_command()
             .args(["remote", "add", "origin", "https://example.com/repo.git"])
             .current_dir(vault)
             .output()

src-tauri/src/git/status.rs

@@ -1,7 +1,7 @@
+use super::git_command;
 use serde::Serialize;
 use std::collections::HashMap;
 use std::path::Path;
-use std::process::Command;
 
 #[derive(Debug, Serialize, Clone)]
 pub struct ModifiedFile {
@@ -23,14 +23,34 @@ struct DiffStats {
     binary: bool,
 }
 
-fn status_label(status_code: &str) -> &'static str {
-    match status_code.trim() {
-        "M" | "MM" | "AM" => "modified",
-        "A" => "added",
-        "D" => "deleted",
-        "??" => "untracked",
-        "R" | "RM" => "renamed",
-        _ => "modified",
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum FileChangeStatus {
+    Modified,
+    Added,
+    Deleted,
+    Untracked,
+    Renamed,
+}
+
+impl FileChangeStatus {
+    fn from_code(status_code: &str) -> Self {
+        match status_code.trim() {
+            "A" => Self::Added,
+            "D" => Self::Deleted,
+            "??" => Self::Untracked,
+            "R" | "RM" => Self::Renamed,
+            _ => Self::Modified,
+        }
+    }
+
+    fn label(self) -> &'static str {
+        match self {
+            Self::Added => "added",
+            Self::Deleted => "deleted",
+            Self::Untracked => "untracked",
+            Self::Renamed => "renamed",
+            Self::Modified => "modified",
+        }
     }
 }
 
@@ -68,7 +88,7 @@ fn parse_numstat_line(line: &str) -> Option<(String, DiffStats)> {
 }
 
 fn repo_has_head(vault: &Path) -> Result<bool, String> {
-    let output = Command::new("git")
+    let output = git_command()
         .args(["rev-parse", "--verify", "HEAD"])
         .current_dir(vault)
         .output()
@@ -82,7 +102,7 @@ fn load_diff_stats(vault: &Path) -> Result<HashMap<String, DiffStats>, String> {
         return Ok(HashMap::new());
     }
 
-    let output = Command::new("git")
+    let output = git_command()
         .args(["diff", "--numstat", "--find-renames", "HEAD", "--"])
         .current_dir(vault)
         .output()
@@ -100,7 +120,7 @@ fn load_diff_stats(vault: &Path) -> Result<HashMap<String, DiffStats>, String> {
         .collect::<HashMap<_, _>>())
 }
 
-fn count_worktree_lines(vault: &Path, relative_path: &str) -> DiffStats {
+fn count_worktree_lines(vault: &Path, relative_path: &Path) -> DiffStats {
     let full_path = vault.join(relative_path);
     let added_lines = std::fs::read_to_string(full_path)
         .ok()
@@ -115,19 +135,20 @@ fn count_worktree_lines(vault: &Path, relative_path: &str) -> DiffStats {
 
 fn resolve_diff_stats(
     vault: &Path,
-    relative_path: &str,
-    status: &str,
+    relative_path: &Path,
+    status: FileChangeStatus,
     diff_stats: &HashMap<String, DiffStats>,
 ) -> DiffStats {
-    if status == "untracked" {
+    if status == FileChangeStatus::Untracked {
         return count_worktree_lines(vault, relative_path);
     }
 
-    diff_stats.get(relative_path).copied().unwrap_or_default()
+    let key = relative_path.to_string_lossy();
+    diff_stats.get(key.as_ref()).copied().unwrap_or_default()
 }
 
-fn ensure_path_within_vault(vault: &Path, relative_path: &str, abs: &Path) -> Result<(), String> {
-    for component in Path::new(relative_path).components() {
+fn ensure_path_within_vault(vault: &Path, relative_path: &Path, abs: &Path) -> Result<(), String> {
+    for component in relative_path.components() {
         if matches!(component, std::path::Component::ParentDir) {
             return Err("File path is outside the vault".into());
         }
@@ -151,9 +172,10 @@ fn ensure_path_within_vault(vault: &Path, relative_path: &str, abs: &Path) -> Re
     }
 }
 
-fn load_file_status(vault: &Path, relative_path: &str) -> Result<String, String> {
-    let output = Command::new("git")
-        .args(["status", "--porcelain", "--", relative_path])
+fn load_file_status(vault: &Path, relative_path: &Path) -> Result<String, String> {
+    let output = git_command()
+        .args(["status", "--porcelain", "--"])
+        .arg(relative_path)
         .current_dir(vault)
         .output()
         .map_err(|e| format!("Failed to run git status: {e}"))?;
@@ -166,14 +188,16 @@ fn load_file_status(vault: &Path, relative_path: &str) -> Result<String, String>
         .unwrap_or_default())
 }
 
-fn restore_tracked_file(vault: &Path, relative_path: &str) -> Result<(), String> {
-    let _ = Command::new("git")
-        .args(["reset", "HEAD", "--", relative_path])
+fn restore_tracked_file(vault: &Path, relative_path: &Path) -> Result<(), String> {
+    let _ = git_command()
+        .args(["reset", "HEAD", "--"])
+        .arg(relative_path)
         .current_dir(vault)
         .output();
 
-    let checkout = Command::new("git")
-        .args(["checkout", "--", relative_path])
+    let checkout = git_command()
+        .args(["checkout", "--"])
+        .arg(relative_path)
         .current_dir(vault)
         .output()
         .map_err(|e| format!("Failed to run git checkout: {e}"))?;
@@ -189,7 +213,7 @@ fn restore_tracked_file(vault: &Path, relative_path: &str) -> Result<(), String>
 /// Get list of modified/added/deleted files in the vault (uncommitted changes).
 pub fn get_modified_files(vault_path: &str) -> Result<Vec<ModifiedFile>, String> {
     let vault = Path::new(vault_path);
-    let output = Command::new("git")
+    let output = git_command()
         .args(["status", "--porcelain", "--untracked-files=all"])
         .current_dir(vault)
         .output()
@@ -217,14 +241,14 @@ pub fn get_modified_files(vault_path: &str) -> Result<Vec<ModifiedFile>, String>
                 return None;
             }
 
-            let status = status_label(status_code);
+            let status = FileChangeStatus::from_code(status_code);
             let full_path = vault.join(&relative_path).to_string_lossy().to_string();
-            let stats = resolve_diff_stats(vault, &relative_path, status, &diff_stats);
+            let stats = resolve_diff_stats(vault, Path::new(&relative_path), status, &diff_stats);
 
             Some(ModifiedFile {
                 path: full_path,
                 relative_path,
-                status: status.to_string(),
+                status: status.label().to_string(),
                 added_lines: stats.added_lines,
                 deleted_lines: stats.deleted_lines,
                 binary: stats.binary,
@@ -244,10 +268,11 @@ pub fn get_modified_files(vault_path: &str) -> Result<Vec<ModifiedFile>, String>
 /// returned by [`get_modified_files`]).
 pub fn discard_file_changes(vault_path: &str, relative_path: &str) -> Result<(), String> {
     let vault = Path::new(vault_path);
-    let abs = vault.join(relative_path);
+    let relative = Path::new(relative_path);
+    let abs = vault.join(relative);
 
-    ensure_path_within_vault(vault, relative_path, &abs)?;
-    let status_code = load_file_status(vault, relative_path)?;
+    ensure_path_within_vault(vault, relative, &abs)?;
+    let status_code = load_file_status(vault, relative)?;
 
     match status_code.as_str() {
         "??" => {
@@ -255,7 +280,7 @@ pub fn discard_file_changes(vault_path: &str, relative_path: &str) -> Result<(),
                 .map_err(|e| format!("Failed to delete untracked file: {e}"))?;
         }
         _ => {
-            restore_tracked_file(vault, relative_path)?;
+            restore_tracked_file(vault, relative)?;
         }
     }
 
@@ -264,11 +289,11 @@ pub fn discard_file_changes(vault_path: &str, relative_path: &str) -> Result<(),
 
 #[cfg(test)]
 mod tests {
+    use super::git_command;
     use super::*;
     use crate::git::git_commit;
     use crate::git::tests::setup_git_repo;
     use std::fs;
-    use std::process::Command;
 
     fn write_and_commit_markdown(vault: &Path, vp: &str, relative_path: &str, content: &str) {
         fs::write(vault.join(relative_path), content).unwrap();
@@ -282,12 +307,12 @@ mod tests {
 
         // Create and commit a file
         fs::write(vault.join("note.md"), "# Note\n").unwrap();
-        Command::new("git")
+        git_command()
             .args(["add", "note.md"])
             .current_dir(vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["commit", "-m", "Add note"])
             .current_dir(vault)
             .output()
@@ -327,12 +352,12 @@ mod tests {
 
         // Create initial commit so git is initialized
         fs::write(vault.join("init.md"), "# Init\n").unwrap();
-        Command::new("git")
+        git_command()
             .args(["add", "init.md"])
             .current_dir(vault)
             .output()
             .unwrap();
-        Command::new("git")
+        git_command()
             .args(["commit", "-m", "Initial"])
             .current_dir(vault)
             .output()

src-tauri/src/lib.rs

@@ -7,11 +7,25 @@ pub mod git;
 pub mod mcp;
 #[cfg(desktop)]
 pub mod menu;
+pub mod opencode_cli;
+mod opencode_config;
+mod opencode_discovery;
+mod opencode_events;
+pub mod pi_cli;
+mod pi_config;
+mod pi_discovery;
+mod pi_events;
 pub mod search;
 pub mod settings;
 pub mod telemetry;
 pub mod vault;
 pub mod vault_list;
+pub mod vault_watcher;
+#[cfg(desktop)]
+mod window_state;
+
+use std::ffi::OsStr;
+use std::process::Command;
 
 #[cfg(desktop)]
 use std::path::{Path, PathBuf};
@@ -20,12 +34,69 @@ use std::process::Child;
 #[cfg(desktop)]
 use std::sync::Mutex;
 
+#[cfg(windows)]
+const CREATE_NO_WINDOW: u32 = 0x08000000;
+
+pub(crate) fn hidden_command(program: impl AsRef<OsStr>) -> Command {
+    let mut command = Command::new(program);
+    suppress_windows_console(&mut command);
+    command
+}
+
+#[cfg(windows)]
+fn suppress_windows_console(command: &mut Command) {
+    use std::os::windows::process::CommandExt;
+    command.creation_flags(CREATE_NO_WINDOW);
+}
+
+#[cfg(not(windows))]
+fn suppress_windows_console(_command: &mut Command) {}
+
 #[cfg(desktop)]
 struct WsBridgeChild(Mutex<Option<Child>>);
 
 #[cfg(desktop)]
 struct ActiveAssetScopeRoots(Mutex<Vec<PathBuf>>);
 
+#[cfg(any(test, all(desktop, target_os = "linux")))]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+struct StartupEnvOverride {
+    key: &'static str,
+    value: &'static str,
+}
+
+#[cfg(any(test, all(desktop, target_os = "linux")))]
+fn linux_appimage_startup_env_overrides_with<F>(mut get_var: F) -> Vec<StartupEnvOverride>
+where
+    F: FnMut(&str) -> Option<String>,
+{
+    let is_appimage = ["APPIMAGE", "APPDIR"]
+        .into_iter()
+        .any(|key| get_var(key).is_some_and(|value| !value.trim().is_empty()));
+    if !is_appimage {
+        return Vec::new();
+    }
+
+    if get_var("WEBKIT_DISABLE_DMABUF_RENDERER").is_some_and(|value| !value.trim().is_empty()) {
+        return Vec::new();
+    }
+
+    vec![StartupEnvOverride {
+        key: "WEBKIT_DISABLE_DMABUF_RENDERER",
+        value: "1",
+    }]
+}
+
+#[cfg(all(desktop, target_os = "linux"))]
+fn apply_linux_appimage_startup_env_overrides() {
+    for env_override in linux_appimage_startup_env_overrides_with(|key| std::env::var(key).ok()) {
+        std::env::set_var(env_override.key, env_override.value);
+    }
+}
+
+#[cfg(not(all(desktop, target_os = "linux")))]
+fn apply_linux_appimage_startup_env_overrides() {}
+
 #[cfg(desktop)]
 fn log_startup_result(label: &str, result: Result<usize, String>) {
     match result {
@@ -35,6 +106,78 @@ fn log_startup_result(label: &str, result: Result<usize, String>) {
     }
 }
 
+#[cfg(desktop)]
+fn selected_mcp_bridge_vault_path(vault_list: &vault_list::VaultList) -> Option<PathBuf> {
+    vault_list
+        .active_vault
+        .as_deref()
+        .map(str::trim)
+        .filter(|path| !path.is_empty())
+        .map(PathBuf::from)
+}
+
+#[cfg(desktop)]
+fn validate_mcp_bridge_vault_path(vault_path: &Path) -> Result<PathBuf, String> {
+    let resolved = std::fs::canonicalize(vault_path).map_err(|e| {
+        format!(
+            "MCP bridge vault is not available: {} ({e})",
+            vault_path.display()
+        )
+    })?;
+
+    if !resolved.is_dir() {
+        return Err(format!(
+            "MCP bridge vault is not available: {} is not a directory",
+            vault_path.display()
+        ));
+    }
+
+    Ok(resolved)
+}
+
+#[cfg(desktop)]
+fn stop_ws_bridge_child(active_child: &mut Option<Child>) {
+    if let Some(mut child) = active_child.take() {
+        let _ = child.kill();
+        let _ = child.wait();
+        log::info!("ws-bridge child process stopped");
+    }
+}
+
+#[cfg(desktop)]
+pub(crate) fn sync_ws_bridge_for_vault(
+    app_handle: &tauri::AppHandle,
+    vault_path: Option<&Path>,
+) -> Result<&'static str, String> {
+    use tauri::Manager;
+
+    let state: tauri::State<'_, WsBridgeChild> = app_handle.state();
+    let mut active_child = state
+        .0
+        .lock()
+        .map_err(|_| "Failed to lock ws-bridge state".to_string())?;
+
+    let Some(vault_path) = vault_path else {
+        stop_ws_bridge_child(&mut active_child);
+        return Ok("stopped");
+    };
+
+    let resolved_vault_path = match validate_mcp_bridge_vault_path(vault_path) {
+        Ok(path) => path,
+        Err(e) => {
+            stop_ws_bridge_child(&mut active_child);
+            return Err(e);
+        }
+    };
+
+    stop_ws_bridge_child(&mut active_child);
+
+    let child = mcp::spawn_ws_bridge(&resolved_vault_path)?;
+
+    *active_child = Some(child);
+    Ok("started")
+}
+
 /// Run startup housekeeping on the default vault (migrate legacy frontmatter, seed configs).
 #[cfg(desktop)]
 fn run_startup_tasks() {
@@ -57,17 +200,21 @@ fn run_startup_tasks() {
 
 #[cfg(desktop)]
 fn spawn_ws_bridge(app: &mut tauri::App) {
-    use tauri::Manager;
-    let vault_path = dirs::home_dir()
-        .map(|h| h.join("Laputa"))
-        .unwrap_or_default();
-    let vp_str = vault_path.to_string_lossy().to_string();
-    match mcp::spawn_ws_bridge(&vp_str) {
-        Ok(child) => {
-            let state: tauri::State<'_, WsBridgeChild> = app.state();
-            *state.0.lock().unwrap() = Some(child);
+    let vault_path = match vault_list::load_vault_list() {
+        Ok(vault_list) => selected_mcp_bridge_vault_path(&vault_list),
+        Err(e) => {
+            log::warn!("Failed to load active vault for ws-bridge startup: {}", e);
+            None
         }
-        Err(e) => log::warn!("Failed to start ws-bridge: {}", e),
+    };
+
+    let Some(vault_path) = vault_path else {
+        log::info!("ws-bridge not started: no active vault selected");
+        return;
+    };
+
+    if let Err(e) = sync_ws_bridge_for_vault(app.handle(), Some(&vault_path)) {
+        log::warn!("Failed to start ws-bridge: {}", e);
     }
 }
 
@@ -91,11 +238,31 @@ fn setup_desktop_plugins(app: &mut tauri::App) -> Result<(), Box<dyn std::error:
         .plugin(tauri_plugin_updater::Builder::new().build())?;
     app.handle().plugin(tauri_plugin_process::init())?;
     app.handle().plugin(tauri_plugin_opener::init())?;
+    #[cfg(not(target_os = "linux"))]
     menu::setup_menu(app)?;
+    setup_linux_window_chrome(app)?;
+    window_state::restore_main_window_state(app);
     Ok(())
 }
 
-const MACOS_WEBVIEW_RESERVED_COMMAND_KEYS: &[&str] = &["O"];
+#[cfg(all(desktop, target_os = "linux"))]
+fn setup_linux_window_chrome(app: &mut tauri::App) -> Result<(), Box<dyn std::error::Error>> {
+    use tauri::Manager;
+
+    if let Some(window) = app.get_webview_window("main") {
+        let _ = window.set_decorations(false);
+    }
+    Ok(())
+}
+
+#[cfg(not(all(desktop, target_os = "linux")))]
+fn setup_linux_window_chrome(_app: &mut tauri::App) -> Result<(), Box<dyn std::error::Error>> {
+    Ok(())
+}
+
+#[cfg(any(test, all(desktop, target_os = "macos")))]
+const MACOS_WEBVIEW_RESERVED_COMMAND_KEYS: &[&str] = &["O", "F"];
+#[cfg(any(test, all(desktop, target_os = "macos")))]
 const MACOS_WEBVIEW_RESERVED_COMMAND_SHIFT_KEYS: &[&str] = &["L"];
 
 #[cfg(all(desktop, target_os = "macos"))]
@@ -234,10 +401,10 @@ macro_rules! app_invoke_handler {
             commands::get_vault_ai_guidance_status,
             commands::restore_vault_ai_guidance,
             commands::stream_claude_chat,
-            commands::stream_claude_agent,
             commands::stream_ai_agent,
             commands::reload_vault,
             commands::reload_vault_entry,
+            commands::sync_vault_asset_scope_for_window,
             commands::sync_note_title,
             commands::save_image,
             commands::copy_image_to_vault,
@@ -259,7 +426,7 @@ macro_rules! app_invoke_handler {
             commands::download_and_install_app_update,
             commands::load_vault_list,
             commands::save_vault_list,
-            commands::clone_repo,
+            commands::git_clone::clone_git_repo,
             commands::search_vault,
             commands::create_empty_vault,
             commands::create_getting_started_vault,
@@ -268,11 +435,15 @@ macro_rules! app_invoke_handler {
             commands::register_mcp_tools,
             commands::remove_mcp_tools,
             commands::check_mcp_status,
+            commands::get_mcp_config_snippet,
+            commands::sync_mcp_bridge_vault,
             commands::repair_vault,
             commands::reinit_telemetry,
             commands::list_views,
             commands::save_view_cmd,
-            commands::delete_view_cmd
+            commands::delete_view_cmd,
+            vault_watcher::start_vault_watcher,
+            vault_watcher::stop_vault_watcher
         ]
     };
 }
@@ -285,6 +456,8 @@ fn with_invoke_handler(builder: tauri::Builder<tauri::Wry>) -> tauri::Builder<ta
 fn handle_run_event(app_handle: &tauri::AppHandle, event: &tauri::RunEvent) {
     use tauri::Manager;
 
+    window_state::handle_run_event(app_handle, event);
+
     if let tauri::RunEvent::Exit = event {
         let state: tauri::State<'_, WsBridgeChild> = app_handle.state();
         let mut guard = state.0.lock().unwrap();
@@ -297,12 +470,15 @@ fn handle_run_event(app_handle: &tauri::AppHandle, event: &tauri::RunEvent) {
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
+    apply_linux_appimage_startup_env_overrides();
     let builder = tauri::Builder::default();
 
     #[cfg(desktop)]
     let builder = builder
         .manage(WsBridgeChild(Mutex::new(None)))
-        .manage(ActiveAssetScopeRoots(Mutex::new(Vec::new())));
+        .manage(ActiveAssetScopeRoots(Mutex::new(Vec::new())))
+        .manage(window_state::MainWindowFrameState::default())
+        .manage(vault_watcher::VaultWatcherState::new());
 
     with_invoke_handler(builder)
         .setup(setup_app)
@@ -316,16 +492,101 @@ pub fn run() {
 
 #[cfg(test)]
 mod tests {
+    use super::linux_appimage_startup_env_overrides_with;
+    use super::StartupEnvOverride;
+    use super::MACOS_WEBVIEW_RESERVED_COMMAND_KEYS;
     use super::MACOS_WEBVIEW_RESERVED_COMMAND_SHIFT_KEYS;
 
+    #[cfg(desktop)]
+    use super::{selected_mcp_bridge_vault_path, validate_mcp_bridge_vault_path};
+    #[cfg(desktop)]
+    use crate::vault_list::VaultList;
+
     #[cfg(all(desktop, unix))]
     use super::vault_asset_scope_roots;
 
     #[test]
     fn macos_webview_shortcut_prevention_includes_ai_panel_shortcut() {
+        assert_eq!(MACOS_WEBVIEW_RESERVED_COMMAND_KEYS, ["O", "F"]);
         assert_eq!(MACOS_WEBVIEW_RESERVED_COMMAND_SHIFT_KEYS, ["L"]);
     }
 
+    #[test]
+    fn linux_appimage_startup_env_overrides_are_empty_outside_appimage_launches() {
+        let overrides = linux_appimage_startup_env_overrides_with(|_| None);
+
+        assert!(overrides.is_empty());
+    }
+
+    #[test]
+    fn linux_appimage_startup_env_overrides_disable_dmabuf_for_appimages() {
+        let overrides = linux_appimage_startup_env_overrides_with(|key| match key {
+            "APPIMAGE" => Some("/tmp/Tolaria.AppImage".to_string()),
+            _ => None,
+        });
+
+        assert_eq!(
+            overrides,
+            vec![StartupEnvOverride {
+                key: "WEBKIT_DISABLE_DMABUF_RENDERER",
+                value: "1",
+            }]
+        );
+    }
+
+    #[test]
+    fn linux_appimage_startup_env_overrides_preserve_explicit_user_setting() {
+        let overrides = linux_appimage_startup_env_overrides_with(|key| match key {
+            "APPDIR" => Some("/tmp/.mount_Tolaria".to_string()),
+            "WEBKIT_DISABLE_DMABUF_RENDERER" => Some("0".to_string()),
+            _ => None,
+        });
+
+        assert!(overrides.is_empty());
+    }
+
+    #[cfg(desktop)]
+    #[test]
+    fn selected_mcp_bridge_vault_path_uses_persisted_active_vault() {
+        let list = VaultList {
+            vaults: Vec::new(),
+            active_vault: Some("/tmp/Selected Vault".to_string()),
+            hidden_defaults: Vec::new(),
+        };
+
+        assert_eq!(
+            selected_mcp_bridge_vault_path(&list),
+            Some(std::path::PathBuf::from("/tmp/Selected Vault"))
+        );
+    }
+
+    #[cfg(desktop)]
+    #[test]
+    fn selected_mcp_bridge_vault_path_ignores_blank_active_vault() {
+        let list = VaultList {
+            vaults: Vec::new(),
+            active_vault: Some("  ".to_string()),
+            hidden_defaults: Vec::new(),
+        };
+
+        assert_eq!(selected_mcp_bridge_vault_path(&list), None);
+    }
+
+    #[cfg(desktop)]
+    #[test]
+    fn validate_mcp_bridge_vault_path_requires_existing_directory() {
+        let dir = tempfile::tempdir().unwrap();
+        let vault = dir.path().join("Vault With Spaces");
+        std::fs::create_dir(&vault).unwrap();
+
+        let resolved = validate_mcp_bridge_vault_path(&vault).unwrap();
+        assert_eq!(resolved, vault.canonicalize().unwrap());
+
+        let missing = dir.path().join("Missing Vault");
+        let err = validate_mcp_bridge_vault_path(&missing).unwrap_err();
+        assert!(err.contains("MCP bridge vault is not available"));
+    }
+
     #[cfg(all(desktop, unix))]
     #[test]
     fn vault_asset_scope_roots_include_requested_symlink_path() {

src-tauri/src/mcp.rs

@@ -17,32 +17,110 @@ pub enum McpStatus {
 
 /// Find the `node` binary path at runtime.
 pub(crate) fn find_node() -> Result<PathBuf, String> {
-    let output = Command::new("which")
-        .arg("node")
+    let output = node_lookup_command()
         .output()
-        .map_err(|e| format!("Failed to run `which node`: {e}"))?;
+        .map_err(|e| format!("Failed to locate node on PATH: {e}"))?;
     if output.status.success() {
-        let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
-        if !path.is_empty() {
-            return Ok(PathBuf::from(path));
+        if let Some(path) = first_node_lookup_path(&output.stdout) {
+            verify_node_version(&path)?;
+            return Ok(path);
         }
     }
 
     if let Some(path) = fallback_node_path() {
+        verify_node_version(&path)?;
         return Ok(path);
     }
 
     Err("node not found in PATH or common install locations".into())
 }
 
+fn first_node_lookup_path(stdout: &[u8]) -> Option<PathBuf> {
+    String::from_utf8_lossy(stdout)
+        .lines()
+        .map(str::trim)
+        .find(|line| !line.is_empty())
+        .map(PathBuf::from)
+}
+
+fn verify_node_version(node: &Path) -> Result<(), String> {
+    let output = crate::hidden_command(node)
+        .arg("--version")
+        .output()
+        .map_err(|e| format!("Failed to run {} --version: {e}", node.display()))?;
+    if !output.status.success() {
+        return Err(format!(
+            "{} --version failed; install Node.js 18+ and make it available on PATH",
+            node.display()
+        ));
+    }
+
+    let raw_version = String::from_utf8_lossy(&output.stdout);
+    let Some(major) = node_major_version(&raw_version) else {
+        return Err(format!(
+            "Cannot parse Node.js version from '{}'",
+            raw_version.trim()
+        ));
+    };
+    if major < 18 {
+        return Err(format!(
+            "Node.js 18+ is required for Tolaria MCP tools; found {}",
+            raw_version.trim()
+        ));
+    }
+
+    Ok(())
+}
+
+fn node_major_version(version: &str) -> Option<u32> {
+    version
+        .trim()
+        .trim_start_matches('v')
+        .split('.')
+        .next()
+        .and_then(|major| major.parse().ok())
+}
+
+fn node_lookup_command() -> Command {
+    #[cfg(windows)]
+    let mut command = crate::hidden_command("where.exe");
+    #[cfg(not(windows))]
+    let mut command = crate::hidden_command("which");
+
+    command.arg("node");
+    command
+}
+
 fn fallback_node_path() -> Option<PathBuf> {
     let mut candidates = vec![
         PathBuf::from("/opt/homebrew/bin/node"),
         PathBuf::from("/usr/local/bin/node"),
     ];
 
+    #[cfg(windows)]
+    {
+        if let Some(program_files) = std::env::var_os("ProgramFiles") {
+            candidates.push(PathBuf::from(program_files).join("nodejs").join("node.exe"));
+        }
+        if let Some(program_files_x86) = std::env::var_os("ProgramFiles(x86)") {
+            candidates.push(
+                PathBuf::from(program_files_x86)
+                    .join("nodejs")
+                    .join("node.exe"),
+            );
+        }
+        if let Some(local_app_data) = std::env::var_os("LOCALAPPDATA") {
+            candidates.push(
+                PathBuf::from(local_app_data)
+                    .join("Programs")
+                    .join("nodejs")
+                    .join("node.exe"),
+            );
+        }
+    }
+
     if let Some(home) = dirs::home_dir() {
-        candidates.push(home.join(".volta").join("bin").join("node"));
+        candidates.push(home.join(".volta").join("bin").join(node_binary_name()));
 
         let nvm_dir = home.join(".nvm").join("versions").join("node");
         if let Ok(entries) = std::fs::read_dir(nvm_dir) {
@@ -62,6 +140,14 @@ fn fallback_node_path() -> Option<PathBuf> {
     candidates.into_iter().find(|path| path.is_file())
 }
 
+fn node_binary_name() -> &'static str {
+    if cfg!(windows) {
+        "node.exe"
+    } else {
+        "node"
+    }
+}
+
 /// Resolve the path to `mcp-server/`.
 ///
 /// In dev mode, uses `CARGO_MANIFEST_DIR` (set at compile time).
@@ -70,36 +156,72 @@ pub(crate) fn mcp_server_dir() -> Result<PathBuf, String> {
     let dev_path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
         .join("..")
         .join("mcp-server");
-    if dev_path.join("ws-bridge.js").exists() {
-        return Ok(std::fs::canonicalize(&dev_path).unwrap_or(dev_path));
-    }
-
     let exe = std::env::current_exe().map_err(|e| format!("Cannot find executable: {e}"))?;
-    // On macOS the exe lives at Contents/MacOS/<binary>.
-    // Resources are placed at Contents/Resources/ by Tauri.
-    let release_path = exe
-        .parent()
-        .and_then(|p| p.parent())
-        .map(|p| p.join("Resources").join("mcp-server"))
-        .ok_or_else(|| "Cannot resolve mcp-server directory".to_string())?;
-    if release_path.join("ws-bridge.js").exists() {
-        return Ok(release_path);
+    let appdir = std::env::var_os("APPDIR").map(PathBuf::from);
+    let candidates = mcp_server_dir_candidates(&dev_path, &exe, appdir.as_deref());
+    if let Some(path) = candidates
+        .iter()
+        .find(|path| mcp_server_dir_has_files(path))
+    {
+        return Ok(std::fs::canonicalize(path).unwrap_or_else(|_| path.clone()));
     }
 
+    let searched = candidates
+        .iter()
+        .map(|path| path.display().to_string())
+        .collect::<Vec<_>>()
+        .join(", ");
     Err(format!(
-        "mcp-server not found at {} or {}",
-        dev_path.display(),
-        release_path.display()
+        "mcp-server not found. Searched these paths: {searched}"
     ))
 }
 
+fn mcp_server_dir_candidates(
+    dev_path: &Path,
+    exe_path: &Path,
+    appdir: Option<&Path>,
+) -> Vec<PathBuf> {
+    let mut candidates = vec![dev_path.to_path_buf()];
+
+    if let Some(exe_dir) = exe_path.parent() {
+        candidates.push(exe_dir.join("mcp-server"));
+        if let Some(bundle_root) = exe_dir.parent() {
+            candidates.push(bundle_root.join("Resources").join("mcp-server"));
+            candidates.push(bundle_root.join("lib").join("tolaria").join("mcp-server"));
+        }
+    }
+
+    if let Some(appdir) = appdir {
+        candidates.push(
+            appdir
+                .join("usr")
+                .join("lib")
+                .join("tolaria")
+                .join("mcp-server"),
+        );
+    }
+
+    candidates.push(
+        PathBuf::from("/usr")
+            .join("lib")
+            .join("tolaria")
+            .join("mcp-server"),
+    );
+    candidates
+}
+
+fn mcp_server_dir_has_files(path: &Path) -> bool {
+    path.join("index.js").is_file() && path.join("ws-bridge.js").is_file()
+}
+
 /// Spawn the WebSocket bridge as a child process.
-pub fn spawn_ws_bridge(vault_path: &str) -> Result<Child, String> {
+pub fn spawn_ws_bridge(vault_path: impl AsRef<Path>) -> Result<Child, String> {
     let node = find_node()?;
     let server_dir = mcp_server_dir()?;
     let script = server_dir.join("ws-bridge.js");
+    let vault_path = vault_path.as_ref();
 
-    let child = Command::new(node)
+    let child = crate::hidden_command(node)
         .arg(&script)
         .env("VAULT_PATH", vault_path)
         .env("WS_PORT", "9710")
@@ -110,18 +232,28 @@ pub fn spawn_ws_bridge(vault_path: &str) -> Result<Child, String> {
         .spawn()
         .map_err(|e| format!("Failed to spawn ws-bridge: {e}"))?;
 
-    log::info!("ws-bridge spawned (pid: {})", child.id());
+    log::info!(
+        "ws-bridge spawned (pid: {}, vault: {})",
+        child.id(),
+        vault_path.display()
+    );
     Ok(child)
 }
 
 fn mcp_config_paths() -> Vec<PathBuf> {
-    [
-        dirs::home_dir().map(|home| home.join(".claude").join("mcp.json")),
-        dirs::home_dir().map(|home| home.join(".cursor").join("mcp.json")),
+    dirs::home_dir()
+        .map(|home| mcp_config_paths_for_home(&home))
+        .unwrap_or_default()
+}
+
+fn mcp_config_paths_for_home(home: &Path) -> Vec<PathBuf> {
+    vec![
+        home.join(".claude.json"),
+        home.join(".claude").join("mcp.json"),
+        home.join(".gemini").join("settings.json"),
+        home.join(".cursor").join("mcp.json"),
+        home.join(".config").join("mcp").join("mcp.json"),
     ]
-    .into_iter()
-    .flatten()
-    .collect()
 }
 
 fn read_registered_mcp_entry(config_path: &Path) -> Option<serde_json::Value> {
@@ -146,6 +278,14 @@ fn entry_index_js_exists(entry: &serde_json::Value) -> bool {
         .is_some_and(|index_js| Path::new(index_js).exists())
 }
 
+fn entry_uses_stdio(entry: &serde_json::Value) -> bool {
+    entry["type"].as_str() == Some("stdio")
+}
+
+fn entry_has_ui_port(entry: &serde_json::Value) -> bool {
+    entry["env"]["WS_UI_PORT"].as_str() == Some("9711")
+}
+
 fn entry_targets_vault(entry: &serde_json::Value, vault_path: &Path) -> bool {
     let Some(entry_vault_path) = entry["env"]["VAULT_PATH"].as_str() else {
         return false;
@@ -162,14 +302,40 @@ fn entry_targets_vault(entry: &serde_json::Value, vault_path: &Path) -> bool {
 }
 
 /// Build the MCP server entry JSON for a given vault path and index.js path.
-fn build_mcp_entry(index_js: &str, vault_path: &str) -> serde_json::Value {
+fn build_mcp_entry(node_command: &str, index_js: &str, vault_path: &str) -> serde_json::Value {
     serde_json::json!({
-        "command": "node",
+        "type": "stdio",
+        "command": node_command,
         "args": [index_js],
-        "env": { "VAULT_PATH": vault_path }
+        "env": {
+            "VAULT_PATH": vault_path,
+            "WS_UI_PORT": "9711"
+        }
     })
 }
 
+fn build_mcp_config_snippet(entry: &serde_json::Value) -> Result<String, String> {
+    let mut servers = serde_json::Map::new();
+    servers.insert(MCP_SERVER_NAME.to_string(), entry.clone());
+    let config = serde_json::json!({ "mcpServers": servers });
+
+    serde_json::to_string_pretty(&config)
+        .map_err(|e| format!("Failed to serialize MCP config snippet: {e}"))
+}
+
+/// Build the exact MCP config JSON users can copy into compatible tools.
+pub fn mcp_config_snippet(vault_path: &str) -> Result<String, String> {
+    let node = find_node().map_err(|e| {
+        format!("Node.js 18+ is required on PATH before Tolaria can build MCP config: {e}")
+    })?;
+    let server_dir = mcp_server_dir()?;
+    let index_js = server_dir.join("index.js").to_string_lossy().into_owned();
+    let node_command = node.to_string_lossy().into_owned();
+    let entry = build_mcp_entry(&node_command, &index_js, vault_path);
+
+    build_mcp_config_snippet(&entry)
+}
+
 /// Write MCP registration to a list of config file paths.
 /// Returns "registered" on first registration, "updated" if already present.
 fn register_mcp_to_configs(entry: &serde_json::Value, config_paths: &[PathBuf]) -> String {
@@ -184,12 +350,16 @@ fn register_mcp_to_configs(entry: &serde_json::Value, config_paths: &[PathBuf])
     status.to_string()
 }
 
-/// Register Tolaria as an MCP server in Claude Code and Cursor config files.
+/// Register Tolaria as an MCP server in external AI tool config files.
 pub fn register_mcp(vault_path: &str) -> Result<String, String> {
+    let node = find_node().map_err(|e| {
+        format!("Node.js 18+ is required on PATH before Tolaria can register MCP tools: {e}")
+    })?;
     let server_dir = mcp_server_dir()?;
     let index_js = server_dir.join("index.js").to_string_lossy().into_owned();
+    let node_command = node.to_string_lossy().into_owned();
 
-    let entry = build_mcp_entry(&index_js, vault_path);
+    let entry = build_mcp_entry(&node_command, &index_js, vault_path);
 
     Ok(register_mcp_to_configs(&entry, &mcp_config_paths()))
 }
@@ -297,13 +467,16 @@ pub fn remove_mcp() -> String {
 /// Check whether the MCP server is properly installed and registered.
 ///
 /// Returns `Installed` when the Tolaria entry exists for the active vault in
-/// Claude Code or Cursor config and the referenced index.js file is present.
+/// an external AI tool config and the referenced index.js file is present.
 /// Otherwise returns `NotInstalled`.
 pub fn check_mcp_status(vault_path: &str) -> McpStatus {
     let active_vault_path = Path::new(vault_path);
     if mcp_config_paths().into_iter().any(|config_path| {
         read_registered_mcp_entry(&config_path).is_some_and(|entry| {
-            entry_index_js_exists(&entry) && entry_targets_vault(&entry, active_vault_path)
+            entry_uses_stdio(&entry)
+                && entry_index_js_exists(&entry)
+                && entry_has_ui_port(&entry)
+                && entry_targets_vault(&entry, active_vault_path)
         })
     }) {
         McpStatus::Installed
@@ -321,6 +494,51 @@ mod tests {
         serde_json::from_str(&raw).unwrap()
     }
 
+    fn temp_config_path(file_name: &str) -> (tempfile::TempDir, PathBuf) {
+        let tmp = tempfile::tempdir().unwrap();
+        let config_path = tmp.path().join(file_name);
+        (tmp, config_path)
+    }
+
+    fn write_config_json(config_path: &Path, config: serde_json::Value) {
+        std::fs::write(config_path, serde_json::to_string(&config).unwrap()).unwrap();
+    }
+
+    fn managed_server(index_js: &str, vault_path: &str) -> serde_json::Value {
+        serde_json::json!({
+            "type": "stdio",
+            "command": "node",
+            "args": [index_js],
+            "env": { "VAULT_PATH": vault_path, "WS_UI_PORT": "9711" }
+        })
+    }
+
+    fn test_mcp_entry(index_js: &str, vault_path: &str) -> serde_json::Value {
+        build_mcp_entry("node", index_js, vault_path)
+    }
+
+    fn write_mcp_servers_config(config_path: &Path, servers: Vec<(&str, serde_json::Value)>) {
+        let servers = servers
+            .into_iter()
+            .map(|(name, server)| (name.to_string(), server))
+            .collect::<serde_json::Map<_, _>>();
+        write_config_json(config_path, serde_json::json!({ "mcpServers": servers }));
+    }
+
+    struct ExpectedMcpServer<'a> {
+        index_js: &'a str,
+        vault_path: &'a str,
+    }
+
+    fn assert_registered_tolaria_server(
+        config: &serde_json::Value,
+        expected: ExpectedMcpServer<'_>,
+    ) {
+        let server = &config["mcpServers"][MCP_SERVER_NAME];
+        assert_eq!(server["args"][0], expected.index_js);
+        assert_eq!(server["env"]["VAULT_PATH"], expected.vault_path);
+    }
+
     fn write_index_js(dir: &Path) -> PathBuf {
         let index_js = dir.join("index.js");
         std::fs::write(&index_js, "console.log('ok');").unwrap();
@@ -329,29 +547,83 @@ mod tests {
 
     #[test]
     fn build_mcp_entry_produces_correct_json() {
-        let entry = build_mcp_entry("/path/to/index.js", "/my/vault");
-        assert_eq!(entry["command"], "node");
+        let entry = build_mcp_entry("/usr/local/bin/node", "/path/to/index.js", "/my/vault");
+        assert_eq!(entry["type"], "stdio");
+        assert_eq!(entry["command"], "/usr/local/bin/node");
         assert_eq!(entry["args"][0], "/path/to/index.js");
         assert_eq!(entry["env"]["VAULT_PATH"], "/my/vault");
+        assert_eq!(entry["env"]["WS_UI_PORT"], "9711");
+    }
+
+    #[test]
+    fn build_mcp_config_snippet_wraps_tolaria_server_entry() {
+        let entry = test_mcp_entry("/path/to/index.js", "/my/vault");
+        let snippet = build_mcp_config_snippet(&entry).unwrap();
+        let config: serde_json::Value = serde_json::from_str(&snippet).unwrap();
+
+        assert_eq!(
+            config["mcpServers"][MCP_SERVER_NAME]["args"][0],
+            "/path/to/index.js"
+        );
+        assert_eq!(
+            config["mcpServers"][MCP_SERVER_NAME]["env"]["VAULT_PATH"],
+            "/my/vault"
+        );
+    }
+
+    #[test]
+    fn first_node_lookup_path_uses_first_non_empty_line() {
+        let stdout = b"\nC:\\Program Files\\nodejs\\node.exe\r\nC:\\Other\\node.exe\r\n";
+        assert_eq!(
+            first_node_lookup_path(stdout).unwrap(),
+            PathBuf::from("C:\\Program Files\\nodejs\\node.exe")
+        );
+    }
+
+    #[test]
+    fn node_major_version_accepts_current_node_output() {
+        assert_eq!(node_major_version("v24.13.1\n"), Some(24));
+        assert_eq!(node_major_version("18.19.0"), Some(18));
+        assert_eq!(node_major_version("not-node"), None);
+    }
+
+    #[test]
+    fn mcp_server_dir_candidates_prefer_exe_dir_before_macos_resources() {
+        let dev_path = Path::new("/repo/mcp-server");
+        let exe_path = Path::new("/Users/tester/AppData/Local/Tolaria/tolaria.exe");
+        let candidates = mcp_server_dir_candidates(dev_path, exe_path, None);
+
+        let windows_dir = PathBuf::from("/Users/tester/AppData/Local/Tolaria/mcp-server");
+        let macos_dir = PathBuf::from("/Users/tester/AppData/Local/Resources/mcp-server");
+        let windows_pos = candidates
+            .iter()
+            .position(|path| path == &windows_dir)
+            .unwrap();
+        let macos_pos = candidates
+            .iter()
+            .position(|path| path == &macos_dir)
+            .unwrap();
+
+        assert_eq!(candidates[0], dev_path);
+        assert!(windows_pos < macos_pos);
     }
 
     #[test]
     fn upsert_creates_new_config() {
         let tmp = tempfile::tempdir().unwrap();
         let config_path = tmp.path().join("mcp.json");
-        let entry = build_mcp_entry("/test/index.js", "/test/vault");
+        let entry = test_mcp_entry("/test/index.js", "/test/vault");
 
         let was_update = upsert_mcp_config(&config_path, &entry).unwrap();
         assert!(!was_update);
 
         let config = read_config(&config_path);
-        assert_eq!(
-            config["mcpServers"][MCP_SERVER_NAME]["args"][0],
-            "/test/index.js"
-        );
-        assert_eq!(
-            config["mcpServers"][MCP_SERVER_NAME]["env"]["VAULT_PATH"],
-            "/test/vault"
+        assert_registered_tolaria_server(
+            &config,
+            ExpectedMcpServer {
+                index_js: "/test/index.js",
+                vault_path: "/test/vault",
+            },
         );
     }
 
@@ -360,10 +632,10 @@ mod tests {
         let tmp = tempfile::tempdir().unwrap();
         let config_path = tmp.path().join("mcp.json");
 
-        let entry1 = build_mcp_entry("/test/index.js", "/vault/v1");
+        let entry1 = test_mcp_entry("/test/index.js", "/vault/v1");
         upsert_mcp_config(&config_path, &entry1).unwrap();
 
-        let entry2 = build_mcp_entry("/test/index.js", "/vault/v2");
+        let entry2 = test_mcp_entry("/test/index.js", "/vault/v2");
         let was_update = upsert_mcp_config(&config_path, &entry2).unwrap();
         assert!(was_update);
 
@@ -390,7 +662,7 @@ mod tests {
         });
         std::fs::write(&config_path, serde_json::to_string(&existing).unwrap()).unwrap();
 
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
         let was_update = upsert_mcp_config(&config_path, &entry).unwrap();
         assert!(was_update);
 
@@ -404,17 +676,16 @@ mod tests {
 
     #[test]
     fn upsert_preserves_other_servers() {
-        let tmp = tempfile::tempdir().unwrap();
-        let config_path = tmp.path().join("mcp.json");
+        let (_tmp, config_path) = temp_config_path("mcp.json");
+        write_mcp_servers_config(
+            &config_path,
+            vec![(
+                "other-server",
+                serde_json::json!({ "command": "other", "args": [] }),
+            )],
+        );
 
-        let existing = serde_json::json!({
-            "mcpServers": {
-                "other-server": { "command": "other", "args": [] }
-            }
-        });
-        std::fs::write(&config_path, serde_json::to_string(&existing).unwrap()).unwrap();
-
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
         upsert_mcp_config(&config_path, &entry).unwrap();
 
         let raw = std::fs::read_to_string(&config_path).unwrap();
@@ -423,11 +694,64 @@ mod tests {
         assert!(config["mcpServers"][MCP_SERVER_NAME].is_object());
     }
 
+    #[test]
+    fn upsert_preserves_other_top_level_settings() {
+        let (_tmp, config_path) = temp_config_path(".claude.json");
+        write_config_json(
+            &config_path,
+            serde_json::json!({
+                "model": "sonnet",
+                "theme": "dark",
+                "mcpServers": {
+                    "other-server": { "command": "other", "args": [] }
+                }
+            }),
+        );
+
+        let entry = test_mcp_entry("/test/index.js", "/vault");
+        upsert_mcp_config(&config_path, &entry).unwrap();
+
+        let config = read_config(&config_path);
+        assert_eq!(config["model"], "sonnet");
+        assert_eq!(config["theme"], "dark");
+        assert!(config["mcpServers"]["other-server"].is_object());
+        assert!(config["mcpServers"][MCP_SERVER_NAME].is_object());
+    }
+
+    #[test]
+    fn upsert_preserves_gemini_settings_json_fields() {
+        let (_tmp, config_path) = temp_config_path("settings.json");
+        write_config_json(
+            &config_path,
+            serde_json::json!({
+                "theme": "GitHub",
+                "mcpServers": {
+                    "other": { "command": "example" }
+                }
+            }),
+        );
+        let entry = test_mcp_entry("/gemini/index.js", "/gemini-vault");
+
+        let was_update = upsert_mcp_config(&config_path, &entry).unwrap();
+        let config = read_config(&config_path);
+
+        assert!(!was_update);
+        assert_eq!(config["theme"], "GitHub");
+        assert_eq!(config["mcpServers"]["other"]["command"], "example");
+        assert_registered_tolaria_server(
+            &config,
+            ExpectedMcpServer {
+                index_js: "/gemini/index.js",
+                vault_path: "/gemini-vault",
+            },
+        );
+    }
+
     #[test]
     fn upsert_creates_parent_dirs() {
         let tmp = tempfile::tempdir().unwrap();
         let config_path = tmp.path().join("nested").join("dir").join("mcp.json");
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
 
         upsert_mcp_config(&config_path, &entry).unwrap();
         assert!(config_path.exists());
@@ -437,7 +761,7 @@ mod tests {
     fn register_mcp_to_configs_returns_registered_for_new() {
         let tmp = tempfile::tempdir().unwrap();
         let config = tmp.path().join("claude").join("mcp.json");
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
 
         let status = register_mcp_to_configs(&entry, &[config]);
         assert_eq!(status, "registered");
@@ -447,7 +771,7 @@ mod tests {
     fn register_mcp_to_configs_returns_updated_for_existing() {
         let tmp = tempfile::tempdir().unwrap();
         let config = tmp.path().join("mcp.json");
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
 
         // First call
         register_mcp_to_configs(&entry, std::slice::from_ref(&config));
@@ -491,20 +815,55 @@ mod tests {
     #[test]
     fn register_mcp_to_configs_writes_multiple_configs() {
         let tmp = tempfile::tempdir().unwrap();
+        let claude_user_cfg = tmp.path().join(".claude.json");
         let claude_cfg = tmp.path().join("claude").join("mcp.json");
+        let gemini_cfg = tmp.path().join(".gemini").join("settings.json");
         let cursor_cfg = tmp.path().join("cursor").join("mcp.json");
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let generic_cfg = tmp.path().join(".config").join("mcp").join("mcp.json");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
 
-        register_mcp_to_configs(&entry, &[claude_cfg.clone(), cursor_cfg.clone()]);
+        register_mcp_to_configs(
+            &entry,
+            &[
+                claude_user_cfg.clone(),
+                claude_cfg.clone(),
+                gemini_cfg.clone(),
+                cursor_cfg.clone(),
+                generic_cfg.clone(),
+            ],
+        );
 
+        assert!(claude_user_cfg.exists());
         assert!(claude_cfg.exists());
+        assert!(gemini_cfg.exists());
         assert!(cursor_cfg.exists());
+        assert!(generic_cfg.exists());
 
-        let raw = std::fs::read_to_string(&claude_cfg).unwrap();
+        let raw = std::fs::read_to_string(&claude_user_cfg).unwrap();
         let config: serde_json::Value = serde_json::from_str(&raw).unwrap();
+        assert_registered_tolaria_server(
+            &config,
+            ExpectedMcpServer {
+                index_js: "/test/index.js",
+                vault_path: "/vault",
+            },
+        );
+    }
+
+    #[test]
+    fn mcp_config_paths_for_home_includes_all_supported_config_paths() {
+        let home = Path::new("/Users/tester");
+        let paths = mcp_config_paths_for_home(home);
+
         assert_eq!(
-            config["mcpServers"][MCP_SERVER_NAME]["args"][0],
-            "/test/index.js"
+            paths,
+            vec![
+                home.join(".claude.json"),
+                home.join(".claude").join("mcp.json"),
+                home.join(".gemini").join("settings.json"),
+                home.join(".cursor").join("mcp.json"),
+                home.join(".config").join("mcp").join("mcp.json"),
+            ]
         );
     }
     #[test]
@@ -512,14 +871,14 @@ mod tests {
         let tmp = tempfile::tempdir().unwrap();
         let config_path = tmp.path().join("mcp.json");
         std::fs::write(&config_path, "not valid json{{{{").unwrap();
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
         let result = upsert_mcp_config(&config_path, &entry);
         assert!(result.is_err());
     }
 
     #[test]
     fn register_mcp_to_configs_handles_empty_list() {
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
         // Empty config list — function should return "registered" (no existing)
         let status = register_mcp_to_configs(&entry, &[]);
         // With empty config list, there were no updates, so status should be "registered"
@@ -528,23 +887,20 @@ mod tests {
 
     #[test]
     fn read_registered_mcp_entry_prefers_primary_server_name() {
-        let tmp = tempfile::tempdir().unwrap();
-        let config_path = tmp.path().join("mcp.json");
-        let config = serde_json::json!({
-            "mcpServers": {
-                "tolaria": {
-                    "command": "node",
-                    "args": ["/primary/index.js"],
-                    "env": { "VAULT_PATH": "/primary" }
-                },
-                "laputa": {
-                    "command": "node",
-                    "args": ["/legacy/index.js"],
-                    "env": { "VAULT_PATH": "/legacy" }
-                }
-            }
-        });
-        std::fs::write(&config_path, serde_json::to_string(&config).unwrap()).unwrap();
+        let (_tmp, config_path) = temp_config_path("mcp.json");
+        write_mcp_servers_config(
+            &config_path,
+            vec![
+                (
+                    MCP_SERVER_NAME,
+                    managed_server("/primary/index.js", "/primary"),
+                ),
+                (
+                    LEGACY_MCP_SERVER_NAME,
+                    managed_server("/legacy/index.js", "/legacy"),
+                ),
+            ],
+        );
 
         let entry = read_registered_mcp_entry(&config_path).unwrap();
         assert_eq!(entry["env"]["VAULT_PATH"], "/primary");
@@ -552,18 +908,14 @@ mod tests {
 
     #[test]
     fn read_registered_mcp_entry_uses_legacy_server_name() {
-        let tmp = tempfile::tempdir().unwrap();
-        let config_path = tmp.path().join("mcp.json");
-        let config = serde_json::json!({
-            "mcpServers": {
-                "laputa": {
-                    "command": "node",
-                    "args": ["/legacy/index.js"],
-                    "env": { "VAULT_PATH": "/legacy" }
-                }
-            }
-        });
-        std::fs::write(&config_path, serde_json::to_string(&config).unwrap()).unwrap();
+        let (_tmp, config_path) = temp_config_path("mcp.json");
+        write_mcp_servers_config(
+            &config_path,
+            vec![(
+                LEGACY_MCP_SERVER_NAME,
+                managed_server("/legacy/index.js", "/legacy"),
+            )],
+        );
 
         let entry = read_registered_mcp_entry(&config_path).unwrap();
         assert_eq!(entry["env"]["VAULT_PATH"], "/legacy");
@@ -611,7 +963,7 @@ mod tests {
         let config_path = tmp.path().join("mcp.json");
         std::fs::write(&config_path, "[]").unwrap();
 
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
         let result = upsert_mcp_config(&config_path, &entry);
         assert!(matches!(result, Err(ref error) if error.contains("Config is not a JSON object")));
     }
@@ -625,7 +977,7 @@ mod tests {
         });
         std::fs::write(&config_path, serde_json::to_string(&config).unwrap()).unwrap();
 
-        let entry = build_mcp_entry("/test/index.js", "/vault");
+        let entry = test_mcp_entry("/test/index.js", "/vault");
         let result = upsert_mcp_config(&config_path, &entry);
         assert!(
             matches!(result, Err(ref error) if error.contains("mcpServers is not a JSON object"))

src-tauri/src/menu.rs

@@ -13,6 +13,8 @@ const FILE_QUICK_OPEN: &str = "file-quick-open";
 const FILE_QUICK_OPEN_ALIAS: &str = "file-quick-open-alias";
 const FILE_SAVE: &str = "file-save";
 
+const EDIT_FIND_IN_NOTE: &str = "edit-find-in-note";
+const EDIT_REPLACE_IN_NOTE: &str = "edit-replace-in-note";
 const EDIT_FIND_IN_VAULT: &str = "edit-find-in-vault";
 const EDIT_TOGGLE_NOTE_LIST_SEARCH: &str = "edit-toggle-note-list-search";
 const EDIT_TOGGLE_RAW_EDITOR: &str = "edit-toggle-raw-editor";
@@ -62,6 +64,8 @@ const CUSTOM_IDS: &[&str] = &[
     FILE_QUICK_OPEN,
     FILE_QUICK_OPEN_ALIAS,
     FILE_SAVE,
+    EDIT_FIND_IN_NOTE,
+    EDIT_REPLACE_IN_NOTE,
     EDIT_FIND_IN_VAULT,
     EDIT_TOGGLE_NOTE_LIST_SEARCH,
     EDIT_TOGGLE_RAW_EDITOR,
@@ -112,6 +116,9 @@ const NOTE_DEPENDENT_IDS: &[&str] = &[
     NOTE_OPEN_IN_NEW_WINDOW,
 ];
 
+/// IDs of menu items that depend on the editor being the active surface.
+const EDITOR_FIND_DEPENDENT_IDS: &[&str] = &[EDIT_FIND_IN_NOTE, EDIT_REPLACE_IN_NOTE];
+
 /// IDs of menu items that depend on the note list being the active surface.
 const NOTE_LIST_SEARCH_DEPENDENT_IDS: &[&str] = &[EDIT_TOGGLE_NOTE_LIST_SEARCH];
 
@@ -156,6 +163,11 @@ fn build_app_menu(app: &App) -> MenuResult {
 }
 
 fn build_file_menu(app: &App) -> MenuResult {
+    let quick_open_alias_label = if cfg!(target_os = "macos") {
+        "Quick Open (Cmd+O)"
+    } else {
+        "Quick Open (Ctrl+O)"
+    };
     let new_note = MenuItemBuilder::new("New Note")
         .id(FILE_NEW_NOTE)
         .accelerator("CmdOrCtrl+N")
@@ -167,7 +179,7 @@ fn build_file_menu(app: &App) -> MenuResult {
         .id(FILE_QUICK_OPEN)
         .accelerator("CmdOrCtrl+P")
         .build(app)?;
-    let quick_open_alias = MenuItemBuilder::new("Quick Open (Cmd+O)")
+    let quick_open_alias = MenuItemBuilder::new(quick_open_alias_label)
         .id(FILE_QUICK_OPEN_ALIAS)
         .accelerator("CmdOrCtrl+O")
         .build(app)?;
@@ -186,6 +198,15 @@ fn build_file_menu(app: &App) -> MenuResult {
 }
 
 fn build_edit_menu(app: &App) -> MenuResult {
+    let find_in_note = MenuItemBuilder::new("Find in Note")
+        .id(EDIT_FIND_IN_NOTE)
+        .accelerator("CmdOrCtrl+F")
+        .enabled(false)
+        .build(app)?;
+    let replace_in_note = MenuItemBuilder::new("Replace in Note")
+        .id(EDIT_REPLACE_IN_NOTE)
+        .enabled(false)
+        .build(app)?;
     let find_in_vault = MenuItemBuilder::new("Find in Vault")
         .id(EDIT_FIND_IN_VAULT)
         .accelerator("CmdOrCtrl+Shift+F")
@@ -209,6 +230,8 @@ fn build_edit_menu(app: &App) -> MenuResult {
         .separator()
         .select_all()
         .separator()
+        .item(&find_in_note)
+        .item(&replace_in_note)
         .item(&find_in_vault)
         .item(&toggle_note_list_search)
         .item(&toggle_diff)
@@ -320,7 +343,7 @@ fn build_note_menu(app: &App) -> MenuResult {
         .build(app)?;
     let toggle_ai_chat = MenuItemBuilder::new("Toggle AI Panel")
         .id(VIEW_TOGGLE_AI_CHAT)
-        .accelerator("Cmd+Shift+L")
+        .accelerator("CmdOrCtrl+Shift+L")
         .build(app)?;
     let toggle_backlinks = MenuItemBuilder::new("Toggle Backlinks")
         .id(VIEW_TOGGLE_BACKLINKS)
@@ -463,6 +486,11 @@ pub fn set_note_items_enabled(app_handle: &AppHandle, enabled: bool) {
     set_items_enabled(app_handle, NOTE_DEPENDENT_IDS, enabled);
 }
 
+/// Enable or disable menu items that depend on the editor being the active surface.
+pub fn set_editor_find_items_enabled(app_handle: &AppHandle, enabled: bool) {
+    set_items_enabled(app_handle, EDITOR_FIND_DEPENDENT_IDS, enabled);
+}
+
 /// Enable or disable menu items that depend on the note list being the active surface.
 pub fn set_note_list_search_items_enabled(app_handle: &AppHandle, enabled: bool) {
     set_items_enabled(app_handle, NOTE_LIST_SEARCH_DEPENDENT_IDS, enabled);
@@ -501,6 +529,8 @@ mod tests {
             FILE_NEW_TYPE,
             FILE_QUICK_OPEN,
             FILE_SAVE,
+            EDIT_FIND_IN_NOTE,
+            EDIT_REPLACE_IN_NOTE,
             EDIT_FIND_IN_VAULT,
             EDIT_TOGGLE_NOTE_LIST_SEARCH,
             EDIT_TOGGLE_RAW_EDITOR,
@@ -559,6 +589,16 @@ mod tests {
         }
     }
 
+    #[test]
+    fn editor_find_dependent_ids_are_subset_of_custom_ids() {
+        for id in EDITOR_FIND_DEPENDENT_IDS {
+            assert!(
+                CUSTOM_IDS.contains(id),
+                "editor-find-dependent ID {id} not in CUSTOM_IDS"
+            );
+        }
+    }
+
     #[test]
     fn git_dependent_ids_are_subset_of_custom_ids() {
         for id in GIT_COMMIT_DEPENDENT_IDS {

src-tauri/src/opencode_cli.rs

@@ -0,0 +1,58 @@
+use crate::ai_agents::{AiAgentAvailability, AiAgentStreamEvent};
+use std::io::BufRead;
+
+#[derive(Debug, Clone)]
+pub struct AgentStreamRequest {
+    pub message: String,
+    pub system_prompt: Option<String>,
+    pub vault_path: String,
+}
+
+pub fn check_cli() -> AiAgentAvailability {
+    crate::opencode_discovery::check_cli()
+}
+
+pub fn run_agent_stream<F>(request: AgentStreamRequest, mut emit: F) -> Result<String, String>
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    let binary = crate::opencode_discovery::find_binary()?;
+    let mut command = crate::opencode_config::build_command(&binary, &request)?;
+    let mut child = command
+        .spawn()
+        .map_err(|error| format!("Failed to spawn opencode: {error}"))?;
+
+    let stdout = child.stdout.take().ok_or("No stdout handle")?;
+    let reader = std::io::BufReader::new(stdout);
+    let mut session_id = String::new();
+
+    for line in reader.lines() {
+        let json = match crate::opencode_events::parse_line(line, &mut emit) {
+            Some(json) => json,
+            None => continue,
+        };
+
+        if let Some(id) = crate::opencode_events::session_id(&json) {
+            session_id = id.to_string();
+        }
+
+        crate::opencode_events::dispatch_event(&json, &mut emit);
+    }
+
+    let stderr_output = child
+        .stderr
+        .take()
+        .and_then(|stderr| std::io::read_to_string(stderr).ok())
+        .unwrap_or_default();
+    let status = child
+        .wait()
+        .map_err(|error| format!("Wait failed: {error}"))?;
+    if !status.success() {
+        emit(AiAgentStreamEvent::Error {
+            message: crate::opencode_events::format_error(stderr_output, status.to_string()),
+        });
+    }
+
+    emit(AiAgentStreamEvent::Done);
+    Ok(session_id)
+}

src-tauri/src/opencode_config.rs

@@ -0,0 +1,149 @@
+use crate::opencode_cli::AgentStreamRequest;
+use std::path::Path;
+use std::process::Stdio;
+
+pub(crate) fn build_command(
+    binary: &Path,
+    request: &AgentStreamRequest,
+) -> Result<std::process::Command, String> {
+    let mut command = crate::hidden_command(binary);
+    command
+        .args(build_args())
+        .arg(build_prompt(request))
+        .env(
+            "OPENCODE_CONFIG_CONTENT",
+            build_config(&request.vault_path)?,
+        )
+        .current_dir(&request.vault_path)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    Ok(command)
+}
+
+fn build_args() -> Vec<String> {
+    vec!["run".into(), "--format".into(), "json".into()]
+}
+
+fn build_prompt(request: &AgentStreamRequest) -> String {
+    match request
+        .system_prompt
+        .as_ref()
+        .map(|prompt| prompt.trim())
+        .filter(|prompt| !prompt.is_empty())
+    {
+        Some(system_prompt) => format!(
+            "System instructions:\n{system_prompt}\n\nUser request:\n{}",
+            request.message
+        ),
+        None => request.message.clone(),
+    }
+}
+
+fn build_config(vault_path: &str) -> Result<String, String> {
+    let mcp_server = crate::mcp::mcp_server_dir()?.join("index.js");
+    let mcp_server_path = mcp_server
+        .to_str()
+        .ok_or("Invalid MCP server path")?
+        .to_string();
+
+    serde_json::to_string(&serde_json::json!({
+        "$schema": "https://opencode.ai/config.json",
+        "permission": permission_config(),
+        "mcp": {
+            "tolaria": {
+                "type": "local",
+                "command": ["node", mcp_server_path],
+                "environment": { "VAULT_PATH": vault_path },
+                "enabled": true
+            }
+        }
+    }))
+    .map_err(|error| format!("Failed to serialize opencode config: {error}"))
+}
+
+fn permission_config() -> serde_json::Value {
+    serde_json::json!({
+        "read": "allow",
+        "edit": "allow",
+        "glob": "allow",
+        "grep": "allow",
+        "list": "allow",
+        "external_directory": "deny",
+        "bash": "deny"
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::ffi::OsStr;
+    use std::path::PathBuf;
+
+    fn request() -> AgentStreamRequest {
+        AgentStreamRequest {
+            message: "Rename the note".into(),
+            system_prompt: None,
+            vault_path: "/tmp/vault".into(),
+        }
+    }
+
+    #[test]
+    fn args_use_documented_safe_run_mode() {
+        let args = build_args();
+
+        assert_eq!(args, vec!["run", "--format", "json"]);
+        assert!(!args.contains(&"--dangerously-skip-permissions".to_string()));
+        assert!(!args.contains(&"--dir".to_string()));
+        assert!(!args.contains(&"--thinking".to_string()));
+    }
+
+    #[test]
+    fn command_sets_vault_cwd_and_mcp_config() {
+        let command = build_command(&PathBuf::from("opencode"), &request()).unwrap();
+        let actual_args: Vec<&OsStr> = command.get_args().collect();
+        let config_value = command
+            .get_envs()
+            .find(|(key, _)| *key == OsStr::new("OPENCODE_CONFIG_CONTENT"))
+            .and_then(|(_, value)| value);
+
+        assert_eq!(command.get_program(), OsStr::new("opencode"));
+        assert_eq!(actual_args[0], OsStr::new("run"));
+        assert_eq!(actual_args[1], OsStr::new("--format"));
+        assert_eq!(actual_args[2], OsStr::new("json"));
+        assert_eq!(actual_args.last(), Some(&OsStr::new("Rename the note")));
+        assert_eq!(command.get_current_dir(), Some(Path::new("/tmp/vault")));
+        assert!(config_value.is_some());
+    }
+
+    #[test]
+    fn config_includes_permissions_and_tolaria_mcp_server() {
+        if let Ok(config) = build_config("/tmp/vault") {
+            let json: serde_json::Value = serde_json::from_str(&config).unwrap();
+            assert_eq!(json["permission"]["edit"], "allow");
+            assert_eq!(json["permission"]["external_directory"], "deny");
+            assert_eq!(json["permission"]["bash"], "deny");
+            assert_eq!(json["mcp"]["tolaria"]["type"], "local");
+            assert_eq!(json["mcp"]["tolaria"]["command"][0], "node");
+            assert_eq!(
+                json["mcp"]["tolaria"]["environment"]["VAULT_PATH"],
+                "/tmp/vault"
+            );
+            assert!(json["mcp"]["tolaria"]["command"][1]
+                .as_str()
+                .unwrap()
+                .ends_with("index.js"));
+        }
+    }
+
+    #[test]
+    fn prompt_keeps_system_prompt_first() {
+        let prompt = build_prompt(&AgentStreamRequest {
+            system_prompt: Some("Be concise".into()),
+            ..request()
+        });
+
+        assert!(prompt.starts_with("System instructions:\nBe concise"));
+        assert!(prompt.contains("User request:\nRename the note"));
+    }
+}

src-tauri/src/opencode_discovery.rs

@@ -0,0 +1,159 @@
+use crate::ai_agents::AiAgentAvailability;
+use std::path::{Path, PathBuf};
+
+pub(crate) fn check_cli() -> AiAgentAvailability {
+    match find_binary() {
+        Ok(binary) => AiAgentAvailability {
+            installed: true,
+            version: version_for_binary(&binary),
+        },
+        Err(_) => AiAgentAvailability {
+            installed: false,
+            version: None,
+        },
+    }
+}
+
+pub(crate) fn find_binary() -> Result<PathBuf, String> {
+    if let Some(binary) = find_binary_on_path() {
+        return Ok(binary);
+    }
+
+    if let Some(binary) = find_binary_in_user_shell() {
+        return Ok(binary);
+    }
+
+    if let Some(binary) = find_existing_binary(opencode_binary_candidates()) {
+        return Ok(binary);
+    }
+
+    Err("OpenCode CLI not found. Install it: https://opencode.ai/docs/".into())
+}
+
+fn version_for_binary(binary: &PathBuf) -> Option<String> {
+    crate::hidden_command(binary)
+        .arg("--version")
+        .output()
+        .ok()
+        .filter(|output| output.status.success())
+        .map(|output| String::from_utf8_lossy(&output.stdout).trim().to_string())
+}
+
+fn find_binary_on_path() -> Option<PathBuf> {
+    crate::hidden_command("which")
+        .arg("opencode")
+        .output()
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
+
+fn find_binary_in_user_shell() -> Option<PathBuf> {
+    user_shell_candidates()
+        .into_iter()
+        .filter(|shell| shell.exists())
+        .find_map(|shell| command_path_from_shell(&shell, "opencode"))
+}
+
+fn user_shell_candidates() -> Vec<PathBuf> {
+    let mut shells = Vec::new();
+    if let Some(shell) = std::env::var_os("SHELL") {
+        if !shell.is_empty() {
+            shells.push(PathBuf::from(shell));
+        }
+    }
+    shells.push(PathBuf::from("/bin/zsh"));
+    shells.push(PathBuf::from("/bin/bash"));
+    shells
+}
+
+fn command_path_from_shell(shell: &Path, command: &str) -> Option<PathBuf> {
+    crate::hidden_command(shell)
+        .arg("-lc")
+        .arg(format!("command -v {command}"))
+        .output()
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
+
+fn path_from_successful_output(output: &std::process::Output) -> Option<PathBuf> {
+    if output.status.success() {
+        first_existing_path(&String::from_utf8_lossy(&output.stdout))
+    } else {
+        None
+    }
+}
+
+fn first_existing_path(stdout: &str) -> Option<PathBuf> {
+    stdout.lines().find_map(|line| {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            return None;
+        }
+        let candidate = PathBuf::from(trimmed);
+        candidate.exists().then_some(candidate)
+    })
+}
+
+fn find_existing_binary(candidates: Vec<PathBuf>) -> Option<PathBuf> {
+    candidates.into_iter().find(|candidate| candidate.exists())
+}
+
+fn opencode_binary_candidates() -> Vec<PathBuf> {
+    dirs::home_dir()
+        .map(|home| opencode_binary_candidates_for_home(&home))
+        .unwrap_or_default()
+}
+
+fn opencode_binary_candidates_for_home(home: &Path) -> Vec<PathBuf> {
+    vec![
+        home.join(".local/bin/opencode"),
+        home.join(".opencode/bin/opencode"),
+        home.join(".local/share/mise/shims/opencode"),
+        home.join(".asdf/shims/opencode"),
+        home.join(".npm-global/bin/opencode"),
+        home.join(".npm/bin/opencode"),
+        home.join(".bun/bin/opencode"),
+        PathBuf::from("/usr/local/bin/opencode"),
+        PathBuf::from("/opt/homebrew/bin/opencode"),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn binary_candidates_include_supported_local_installs() {
+        let home = PathBuf::from("/Users/alex");
+        let candidates = opencode_binary_candidates_for_home(&home);
+        let expected = [
+            home.join(".local/bin/opencode"),
+            home.join(".opencode/bin/opencode"),
+            home.join(".local/share/mise/shims/opencode"),
+            home.join(".asdf/shims/opencode"),
+            home.join(".npm-global/bin/opencode"),
+            home.join(".bun/bin/opencode"),
+            PathBuf::from("/opt/homebrew/bin/opencode"),
+        ];
+
+        for candidate in expected {
+            assert!(
+                candidates.contains(&candidate),
+                "missing {}",
+                candidate.display()
+            );
+        }
+    }
+
+    #[test]
+    fn first_existing_path_skips_empty_and_missing_lines() {
+        let dir = tempfile::tempdir().unwrap();
+        let missing = dir.path().join("missing-opencode");
+        let opencode = dir.path().join("opencode");
+        std::fs::write(&opencode, "#!/bin/sh\n").unwrap();
+
+        let stdout = format!("\n{}\n{}\n", missing.display(), opencode.display());
+
+        assert_eq!(first_existing_path(&stdout), Some(opencode));
+    }
+}

src-tauri/src/opencode_events.rs

@@ -0,0 +1,171 @@
+use crate::ai_agents::AiAgentStreamEvent;
+
+pub(crate) fn parse_line<F>(
+    line: Result<String, std::io::Error>,
+    emit: &mut F,
+) -> Option<serde_json::Value>
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    let line = match line {
+        Ok(line) => line,
+        Err(error) => {
+            emit(AiAgentStreamEvent::Error {
+                message: format!("Read error: {error}"),
+            });
+            return None;
+        }
+    };
+
+    let trimmed = line.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+
+    serde_json::from_str::<serde_json::Value>(trimmed).ok()
+}
+
+pub(crate) fn dispatch_event<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    if json["type"].as_str() == Some("session") {
+        emit_session_event(json, emit);
+    }
+
+    match json["type"].as_str().unwrap_or_default() {
+        "message" | "text" => emit_text(json, emit),
+        "reasoning" => emit_reasoning(json, emit),
+        "tool_use" | "tool" => emit_tool_start(json, emit),
+        "tool_result" | "tool_done" => emit_tool_done(json, emit),
+        "error" => emit_error_event(json, emit),
+        _ => {}
+    }
+}
+
+pub(crate) fn session_id(json: &serde_json::Value) -> Option<&str> {
+    json["sessionID"]
+        .as_str()
+        .or_else(|| json["session_id"].as_str())
+        .or_else(|| json["session"]["id"].as_str())
+}
+
+pub(crate) fn format_error(stderr_output: String, status: String) -> String {
+    let lower = stderr_output.to_ascii_lowercase();
+    if is_auth_error(&lower) {
+        return "OpenCode CLI is not authenticated or has no provider configured. Run `opencode auth login` or configure a provider in OpenCode, then retry.".into();
+    }
+
+    if stderr_output.trim().is_empty() {
+        format!("opencode exited with status {status}")
+    } else {
+        stderr_output.lines().take(3).collect::<Vec<_>>().join("\n")
+    }
+}
+
+fn emit_session_event<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    if let Some(session_id) = session_id(json) {
+        emit(AiAgentStreamEvent::Init {
+            session_id: session_id.to_string(),
+        });
+    }
+}
+
+fn emit_text<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    if let Some(text) = text_value(json) {
+        emit(AiAgentStreamEvent::TextDelta {
+            text: text.to_string(),
+        });
+    }
+}
+
+fn emit_reasoning<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    if let Some(text) = text_value(json) {
+        emit(AiAgentStreamEvent::ThinkingDelta {
+            text: text.to_string(),
+        });
+    }
+}
+
+fn emit_tool_start<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    let tool_id = tool_id(json).unwrap_or("tool").to_string();
+    let tool_name = json["name"]
+        .as_str()
+        .or_else(|| json["tool"].as_str())
+        .unwrap_or("tool")
+        .to_string();
+    let input = json.get("input").map(|input| input.to_string());
+
+    emit(AiAgentStreamEvent::ToolStart {
+        tool_name,
+        tool_id,
+        input,
+    });
+}
+
+fn emit_tool_done<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    let tool_id = tool_id(json).unwrap_or("tool").to_string();
+    let output = json["output"]
+        .as_str()
+        .map(|output| output.to_string())
+        .or_else(|| json.get("result").map(|result| result.to_string()));
+
+    emit(AiAgentStreamEvent::ToolDone { tool_id, output });
+}
+
+fn emit_error_event<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    if let Some(message) = message_value(json) {
+        emit(AiAgentStreamEvent::Error {
+            message: message.to_string(),
+        });
+    }
+}
+
+fn tool_id(json: &serde_json::Value) -> Option<&str> {
+    json["id"]
+        .as_str()
+        .or_else(|| json["toolID"].as_str())
+        .or_else(|| json["tool_id"].as_str())
+}
+
+fn text_value(json: &serde_json::Value) -> Option<&str> {
+    json["text"]
+        .as_str()
+        .or_else(|| json["content"].as_str())
+        .or_else(|| json["message"].as_str())
+}
+
+fn message_value(json: &serde_json::Value) -> Option<&str> {
+    json["message"]
+        .as_str()
+        .or_else(|| json["error"].as_str())
+        .or_else(|| json["text"].as_str())
+}
+
+fn is_auth_error(lower: &str) -> bool {
+    ["auth", "login", "sign in", "api key", "provider"]
+        .iter()
+        .any(|pattern| lower.contains(pattern))
+}
+
+#[cfg(test)]
+#[path = "opencode_events_tests.rs"]
+mod tests;

src-tauri/src/opencode_events_tests.rs

@@ -0,0 +1,63 @@
+use super::*;
+
+#[test]
+fn dispatch_maps_session_reasoning_and_text() {
+    let mut events = Vec::new();
+    let started = serde_json::json!({ "type": "session", "sessionID": "ses_1" });
+    let reasoning = serde_json::json!({ "type": "reasoning", "text": "Checking links" });
+    let text = serde_json::json!({ "type": "message", "text": "Done" });
+
+    for event in [started, reasoning, text] {
+        dispatch_event(&event, &mut |event| events.push(event));
+    }
+
+    assert!(matches!(
+        &events[0],
+        AiAgentStreamEvent::Init { session_id } if session_id == "ses_1"
+    ));
+    assert!(matches!(
+        &events[1],
+        AiAgentStreamEvent::ThinkingDelta { text } if text == "Checking links"
+    ));
+    assert!(matches!(
+        &events[2],
+        AiAgentStreamEvent::TextDelta { text } if text == "Done"
+    ));
+}
+
+#[test]
+fn dispatch_maps_tool_events() {
+    let mut events = Vec::new();
+    let tool_start = serde_json::json!({
+        "type": "tool_use",
+        "id": "tool_1",
+        "name": "read",
+        "input": { "path": "Note.md" }
+    });
+    let tool_done = serde_json::json!({ "type": "tool_result", "id": "tool_1", "output": "ok" });
+
+    dispatch_event(&tool_start, &mut |event| events.push(event));
+    dispatch_event(&tool_done, &mut |event| events.push(event));
+
+    assert!(matches!(
+        &events[0],
+        AiAgentStreamEvent::ToolStart { tool_name, tool_id, input }
+            if tool_name == "read" && tool_id == "tool_1" && input.as_deref() == Some(r#"{"path":"Note.md"}"#)
+    ));
+    assert!(matches!(
+        &events[1],
+        AiAgentStreamEvent::ToolDone { tool_id, output }
+            if tool_id == "tool_1" && output.as_deref() == Some("ok")
+    ));
+}
+
+#[test]
+fn format_error_explains_missing_auth_or_provider_setup() {
+    let message = format_error(
+        "provider auth failed: please login".into(),
+        "exit status: 1".into(),
+    );
+
+    assert!(message.contains("OpenCode CLI is not authenticated"));
+    assert!(message.contains("opencode auth login"));
+}

src-tauri/src/pi_cli.rs

@@ -0,0 +1,62 @@
+use crate::ai_agents::{AiAgentAvailability, AiAgentStreamEvent};
+use std::io::BufRead;
+
+#[derive(Debug, Clone)]
+pub struct AgentStreamRequest {
+    pub message: String,
+    pub system_prompt: Option<String>,
+    pub vault_path: String,
+}
+
+pub fn check_cli() -> AiAgentAvailability {
+    crate::pi_discovery::check_cli()
+}
+
+pub fn run_agent_stream<F>(request: AgentStreamRequest, mut emit: F) -> Result<String, String>
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    let binary = crate::pi_discovery::find_binary()?;
+    let agent_dir = tempfile::Builder::new()
+        .prefix("tolaria-pi-agent-")
+        .tempdir()
+        .map_err(|error| format!("Failed to create Pi config directory: {error}"))?;
+    let mut command = crate::pi_config::build_command(&binary, &request, agent_dir.path())?;
+    let mut child = command
+        .spawn()
+        .map_err(|error| format!("Failed to spawn pi: {error}"))?;
+
+    let stdout = child.stdout.take().ok_or("No stdout handle")?;
+    let reader = std::io::BufReader::new(stdout);
+    let mut session_id = String::new();
+
+    for line in reader.lines() {
+        let json = match crate::pi_events::parse_line(line, &mut emit) {
+            Some(json) => json,
+            None => continue,
+        };
+
+        if let Some(id) = crate::pi_events::session_id(&json) {
+            session_id = id.to_string();
+        }
+
+        crate::pi_events::dispatch_event(&json, &mut emit);
+    }
+
+    let stderr_output = child
+        .stderr
+        .take()
+        .and_then(|stderr| std::io::read_to_string(stderr).ok())
+        .unwrap_or_default();
+    let status = child
+        .wait()
+        .map_err(|error| format!("Wait failed: {error}"))?;
+    if !status.success() {
+        emit(AiAgentStreamEvent::Error {
+            message: crate::pi_events::format_error(stderr_output, status.to_string()),
+        });
+    }
+
+    emit(AiAgentStreamEvent::Done);
+    Ok(session_id)
+}

src-tauri/src/pi_config.rs

@@ -0,0 +1,160 @@
+use crate::pi_cli::AgentStreamRequest;
+use std::path::Path;
+use std::process::Stdio;
+
+pub(crate) fn build_command(
+    binary: &Path,
+    request: &AgentStreamRequest,
+    agent_dir: &Path,
+) -> Result<std::process::Command, String> {
+    write_mcp_config(agent_dir, &request.vault_path)?;
+
+    let mut command = crate::hidden_command(binary);
+    command
+        .args(build_args())
+        .arg(build_prompt(request))
+        .env("PI_CODING_AGENT_DIR", agent_dir)
+        .current_dir(&request.vault_path)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped());
+    Ok(command)
+}
+
+fn build_args() -> Vec<String> {
+    vec![
+        "--mode".into(),
+        "json".into(),
+        "--no-session".into(),
+        "--extension".into(),
+        "npm:pi-mcp-adapter".into(),
+    ]
+}
+
+fn build_prompt(request: &AgentStreamRequest) -> String {
+    match request
+        .system_prompt
+        .as_ref()
+        .map(|prompt| prompt.trim())
+        .filter(|prompt| !prompt.is_empty())
+    {
+        Some(system_prompt) => format!(
+            "System instructions:\n{system_prompt}\n\nUser request:\n{}",
+            request.message
+        ),
+        None => request.message.clone(),
+    }
+}
+
+fn write_mcp_config(agent_dir: &Path, vault_path: &str) -> Result<(), String> {
+    std::fs::create_dir_all(agent_dir)
+        .map_err(|error| format!("Failed to create Pi agent directory: {error}"))?;
+    let config = build_mcp_config(vault_path)?;
+    std::fs::write(agent_dir.join("mcp.json"), config)
+        .map_err(|error| format!("Failed to write Pi MCP config: {error}"))
+}
+
+fn build_mcp_config(vault_path: &str) -> Result<String, String> {
+    let mcp_server = crate::mcp::mcp_server_dir()?.join("index.js");
+    let mcp_server_path = mcp_server
+        .to_str()
+        .ok_or("Invalid MCP server path")?
+        .to_string();
+
+    serde_json::to_string(&serde_json::json!({
+        "settings": {
+            "toolPrefix": "none",
+            "idleTimeout": 10
+        },
+        "mcpServers": {
+            "tolaria": {
+                "command": "node",
+                "args": [mcp_server_path],
+                "env": {
+                    "VAULT_PATH": vault_path,
+                    "WS_UI_PORT": "9711"
+                },
+                "lifecycle": "lazy",
+                "directTools": true
+            }
+        }
+    }))
+    .map_err(|error| format!("Failed to serialize Pi MCP config: {error}"))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::ffi::OsStr;
+    use std::path::PathBuf;
+
+    fn request() -> AgentStreamRequest {
+        AgentStreamRequest {
+            message: "Rename the note".into(),
+            system_prompt: None,
+            vault_path: "/tmp/vault".into(),
+        }
+    }
+
+    #[test]
+    fn args_use_documented_json_mode_with_mcp_adapter() {
+        let args = build_args();
+
+        assert_eq!(args[0], "--mode");
+        assert_eq!(args[1], "json");
+        assert!(args.contains(&"--no-session".to_string()));
+        assert!(args.contains(&"--extension".to_string()));
+        assert!(args.contains(&"npm:pi-mcp-adapter".to_string()));
+        assert!(!args.contains(&"--no-tools".to_string()));
+    }
+
+    #[test]
+    fn command_sets_vault_cwd_closed_stdin_and_config_dir() {
+        let agent_dir = tempfile::tempdir().unwrap();
+        let command = build_command(&PathBuf::from("pi"), &request(), agent_dir.path()).unwrap();
+        let actual_args: Vec<&OsStr> = command.get_args().collect();
+        let config_dir = command
+            .get_envs()
+            .find(|(key, _)| *key == OsStr::new("PI_CODING_AGENT_DIR"))
+            .and_then(|(_, value)| value);
+
+        assert_eq!(command.get_program(), OsStr::new("pi"));
+        assert_eq!(actual_args[0], OsStr::new("--mode"));
+        assert_eq!(actual_args[1], OsStr::new("json"));
+        assert_eq!(actual_args.last(), Some(&OsStr::new("Rename the note")));
+        assert_eq!(command.get_current_dir(), Some(Path::new("/tmp/vault")));
+        assert_eq!(config_dir, Some(agent_dir.path().as_os_str()));
+        assert!(agent_dir.path().join("mcp.json").exists());
+    }
+
+    #[test]
+    fn mcp_config_includes_tolaria_server_for_active_vault() {
+        if let Ok(config) = build_mcp_config("/tmp/vault") {
+            let json: serde_json::Value = serde_json::from_str(&config).unwrap();
+            assert_eq!(json["settings"]["toolPrefix"], "none");
+            assert_eq!(json["mcpServers"]["tolaria"]["command"], "node");
+            assert_eq!(json["mcpServers"]["tolaria"]["lifecycle"], "lazy");
+            assert_eq!(json["mcpServers"]["tolaria"]["directTools"], true);
+            assert_eq!(
+                json["mcpServers"]["tolaria"]["env"]["VAULT_PATH"],
+                "/tmp/vault"
+            );
+            assert_eq!(json["mcpServers"]["tolaria"]["env"]["WS_UI_PORT"], "9711");
+            assert!(json["mcpServers"]["tolaria"]["args"][0]
+                .as_str()
+                .unwrap()
+                .ends_with("index.js"));
+        }
+    }
+
+    #[test]
+    fn prompt_keeps_system_prompt_first() {
+        let prompt = build_prompt(&AgentStreamRequest {
+            system_prompt: Some("Be concise".into()),
+            ..request()
+        });
+
+        assert!(prompt.starts_with("System instructions:\nBe concise"));
+        assert!(prompt.contains("User request:\nRename the note"));
+    }
+}

src-tauri/src/pi_discovery.rs

@@ -0,0 +1,263 @@
+use crate::ai_agents::AiAgentAvailability;
+use std::path::{Path, PathBuf};
+
+pub(crate) fn check_cli() -> AiAgentAvailability {
+    match find_binary() {
+        Ok(binary) => AiAgentAvailability {
+            installed: true,
+            version: version_for_binary(&binary),
+        },
+        Err(_) => AiAgentAvailability {
+            installed: false,
+            version: None,
+        },
+    }
+}
+
+pub(crate) fn find_binary() -> Result<PathBuf, String> {
+    if let Some(binary) = find_binary_on_path() {
+        return Ok(binary);
+    }
+
+    if let Some(binary) = find_binary_in_user_shell() {
+        return Ok(binary);
+    }
+
+    if let Some(binary) = find_existing_binary(pi_binary_candidates()) {
+        return Ok(binary);
+    }
+
+    Err("Pi CLI not found. Install it: https://pi.dev".into())
+}
+
+fn version_for_binary(binary: &PathBuf) -> Option<String> {
+    crate::hidden_command(binary)
+        .arg("--version")
+        .output()
+        .ok()
+        .filter(|output| output.status.success())
+        .map(|output| String::from_utf8_lossy(&output.stdout).trim().to_string())
+}
+
+fn find_binary_on_path() -> Option<PathBuf> {
+    crate::hidden_command("which")
+        .arg("pi")
+        .output()
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
+
+fn find_binary_in_user_shell() -> Option<PathBuf> {
+    user_shell_candidates()
+        .into_iter()
+        .filter(|shell| shell.exists())
+        .find_map(|shell| command_path_from_shell(&shell, "pi"))
+}
+
+fn user_shell_candidates() -> Vec<PathBuf> {
+    let mut shells = Vec::new();
+    if let Some(shell) = std::env::var_os("SHELL") {
+        if !shell.is_empty() {
+            shells.push(PathBuf::from(shell));
+        }
+    }
+    shells.push(PathBuf::from("/bin/zsh"));
+    shells.push(PathBuf::from("/bin/bash"));
+    shells
+}
+
+fn command_path_from_shell(shell: &Path, command: &str) -> Option<PathBuf> {
+    crate::hidden_command(shell)
+        .arg("-lc")
+        .arg(format!("command -v {command}"))
+        .output()
+        .ok()
+        .and_then(|output| path_from_successful_output(&output))
+}
+
+fn path_from_successful_output(output: &std::process::Output) -> Option<PathBuf> {
+    if output.status.success() {
+        first_existing_path(&String::from_utf8_lossy(&output.stdout))
+    } else {
+        None
+    }
+}
+
+fn first_existing_path(stdout: &str) -> Option<PathBuf> {
+    stdout.lines().find_map(|line| {
+        let trimmed = line.trim();
+        if trimmed.is_empty() {
+            return None;
+        }
+        let candidate = PathBuf::from(trimmed);
+        candidate.exists().then_some(candidate)
+    })
+}
+
+fn find_existing_binary(candidates: Vec<PathBuf>) -> Option<PathBuf> {
+    candidates.into_iter().find(|candidate| candidate.exists())
+}
+
+fn pi_binary_candidates() -> Vec<PathBuf> {
+    let mut candidates = pi_binary_candidates_from_env();
+
+    if let Some(home) = dirs::home_dir() {
+        candidates.extend(pi_binary_candidates_for_home(&home));
+    }
+
+    candidates.extend(pi_global_binary_candidates());
+    candidates
+}
+
+fn pi_binary_candidates_for_home(home: &Path) -> Vec<PathBuf> {
+    let mut candidates = pi_nvm_binary_candidates_for_home(home);
+    candidates.extend([
+        home.join(".local/bin/pi"),
+        home.join(".pi/bin/pi"),
+        home.join(".local/share/mise/shims/pi"),
+        home.join(".asdf/shims/pi"),
+        home.join(".npm-global/bin/pi"),
+        home.join(".npm/bin/pi"),
+        home.join(".bun/bin/pi"),
+    ]);
+    candidates
+}
+
+fn pi_global_binary_candidates() -> Vec<PathBuf> {
+    vec![
+        PathBuf::from("/usr/local/bin/pi"),
+        PathBuf::from("/opt/homebrew/bin/pi"),
+    ]
+}
+
+fn pi_binary_candidates_from_env() -> Vec<PathBuf> {
+    let nvm_bin = std::env::var_os("NVM_BIN").map(PathBuf::from);
+    let npm_config_prefix = std::env::var_os("npm_config_prefix").map(PathBuf::from);
+    let npm_config_prefix_upper = std::env::var_os("NPM_CONFIG_PREFIX").map(PathBuf::from);
+
+    pi_binary_candidates_from_prefixes(nvm_bin, npm_config_prefix, npm_config_prefix_upper)
+}
+
+fn pi_binary_candidates_from_prefixes(
+    nvm_bin: Option<PathBuf>,
+    npm_config_prefix: Option<PathBuf>,
+    npm_config_prefix_upper: Option<PathBuf>,
+) -> Vec<PathBuf> {
+    let mut candidates = Vec::new();
+
+    if let Some(path) = nvm_bin.filter(|path| !path.as_os_str().is_empty()) {
+        candidates.push(path.join("pi"));
+    }
+    if let Some(path) = npm_config_prefix.filter(|path| !path.as_os_str().is_empty()) {
+        candidates.push(path.join("bin/pi"));
+    }
+    if let Some(path) = npm_config_prefix_upper.filter(|path| !path.as_os_str().is_empty()) {
+        candidates.push(path.join("bin/pi"));
+    }
+
+    candidates
+}
+
+fn pi_nvm_binary_candidates_for_home(home: &Path) -> Vec<PathBuf> {
+    let versions_dir = home.join(".nvm/versions/node");
+    let mut version_dirs = match std::fs::read_dir(versions_dir) {
+        Ok(entries) => entries
+            .flatten()
+            .map(|entry| entry.path())
+            .filter(|path| path.is_dir())
+            .collect::<Vec<_>>(),
+        Err(_) => return Vec::new(),
+    };
+
+    version_dirs.sort_by(|left, right| right.file_name().cmp(&left.file_name()));
+    version_dirs
+        .into_iter()
+        .map(|version_dir| version_dir.join("bin/pi"))
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn binary_candidates_include_supported_local_installs() {
+        let home = PathBuf::from("/Users/alex");
+        let candidates = pi_binary_candidates_for_home(&home);
+        let expected = [
+            home.join(".local/bin/pi"),
+            home.join(".pi/bin/pi"),
+            home.join(".local/share/mise/shims/pi"),
+            home.join(".asdf/shims/pi"),
+            home.join(".npm-global/bin/pi"),
+            home.join(".bun/bin/pi"),
+        ];
+
+        for candidate in expected {
+            assert!(
+                candidates.contains(&candidate),
+                "missing {}",
+                candidate.display()
+            );
+        }
+    }
+
+    #[test]
+    fn binary_candidates_include_nvm_node_version_installs() {
+        let home = tempfile::tempdir().unwrap();
+        let pi = home.path().join(".nvm/versions/node/v22.20.0/bin/pi");
+
+        std::fs::create_dir_all(pi.parent().unwrap()).unwrap();
+        std::fs::write(&pi, "#!/bin/sh\n").unwrap();
+
+        let candidates = pi_binary_candidates_for_home(home.path());
+
+        assert!(
+            candidates.contains(&pi),
+            "missing nvm candidate {}",
+            pi.display()
+        );
+    }
+
+    #[test]
+    fn binary_candidates_include_static_global_fallbacks() {
+        let candidates = pi_global_binary_candidates();
+
+        assert!(candidates.contains(&PathBuf::from("/usr/local/bin/pi")));
+        assert!(candidates.contains(&PathBuf::from("/opt/homebrew/bin/pi")));
+    }
+
+    #[test]
+    fn binary_candidates_include_env_provided_npm_and_nvm_prefixes() {
+        let nvm_bin = PathBuf::from("/Users/alex/.nvm/versions/node/v22.20.0/bin");
+        let npm_config_prefix = PathBuf::from("/Users/alex/.npm-global");
+        let npm_config_prefix_upper = PathBuf::from("/Users/alex/.npm");
+
+        let candidates = pi_binary_candidates_from_prefixes(
+            Some(nvm_bin.clone()),
+            Some(npm_config_prefix.clone()),
+            Some(npm_config_prefix_upper.clone()),
+        );
+
+        assert_eq!(
+            candidates,
+            vec![
+                nvm_bin.join("pi"),
+                npm_config_prefix.join("bin/pi"),
+                npm_config_prefix_upper.join("bin/pi"),
+            ]
+        );
+    }
+
+    #[test]
+    fn first_existing_path_skips_empty_and_missing_lines() {
+        let dir = tempfile::tempdir().unwrap();
+        let missing = dir.path().join("missing-pi");
+        let pi = dir.path().join("pi");
+        std::fs::write(&pi, "#!/bin/sh\n").unwrap();
+
+        let stdout = format!("\n{}\n{}\n", missing.display(), pi.display());
+
+        assert_eq!(first_existing_path(&stdout), Some(pi));
+    }
+}

src-tauri/src/pi_events.rs

@@ -0,0 +1,159 @@
+use crate::ai_agents::AiAgentStreamEvent;
+
+pub(crate) fn parse_line<F>(
+    line: Result<String, std::io::Error>,
+    emit: &mut F,
+) -> Option<serde_json::Value>
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    let line = match line {
+        Ok(line) => line,
+        Err(error) => {
+            emit(AiAgentStreamEvent::Error {
+                message: format!("Read error: {error}"),
+            });
+            return None;
+        }
+    };
+
+    let trimmed = line.trim();
+    if trimmed.is_empty() {
+        return None;
+    }
+
+    serde_json::from_str::<serde_json::Value>(trimmed).ok()
+}
+
+pub(crate) fn dispatch_event<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    if json["type"].as_str() == Some("session") {
+        emit_session_event(json, emit);
+    }
+
+    match json["type"].as_str().unwrap_or_default() {
+        "message_update" => emit_message_update(json, emit),
+        "tool_execution_start" => emit_tool_start(json, emit),
+        "tool_execution_end" => emit_tool_done(json, emit),
+        "error" => emit_error_event(json, emit),
+        _ => {}
+    }
+}
+
+pub(crate) fn session_id(json: &serde_json::Value) -> Option<&str> {
+    json["id"]
+        .as_str()
+        .or_else(|| json["session_id"].as_str())
+        .or_else(|| json["session"]["id"].as_str())
+}
+
+pub(crate) fn format_error(stderr_output: String, status: String) -> String {
+    let lower = stderr_output.to_ascii_lowercase();
+    if is_auth_error(&lower) {
+        return "Pi CLI is not authenticated. Run `pi /login` in your terminal or configure a provider API key, then retry.".into();
+    }
+
+    if stderr_output.trim().is_empty() {
+        format!("pi exited with status {status}")
+    } else {
+        stderr_output.lines().take(3).collect::<Vec<_>>().join("\n")
+    }
+}
+
+fn emit_session_event<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    if let Some(session_id) = session_id(json) {
+        emit(AiAgentStreamEvent::Init {
+            session_id: session_id.to_string(),
+        });
+    }
+}
+
+fn emit_message_update<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    let event = &json["assistantMessageEvent"];
+    match event["type"].as_str().unwrap_or_default() {
+        "text_delta" => emit_delta(event, emit, |text| AiAgentStreamEvent::TextDelta { text }),
+        "thinking_delta" => emit_delta(event, emit, |text| AiAgentStreamEvent::ThinkingDelta {
+            text,
+        }),
+        _ => {}
+    }
+}
+
+fn emit_delta<F>(
+    json: &serde_json::Value,
+    emit: &mut F,
+    build: impl FnOnce(String) -> AiAgentStreamEvent,
+) where
+    F: FnMut(AiAgentStreamEvent),
+{
+    if let Some(delta) = json["delta"].as_str() {
+        emit(build(delta.to_string()));
+    }
+}
+
+fn emit_tool_start<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    emit(AiAgentStreamEvent::ToolStart {
+        tool_name: tool_name(json),
+        tool_id: tool_id(json),
+        input: json.get("args").map(|args| args.to_string()),
+    });
+}
+
+fn emit_tool_done<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    emit(AiAgentStreamEvent::ToolDone {
+        tool_id: tool_id(json),
+        output: json.get("result").map(|result| result.to_string()),
+    });
+}
+
+fn emit_error_event<F>(json: &serde_json::Value, emit: &mut F)
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    if let Some(message) = message_value(json) {
+        emit(AiAgentStreamEvent::Error {
+            message: message.to_string(),
+        });
+    }
+}
+
+fn tool_name(json: &serde_json::Value) -> String {
+    json["toolName"].as_str().unwrap_or("tool").to_string()
+}
+
+fn tool_id(json: &serde_json::Value) -> String {
+    json["toolCallId"].as_str().unwrap_or("tool").to_string()
+}
+
+fn message_value(json: &serde_json::Value) -> Option<&str> {
+    json["message"]
+        .as_str()
+        .or_else(|| json["error"].as_str())
+        .or_else(|| json["text"].as_str())
+}
+
+fn is_auth_error(lower: &str) -> bool {
+    [
+        "auth", "login", "sign in", "api key", "api.key", "provider", "401",
+    ]
+    .iter()
+    .any(|pattern| lower.contains(pattern))
+}
+
+#[cfg(test)]
+#[path = "pi_events_tests.rs"]
+mod tests;

src-tauri/src/pi_events_tests.rs

@@ -0,0 +1,74 @@
+use super::*;
+
+#[test]
+fn dispatch_maps_session_thinking_and_text() {
+    let mut events = Vec::new();
+    let started = serde_json::json!({ "type": "session", "id": "pi-session" });
+    let thinking = serde_json::json!({
+        "type": "message_update",
+        "assistantMessageEvent": { "type": "thinking_delta", "delta": "Checking links" }
+    });
+    let text = serde_json::json!({
+        "type": "message_update",
+        "assistantMessageEvent": { "type": "text_delta", "delta": "Done" }
+    });
+
+    for event in [started, thinking, text] {
+        dispatch_event(&event, &mut |event| events.push(event));
+    }
+
+    assert!(matches!(
+        &events[0],
+        AiAgentStreamEvent::Init { session_id } if session_id == "pi-session"
+    ));
+    assert!(matches!(
+        &events[1],
+        AiAgentStreamEvent::ThinkingDelta { text } if text == "Checking links"
+    ));
+    assert!(matches!(
+        &events[2],
+        AiAgentStreamEvent::TextDelta { text } if text == "Done"
+    ));
+}
+
+#[test]
+fn dispatch_maps_tool_events() {
+    let mut events = Vec::new();
+    let tool_start = serde_json::json!({
+        "type": "tool_execution_start",
+        "toolCallId": "tool_1",
+        "toolName": "search_notes",
+        "args": { "query": "today" }
+    });
+    let tool_done = serde_json::json!({
+        "type": "tool_execution_end",
+        "toolCallId": "tool_1",
+        "toolName": "search_notes",
+        "result": { "ok": true }
+    });
+
+    dispatch_event(&tool_start, &mut |event| events.push(event));
+    dispatch_event(&tool_done, &mut |event| events.push(event));
+
+    assert!(matches!(
+        &events[0],
+        AiAgentStreamEvent::ToolStart { tool_name, tool_id, input }
+            if tool_name == "search_notes" && tool_id == "tool_1" && input.as_deref() == Some(r#"{"query":"today"}"#)
+    ));
+    assert!(matches!(
+        &events[1],
+        AiAgentStreamEvent::ToolDone { tool_id, output }
+            if tool_id == "tool_1" && output.as_deref() == Some(r#"{"ok":true}"#)
+    ));
+}
+
+#[test]
+fn format_error_explains_missing_auth_or_provider_setup() {
+    let message = format_error(
+        "provider auth failed: api key required".into(),
+        "exit status: 1".into(),
+    );
+
+    assert!(message.contains("Pi CLI is not authenticated"));
+    assert!(message.contains("pi /login"));
+}

src-tauri/src/search.rs

@@ -1,5 +1,5 @@
 use serde::Serialize;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 use std::time::Instant;
 use walkdir::WalkDir;
 
@@ -20,6 +20,14 @@ pub struct SearchResponse {
     pub mode: String,
 }
 
+pub struct SearchOptions<'a> {
+    pub vault_path: &'a str,
+    pub query: &'a str,
+    pub mode: &'a str,
+    pub limit: usize,
+    pub hide_gitignored_files: bool,
+}
+
 fn extract_snippet(content: &str, query_lower: &str) -> String {
     let content_lower = content.to_lowercase();
     let pos = match content_lower.find(query_lower) {
@@ -63,26 +71,45 @@ pub fn search_vault(
     _mode: &str,
     limit: usize,
 ) -> Result<SearchResponse, String> {
+    search_vault_with_options(SearchOptions {
+        vault_path,
+        query,
+        mode: _mode,
+        limit,
+        hide_gitignored_files: crate::settings::hide_gitignored_files_enabled(),
+    })
+}
+
+fn is_markdown_search_candidate(path: &Path) -> bool {
+    if !path.extension().is_some_and(|ext| ext == "md") {
+        return false;
+    }
+
+    !path
+        .components()
+        .any(|component| component.as_os_str().to_string_lossy().starts_with('.'))
+}
+
+fn collect_markdown_paths(vault_dir: &Path, hide_gitignored_files: bool) -> Vec<PathBuf> {
+    let paths = WalkDir::new(vault_dir)
+        .into_iter()
+        .filter_map(|entry| entry.ok())
+        .map(|entry| entry.into_path())
+        .filter(|path| is_markdown_search_candidate(path))
+        .collect::<Vec<_>>();
+
+    crate::vault::filter_gitignored_paths(vault_dir, paths, hide_gitignored_files)
+}
+
+pub fn search_vault_with_options(options: SearchOptions<'_>) -> Result<SearchResponse, String> {
     let start = Instant::now();
-    let query_lower = query.to_lowercase();
-    let vault_dir = Path::new(vault_path);
+    let query_lower = options.query.to_lowercase();
+    let vault_dir = Path::new(options.vault_path);
 
     let mut results: Vec<SearchResult> = Vec::new();
 
-    for entry in WalkDir::new(vault_dir).into_iter().filter_map(|e| e.ok()) {
-        let path = entry.path();
-        if !path.extension().is_some_and(|ext| ext == "md") {
-            continue;
-        }
-        // Skip hidden dirs and .laputa config
-        if path
-            .components()
-            .any(|c| c.as_os_str().to_string_lossy().starts_with('.'))
-        {
-            continue;
-        }
-
-        let content = match std::fs::read_to_string(path) {
+    for path in collect_markdown_paths(vault_dir, options.hide_gitignored_files) {
+        let content = match std::fs::read_to_string(&path) {
             Ok(c) => c,
             Err(_) => continue,
         };
@@ -117,15 +144,15 @@ pub fn search_vault(
             .partial_cmp(&a.score)
             .unwrap_or(std::cmp::Ordering::Equal)
     });
-    results.truncate(limit);
+    results.truncate(options.limit);
 
     let elapsed_ms = start.elapsed().as_millis() as u64;
 
     Ok(SearchResponse {
         results,
         elapsed_ms,
-        query: query.to_string(),
-        mode: "keyword".to_string(),
+        query: options.query.to_string(),
+        mode: options.mode.to_string(),
     })
 }
 
@@ -135,6 +162,14 @@ mod tests {
     use std::fs;
     use tempfile::Builder;
 
+    fn init_git_repo(root: &Path) {
+        crate::hidden_command("git")
+            .args(["init"])
+            .current_dir(root)
+            .output()
+            .unwrap();
+    }
+
     #[test]
     fn test_extract_snippet_basic() {
         let content = "line one\nline with keyword here\nline three";
@@ -188,4 +223,38 @@ mod tests {
         assert_eq!(response.results.len(), 1);
         assert_eq!(response.results[0].title, "Updated Display Title");
     }
+
+    #[test]
+    fn test_search_vault_hides_gitignored_notes_when_enabled() {
+        let dir = Builder::new()
+            .prefix("search-gitignored-")
+            .tempdir_in(std::env::current_dir().unwrap())
+            .unwrap();
+        init_git_repo(dir.path());
+        fs::create_dir_all(dir.path().join("ignored")).unwrap();
+        fs::write(dir.path().join(".gitignore"), "ignored/\n").unwrap();
+        fs::write(dir.path().join("visible.md"), "# Visible\n\nneedle").unwrap();
+        fs::write(dir.path().join("ignored/hidden.md"), "# Hidden\n\nneedle").unwrap();
+
+        let hidden = search_vault_with_options(SearchOptions {
+            vault_path: dir.path().to_str().unwrap(),
+            query: "needle",
+            mode: "keyword",
+            limit: 10,
+            hide_gitignored_files: true,
+        })
+        .unwrap();
+        let shown = search_vault_with_options(SearchOptions {
+            vault_path: dir.path().to_str().unwrap(),
+            query: "needle",
+            mode: "keyword",
+            limit: 10,
+            hide_gitignored_files: false,
+        })
+        .unwrap();
+
+        assert_eq!(hidden.results.len(), 1);
+        assert_eq!(hidden.results[0].title, "Visible");
+        assert_eq!(shown.results.len(), 2);
+    }
 }

src-tauri/src/settings.rs

@@ -4,20 +4,26 @@ use std::path::PathBuf;
 
 const APP_CONFIG_DIR: &str = "com.tolaria.app";
 const LEGACY_APP_CONFIG_DIR: &str = "com.laputa.app";
+const SUPPORTED_DEFAULT_AI_AGENTS: &[&str] = &["claude_code", "codex", "opencode", "pi"];
+pub const DEFAULT_HIDE_GITIGNORED_FILES: bool = true;
 
-#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, Default)]
 pub struct Settings {
     pub auto_pull_interval_minutes: Option<u32>,
     pub autogit_enabled: Option<bool>,
     pub autogit_idle_threshold_seconds: Option<u32>,
     pub autogit_inactive_threshold_seconds: Option<u32>,
+    pub auto_advance_inbox_after_organize: Option<bool>,
     pub telemetry_consent: Option<bool>,
     pub crash_reporting_enabled: Option<bool>,
     pub analytics_enabled: Option<bool>,
     pub anonymous_id: Option<String>,
     pub release_channel: Option<String>,
+    pub theme_mode: Option<String>,
+    pub ui_language: Option<String>,
     pub initial_h1_auto_rename_enabled: Option<bool>,
     pub default_ai_agent: Option<String>,
+    pub hide_gitignored_files: Option<bool>,
 }
 
 fn normalize_optional_string(value: Option<String>) -> Option<String> {
@@ -47,11 +53,58 @@ pub fn effective_release_channel(value: Option<&str>) -> &'static str {
 
 pub fn normalize_default_ai_agent(value: Option<&str>) -> Option<String> {
     match value.map(|candidate| candidate.trim().to_ascii_lowercase()) {
-        Some(agent) if agent == "claude_code" || agent == "codex" => Some(agent),
+        Some(agent) if SUPPORTED_DEFAULT_AI_AGENTS.contains(&agent.as_str()) => Some(agent),
         _ => None,
     }
 }
 
+pub fn normalize_theme_mode(value: Option<&str>) -> Option<String> {
+    match value.map(|candidate| candidate.trim().to_ascii_lowercase()) {
+        Some(mode) if mode == "light" || mode == "dark" => Some(mode),
+        _ => None,
+    }
+}
+
+pub fn should_hide_gitignored_files(settings: &Settings) -> bool {
+    settings
+        .hide_gitignored_files
+        .unwrap_or(DEFAULT_HIDE_GITIGNORED_FILES)
+}
+
+pub fn hide_gitignored_files_enabled() -> bool {
+    get_settings()
+        .map(|settings| should_hide_gitignored_files(&settings))
+        .unwrap_or(DEFAULT_HIDE_GITIGNORED_FILES)
+}
+
+fn canonical_language_code(value: &str) -> Option<String> {
+    let code = value.trim().replace('_', "-").to_ascii_lowercase();
+    if code.is_empty() {
+        None
+    } else {
+        Some(code)
+    }
+}
+
+fn is_english_language(code: &str) -> bool {
+    code == "en" || code.starts_with("en-")
+}
+
+fn is_simplified_chinese_language(code: &str) -> bool {
+    matches!(code, "zh" | "zh-cn" | "zh-hans" | "zh-sg")
+}
+
+pub fn normalize_ui_language(value: Option<&str>) -> Option<String> {
+    let language = canonical_language_code(value?)?;
+    if is_english_language(&language) {
+        return Some("en".to_string());
+    }
+    if is_simplified_chinese_language(&language) {
+        return Some("zh-Hans".to_string());
+    }
+    None
+}
+
 fn normalize_settings(settings: Settings) -> Settings {
     Settings {
         auto_pull_interval_minutes: settings.auto_pull_interval_minutes,
@@ -62,13 +115,17 @@ fn normalize_settings(settings: Settings) -> Settings {
         autogit_inactive_threshold_seconds: normalize_optional_positive_u32(
             settings.autogit_inactive_threshold_seconds,
         ),
+        auto_advance_inbox_after_organize: settings.auto_advance_inbox_after_organize,
         telemetry_consent: settings.telemetry_consent,
         crash_reporting_enabled: settings.crash_reporting_enabled,
         analytics_enabled: settings.analytics_enabled,
         anonymous_id: normalize_optional_string(settings.anonymous_id),
         release_channel: normalize_release_channel(settings.release_channel.as_deref()),
+        theme_mode: normalize_theme_mode(settings.theme_mode.as_deref()),
+        ui_language: normalize_ui_language(settings.ui_language.as_deref()),
         initial_h1_auto_rename_enabled: settings.initial_h1_auto_rename_enabled,
         default_ai_agent: normalize_default_ai_agent(settings.default_ai_agent.as_deref()),
+        hide_gitignored_files: settings.hide_gitignored_files,
     }
 }
 
@@ -76,7 +133,7 @@ fn app_config_dir() -> Result<PathBuf, String> {
     dirs::config_dir().ok_or_else(|| "Could not determine config directory".to_string())
 }
 
-fn preferred_app_config_path(file_name: &str) -> Result<PathBuf, String> {
+pub(crate) fn preferred_app_config_path(file_name: &str) -> Result<PathBuf, String> {
     Ok(app_config_dir()?.join(APP_CONFIG_DIR).join(file_name))
 }
 
@@ -164,41 +221,8 @@ pub fn set_last_vault(vault_path: &str) -> Result<(), String> {
 mod tests {
     use super::*;
 
-    type SettingsSnapshot<'a> = (
-        Option<u32>,
-        Option<bool>,
-        Option<u32>,
-        Option<u32>,
-        Option<bool>,
-        Option<bool>,
-        Option<bool>,
-        Option<&'a str>,
-        Option<&'a str>,
-        Option<bool>,
-        Option<&'a str>,
-    );
-
-    fn settings_snapshot(settings: &Settings) -> SettingsSnapshot<'_> {
-        (
-            settings.auto_pull_interval_minutes,
-            settings.autogit_enabled,
-            settings.autogit_idle_threshold_seconds,
-            settings.autogit_inactive_threshold_seconds,
-            settings.telemetry_consent,
-            settings.crash_reporting_enabled,
-            settings.analytics_enabled,
-            settings.anonymous_id.as_deref(),
-            settings.release_channel.as_deref(),
-            settings.initial_h1_auto_rename_enabled,
-            settings.default_ai_agent.as_deref(),
-        )
-    }
-
     fn assert_empty_settings(settings: &Settings) {
-        assert_eq!(
-            settings_snapshot(settings),
-            (None, None, None, None, None, None, None, None, None, None, None)
-        );
+        assert_eq!(settings, &Settings::default());
     }
 
     /// Helper: save settings to a temp file and reload them.
@@ -234,17 +258,21 @@ mod tests {
             autogit_enabled: Some(true),
             autogit_idle_threshold_seconds: Some(90),
             autogit_inactive_threshold_seconds: Some(30),
+            auto_advance_inbox_after_organize: Some(true),
             telemetry_consent: Some(true),
             crash_reporting_enabled: Some(true),
             analytics_enabled: Some(false),
             anonymous_id: Some("abc-123-uuid".to_string()),
             release_channel: Some("alpha".to_string()),
+            theme_mode: Some("dark".to_string()),
+            ui_language: Some("zh-Hans".to_string()),
             initial_h1_auto_rename_enabled: Some(false),
             default_ai_agent: Some("codex".to_string()),
+            hide_gitignored_files: Some(false),
         };
         let json = serde_json::to_string(&settings).unwrap();
         let parsed: Settings = serde_json::from_str(&json).unwrap();
-        assert_eq!(settings_snapshot(&parsed), settings_snapshot(&settings));
+        assert_eq!(parsed, settings);
     }
 
     #[test]
@@ -262,18 +290,39 @@ mod tests {
             autogit_enabled: Some(true),
             autogit_idle_threshold_seconds: Some(90),
             autogit_inactive_threshold_seconds: Some(30),
+            auto_advance_inbox_after_organize: Some(true),
             release_channel: Some("alpha".to_string()),
+            theme_mode: Some("dark".to_string()),
+            ui_language: Some("zh-Hans".to_string()),
             initial_h1_auto_rename_enabled: Some(false),
             default_ai_agent: Some("codex".to_string()),
+            hide_gitignored_files: Some(false),
             ..Default::default()
         });
         assert_eq!(loaded.auto_pull_interval_minutes, Some(10));
         assert_eq!(loaded.autogit_enabled, Some(true));
         assert_eq!(loaded.autogit_idle_threshold_seconds, Some(90));
         assert_eq!(loaded.autogit_inactive_threshold_seconds, Some(30));
+        assert_eq!(loaded.auto_advance_inbox_after_organize, Some(true));
         assert_eq!(loaded.release_channel.as_deref(), Some("alpha"));
+        assert_eq!(loaded.theme_mode.as_deref(), Some("dark"));
+        assert_eq!(loaded.ui_language.as_deref(), Some("zh-Hans"));
         assert_eq!(loaded.initial_h1_auto_rename_enabled, Some(false));
         assert_eq!(loaded.default_ai_agent.as_deref(), Some("codex"));
+        assert_eq!(loaded.hide_gitignored_files, Some(false));
+    }
+
+    #[test]
+    fn test_gitignored_files_are_hidden_by_default() {
+        assert!(should_hide_gitignored_files(&Settings::default()));
+        assert!(should_hide_gitignored_files(&Settings {
+            hide_gitignored_files: Some(true),
+            ..Default::default()
+        }));
+        assert!(!should_hide_gitignored_files(&Settings {
+            hide_gitignored_files: Some(false),
+            ..Default::default()
+        }));
     }
 
     #[test]
@@ -281,11 +330,15 @@ mod tests {
         let loaded = save_and_reload(Settings {
             anonymous_id: Some("  test-uuid  ".to_string()),
             release_channel: Some("  alpha  ".to_string()),
+            theme_mode: Some("  dark  ".to_string()),
+            ui_language: Some("  zh-cn  ".to_string()),
             default_ai_agent: Some("  codex  ".to_string()),
             ..Default::default()
         });
         assert_eq!(loaded.anonymous_id.as_deref(), Some("test-uuid"));
         assert_eq!(loaded.release_channel.as_deref(), Some("alpha"));
+        assert_eq!(loaded.theme_mode.as_deref(), Some("dark"));
+        assert_eq!(loaded.ui_language.as_deref(), Some("zh-Hans"));
         assert_eq!(loaded.default_ai_agent.as_deref(), Some("codex"));
     }
 
@@ -327,6 +380,51 @@ mod tests {
         assert!(loaded.default_ai_agent.is_none());
     }
 
+    #[test]
+    fn test_opencode_default_ai_agent_is_preserved() {
+        let loaded = save_and_reload(Settings {
+            default_ai_agent: Some("opencode".to_string()),
+            ..Default::default()
+        });
+        assert_eq!(loaded.default_ai_agent.as_deref(), Some("opencode"));
+    }
+
+    #[test]
+    fn test_pi_default_ai_agent_is_preserved() {
+        let loaded = save_and_reload(Settings {
+            default_ai_agent: Some("pi".to_string()),
+            ..Default::default()
+        });
+        assert_eq!(loaded.default_ai_agent.as_deref(), Some("pi"));
+    }
+
+    #[test]
+    fn test_invalid_theme_mode_is_filtered() {
+        let loaded = save_and_reload(Settings {
+            theme_mode: Some("system".to_string()),
+            ..Default::default()
+        });
+        assert!(loaded.theme_mode.is_none());
+    }
+
+    #[test]
+    fn test_invalid_ui_language_is_filtered() {
+        let loaded = save_and_reload(Settings {
+            ui_language: Some("fr-FR".to_string()),
+            ..Default::default()
+        });
+        assert!(loaded.ui_language.is_none());
+    }
+
+    #[test]
+    fn test_ui_language_aliases_are_canonicalized() {
+        assert_eq!(normalize_ui_language(Some("en-US")).as_deref(), Some("en"));
+        assert_eq!(
+            normalize_ui_language(Some("zh_CN")).as_deref(),
+            Some("zh-Hans")
+        );
+    }
+
     #[test]
     fn test_get_settings_normalizes_legacy_beta_channel() {
         let dir = tempfile::TempDir::new().unwrap();
@@ -377,20 +475,14 @@ mod tests {
             ..Default::default()
         });
         assert_eq!(
-            settings_snapshot(&loaded),
-            (
-                None,
-                None,
-                None,
-                None,
-                Some(true),
-                Some(true),
-                Some(false),
-                Some("test-uuid-v4"),
-                None,
-                None,
-                None,
-            )
+            loaded,
+            Settings {
+                telemetry_consent: Some(true),
+                crash_reporting_enabled: Some(true),
+                analytics_enabled: Some(false),
+                anonymous_id: Some("test-uuid-v4".to_string()),
+                ..Default::default()
+            }
         );
     }
 

src-tauri/src/telemetry.rs

@@ -1,5 +1,7 @@
 use crate::settings;
+use chrono::NaiveDate;
 use regex::Regex;
+use std::borrow::Cow;
 use std::sync::Mutex;
 
 /// Global Sentry guard — must live for the duration of the app.
@@ -44,6 +46,41 @@ fn parse_embedded_sentry_dsn(raw: Option<&str>) -> Option<sentry::types::Dsn> {
     normalize_http_like_value(&normalized).parse().ok()
 }
 
+fn is_stable_calendar_release(version: &str) -> bool {
+    let mut parts = version.split('.');
+    let (Some(year), Some(month), Some(day)) = (parts.next(), parts.next(), parts.next()) else {
+        return false;
+    };
+
+    if parts.next().is_some() {
+        return false;
+    }
+
+    let (Ok(year), Ok(month), Ok(day)) = (
+        year.parse::<i32>(),
+        month.parse::<u32>(),
+        day.parse::<u32>(),
+    ) else {
+        return false;
+    };
+
+    NaiveDate::from_ymd_opt(year, month, day).is_some()
+}
+
+fn sentry_release_for_version(version: &'static str) -> Option<Cow<'static, str>> {
+    is_stable_calendar_release(version).then(|| version.into())
+}
+
+fn sentry_release_kind(version: &str) -> &'static str {
+    if is_stable_calendar_release(version) {
+        "stable"
+    } else if version.contains('-') {
+        "prerelease"
+    } else {
+        "internal"
+    }
+}
+
 /// Initialize Sentry if the user has opted in to crash reporting.
 /// Returns `true` if Sentry was initialized, `false` if skipped.
 pub fn init_sentry_from_settings() -> bool {
@@ -61,9 +98,10 @@ pub fn init_sentry_from_settings() -> bool {
     };
 
     let anonymous_id = settings.anonymous_id.unwrap_or_default();
+    let build_version = env!("CARGO_PKG_VERSION");
     let guard = sentry::init(sentry::ClientOptions {
         dsn: Some(dsn),
-        release: Some(env!("CARGO_PKG_VERSION").into()),
+        release: sentry_release_for_version(build_version),
         send_default_pii: false,
         before_send: Some(std::sync::Arc::new(|mut event| {
             if let Some(ref mut msg) = event.message {
@@ -79,6 +117,8 @@ pub fn init_sentry_from_settings() -> bool {
             id: Some(anonymous_id),
             ..Default::default()
         }));
+        scope.set_tag("tolaria.build_version", build_version);
+        scope.set_tag("tolaria.release_kind", sentry_release_kind(build_version));
     });
 
     *SENTRY_GUARD.lock().unwrap() = Some(guard);
@@ -160,4 +200,26 @@ mod tests {
         // Without SENTRY_DSN env var set at compile time, init should return false
         assert!(!init_sentry_from_settings());
     }
+
+    #[test]
+    fn test_sentry_release_for_stable_calendar_version() {
+        assert!(sentry_release_for_version("2026.4.28").is_some());
+    }
+
+    #[test]
+    fn test_sentry_release_for_alpha_version_is_none() {
+        assert!(sentry_release_for_version("2026.4.28-alpha.7").is_none());
+    }
+
+    #[test]
+    fn test_sentry_release_for_local_dev_version_is_none() {
+        assert!(sentry_release_for_version("0.1.0").is_none());
+    }
+
+    #[test]
+    fn test_sentry_release_kind_classifies_versions() {
+        assert_eq!(sentry_release_kind("2026.4.28"), "stable");
+        assert_eq!(sentry_release_kind("2026.4.28-alpha.7"), "prerelease");
+        assert_eq!(sentry_release_kind("0.1.0"), "internal");
+    }
 }

src-tauri/src/vault/cache.rs

@@ -125,7 +125,7 @@ fn git_head_hash(vault: &Path) -> Option<String> {
 
 /// Run a git command in the given directory and return stdout if successful.
 fn run_git(vault: &Path, args: &[&str]) -> Option<String> {
-    let output = std::process::Command::new("git")
+    let output = crate::hidden_command("git")
         .args(args)
         .current_dir(vault)
         .output()
@@ -510,7 +510,7 @@ fn migrate_legacy_cache(vault: &Path) {
     }
 
     // Remove legacy file from git tracking if present
-    let _ = std::process::Command::new("git")
+    let _ = crate::hidden_command("git")
         .args([
             "rm",
             "--cached",
@@ -727,17 +727,17 @@ mod tests {
     }
 
     fn init_git_repo(vault: &Path) {
-        std::process::Command::new("git")
+        crate::hidden_command("git")
             .args(["init"])
             .current_dir(vault)
             .output()
             .unwrap();
-        std::process::Command::new("git")
+        crate::hidden_command("git")
             .args(["config", "user.email", "test@test.com"])
             .current_dir(vault)
             .output()
             .unwrap();
-        std::process::Command::new("git")
+        crate::hidden_command("git")
             .args(["config", "user.name", "Test"])
             .current_dir(vault)
             .output()
@@ -756,12 +756,12 @@ mod tests {
     }
 
     fn git_add_commit(vault: &Path, msg: &str) {
-        std::process::Command::new("git")
+        crate::hidden_command("git")
             .args(["add", "."])
             .current_dir(vault)
             .output()
             .unwrap();
-        std::process::Command::new("git")
+        crate::hidden_command("git")
             .args(["commit", "-m", msg])
             .current_dir(vault)
             .output()
@@ -1121,7 +1121,7 @@ mod tests {
         // Delete file via filesystem (simulates Finder delete)
         fs::remove_file(vault.join("remove.md")).unwrap();
         // Also stage the deletion so git status is clean for this file
-        std::process::Command::new("git")
+        crate::hidden_command("git")
             .args(["add", "remove.md"])
             .current_dir(vault)
             .output()

src-tauri/src/vault/config_seed.rs

@@ -58,6 +58,16 @@ _organized: true
 This file is only a Claude Code compatibility shim. Keep shared agent instructions in `AGENTS.md`.
 ";
 
+const GEMINI_MD_SHIM: &str = "---
+type: Note
+_organized: true
+---
+
+@AGENTS.md
+
+This file is only a Gemini CLI compatibility shim. Keep shared agent instructions in `AGENTS.md`.
+";
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 #[serde(rename_all = "snake_case")]
 pub enum AiGuidanceFileState {
@@ -71,9 +81,16 @@ pub enum AiGuidanceFileState {
 pub struct VaultAiGuidanceStatus {
     pub agents_state: AiGuidanceFileState,
     pub claude_state: AiGuidanceFileState,
+    pub gemini_state: AiGuidanceFileState,
     pub can_restore: bool,
 }
 
+struct GuidancePaths {
+    agents: PathBuf,
+    claude: PathBuf,
+    gemini: PathBuf,
+}
+
 #[derive(Debug, Default)]
 struct LegacyAgentsMigrationOutcome {
     copied_to_root: bool,
@@ -109,6 +126,10 @@ fn matches_claude_shim(content: &str) -> bool {
         || trimmed == CLAUDE_MD_SHIM.trim()
 }
 
+fn matches_gemini_shim(content: &str) -> bool {
+    content.trim() == GEMINI_MD_SHIM.trim()
+}
+
 fn claude_shim_can_be_replaced(path: &Path) -> bool {
     !path.exists() || {
         let content = read_file_or_empty(path);
@@ -116,6 +137,13 @@ fn claude_shim_can_be_replaced(path: &Path) -> bool {
     }
 }
 
+fn gemini_shim_can_be_replaced(path: &Path) -> bool {
+    !path.exists() || {
+        let content = read_file_or_empty(path);
+        content.trim().is_empty() || matches_gemini_shim(&content)
+    }
+}
+
 fn sync_managed_file(
     path: &Path,
     content: &str,
@@ -150,9 +178,12 @@ fn classify_guidance_file(
     AiGuidanceFileState::Custom
 }
 
-fn guidance_paths(vault_path: &Path) -> (PathBuf, PathBuf) {
-    let vault = vault_path;
-    (vault.join("AGENTS.md"), vault.join("CLAUDE.md"))
+fn guidance_paths(vault_path: &Path) -> GuidancePaths {
+    GuidancePaths {
+        agents: vault_path.join("AGENTS.md"),
+        claude: vault_path.join("CLAUDE.md"),
+        gemini: vault_path.join("GEMINI.md"),
+    }
 }
 
 fn classify_agents_file(path: &Path) -> AiGuidanceFileState {
@@ -167,6 +198,10 @@ fn classify_claude_file(path: &Path) -> AiGuidanceFileState {
     classify_guidance_file(path, matches_claude_shim, claude_shim_can_be_replaced)
 }
 
+fn classify_gemini_file(path: &Path) -> AiGuidanceFileState {
+    classify_guidance_file(path, matches_gemini_shim, gemini_shim_can_be_replaced)
+}
+
 fn guidance_file_needs_restore(state: AiGuidanceFileState) -> bool {
     matches!(
         state,
@@ -175,29 +210,43 @@ fn guidance_file_needs_restore(state: AiGuidanceFileState) -> bool {
 }
 
 fn build_ai_guidance_status(vault_path: &Path) -> VaultAiGuidanceStatus {
-    let (agents_path, claude_path) = guidance_paths(vault_path);
-    let agents_state = classify_agents_file(&agents_path);
-    let claude_state = classify_claude_file(&claude_path);
+    let paths = guidance_paths(vault_path);
+    let agents_state = classify_agents_file(&paths.agents);
+    let claude_state = classify_claude_file(&paths.claude);
+    let gemini_state = classify_gemini_file(&paths.gemini);
 
     VaultAiGuidanceStatus {
         agents_state,
         claude_state,
+        gemini_state,
         can_restore: guidance_file_needs_restore(agents_state)
-            || guidance_file_needs_restore(claude_state),
+            || guidance_file_needs_restore(claude_state)
+            || guidance_file_needs_restore(gemini_state),
     }
 }
 
 fn sync_claude_shim_file(vault_path: &Path) -> Result<bool, String> {
-    let (_, claude_path) = guidance_paths(vault_path);
-    sync_managed_file(&claude_path, CLAUDE_MD_SHIM, claude_shim_can_be_replaced)
+    let paths = guidance_paths(vault_path);
+    sync_managed_file(&paths.claude, CLAUDE_MD_SHIM, claude_shim_can_be_replaced)
 }
 
-fn sync_ai_guidance_files(vault_path: &Path) -> Result<bool, String> {
+fn sync_gemini_shim_file(vault_path: &Path) -> Result<bool, String> {
+    let paths = guidance_paths(vault_path);
+    sync_managed_file(&paths.gemini, GEMINI_MD_SHIM, gemini_shim_can_be_replaced)
+}
+
+fn sync_required_ai_guidance_files(vault_path: &Path) -> Result<bool, String> {
     let wrote_agents = sync_default_agents_file(vault_path)?;
     let wrote_claude = sync_claude_shim_file(vault_path)?;
     Ok(wrote_agents || wrote_claude)
 }
 
+fn sync_all_ai_guidance_files(vault_path: &Path) -> Result<bool, String> {
+    let wrote_required = sync_required_ai_guidance_files(vault_path)?;
+    let wrote_gemini = sync_gemini_shim_file(vault_path)?;
+    Ok(wrote_required || wrote_gemini)
+}
+
 fn migrate_legacy_agents_file(
     root_agents: &Path,
     config_agents: &Path,
@@ -241,8 +290,8 @@ fn cleanup_empty_config_dir(vault: &Path) -> Result<bool, String> {
 }
 
 pub(super) fn sync_default_agents_file(vault_path: &Path) -> Result<bool, String> {
-    let (agents_path, _) = guidance_paths(vault_path);
-    sync_managed_file(&agents_path, AGENTS_MD, root_agents_can_be_replaced)
+    let paths = guidance_paths(vault_path);
+    sync_managed_file(&paths.agents, AGENTS_MD, root_agents_can_be_replaced)
 }
 
 pub fn get_ai_guidance_status(
@@ -255,7 +304,7 @@ pub fn restore_ai_guidance_files(
     vault_path: impl AsRef<str>,
 ) -> Result<VaultAiGuidanceStatus, String> {
     let vault_path = Path::new(vault_path.as_ref());
-    sync_ai_guidance_files(vault_path)?;
+    sync_all_ai_guidance_files(vault_path)?;
     Ok(build_ai_guidance_status(vault_path))
 }
 
@@ -263,7 +312,7 @@ pub fn restore_ai_guidance_files(
 /// Also seeds Tolaria-managed root type definitions used by repair/bootstrap flows.
 pub fn seed_config_files(vault_path: impl AsRef<str>) {
     let vault_path = Path::new(vault_path.as_ref());
-    if sync_ai_guidance_files(vault_path).unwrap_or(false) {
+    if sync_required_ai_guidance_files(vault_path).unwrap_or(false) {
         log::info!("Seeded vault AI guidance files at vault root");
     }
 
@@ -307,7 +356,7 @@ pub fn migrate_agents_md(vault_path: impl AsRef<str>) {
         log::info!("Removed empty config/ directory");
     }
 
-    let _ = sync_ai_guidance_files(vault);
+    let _ = sync_required_ai_guidance_files(vault);
 }
 
 /// Repair config files: ensure `AGENTS.md` at vault root and root type definitions.
@@ -320,7 +369,7 @@ pub fn repair_config_files(vault_path: impl AsRef<str>) -> Result<String, String
 
     migrate_legacy_agents_file(&root_agents, &config_agents)?;
     let _ = cleanup_empty_config_dir(vault)?;
-    sync_ai_guidance_files(vault)?;
+    sync_required_ai_guidance_files(vault)?;
 
     write_if_missing(&vault.join("type.md"), TYPE_TYPE_DEFINITION)?;
     write_if_missing(&vault.join("note.md"), NOTE_TYPE_DEFINITION)?;
@@ -355,6 +404,10 @@ mod tests {
         fs::write(vault.join("CLAUDE.md"), content).unwrap();
     }
 
+    fn write_root_gemini(vault: &Path, content: &str) {
+        fs::write(vault.join("GEMINI.md"), content).unwrap();
+    }
+
     fn write_legacy_agents(vault: &Path, content: &str) {
         fs::write(config_dir(vault).join("agents.md"), content).unwrap();
     }
@@ -367,6 +420,10 @@ mod tests {
         fs::read_to_string(vault.join("CLAUDE.md")).unwrap()
     }
 
+    fn read_root_gemini(vault: &Path) -> String {
+        fs::read_to_string(vault.join("GEMINI.md")).unwrap()
+    }
+
     type VaultOperation = fn(&Path);
 
     fn run_seed(vault: &Path) {
@@ -454,15 +511,52 @@ mod tests {
         assert!(content.contains(expected_root_text));
     }
 
+    fn assert_required_agents_file_seeded(vault: &Path) {
+        assert!(vault.join("AGENTS.md").exists());
+        assert!(read_root_agents(vault).contains("Tolaria Vault"));
+    }
+
+    fn assert_required_guidance_shims_seeded(vault: &Path) {
+        assert_eq!(read_root_claude(vault), CLAUDE_MD_SHIM);
+        assert!(!vault.join("GEMINI.md").exists());
+    }
+
+    fn assert_required_guidance_files_seeded(vault: &Path) {
+        assert_required_agents_file_seeded(vault);
+        assert_required_guidance_shims_seeded(vault);
+    }
+
+    fn assert_root_type_definitions_seeded(vault: &Path) {
+        assert!(vault.join("type.md").exists());
+        assert!(vault.join("note.md").exists());
+        assert!(!vault.join("config").exists());
+    }
+
+    fn assert_type_definition_content(vault: &Path) {
+        let type_content = fs::read_to_string(vault.join("type.md")).unwrap();
+        let note_content = fs::read_to_string(vault.join("note.md")).unwrap();
+        assert_type_definition_body(&type_content);
+        assert_note_definition_body(&note_content);
+    }
+
+    fn assert_type_definition_body(type_content: &str) {
+        assert!(type_content.contains("type: Type"));
+        assert!(type_content.contains("# Type"));
+        assert!(type_content.contains("visible: false"));
+    }
+
+    fn assert_note_definition_body(note_content: &str) {
+        assert!(note_content.contains("type: Type"));
+        assert!(note_content.contains("# Note"));
+    }
+
     #[test]
     fn test_seed_config_files_creates_guidance_files_at_root() {
         let (_dir, vault) = create_vault();
 
         seed_config_files(vault.to_str().unwrap());
 
-        assert!(vault.join("AGENTS.md").exists());
-        assert!(read_root_agents(&vault).contains("Tolaria Vault"));
-        assert_eq!(read_root_claude(&vault), CLAUDE_MD_SHIM);
+        assert_required_guidance_files_seeded(&vault);
     }
 
     #[test]
@@ -471,16 +565,8 @@ mod tests {
 
         seed_config_files(vault.to_str().unwrap());
 
-        assert!(vault.join("type.md").exists());
-        assert!(vault.join("note.md").exists());
-        let type_content = fs::read_to_string(vault.join("type.md")).unwrap();
-        let note_content = fs::read_to_string(vault.join("note.md")).unwrap();
-        assert!(type_content.contains("type: Type"));
-        assert!(type_content.contains("# Type"));
-        assert!(type_content.contains("visible: false"));
-        assert!(note_content.contains("type: Type"));
-        assert!(note_content.contains("# Note"));
-        assert!(!vault.join("config").exists());
+        assert_root_type_definitions_seeded(&vault);
+        assert_type_definition_content(&vault);
     }
 
     #[test]
@@ -604,20 +690,12 @@ mod tests {
         let msg = repair_config_files(vault.to_str().unwrap()).unwrap();
         assert_eq!(msg, "Config files repaired");
 
-        assert!(vault.join("AGENTS.md").exists());
-        assert!(vault.join("CLAUDE.md").exists());
-        assert!(vault.join("type.md").exists());
-        assert!(vault.join("note.md").exists());
-        assert!(!vault.join("config").exists());
-
-        let agents = read_root_agents(&vault);
-        assert!(agents.contains("Tolaria Vault"));
-        let type_content = fs::read_to_string(vault.join("type.md")).unwrap();
-        assert!(type_content.contains("# Type"));
-        assert!(type_content.contains("visible: false"));
-        let note_content = fs::read_to_string(vault.join("note.md")).unwrap();
-        assert!(note_content.contains("type: Type"));
-        assert!(note_content.contains("general-purpose document"));
+        assert_required_guidance_files_seeded(&vault);
+        assert_root_type_definitions_seeded(&vault);
+        assert_type_definition_content(&vault);
+        assert!(fs::read_to_string(vault.join("note.md"))
+            .unwrap()
+            .contains("general-purpose document"));
     }
 
     #[test]
@@ -656,9 +734,15 @@ mod tests {
         write_root_claude(&vault, "");
 
         let status = get_ai_guidance_status(vault.to_str().unwrap()).unwrap();
-        assert_eq!(status.agents_state, AiGuidanceFileState::Custom);
-        assert_eq!(status.claude_state, AiGuidanceFileState::Broken);
-        assert!(status.can_restore);
+        assert_eq!(
+            status,
+            VaultAiGuidanceStatus {
+                agents_state: AiGuidanceFileState::Custom,
+                claude_state: AiGuidanceFileState::Broken,
+                gemini_state: AiGuidanceFileState::Missing,
+                can_restore: true,
+            }
+        );
     }
 
     #[test]
@@ -668,11 +752,18 @@ mod tests {
         write_root_claude(&vault, "");
 
         let status = restore_ai_guidance_files(vault.to_str().unwrap()).unwrap();
-        assert_eq!(status.agents_state, AiGuidanceFileState::Custom);
-        assert_eq!(status.claude_state, AiGuidanceFileState::Managed);
-        assert!(!status.can_restore);
+        assert_eq!(
+            status,
+            VaultAiGuidanceStatus {
+                agents_state: AiGuidanceFileState::Custom,
+                claude_state: AiGuidanceFileState::Managed,
+                gemini_state: AiGuidanceFileState::Managed,
+                can_restore: false,
+            }
+        );
         assert!(read_root_agents(&vault).contains("Custom Agent Config"));
         assert_eq!(read_root_claude(&vault), CLAUDE_MD_SHIM);
+        assert_eq!(read_root_gemini(&vault), GEMINI_MD_SHIM);
     }
 
     #[test]
@@ -681,8 +772,28 @@ mod tests {
         write_root_agents(&vault, "");
 
         let status = restore_ai_guidance_files(vault.to_str().unwrap()).unwrap();
-        assert_eq!(status.agents_state, AiGuidanceFileState::Managed);
-        assert_eq!(status.claude_state, AiGuidanceFileState::Managed);
+        assert_eq!(
+            status,
+            VaultAiGuidanceStatus {
+                agents_state: AiGuidanceFileState::Managed,
+                claude_state: AiGuidanceFileState::Managed,
+                gemini_state: AiGuidanceFileState::Managed,
+                can_restore: false,
+            }
+        );
+    }
+
+    #[test]
+    fn test_restore_ai_guidance_files_preserves_custom_gemini() {
+        let (_dir, vault) = create_vault();
+        write_root_agents(&vault, AGENTS_MD);
+        write_root_claude(&vault, CLAUDE_MD_SHIM);
+        write_root_gemini(&vault, "# Custom Gemini instructions\nDo not overwrite\n");
+
+        let status = restore_ai_guidance_files(vault.to_str().unwrap()).unwrap();
+
+        assert_eq!(status.gemini_state, AiGuidanceFileState::Custom);
         assert!(!status.can_restore);
+        assert!(read_root_gemini(&vault).contains("Custom Gemini instructions"));
     }
 }

src-tauri/src/vault/file.rs

@@ -1,5 +1,5 @@
 use std::fs;
-use std::io::{ErrorKind, Write};
+use std::io::{Error, ErrorKind, Write};
 use std::path::Path;
 use std::time::UNIX_EPOCH;
 
@@ -25,6 +25,49 @@ fn invalid_utf8_text_error(path: &Path) -> String {
     format!("File is not valid UTF-8 text: {}", path.display())
 }
 
+fn is_invalid_platform_path_error(error: &Error) -> bool {
+    error.kind() == ErrorKind::InvalidInput || error.raw_os_error() == Some(123)
+}
+
+#[derive(Clone, Copy)]
+enum NoteIoOperation {
+    Save,
+    Create,
+}
+
+#[derive(Clone, Copy)]
+struct NotePathDisplay<'a> {
+    value: &'a str,
+}
+
+impl<'a> NotePathDisplay<'a> {
+    fn new(value: &'a str) -> Self {
+        Self { value }
+    }
+}
+
+impl NoteIoOperation {
+    fn verb(self) -> &'static str {
+        match self {
+            Self::Save => "save",
+            Self::Create => "create",
+        }
+    }
+}
+
+fn note_io_error(operation: NoteIoOperation, path: NotePathDisplay<'_>, error: &Error) -> String {
+    let verb = operation.verb();
+    if is_invalid_platform_path_error(error) {
+        let path = path.value;
+        format!(
+            "Failed to {verb} note: the path is invalid on this platform. Rename the note or move it to a valid folder, then try again. Path: {path}"
+        )
+    } else {
+        let path = path.value;
+        format!("Failed to {verb} {path}: {error}")
+    }
+}
+
 /// Read the content of a single note file.
 pub fn get_note_content(path: &Path) -> Result<String, String> {
     if !path.exists() {
@@ -62,12 +105,14 @@ pub fn save_note_content(path: &str, content: &str) -> Result<(), String> {
     let file_path = Path::new(path);
     if let Some(parent) = file_path.parent() {
         if !parent.exists() {
-            fs::create_dir_all(parent)
-                .map_err(|e| format!("Failed to create directory {}: {}", parent.display(), e))?;
+            fs::create_dir_all(parent).map_err(|e| {
+                note_io_error(NoteIoOperation::Save, NotePathDisplay::new(path), &e)
+            })?;
         }
     }
     validate_save_path(file_path, path)?;
-    fs::write(file_path, content).map_err(|e| format!("Failed to save {}: {}", path, e))
+    fs::write(file_path, content)
+        .map_err(|e| note_io_error(NoteIoOperation::Save, NotePathDisplay::new(path), &e))
 }
 
 /// Create a new note file without overwriting any existing file.
@@ -75,8 +120,9 @@ pub fn create_note_content(path: &str, content: &str) -> Result<(), String> {
     let file_path = Path::new(path);
     if let Some(parent) = file_path.parent() {
         if !parent.exists() {
-            fs::create_dir_all(parent)
-                .map_err(|e| format!("Failed to create directory {}: {}", parent.display(), e))?;
+            fs::create_dir_all(parent).map_err(|e| {
+                note_io_error(NoteIoOperation::Create, NotePathDisplay::new(path), &e)
+            })?;
         }
     }
     validate_save_path(file_path, path)?;
@@ -86,8 +132,27 @@ pub fn create_note_content(path: &str, content: &str) -> Result<(), String> {
         .open(file_path)
         .map_err(|e| match e.kind() {
             ErrorKind::AlreadyExists => format!("File already exists: {}", path),
-            _ => format!("Failed to create {}: {}", path, e),
+            _ => note_io_error(NoteIoOperation::Create, NotePathDisplay::new(path), &e),
         })?;
     file.write_all(content.as_bytes())
-        .map_err(|e| format!("Failed to save {}: {}", path, e))
+        .map_err(|e| note_io_error(NoteIoOperation::Save, NotePathDisplay::new(path), &e))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn formats_windows_invalid_path_syntax_as_recoverable_save_error() {
+        let path = r"C:\Users\@raflymln\notes\untitled-note-1777236475.md";
+        let message = note_io_error(
+            NoteIoOperation::Save,
+            NotePathDisplay::new(path),
+            &Error::from_raw_os_error(123),
+        );
+
+        assert!(message.contains("path is invalid on this platform"));
+        assert!(message.contains("Rename the note or move it to a valid folder"));
+        assert!(!message.contains("os error 123"));
+    }
 }

src-tauri/src/vault/filename_rules.rs

@@ -0,0 +1,101 @@
+const WINDOWS_RESERVED_DEVICE_NAMES: &[&str] = &[
+    "CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8",
+    "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9",
+];
+
+pub(crate) fn validate_filename_stem(stem: &str) -> Result<(), String> {
+    validate_portable_name_segment(stem, "Invalid filename")
+}
+
+pub(crate) fn validate_folder_name(name: &str) -> Result<(), String> {
+    validate_portable_name_segment(name, "Invalid folder name")
+}
+
+pub(crate) fn validate_view_filename_stem(stem: &str) -> Result<(), String> {
+    validate_portable_name_segment(stem, "Invalid view filename")
+}
+
+fn validate_portable_name_segment(value: &str, message: &str) -> Result<(), String> {
+    if is_invalid_portable_name_segment(value) {
+        return Err(message.to_string());
+    }
+
+    Ok(())
+}
+
+fn is_invalid_portable_name_segment(value: &str) -> bool {
+    let trimmed = value.trim();
+    if trimmed.is_empty() || matches!(trimmed, "." | "..") {
+        return true;
+    }
+
+    if trimmed.ends_with('.') || trimmed.ends_with(' ') {
+        return true;
+    }
+
+    if trimmed.chars().any(is_invalid_portable_name_char) {
+        return true;
+    }
+
+    is_windows_reserved_device_name(trimmed)
+}
+
+fn is_invalid_portable_name_char(ch: char) -> bool {
+    ch.is_control() || matches!(ch, '<' | '>' | ':' | '"' | '/' | '\\' | '|' | '?' | '*')
+}
+
+fn is_windows_reserved_device_name(value: &str) -> bool {
+    let candidate = value
+        .split('.')
+        .next()
+        .unwrap_or(value)
+        .to_ascii_uppercase();
+    WINDOWS_RESERVED_DEVICE_NAMES
+        .iter()
+        .any(|reserved| candidate == *reserved)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{validate_filename_stem, validate_folder_name, validate_view_filename_stem};
+
+    #[test]
+    fn accepts_portable_names() {
+        assert_eq!(validate_filename_stem("meeting-notes"), Ok(()));
+        assert_eq!(validate_filename_stem("draft.v2"), Ok(()));
+        assert_eq!(validate_folder_name("Projects"), Ok(()));
+        assert_eq!(validate_view_filename_stem("active-projects"), Ok(()));
+    }
+
+    #[test]
+    fn rejects_reserved_windows_device_names() {
+        assert_eq!(
+            validate_filename_stem("con"),
+            Err("Invalid filename".to_string())
+        );
+        assert_eq!(
+            validate_folder_name("Lpt1"),
+            Err("Invalid folder name".to_string())
+        );
+        assert_eq!(
+            validate_view_filename_stem("aux"),
+            Err("Invalid view filename".to_string())
+        );
+    }
+
+    #[test]
+    fn rejects_windows_invalid_characters_and_suffixes() {
+        assert_eq!(
+            validate_filename_stem("quarterly:plan"),
+            Err("Invalid filename".to_string())
+        );
+        assert_eq!(
+            validate_folder_name("Research?"),
+            Err("Invalid folder name".to_string())
+        );
+        assert_eq!(
+            validate_view_filename_stem("overview. "),
+            Err("Invalid view filename".to_string())
+        );
+    }
+}

src-tauri/src/vault/folders.rs

@@ -2,6 +2,8 @@ use serde::{Deserialize, Serialize};
 use std::fs;
 use std::path::{Component, Path, PathBuf};
 
+use super::filename_rules::validate_folder_name;
+
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 pub struct FolderRenameResult {
     pub old_path: String,
@@ -13,9 +15,7 @@ fn normalize_folder_name(next_name: &str) -> Result<String, String> {
     if trimmed.is_empty() {
         return Err("Folder name cannot be empty".to_string());
     }
-    if trimmed == "." || trimmed == ".." || trimmed.contains('/') || trimmed.contains('\\') {
-        return Err("Invalid folder name".to_string());
-    }
+    validate_folder_name(trimmed)?;
     Ok(trimmed.to_string())
 }
 
@@ -160,6 +160,16 @@ mod tests {
         assert_eq!(error, "Invalid folder name");
     }
 
+    #[test]
+    fn rename_folder_rejects_windows_invalid_names() {
+        let dir = TempDir::new().unwrap();
+        make_folder(&dir, "projects");
+
+        let error = rename_folder(dir.path(), "projects", "LPT1").unwrap_err();
+
+        assert_eq!(error, "Invalid folder name");
+    }
+
     #[test]
     fn delete_folder_removes_nested_contents() {
         let dir = TempDir::new().unwrap();

src-tauri/src/vault/getting_started.rs

@@ -1,6 +1,5 @@
 use std::fs;
 use std::path::{Path, PathBuf};
-use std::process::Command;
 
 /// Public starter vault cloned when the user chooses Getting Started.
 pub const GETTING_STARTED_REPO_URL: &str =
@@ -569,7 +568,7 @@ fn refresh_cloned_vault_config_files(vault_path: &Path) -> Result<(), String> {
         return Ok(());
     }
 
-    ensure_commit_identity(vault_path)?;
+    crate::git::ensure_author_config(vault_path)?;
     crate::git::git_commit(
         path_to_utf8(vault_path, "Vault path")?,
         "Initialize Tolaria config files",
@@ -578,7 +577,7 @@ fn refresh_cloned_vault_config_files(vault_path: &Path) -> Result<(), String> {
 }
 
 fn vault_has_pending_changes(vault_path: &Path) -> Result<bool, String> {
-    let output = Command::new("git")
+    let output = crate::hidden_command("git")
         .args(["status", "--porcelain"])
         .current_dir(vault_path)
         .output()
@@ -594,38 +593,6 @@ fn vault_has_pending_changes(vault_path: &Path) -> Result<bool, String> {
     ))
 }
 
-fn ensure_commit_identity(vault_path: &Path) -> Result<(), String> {
-    for (key, fallback) in [
-        ("user.name", "Tolaria"),
-        ("user.email", "vault@tolaria.app"),
-    ] {
-        let output = Command::new("git")
-            .args(["config", key])
-            .current_dir(vault_path)
-            .output()
-            .map_err(|e| format!("Failed to inspect git config {key}: {e}"))?;
-
-        if output.status.success() && !String::from_utf8_lossy(&output.stdout).trim().is_empty() {
-            continue;
-        }
-
-        let set_output = Command::new("git")
-            .args(["config", key, fallback])
-            .current_dir(vault_path)
-            .output()
-            .map_err(|e| format!("Failed to set git config {key}: {e}"))?;
-
-        if !set_output.status.success() {
-            return Err(format!(
-                "git config {key} failed: {}",
-                String::from_utf8_lossy(&set_output.stderr).trim()
-            ));
-        }
-    }
-
-    Ok(())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

src-tauri/src/vault/ignored.rs

@@ -0,0 +1,300 @@
+use super::{FolderNode, VaultEntry};
+use std::collections::HashSet;
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::process::Stdio;
+use walkdir::{DirEntry, WalkDir};
+
+fn normalize_relative_path(path: &str) -> String {
+    path.replace('\\', "/")
+        .trim_start_matches("./")
+        .trim_matches('/')
+        .to_string()
+}
+
+fn relative_path(vault_path: &Path, path: &Path) -> Option<String> {
+    let relative = path.strip_prefix(vault_path).ok()?;
+    let normalized = normalize_relative_path(relative.to_string_lossy().as_ref());
+    (!normalized.is_empty()).then_some(normalized)
+}
+
+fn should_descend_for_gitignore(entry: &DirEntry) -> bool {
+    entry.depth() == 0 || entry.file_name().to_string_lossy() != ".git"
+}
+
+fn has_gitignore_file(vault_path: &Path) -> bool {
+    WalkDir::new(vault_path)
+        .follow_links(false)
+        .into_iter()
+        .filter_entry(should_descend_for_gitignore)
+        .filter_map(Result::ok)
+        .any(|entry| {
+            entry.file_type().is_file() && entry.file_name().to_string_lossy() == ".gitignore"
+        })
+}
+
+fn run_git_check_ignore(vault_path: &Path, relative_paths: &[String]) -> Option<String> {
+    let mut child = crate::hidden_command("git")
+        .args(["check-ignore", "--no-index", "--stdin"])
+        .current_dir(vault_path)
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::null())
+        .spawn()
+        .ok()?;
+
+    {
+        let stdin = child.stdin.as_mut()?;
+        for path in relative_paths {
+            writeln!(stdin, "{path}").ok()?;
+        }
+    }
+
+    let output = child.wait_with_output().ok()?;
+    if output.status.success() || output.status.code() == Some(1) {
+        return Some(String::from_utf8_lossy(&output.stdout).to_string());
+    }
+    None
+}
+
+fn ignored_relative_paths(vault_path: &Path, relative_paths: &[String]) -> HashSet<String> {
+    if relative_paths.is_empty() || !has_gitignore_file(vault_path) {
+        return HashSet::new();
+    }
+
+    let mut candidates = relative_paths
+        .iter()
+        .map(|path| normalize_relative_path(path))
+        .filter(|path| !path.is_empty())
+        .collect::<Vec<_>>();
+    candidates.sort();
+    candidates.dedup();
+
+    run_git_check_ignore(vault_path, &candidates)
+        .unwrap_or_default()
+        .lines()
+        .map(normalize_relative_path)
+        .filter(|path| !path.is_empty())
+        .collect()
+}
+
+fn filter_gitignored_items<T>(
+    vault_path: &Path,
+    items: Vec<T>,
+    hide_enabled: bool,
+    relative_for: impl Fn(&T) -> Option<String>,
+) -> Vec<T> {
+    if !hide_enabled || items.is_empty() {
+        return items;
+    }
+
+    let relative_paths = items.iter().filter_map(&relative_for).collect::<Vec<_>>();
+    let ignored = ignored_relative_paths(vault_path, &relative_paths);
+    if ignored.is_empty() {
+        return items;
+    }
+
+    items
+        .into_iter()
+        .filter(|item| {
+            relative_for(item)
+                .map(|relative| !ignored.contains(&relative))
+                .unwrap_or(true)
+        })
+        .collect()
+}
+
+pub fn filter_gitignored_paths(
+    vault_path: &Path,
+    paths: Vec<PathBuf>,
+    hide_enabled: bool,
+) -> Vec<PathBuf> {
+    filter_gitignored_items(vault_path, paths, hide_enabled, |path| {
+        relative_path(vault_path, path)
+    })
+}
+
+pub fn filter_gitignored_entries(
+    vault_path: &Path,
+    entries: Vec<VaultEntry>,
+    hide_enabled: bool,
+) -> Vec<VaultEntry> {
+    filter_gitignored_items(vault_path, entries, hide_enabled, |entry| {
+        relative_path(vault_path, Path::new(&entry.path))
+    })
+}
+
+fn collect_folder_queries(nodes: &[FolderNode], queries: &mut Vec<String>) {
+    for node in nodes {
+        let relative = normalize_relative_path(&node.path);
+        if !relative.is_empty() {
+            queries.push(relative.clone());
+            queries.push(format!("{relative}/"));
+        }
+        collect_folder_queries(&node.children, queries);
+    }
+}
+
+fn path_or_parent_is_ignored(relative_path: &str, ignored: &HashSet<String>) -> bool {
+    if ignored.contains(relative_path) {
+        return true;
+    }
+    let mut current = relative_path;
+    while let Some((parent, _)) = current.rsplit_once('/') {
+        if ignored.contains(parent) {
+            return true;
+        }
+        current = parent;
+    }
+    false
+}
+
+fn filter_folder_nodes(nodes: Vec<FolderNode>, ignored: &HashSet<String>) -> Vec<FolderNode> {
+    nodes
+        .into_iter()
+        .filter_map(|mut node| {
+            let relative = normalize_relative_path(&node.path);
+            if path_or_parent_is_ignored(&relative, ignored) {
+                return None;
+            }
+            node.children = filter_folder_nodes(node.children, ignored);
+            Some(node)
+        })
+        .collect()
+}
+
+pub fn filter_gitignored_folders(
+    vault_path: &Path,
+    folders: Vec<FolderNode>,
+    hide_enabled: bool,
+) -> Vec<FolderNode> {
+    if !hide_enabled || folders.is_empty() {
+        return folders;
+    }
+
+    let mut queries = Vec::new();
+    collect_folder_queries(&folders, &mut queries);
+    let ignored = ignored_relative_paths(vault_path, &queries);
+    if ignored.is_empty() {
+        return folders;
+    }
+
+    filter_folder_nodes(folders, &ignored)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+    use tempfile::TempDir;
+
+    fn write_file(root: &Path, relative: &str, content: &str) {
+        let path = root.join(relative);
+        if let Some(parent) = path.parent() {
+            fs::create_dir_all(parent).unwrap();
+        }
+        fs::write(path, content).unwrap();
+    }
+
+    fn init_git_repo(root: &Path) {
+        crate::hidden_command("git")
+            .args(["init"])
+            .current_dir(root)
+            .output()
+            .unwrap();
+    }
+
+    fn entry(root: &Path, relative: &str) -> VaultEntry {
+        VaultEntry {
+            path: root.join(relative).to_string_lossy().to_string(),
+            filename: relative.rsplit('/').next().unwrap().to_string(),
+            title: relative.to_string(),
+            ..VaultEntry::default()
+        }
+    }
+
+    fn entry_paths(root: &Path, entries: &[VaultEntry]) -> Vec<String> {
+        entries
+            .iter()
+            .map(|entry| relative_path(root, Path::new(&entry.path)).unwrap())
+            .collect()
+    }
+
+    #[test]
+    fn filters_ignored_entries_with_git_style_negation() {
+        let dir = TempDir::new().unwrap();
+        init_git_repo(dir.path());
+        write_file(dir.path(), ".gitignore", "ignored/*\n!ignored/keep.md\n");
+        write_file(dir.path(), "visible.md", "# Visible\n");
+        write_file(dir.path(), "ignored/hidden.md", "# Hidden\n");
+        write_file(dir.path(), "ignored/keep.md", "# Keep\n");
+
+        let filtered = filter_gitignored_entries(
+            dir.path(),
+            vec![
+                entry(dir.path(), "visible.md"),
+                entry(dir.path(), "ignored/hidden.md"),
+                entry(dir.path(), "ignored/keep.md"),
+            ],
+            true,
+        );
+        assert_eq!(
+            entry_paths(dir.path(), &filtered),
+            vec!["visible.md", "ignored/keep.md"]
+        );
+    }
+
+    #[test]
+    fn keeps_ignored_entries_when_visibility_is_enabled() {
+        let dir = TempDir::new().unwrap();
+        init_git_repo(dir.path());
+        write_file(dir.path(), ".gitignore", "ignored/\n");
+
+        let entries = vec![entry(dir.path(), "ignored/hidden.md")];
+        let filtered = filter_gitignored_entries(dir.path(), entries, false);
+        assert_eq!(
+            entry_paths(dir.path(), &filtered),
+            vec!["ignored/hidden.md"]
+        );
+    }
+
+    #[test]
+    fn filters_ignored_folder_trees() {
+        let dir = TempDir::new().unwrap();
+        init_git_repo(dir.path());
+        write_file(dir.path(), ".gitignore", "generated/\n");
+        fs::create_dir_all(dir.path().join("generated/nested")).unwrap();
+        fs::create_dir_all(dir.path().join("notes")).unwrap();
+
+        let folders = vec![
+            FolderNode {
+                name: "generated".to_string(),
+                path: "generated".to_string(),
+                children: vec![FolderNode {
+                    name: "nested".to_string(),
+                    path: "generated/nested".to_string(),
+                    children: vec![],
+                }],
+            },
+            FolderNode {
+                name: "notes".to_string(),
+                path: "notes".to_string(),
+                children: vec![],
+            },
+        ];
+
+        let filtered = filter_gitignored_folders(dir.path(), folders, true);
+        assert_eq!(filtered.len(), 1);
+        assert_eq!(filtered[0].path, "notes");
+    }
+
+    #[test]
+    fn has_no_effect_without_gitignore_file() {
+        let dir = TempDir::new().unwrap();
+        init_git_repo(dir.path());
+
+        let entries = vec![entry(dir.path(), "notes/local.md")];
+        let filtered = filter_gitignored_entries(dir.path(), entries, true);
+        assert_eq!(entry_paths(dir.path(), &filtered), vec!["notes/local.md"]);
+    }
+}

src-tauri/src/vault/mod.rs

@@ -2,9 +2,11 @@ mod cache;
 mod config_seed;
 mod entry;
 mod file;
+pub(crate) mod filename_rules;
 mod folders;
 mod frontmatter;
 mod getting_started;
+mod ignored;
 mod image;
 mod migration;
 mod parsing;
@@ -23,11 +25,13 @@ pub use entry::{FolderNode, VaultEntry};
 pub use file::{create_note_content, get_note_content, save_note_content};
 pub use folders::{delete_folder, rename_folder, FolderRenameResult};
 pub use getting_started::{create_getting_started_vault, default_vault_path, vault_exists};
+pub use ignored::{filter_gitignored_entries, filter_gitignored_folders, filter_gitignored_paths};
 pub use image::{copy_image_to_vault, save_image};
 pub use migration::migrate_is_a_to_type;
 pub use rename::{
     auto_rename_untitled, detect_renames, move_note_to_folder, rename_note, rename_note_filename,
-    update_wikilinks_for_renames, DetectedRename, RenameResult,
+    update_wikilinks_for_renames, AutoRenameUntitledRequest, DetectedRename,
+    MoveNoteToFolderRequest, RenameNoteFilenameRequest, RenameNoteRequest, RenameResult,
 };
 pub use title_sync::{sync_title_on_open, SyncAction};
 pub use trash::{batch_delete_notes, delete_note};

src-tauri/src/vault/rename.rs

@@ -6,6 +6,7 @@ use std::path::Path;
 use tempfile::NamedTempFile;
 use walkdir::WalkDir;
 
+use super::filename_rules::validate_filename_stem;
 use super::rename_transaction::RenameWorkspace;
 use crate::frontmatter::{update_frontmatter_content, FrontmatterValue};
 
@@ -20,23 +21,56 @@ pub struct RenameResult {
     pub failed_updates: usize,
 }
 
+#[derive(Clone, Copy)]
+pub struct RenameNoteRequest<'a> {
+    pub vault_path: &'a str,
+    pub old_path: &'a str,
+    pub new_title: &'a str,
+    pub old_title_hint: Option<&'a str>,
+}
+
+#[derive(Clone, Copy)]
+pub struct RenameNoteFilenameRequest<'a> {
+    pub vault_path: &'a str,
+    pub old_path: &'a str,
+    pub new_filename_stem: &'a str,
+}
+
+#[derive(Clone, Copy)]
+pub struct MoveNoteToFolderRequest<'a> {
+    pub vault_path: &'a str,
+    pub old_path: &'a str,
+    pub destination_folder_path: &'a str,
+}
+
+#[derive(Clone, Copy)]
+pub struct AutoRenameUntitledRequest<'a> {
+    pub vault_path: &'a str,
+    pub note_path: &'a str,
+}
+
 #[derive(Debug, Default)]
 struct WikilinkUpdateSummary {
     updated_files: usize,
     failed_updates: usize,
 }
 
-/// Convert a title to a filename slug (lowercase, hyphens, no special chars).
+/// Convert a title to a filename slug (lowercase, hyphens, Unicode letters/digits preserved).
 pub(super) fn title_to_slug(title: &str) -> String {
-    title
+    let slug = title
         .to_lowercase()
         .chars()
-        .map(|c| if c.is_ascii_alphanumeric() { c } else { '-' })
+        .map(|c| if c.is_alphanumeric() { c } else { '-' })
         .collect::<String>()
         .split('-')
         .filter(|s| !s.is_empty())
         .collect::<Vec<&str>>()
-        .join("-")
+        .join("-");
+    if slug.is_empty() {
+        "untitled".to_string()
+    } else {
+        slug
+    }
 }
 
 /// Build a regex that matches wiki links referencing any of the provided targets.
@@ -176,12 +210,13 @@ fn update_note_title_in_content(content: &str, new_title: &str) -> String {
 }
 
 /// Strip vault prefix and .md suffix to get the relative path stem (e.g., "project/weekly-review").
-fn to_path_stem<'a>(abs_path: &'a str, vault_prefix: &str) -> &'a str {
-    abs_path
-        .strip_prefix(vault_prefix)
-        .unwrap_or(abs_path)
+fn to_path_stem(path: &Path, vault_root: &Path) -> String {
+    let relative = path.strip_prefix(vault_root).unwrap_or(path);
+    let normalized = relative.to_string_lossy().replace('\\', "/");
+    normalized
         .strip_suffix(".md")
-        .unwrap_or(abs_path)
+        .unwrap_or(&normalized)
+        .to_string()
 }
 
 pub(crate) fn recover_pending_rename_transactions(vault: &Path) -> Result<(), String> {
@@ -197,8 +232,7 @@ fn persist_staged_note(staged: NamedTempFile, target_path: &Path) -> Result<(),
 
 fn finalize_rename(vault: &Path, old_targets: &[&str], new_file: &Path) -> RenameResult {
     let new_path = new_file.to_string_lossy().to_string();
-    let vault_prefix = format!("{}/", vault.to_string_lossy());
-    let new_path_stem = to_path_stem(&new_path, &vault_prefix).to_string();
+    let new_path_stem = to_path_stem(new_file, vault);
     let summary = update_wikilinks_in_vault(vault, old_targets, &new_path_stem, new_file);
     RenameResult {
         new_path,
@@ -213,25 +247,19 @@ fn normalize_filename_stem(new_filename_stem: &str) -> Result<String, String> {
     if stem.is_empty() {
         return Err("New filename cannot be empty".to_string());
     }
-    if is_invalid_filename_stem(stem) {
-        return Err("Invalid filename".to_string());
-    }
+    validate_filename_stem(stem)?;
     Ok(stem.to_string())
 }
 
-fn is_invalid_filename_stem(stem: &str) -> bool {
-    stem == "." || stem == ".." || stem.contains('/') || stem.contains('\\')
-}
-
 struct LoadedNote {
     content: String,
     filename: String,
     title: String,
 }
 
-fn unchanged_result(path: &str) -> RenameResult {
+fn unchanged_result(path: &Path) -> RenameResult {
     RenameResult {
-        new_path: path.to_string(),
+        new_path: path.to_string_lossy().to_string(),
         updated_files: 0,
         failed_updates: 0,
     }
@@ -245,20 +273,19 @@ fn validate_new_title(new_title: &str) -> Result<&str, String> {
     Ok(trimmed)
 }
 
-fn ensure_existing_note(old_file: &Path, old_path: &str) -> Result<(), String> {
+fn ensure_existing_note(old_file: &Path) -> Result<(), String> {
     if old_file.exists() {
         return Ok(());
     }
-    Err(format!("File does not exist: {}", old_path))
+    Err(format!("File does not exist: {}", old_file.display()))
 }
 
 fn load_note_for_title_rename(
     old_file: &Path,
-    old_path: &str,
     old_title_hint: Option<&str>,
 ) -> Result<LoadedNote, String> {
-    let content =
-        fs::read_to_string(old_file).map_err(|e| format!("Failed to read {}: {}", old_path, e))?;
+    let content = fs::read_to_string(old_file)
+        .map_err(|e| format!("Failed to read {}: {}", old_file.display(), e))?;
     let filename = old_file
         .file_name()
         .map(|f| f.to_string_lossy().to_string())
@@ -277,10 +304,9 @@ fn persist_title_only_update(
     workspace: &RenameWorkspace,
     old_file: &Path,
     updated_content: &str,
-    old_path: &str,
 ) -> Result<RenameResult, String> {
     persist_staged_note(workspace.stage_note_content(updated_content)?, old_file)?;
-    Ok(unchanged_result(old_path))
+    Ok(unchanged_result(old_file))
 }
 
 /// Rename a note: update its frontmatter title, rename the file, and update wiki links across the vault.
@@ -288,19 +314,14 @@ fn persist_title_only_update(
 /// When `old_title_hint` is provided it is used instead of extracting the title from
 /// the file's frontmatter/filename.  This is needed when the caller has already saved
 /// updated content to disk before triggering the rename.
-pub fn rename_note(
-    vault_path: &str,
-    old_path: &str,
-    new_title: &str,
-    old_title_hint: Option<&str>,
-) -> Result<RenameResult, String> {
-    let vault = Path::new(vault_path);
-    let old_file = Path::new(old_path);
+pub fn rename_note(request: RenameNoteRequest<'_>) -> Result<RenameResult, String> {
+    let vault = Path::new(request.vault_path);
+    let old_file = Path::new(request.old_path);
 
     recover_pending_rename_transactions(vault)?;
-    ensure_existing_note(old_file, old_path)?;
-    let new_title = validate_new_title(new_title)?;
-    let loaded = load_note_for_title_rename(old_file, old_path, old_title_hint)?;
+    ensure_existing_note(old_file)?;
+    let new_title = validate_new_title(request.new_title)?;
+    let loaded = load_note_for_title_rename(old_file, request.old_title_hint)?;
 
     // Check both title and filename: even if the title in content matches,
     // the filename may still be stale (e.g. "untitled-note.md" after user changed H1).
@@ -309,7 +330,7 @@ pub fn rename_note(
     let filename_matches = loaded.filename == expected_filename;
 
     if title_unchanged && filename_matches {
-        return Ok(unchanged_result(old_path));
+        return Ok(unchanged_result(old_file));
     }
 
     // Update content only if the title actually changed
@@ -321,53 +342,50 @@ pub fn rename_note(
     let workspace = RenameWorkspace::new(vault)?;
 
     if filename_matches {
-        return persist_title_only_update(&workspace, old_file, &updated_content, old_path);
+        return persist_title_only_update(&workspace, old_file, &updated_content);
     }
 
     let parent_dir = old_file
         .parent()
         .ok_or("Cannot determine parent directory")?;
     let committed = workspace
-        .operation(old_path, old_file)
+        .operation(request.old_path, old_file)
         .rename_with_candidates(
             workspace.stage_note_content(&updated_content)?,
             &expected_filename,
             parent_dir,
         )?;
-    let vault_prefix = format!("{}/", vault.to_string_lossy());
-    let old_path_stem = to_path_stem(old_path, &vault_prefix);
-    let old_targets = collect_legacy_wikilink_targets(&loaded.title, old_path_stem);
+    let old_path_stem = to_path_stem(old_file, vault);
+    let old_targets = collect_legacy_wikilink_targets(&loaded.title, &old_path_stem);
     Ok(finalize_rename(vault, &old_targets, committed.new_file()))
 }
 
 /// Rename only the file path stem while preserving title/frontmatter content.
 pub fn rename_note_filename(
-    vault_path: &str,
-    old_path: &str,
-    new_filename_stem: &str,
+    request: RenameNoteFilenameRequest<'_>,
 ) -> Result<RenameResult, String> {
-    let vault = Path::new(vault_path);
-    let old_file = Path::new(old_path);
+    let vault = Path::new(request.vault_path);
+    let old_file = Path::new(request.old_path);
 
     recover_pending_rename_transactions(vault)?;
 
     if !old_file.exists() {
-        return Err(format!("File does not exist: {}", old_path));
+        return Err(format!("File does not exist: {}", old_file.display()));
     }
 
-    let normalized_stem = normalize_filename_stem(new_filename_stem)?;
+    let normalized_stem = normalize_filename_stem(request.new_filename_stem)?;
     let old_filename = old_file
         .file_name()
         .map(|f| f.to_string_lossy().to_string())
         .unwrap_or_default();
-    let content =
-        fs::read_to_string(old_file).map_err(|e| format!("Failed to read {}: {}", old_path, e))?;
+    let content = fs::read_to_string(old_file)
+        .map_err(|e| format!("Failed to read {}: {}", request.old_path, e))?;
     let fm_title = extract_fm_title_value(&content);
     let old_title = super::extract_title(fm_title.as_deref(), &content, &old_filename);
     let new_filename = format!("{}.md", normalized_stem);
 
     if old_filename == new_filename {
-        return Ok(unchanged_result(old_path));
+        return Ok(unchanged_result(old_file));
     }
 
     let parent_dir = old_file
@@ -376,38 +394,33 @@ pub fn rename_note_filename(
     let new_file = parent_dir.join(&new_filename);
     let workspace = RenameWorkspace::new(vault)?;
     let committed = workspace
-        .operation(old_path, old_file)
+        .operation(request.old_path, old_file)
         .rename_exact(workspace.stage_note_content(&content)?, &new_file)?;
 
-    let vault_prefix = format!("{}/", vault.to_string_lossy());
-    let old_path_stem = to_path_stem(old_path, &vault_prefix);
-    let old_targets = collect_legacy_wikilink_targets(&old_title, old_path_stem);
+    let old_path_stem = to_path_stem(old_file, vault);
+    let old_targets = collect_legacy_wikilink_targets(&old_title, &old_path_stem);
     Ok(finalize_rename(vault, &old_targets, committed.new_file()))
 }
 
 /// Move a note into a different folder while preserving its filename and content.
-pub fn move_note_to_folder(
-    vault_path: &str,
-    old_path: &str,
-    destination_folder_path: &str,
-) -> Result<RenameResult, String> {
-    let vault = Path::new(vault_path);
-    let old_file = Path::new(old_path);
-    let destination_dir = Path::new(destination_folder_path);
+pub fn move_note_to_folder(request: MoveNoteToFolderRequest<'_>) -> Result<RenameResult, String> {
+    let vault = Path::new(request.vault_path);
+    let old_file = Path::new(request.old_path);
+    let destination_dir = Path::new(request.destination_folder_path);
 
     recover_pending_rename_transactions(vault)?;
-    ensure_existing_note(old_file, old_path)?;
+    ensure_existing_note(old_file)?;
 
     if !destination_dir.exists() {
         return Err(format!(
             "Folder does not exist: {}",
-            destination_folder_path
+            request.destination_folder_path
         ));
     }
     if !destination_dir.is_dir() {
         return Err(format!(
             "Folder is not a directory: {}",
-            destination_folder_path
+            request.destination_folder_path
         ));
     }
 
@@ -415,24 +428,23 @@ pub fn move_note_to_folder(
         .file_name()
         .map(|f| f.to_string_lossy().to_string())
         .unwrap_or_default();
-    let content =
-        fs::read_to_string(old_file).map_err(|e| format!("Failed to read {}: {}", old_path, e))?;
+    let content = fs::read_to_string(old_file)
+        .map_err(|e| format!("Failed to read {}: {}", request.old_path, e))?;
     let fm_title = extract_fm_title_value(&content);
     let old_title = super::extract_title(fm_title.as_deref(), &content, &old_filename);
     let new_file = destination_dir.join(&old_filename);
 
     if new_file == old_file {
-        return Ok(unchanged_result(old_path));
+        return Ok(unchanged_result(old_file));
     }
 
     let workspace = RenameWorkspace::new(vault)?;
     let committed = workspace
-        .operation(old_path, old_file)
+        .operation(request.old_path, old_file)
         .rename_exact(workspace.stage_note_content(&content)?, &new_file)?;
 
-    let vault_prefix = format!("{}/", vault.to_string_lossy());
-    let old_path_stem = to_path_stem(old_path, &vault_prefix);
-    let old_targets = collect_legacy_wikilink_targets(&old_title, old_path_stem);
+    let old_path_stem = to_path_stem(old_file, vault);
+    let old_targets = collect_legacy_wikilink_targets(&old_title, &old_path_stem);
     Ok(finalize_rename(vault, &old_targets, committed.new_file()))
 }
 
@@ -451,10 +463,9 @@ fn is_untitled_filename(filename: &str) -> bool {
 /// Returns `Some(RenameResult)` if renamed, `None` if conditions not met.
 /// This is a ONE-SHOT rename: only fires for untitled-* files with an H1.
 pub fn auto_rename_untitled(
-    vault_path: &str,
-    note_path: &str,
+    request: AutoRenameUntitledRequest<'_>,
 ) -> Result<Option<RenameResult>, String> {
-    let path = Path::new(note_path);
+    let path = Path::new(request.note_path);
     let filename = path
         .file_name()
         .map(|f| f.to_string_lossy().to_string())
@@ -464,15 +475,20 @@ pub fn auto_rename_untitled(
         return Ok(None);
     }
 
-    let content =
-        fs::read_to_string(path).map_err(|e| format!("Failed to read {}: {}", note_path, e))?;
+    let content = fs::read_to_string(path)
+        .map_err(|e| format!("Failed to read {}: {}", request.note_path, e))?;
 
     let h1_title = match super::parsing::extract_h1_title(&content) {
         Some(t) => t,
         None => return Ok(None),
     };
 
-    let result = rename_note(vault_path, note_path, &h1_title, None)?;
+    let result = rename_note(RenameNoteRequest {
+        vault_path: request.vault_path,
+        old_path: request.note_path,
+        new_title: &h1_title,
+        old_title_hint: None,
+    })?;
     Ok(Some(result))
 }
 
@@ -484,9 +500,8 @@ pub struct DetectedRename {
 }
 
 /// Detect renamed files by comparing working tree against HEAD using git diff.
-pub fn detect_renames(vault_path: &str) -> Result<Vec<DetectedRename>, String> {
-    let vault = Path::new(vault_path);
-    let output = std::process::Command::new("git")
+pub fn detect_renames(vault: &Path) -> Result<Vec<DetectedRename>, String> {
+    let output = crate::hidden_command("git")
         .args(["diff", "HEAD", "--name-status", "--diff-filter=R", "-M"])
         .current_dir(vault)
         .output()
@@ -521,28 +536,21 @@ pub fn detect_renames(vault_path: &str) -> Result<Vec<DetectedRename>, String> {
 /// Update wikilinks across the vault for a list of detected renames.
 /// Returns the total number of files updated.
 pub fn update_wikilinks_for_renames(
-    vault_path: &str,
+    vault: &Path,
     renames: &[DetectedRename],
 ) -> Result<usize, String> {
-    let vault = Path::new(vault_path);
     let mut total_updated = 0;
 
     for rename in renames {
-        let old_stem = rename
-            .old_path
-            .strip_suffix(".md")
-            .unwrap_or(&rename.old_path);
-        let new_stem = rename
-            .new_path
-            .strip_suffix(".md")
-            .unwrap_or(&rename.new_path);
-        let old_filename_stem = old_stem.split('/').next_back().unwrap_or(old_stem);
+        let old_file = vault.join(&rename.old_path);
+        let new_file = vault.join(&rename.new_path);
+        let old_stem = to_path_stem(&old_file, vault);
+        let new_stem = to_path_stem(&new_file, vault);
+        let old_filename_stem = old_stem.split('/').next_back().unwrap_or(&old_stem);
         // Build title from filename stem (kebab-case → Title Case)
         let old_title = super::parsing::slug_to_title(old_filename_stem);
-        // The new file is the exclude target (don't rewrite wikilinks inside the renamed file itself)
-        let new_file = vault.join(&rename.new_path);
-        let old_targets = collect_legacy_wikilink_targets(&old_title, old_stem);
-        let summary = update_wikilinks_in_vault(vault, &old_targets, new_stem, &new_file);
+        let old_targets = collect_legacy_wikilink_targets(&old_title, &old_stem);
+        let summary = update_wikilinks_in_vault(vault, &old_targets, &new_stem, &new_file);
         total_updated += summary.updated_files;
     }
 
@@ -555,13 +563,13 @@ mod tests {
     use std::io::Write;
     use tempfile::TempDir;
 
-    fn create_test_file(dir: &Path, name: &str, content: &str) {
+    fn create_test_file(dir: &Path, name: impl AsRef<Path>, content: impl AsRef<[u8]>) {
         let file_path = dir.join(name);
         if let Some(parent) = file_path.parent() {
             fs::create_dir_all(parent).unwrap();
         }
         let mut file = fs::File::create(file_path).unwrap();
-        file.write_all(content.as_bytes()).unwrap();
+        file.write_all(content.as_ref()).unwrap();
     }
 
     struct RenameTestRequest<'a> {
@@ -577,16 +585,86 @@ mod tests {
     ) -> (std::path::PathBuf, RenameResult) {
         create_test_file(vault, request.path, request.content);
         let old_path = vault.join(request.path);
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            request.new_title,
-            request.old_title_hint,
-        )
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: request.new_title,
+            old_title_hint: request.old_title_hint,
+        })
         .unwrap();
         (old_path, result)
     }
 
+    fn create_current_note(vault: &Path, relative_path: impl AsRef<Path>) -> std::path::PathBuf {
+        let relative_path = relative_path.as_ref();
+        create_test_file(vault, relative_path, "# Current\n");
+        vault.join(relative_path)
+    }
+
+    fn assert_rename_note_filename_error<P>(
+        new_filename_stem: impl AsRef<str>,
+        existing_destination: Option<P>,
+        expected_error: impl AsRef<str>,
+    ) where
+        P: AsRef<Path>,
+    {
+        let dir = TempDir::new().unwrap();
+        let vault = dir.path();
+        let current_path = create_current_note(vault, "note/current.md");
+        if let Some(existing_path) = existing_destination {
+            create_test_file(vault, existing_path.as_ref(), "# Existing\n");
+        }
+
+        let result = rename_note_filename(RenameNoteFilenameRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: current_path.to_str().unwrap(),
+            new_filename_stem: new_filename_stem.as_ref(),
+        });
+
+        assert_eq!(result.unwrap_err(), expected_error.as_ref());
+    }
+
+    fn assert_move_note_to_folder_error(expected_error: impl AsRef<str>) {
+        let dir = TempDir::new().unwrap();
+        let vault = dir.path();
+        create_test_file(vault, "projects/weekly-review.md", "# Weekly Review\n");
+        create_test_file(vault, "areas/weekly-review.md", "# Existing\n");
+
+        let result = move_note_to_folder(MoveNoteToFolderRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: vault.join("projects/weekly-review.md").to_str().unwrap(),
+            destination_folder_path: vault.join("areas").to_str().unwrap(),
+        });
+
+        assert_eq!(result.unwrap_err(), expected_error.as_ref());
+    }
+
+    fn assert_slug_case(input: &str, expected: &str) {
+        assert_eq!(title_to_slug(input), expected);
+    }
+
+    fn assert_unicode_rename_path(result: &RenameResult) {
+        assert!(
+            result.new_path.ends_with("你好.md"),
+            "got {}",
+            result.new_path
+        );
+    }
+
+    fn assert_unicode_rename_filesystem(vault: &Path, old_path: &Path, result: &RenameResult) {
+        assert!(Path::new(&result.new_path).exists());
+        assert!(!old_path.exists());
+        assert!(
+            !vault.join(".md").exists(),
+            "must not produce a stem-less .md file"
+        );
+    }
+
+    fn assert_unicode_rename_frontmatter(result: &RenameResult) {
+        let new_content = fs::read_to_string(&result.new_path).unwrap();
+        assert!(new_content.contains("title: 你好"));
+    }
+
     #[test]
     fn test_title_to_slug() {
         assert_eq!(title_to_slug("Weekly Review"), "weekly-review");
@@ -594,6 +672,44 @@ mod tests {
         assert_eq!(title_to_slug("Hello World"), "hello-world");
     }
 
+    #[test]
+    fn test_title_to_slug_preserves_unicode_letters() {
+        assert_slug_case("你好", "你好");
+        assert_slug_case("こんにちは", "こんにちは");
+        assert_slug_case("My Note 你好", "my-note-你好");
+        assert_slug_case("项目-2025  ✦  Q1", "项目-2025-q1");
+    }
+
+    #[test]
+    fn test_title_to_slug_falls_back_to_untitled_for_symbol_only_titles() {
+        assert_eq!(title_to_slug("！？"), "untitled");
+        assert_eq!(title_to_slug("---"), "untitled");
+    }
+
+    #[test]
+    fn test_rename_note_with_cjk_title_writes_unicode_filename() {
+        let dir = TempDir::new().unwrap();
+        let vault = dir.path();
+        create_test_file(
+            vault,
+            "untitled-note-1700000000.md",
+            "---\ntype: Note\n---\n# Untitled Note\n",
+        );
+
+        let old_path = vault.join("untitled-note-1700000000.md");
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: "你好",
+            old_title_hint: None,
+        })
+        .unwrap();
+
+        assert_unicode_rename_path(&result);
+        assert_unicode_rename_filesystem(vault, &old_path, &result);
+        assert_unicode_rename_frontmatter(&result);
+    }
+
     #[test]
     fn test_rename_note_basic() {
         let dir = TempDir::new().unwrap();
@@ -605,12 +721,12 @@ mod tests {
         );
 
         let old_path = vault.join("note/weekly-review.md");
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            "Sprint Retrospective",
-            None,
-        )
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: "Sprint Retrospective",
+            old_title_hint: None,
+        })
         .unwrap();
 
         assert!(result.new_path.ends_with("sprint-retrospective.md"));
@@ -644,12 +760,12 @@ mod tests {
         );
 
         let old_path = vault.join("note/weekly-review.md");
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            "Sprint Retrospective",
-            None,
-        )
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: "Sprint Retrospective",
+            old_title_hint: None,
+        })
         .unwrap();
 
         assert_eq!(result.updated_files, 2);
@@ -669,12 +785,12 @@ mod tests {
         create_test_file(vault, "note/test.md", "# Test\n");
 
         let old_path = vault.join("note/test.md");
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            "  ",
-            None,
-        );
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: "  ",
+            old_title_hint: None,
+        });
         assert!(result.is_err());
     }
 
@@ -767,12 +883,12 @@ mod tests {
         );
 
         let old_path = vault.join("note/old.md");
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            "New Name",
-            None,
-        )
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: "New Name",
+            old_title_hint: None,
+        })
         .unwrap();
 
         let content = fs::read_to_string(&result.new_path).unwrap();
@@ -785,21 +901,25 @@ mod tests {
 
     /// Helper: create a note, rename it, assert the rename succeeded and old file is gone.
     /// Returns the content of the renamed file for further assertions.
-    fn rename_test_note(filename: &str, content: &str, new_title: &str) -> String {
+    fn rename_test_note(
+        filename: impl AsRef<Path>,
+        content: impl AsRef<str>,
+        new_title: impl AsRef<str>,
+    ) -> String {
         let dir = TempDir::new().unwrap();
         let vault = dir.path();
-        create_test_file(vault, filename, content);
+        create_test_file(vault, filename.as_ref(), content.as_ref());
 
-        let old_path = vault.join(filename);
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            new_title,
-            None,
-        )
+        let old_path = vault.join(filename.as_ref());
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: new_title.as_ref(),
+            old_title_hint: None,
+        })
         .expect("rename_note should succeed");
 
-        let expected_slug = title_to_slug(new_title);
+        let expected_slug = title_to_slug(new_title.as_ref());
         assert!(
             result.new_path.ends_with(&format!("{}.md", expected_slug)),
             "new path should end with slug: {}",
@@ -869,12 +989,12 @@ mod tests {
         );
 
         let old_path = vault.join("note/untitled-note.md");
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            "My New Note",
-            None,
-        )
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: "My New Note",
+            old_title_hint: None,
+        })
         .unwrap();
 
         // File should be renamed to match the title slug
@@ -910,12 +1030,12 @@ mod tests {
         );
 
         let old_path = vault.join("note/untitled-note.md");
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            "My Note",
-            None,
-        )
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: "My Note",
+            old_title_hint: None,
+        })
         .unwrap();
 
         // Should get a suffixed name to avoid collision
@@ -946,11 +1066,11 @@ mod tests {
         );
 
         let old_path = vault.join("note/project-kickoff.md");
-        let result = rename_note_filename(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            "manual-name",
-        )
+        let result = rename_note_filename(RenameNoteFilenameRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_filename_stem: "manual-name",
+        })
         .unwrap();
 
         assert!(result.new_path.ends_with("manual-name.md"));
@@ -968,18 +1088,16 @@ mod tests {
 
     #[test]
     fn test_rename_note_filename_rejects_existing_destination() {
-        let dir = TempDir::new().unwrap();
-        let vault = dir.path();
-        create_test_file(vault, "note/current.md", "# Current\n");
-        create_test_file(vault, "note/manual-name.md", "# Existing\n");
-
-        let result = rename_note_filename(
-            vault.to_str().unwrap(),
-            vault.join("note/current.md").to_str().unwrap(),
+        assert_rename_note_filename_error(
             "manual-name",
+            Some("note/manual-name.md"),
+            "A note with that name already exists",
         );
+    }
 
-        assert_eq!(result.unwrap_err(), "A note with that name already exists");
+    #[test]
+    fn test_rename_note_filename_rejects_windows_invalid_names() {
+        assert_rename_note_filename_error("quarterly:plan", None::<&str>, "Invalid filename");
     }
 
     #[test]
@@ -997,11 +1115,11 @@ mod tests {
             "Reference [[projects/weekly-review]]\n",
         );
 
-        let result = move_note_to_folder(
-            vault.to_str().unwrap(),
-            vault.join("projects/weekly-review.md").to_str().unwrap(),
-            vault.join("areas").to_str().unwrap(),
-        )
+        let result = move_note_to_folder(MoveNoteToFolderRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: vault.join("projects/weekly-review.md").to_str().unwrap(),
+            destination_folder_path: vault.join("areas").to_str().unwrap(),
+        })
         .expect("move should succeed");
 
         assert!(result.new_path.ends_with("areas/weekly-review.md"));
@@ -1020,11 +1138,11 @@ mod tests {
         create_test_file(vault, "projects/weekly-review.md", "# Weekly Review\n");
 
         let source = vault.join("projects/weekly-review.md");
-        let result = move_note_to_folder(
-            vault.to_str().unwrap(),
-            source.to_str().unwrap(),
-            vault.join("projects").to_str().unwrap(),
-        )
+        let result = move_note_to_folder(MoveNoteToFolderRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: source.to_str().unwrap(),
+            destination_folder_path: vault.join("projects").to_str().unwrap(),
+        })
         .expect("move should noop");
 
         assert_eq!(result.new_path, source.to_string_lossy());
@@ -1034,18 +1152,7 @@ mod tests {
 
     #[test]
     fn test_move_note_to_folder_rejects_existing_destination() {
-        let dir = TempDir::new().unwrap();
-        let vault = dir.path();
-        create_test_file(vault, "projects/weekly-review.md", "# Weekly Review\n");
-        create_test_file(vault, "areas/weekly-review.md", "# Existing\n");
-
-        let result = move_note_to_folder(
-            vault.to_str().unwrap(),
-            vault.join("projects/weekly-review.md").to_str().unwrap(),
-            vault.join("areas").to_str().unwrap(),
-        );
-
-        assert_eq!(result.unwrap_err(), "A note with that name already exists");
+        assert_move_note_to_folder_error("A note with that name already exists");
     }
 
     #[test]
@@ -1073,12 +1180,12 @@ mod tests {
         let old_path = vault.join("note/weekly-review.md");
         // Without old_title_hint, rename_note would see H1 = "Sprint Retrospective" == new_title → noop
         // With old_title_hint = "Weekly Review", it knows to search for [[Weekly Review]] and replace
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            "Sprint Retrospective",
-            Some("Weekly Review"),
-        )
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: "Sprint Retrospective",
+            old_title_hint: Some("Weekly Review"),
+        })
         .unwrap();
 
         assert_eq!(result.updated_files, 2);
@@ -1105,12 +1212,12 @@ mod tests {
         );
 
         let old_path = vault.join("note/old.md");
-        let result = rename_note(
-            vault.to_str().unwrap(),
-            old_path.to_str().unwrap(),
-            "Brand New Title",
-            None,
-        )
+        let result = rename_note(RenameNoteRequest {
+            vault_path: vault.to_str().unwrap(),
+            old_path: old_path.to_str().unwrap(),
+            new_title: "Brand New Title",
+            old_title_hint: None,
+        })
         .unwrap();
 
         let content = fs::read_to_string(&result.new_path).unwrap();

src-tauri/src/vault_watcher.rs

@@ -0,0 +1,255 @@
+use std::ffi::OsStr;
+use std::path::{Path, PathBuf};
+
+use serde::Serialize;
+
+pub const VAULT_CHANGED_EVENT: &str = "vault-changed";
+
+#[derive(Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct VaultChangedPayload {
+    vault_path: String,
+    paths: Vec<String>,
+}
+
+fn has_ignored_component(path: &Path) -> bool {
+    path.components().any(|part| {
+        let component = part.as_os_str();
+        component == OsStr::new(".git") || component == OsStr::new("node_modules")
+    })
+}
+
+fn is_temp_file_name(name: &OsStr) -> bool {
+    let Some(name) = name.to_str() else {
+        return false;
+    };
+    name == ".DS_Store"
+        || name == ".tolaria-rename-txn"
+        || name.starts_with(".#")
+        || name.ends_with('~')
+        || name.ends_with(".tmp")
+        || name.ends_with(".swp")
+        || name.ends_with(".swx")
+}
+
+fn is_watchable_path(path: &Path) -> bool {
+    if has_ignored_component(path) {
+        return false;
+    }
+    match path.file_name() {
+        Some(name) => !is_temp_file_name(name),
+        None => true,
+    }
+}
+
+#[cfg(desktop)]
+mod desktop {
+    use std::sync::Mutex;
+
+    use notify::{
+        recommended_watcher, Event, EventKind, RecommendedWatcher, RecursiveMode, Watcher,
+    };
+    use tauri::Emitter;
+
+    use super::{is_watchable_path, Path, PathBuf, VaultChangedPayload, VAULT_CHANGED_EVENT};
+
+    struct ActiveVaultWatcher {
+        path: PathBuf,
+        _watcher: RecommendedWatcher,
+    }
+
+    pub struct VaultWatcherState {
+        active: Mutex<Option<ActiveVaultWatcher>>,
+    }
+
+    impl Default for VaultWatcherState {
+        fn default() -> Self {
+            Self::new()
+        }
+    }
+
+    impl VaultWatcherState {
+        pub fn new() -> Self {
+            Self {
+                active: Mutex::new(None),
+            }
+        }
+    }
+
+    fn validate_vault_path(vault_path: PathBuf) -> Result<PathBuf, String> {
+        if vault_path.as_os_str().is_empty() {
+            return Err("Vault path is required".to_string());
+        }
+        if !vault_path.is_dir() {
+            return Err(format!(
+                "Vault path is not a directory: {}",
+                vault_path.display()
+            ));
+        }
+        Ok(vault_path)
+    }
+
+    fn should_emit_event(event: &Event) -> bool {
+        !matches!(event.kind, EventKind::Access(_))
+    }
+
+    fn changed_paths(event: Event) -> Vec<String> {
+        if !should_emit_event(&event) {
+            return Vec::new();
+        }
+        event
+            .paths
+            .into_iter()
+            .filter(|path| is_watchable_path(path))
+            .map(|path| path.to_string_lossy().to_string())
+            .collect()
+    }
+
+    fn emit_vault_change(app: &tauri::AppHandle, vault_path: &Path, event: Event) {
+        let paths = changed_paths(event);
+        if paths.is_empty() {
+            return;
+        }
+        let payload = VaultChangedPayload {
+            vault_path: vault_path.to_string_lossy().to_string(),
+            paths,
+        };
+        if let Err(err) = app.emit(VAULT_CHANGED_EVENT, payload) {
+            log::warn!("Failed to emit vault watcher event: {}", err);
+        }
+    }
+
+    pub fn start(
+        app: tauri::AppHandle,
+        state: tauri::State<'_, VaultWatcherState>,
+        path: PathBuf,
+    ) -> Result<(), String> {
+        let vault_path = validate_vault_path(path)?;
+        let mut active = state
+            .active
+            .lock()
+            .map_err(|_| "Failed to lock vault watcher state".to_string())?;
+        if active
+            .as_ref()
+            .is_some_and(|watcher| watcher.path == vault_path)
+        {
+            return Ok(());
+        }
+
+        let event_vault_path = vault_path.clone();
+        let event_app = app.clone();
+        let mut watcher = recommended_watcher(move |event| match event {
+            Ok(event) => emit_vault_change(&event_app, &event_vault_path, event),
+            Err(err) => log::warn!("Vault watcher event failed: {}", err),
+        })
+        .map_err(|err| format!("Failed to create vault watcher: {err}"))?;
+        watcher
+            .watch(&vault_path, RecursiveMode::Recursive)
+            .map_err(|err| format!("Failed to watch {}: {err}", vault_path.display()))?;
+
+        *active = Some(ActiveVaultWatcher {
+            path: vault_path,
+            _watcher: watcher,
+        });
+        Ok(())
+    }
+
+    pub fn stop(state: tauri::State<'_, VaultWatcherState>) -> Result<(), String> {
+        let mut active = state
+            .active
+            .lock()
+            .map_err(|_| "Failed to lock vault watcher state".to_string())?;
+        *active = None;
+        Ok(())
+    }
+}
+
+#[cfg(not(desktop))]
+mod mobile {
+    use super::PathBuf;
+
+    pub struct VaultWatcherState;
+
+    impl Default for VaultWatcherState {
+        fn default() -> Self {
+            Self::new()
+        }
+    }
+
+    impl VaultWatcherState {
+        pub fn new() -> Self {
+            Self
+        }
+    }
+
+    pub fn start(_path: PathBuf) -> Result<(), String> {
+        Ok(())
+    }
+
+    pub fn stop() -> Result<(), String> {
+        Ok(())
+    }
+}
+
+#[cfg(desktop)]
+pub use desktop::VaultWatcherState;
+#[cfg(not(desktop))]
+pub use mobile::VaultWatcherState;
+
+#[cfg(desktop)]
+#[tauri::command]
+pub fn start_vault_watcher(
+    app: tauri::AppHandle,
+    state: tauri::State<'_, VaultWatcherState>,
+    path: PathBuf,
+) -> Result<(), String> {
+    desktop::start(app, state, path)
+}
+
+#[cfg(desktop)]
+#[tauri::command]
+pub fn stop_vault_watcher(state: tauri::State<'_, VaultWatcherState>) -> Result<(), String> {
+    desktop::stop(state)
+}
+
+#[cfg(not(desktop))]
+#[tauri::command]
+pub fn start_vault_watcher(path: PathBuf) -> Result<(), String> {
+    mobile::start(path)
+}
+
+#[cfg(not(desktop))]
+#[tauri::command]
+pub fn stop_vault_watcher() -> Result<(), String> {
+    mobile::stop()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::is_watchable_path;
+    use std::path::Path;
+
+    #[test]
+    fn ignores_git_and_dependency_directory_changes() {
+        assert!(!is_watchable_path(Path::new(".git/index.lock")));
+        assert!(!is_watchable_path(Path::new(
+            "node_modules/package/index.js"
+        )));
+    }
+
+    #[test]
+    fn ignores_common_temporary_files() {
+        assert!(!is_watchable_path(Path::new("note.md.tmp")));
+        assert!(!is_watchable_path(Path::new("note.md.swp")));
+        assert!(!is_watchable_path(Path::new("draft.md~")));
+        assert!(!is_watchable_path(Path::new(".DS_Store")));
+        assert!(!is_watchable_path(Path::new(".tolaria-rename-txn")));
+    }
+
+    #[test]
+    fn keeps_notes_assets_and_saved_views_watchable() {
+        assert!(is_watchable_path(Path::new("notes/day.md")));
+        assert!(is_watchable_path(Path::new("attachments/image.png")));
+        assert!(is_watchable_path(Path::new(".laputa/views/work.yml")));
+    }
+}

src-tauri/src/window_state.rs

@@ -0,0 +1,514 @@
+use serde::{Deserialize, Serialize};
+use std::fs;
+use std::path::PathBuf;
+use std::sync::Mutex;
+use tauri::{
+    App, AppHandle, LogicalPosition, LogicalSize, Manager, Position, RunEvent, Size, WebviewWindow,
+    WindowEvent,
+};
+
+const MAIN_WINDOW_LABEL: &str = "main";
+const WINDOW_STATE_FILE: &str = "window-state.json";
+const MIN_WINDOW_WIDTH: u32 = 480;
+const MIN_WINDOW_HEIGHT: u32 = 400;
+
+#[derive(Debug, Default)]
+pub(crate) struct MainWindowFrameState(Mutex<Option<WindowFrame>>);
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq, Serialize, Deserialize)]
+struct WindowFrame {
+    x: i32,
+    y: i32,
+    width: u32,
+    height: u32,
+}
+
+#[derive(Debug, Clone, Copy, Eq, PartialEq)]
+struct ScreenArea {
+    x: i32,
+    y: i32,
+    width: u32,
+    height: u32,
+}
+
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct PersistedWindowState {
+    main: Option<WindowFrame>,
+    #[serde(default)]
+    coordinate_space: WindowFrameCoordinateSpace,
+}
+
+#[derive(Debug, Default, Clone, Copy, Eq, PartialEq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+enum WindowFrameCoordinateSpace {
+    #[default]
+    Physical,
+    Logical,
+}
+
+pub(crate) fn restore_main_window_state(app: &mut App) {
+    let Some(window) = app.get_webview_window(MAIN_WINDOW_LABEL) else {
+        return;
+    };
+    restore_main_window_frame(app.handle(), &window, "during setup");
+}
+
+pub(crate) fn handle_run_event(app_handle: &AppHandle, event: &RunEvent) {
+    match event {
+        event if restores_window_frame_after_runtime_ready(event) => {
+            restore_main_window_state_from_handle(app_handle)
+        }
+        RunEvent::WindowEvent {
+            label,
+            event:
+                WindowEvent::Moved(_) | WindowEvent::Resized(_) | WindowEvent::ScaleFactorChanged { .. },
+            ..
+        } if label == MAIN_WINDOW_LABEL => cache_current_normal_frame(app_handle),
+        RunEvent::WindowEvent {
+            label,
+            event: WindowEvent::CloseRequested { .. } | WindowEvent::Destroyed,
+            ..
+        } if label == MAIN_WINDOW_LABEL => save_main_window_frame(app_handle),
+        RunEvent::Exit => save_main_window_frame(app_handle),
+        _ => {}
+    }
+}
+
+fn restores_window_frame_after_runtime_ready(event: &RunEvent) -> bool {
+    matches!(event, RunEvent::Ready)
+}
+
+fn restore_main_window_state_from_handle(app_handle: &AppHandle) {
+    let Some(window) = app_handle.get_webview_window(MAIN_WINDOW_LABEL) else {
+        return;
+    };
+    restore_main_window_frame(app_handle, &window, "after runtime ready");
+}
+
+fn restore_main_window_frame(app_handle: &AppHandle, window: &WebviewWindow, phase: &str) {
+    let Some(frame) = read_main_window_frame(window_scale_factor(window)) else {
+        return;
+    };
+    let areas = current_screen_areas(window);
+    let Some(restored_frame) = fit_frame_to_screens(frame, &areas) else {
+        return;
+    };
+
+    if let Err(err) = apply_window_frame(window, restored_frame) {
+        log::warn!("Failed to restore main window state {phase}: {err}");
+        return;
+    }
+
+    cache_frame(app_handle, restored_frame);
+}
+
+fn cache_current_normal_frame(app_handle: &AppHandle) {
+    if let Some(frame) = current_normal_main_window_frame(app_handle) {
+        cache_frame(app_handle, frame);
+    }
+}
+
+fn save_main_window_frame(app_handle: &AppHandle) {
+    let frame = current_normal_main_window_frame(app_handle).or_else(|| cached_frame(app_handle));
+    if let Some(frame) = frame {
+        if let Err(err) = write_main_window_frame(frame) {
+            log::warn!("Failed to save main window state: {err}");
+        }
+    }
+}
+
+fn current_normal_main_window_frame(app_handle: &AppHandle) -> Option<WindowFrame> {
+    let window = app_handle.get_webview_window(MAIN_WINDOW_LABEL)?;
+    if !is_normal_window(&window) {
+        return None;
+    }
+    read_window_frame(&window).filter(is_valid_saved_frame)
+}
+
+fn is_normal_window(window: &WebviewWindow) -> bool {
+    let is_fullscreen = window.is_fullscreen().unwrap_or(false);
+    let is_maximized = window.is_maximized().unwrap_or(false);
+    let is_minimized = window.is_minimized().unwrap_or(false);
+    !is_fullscreen && !is_maximized && !is_minimized
+}
+
+fn read_window_frame(window: &WebviewWindow) -> Option<WindowFrame> {
+    let scale_factor = window_scale_factor(window);
+    let position = window.outer_position().ok()?;
+    let size = window.inner_size().ok()?;
+    Some(WindowFrame::from_logical_geometry(
+        position.to_logical::<f64>(scale_factor),
+        size.to_logical::<f64>(scale_factor),
+    ))
+}
+
+fn apply_window_frame(window: &WebviewWindow, frame: WindowFrame) -> tauri::Result<()> {
+    window.set_size(Size::Logical(LogicalSize::new(
+        frame.width as f64,
+        frame.height as f64,
+    )))?;
+    window.set_position(Position::Logical(LogicalPosition::new(
+        frame.x as f64,
+        frame.y as f64,
+    )))
+}
+
+fn current_screen_areas(window: &WebviewWindow) -> Vec<ScreenArea> {
+    let scale_factor = window_scale_factor(window);
+    window
+        .available_monitors()
+        .unwrap_or_default()
+        .into_iter()
+        .map(|monitor| {
+            let area = monitor.work_area();
+            let position = area.position.to_logical::<f64>(scale_factor);
+            let size = area.size.to_logical::<f64>(scale_factor);
+            ScreenArea {
+                x: rounded_i32(position.x),
+                y: rounded_i32(position.y),
+                width: rounded_u32(size.width),
+                height: rounded_u32(size.height),
+            }
+        })
+        .filter(ScreenArea::has_area)
+        .collect()
+}
+
+fn window_scale_factor(window: &WebviewWindow) -> f64 {
+    window.scale_factor().unwrap_or(1.0).max(1.0)
+}
+
+fn fit_frame_to_screens(frame: WindowFrame, screens: &[ScreenArea]) -> Option<WindowFrame> {
+    if frame_is_visible(frame, screens) {
+        return Some(frame);
+    }
+
+    let screen = best_screen_for_frame(frame, screens)?;
+    let width = clamp_dimension(frame.width, MIN_WINDOW_WIDTH, screen.width);
+    let height = clamp_dimension(frame.height, MIN_WINDOW_HEIGHT, screen.height);
+    Some(WindowFrame {
+        x: clamp_axis(frame.x, width, screen.x, screen.width),
+        y: clamp_axis(frame.y, height, screen.y, screen.height),
+        width,
+        height,
+    })
+}
+
+fn frame_is_visible(frame: WindowFrame, screens: &[ScreenArea]) -> bool {
+    frame_corners(frame)
+        .into_iter()
+        .all(|point| screens.iter().any(|screen| screen.contains(point)))
+}
+
+fn frame_corners(frame: WindowFrame) -> [(i32, i32); 4] {
+    let right = frame.right() - 1;
+    let bottom = frame.bottom() - 1;
+    [
+        (frame.x, frame.y),
+        (right, frame.y),
+        (frame.x, bottom),
+        (right, bottom),
+    ]
+}
+
+fn best_screen_for_frame(frame: WindowFrame, screens: &[ScreenArea]) -> Option<ScreenArea> {
+    screens
+        .iter()
+        .copied()
+        .filter(ScreenArea::has_area)
+        .max_by_key(|screen| intersection_area(frame, *screen))
+}
+
+fn intersection_area(frame: WindowFrame, screen: ScreenArea) -> u64 {
+    let left = frame.x.max(screen.x);
+    let top = frame.y.max(screen.y);
+    let right = frame.right().min(screen.right());
+    let bottom = frame.bottom().min(screen.bottom());
+    if right <= left || bottom <= top {
+        return 0;
+    }
+    (right - left) as u64 * (bottom - top) as u64
+}
+
+fn clamp_dimension(value: u32, min: u32, max: u32) -> u32 {
+    if max < min {
+        max
+    } else {
+        value.clamp(min, max)
+    }
+}
+
+fn clamp_axis(value: i32, size: u32, area_start: i32, area_size: u32) -> i32 {
+    let max_start = area_start + area_size as i32 - size as i32;
+    if max_start < area_start {
+        return area_start;
+    }
+    value.clamp(area_start, max_start)
+}
+
+fn cache_frame(app_handle: &AppHandle, frame: WindowFrame) {
+    let state: tauri::State<'_, MainWindowFrameState> = app_handle.state();
+    if let Ok(mut cached_frame) = state.0.lock() {
+        *cached_frame = Some(frame);
+    };
+}
+
+fn cached_frame(app_handle: &AppHandle) -> Option<WindowFrame> {
+    let state: tauri::State<'_, MainWindowFrameState> = app_handle.state();
+    state.0.lock().ok().and_then(|cached_frame| *cached_frame)
+}
+
+fn window_state_path() -> Result<PathBuf, String> {
+    crate::settings::preferred_app_config_path(WINDOW_STATE_FILE)
+}
+
+fn read_main_window_frame(scale_factor: f64) -> Option<WindowFrame> {
+    let content = fs::read_to_string(window_state_path().ok()?).ok()?;
+    let persisted: PersistedWindowState = serde_json::from_str(&content).ok()?;
+    persisted
+        .main
+        .map(|frame| {
+            persisted
+                .coordinate_space
+                .to_logical_frame(frame, scale_factor)
+        })
+        .filter(is_valid_saved_frame)
+}
+
+fn write_main_window_frame(frame: WindowFrame) -> Result<(), String> {
+    let path = window_state_path()?;
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|e| format!("Failed to create window state directory: {e}"))?;
+    }
+
+    let persisted = PersistedWindowState {
+        main: Some(frame),
+        coordinate_space: WindowFrameCoordinateSpace::Logical,
+    };
+    let json = serde_json::to_string_pretty(&persisted)
+        .map_err(|e| format!("Failed to serialize window state: {e}"))?;
+    fs::write(path, json).map_err(|e| format!("Failed to write window state: {e}"))
+}
+
+fn is_valid_saved_frame(frame: &WindowFrame) -> bool {
+    frame.width >= MIN_WINDOW_WIDTH && frame.height >= MIN_WINDOW_HEIGHT
+}
+
+fn rounded_i32(value: f64) -> i32 {
+    value.round() as i32
+}
+
+fn rounded_u32(value: f64) -> u32 {
+    value.round().max(0.0) as u32
+}
+
+impl WindowFrame {
+    fn from_logical_geometry(position: LogicalPosition<f64>, size: LogicalSize<f64>) -> Self {
+        Self {
+            x: rounded_i32(position.x),
+            y: rounded_i32(position.y),
+            width: rounded_u32(size.width),
+            height: rounded_u32(size.height),
+        }
+    }
+
+    fn to_logical(self, scale_factor: f64) -> Self {
+        let scale_factor = scale_factor.max(1.0);
+        Self {
+            x: rounded_i32(self.x as f64 / scale_factor),
+            y: rounded_i32(self.y as f64 / scale_factor),
+            width: rounded_u32(self.width as f64 / scale_factor),
+            height: rounded_u32(self.height as f64 / scale_factor),
+        }
+    }
+
+    fn right(self) -> i32 {
+        self.x + self.width as i32
+    }
+
+    fn bottom(self) -> i32 {
+        self.y + self.height as i32
+    }
+}
+
+impl WindowFrameCoordinateSpace {
+    fn to_logical_frame(self, frame: WindowFrame, scale_factor: f64) -> WindowFrame {
+        match self {
+            Self::Logical => frame,
+            Self::Physical => frame.to_logical(scale_factor),
+        }
+    }
+}
+
+impl ScreenArea {
+    fn right(self) -> i32 {
+        self.x + self.width as i32
+    }
+
+    fn bottom(self) -> i32 {
+        self.y + self.height as i32
+    }
+
+    fn has_area(&self) -> bool {
+        self.width > 0 && self.height > 0
+    }
+
+    fn contains(&self, point: (i32, i32)) -> bool {
+        let (x, y) = point;
+        x >= self.x && x < self.right() && y >= self.y && y < self.bottom()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn frame(x: i32, y: i32, width: u32, height: u32) -> WindowFrame {
+        WindowFrame {
+            x,
+            y,
+            width,
+            height,
+        }
+    }
+
+    fn screen(x: i32, y: i32, width: u32, height: u32) -> ScreenArea {
+        ScreenArea {
+            x,
+            y,
+            width,
+            height,
+        }
+    }
+
+    #[test]
+    fn records_logical_window_geometry_for_persistence() {
+        let saved = WindowFrame::from_logical_geometry(
+            LogicalPosition::new(80.0, 120.0),
+            LogicalSize::new(1100.0, 700.0),
+        );
+
+        assert_eq!(saved, frame(80, 120, 1100, 700));
+    }
+
+    #[test]
+    fn migrates_legacy_physical_frames_to_logical_points() {
+        let saved = frame(160, 240, 2200, 1400);
+
+        assert_eq!(
+            WindowFrameCoordinateSpace::Physical.to_logical_frame(saved, 2.0),
+            frame(80, 120, 1100, 700)
+        );
+    }
+
+    #[test]
+    fn keeps_explicit_logical_frames_unscaled() {
+        let saved = frame(80, 120, 1100, 700);
+
+        assert_eq!(
+            WindowFrameCoordinateSpace::Logical.to_logical_frame(saved, 2.0),
+            saved
+        );
+    }
+
+    #[test]
+    fn keeps_valid_frame_unchanged() {
+        let saved = frame(120, 80, 1400, 900);
+        let screens = [screen(0, 0, 1920, 1080)];
+
+        assert_eq!(fit_frame_to_screens(saved, &screens), Some(saved));
+    }
+
+    #[test]
+    fn clamps_oversized_frame_to_current_work_area() {
+        let saved = frame(-100, -80, 2600, 1800);
+        let screens = [screen(0, 0, 1440, 900)];
+
+        assert_eq!(
+            fit_frame_to_screens(saved, &screens),
+            Some(frame(0, 0, 1440, 900))
+        );
+    }
+
+    #[test]
+    fn moves_offscreen_frame_back_to_a_visible_screen() {
+        let saved = frame(3200, 1800, 900, 700);
+        let screens = [screen(0, 0, 1440, 900)];
+
+        assert_eq!(
+            fit_frame_to_screens(saved, &screens),
+            Some(frame(540, 200, 900, 700))
+        );
+    }
+
+    #[test]
+    fn picks_the_screen_with_the_largest_visible_overlap() {
+        let saved = frame(1700, 100, 900, 700);
+        let screens = [screen(0, 0, 1920, 1080), screen(1920, 0, 1440, 900)];
+
+        assert_eq!(fit_frame_to_screens(saved, &screens), Some(saved));
+    }
+
+    #[test]
+    fn ignores_empty_screen_areas_when_restoring() {
+        let saved = frame(100, 100, 800, 600);
+        let screens = [screen(0, 0, 0, 900), screen(0, 0, 1440, 900)];
+
+        assert_eq!(fit_frame_to_screens(saved, &screens), Some(saved));
+    }
+
+    #[test]
+    fn returns_none_when_no_usable_screens_exist() {
+        let saved = frame(100, 100, 800, 600);
+
+        assert_eq!(fit_frame_to_screens(saved, &[]), None);
+        assert_eq!(fit_frame_to_screens(saved, &[screen(0, 0, 0, 0)]), None);
+    }
+
+    #[test]
+    fn fits_to_tiny_work_area_when_it_is_smaller_than_minimum_size() {
+        let saved = frame(100, 100, 800, 600);
+        let screens = [screen(0, 0, 320, 240)];
+
+        assert_eq!(
+            fit_frame_to_screens(saved, &screens),
+            Some(frame(0, 0, 320, 240))
+        );
+    }
+
+    #[test]
+    fn reports_visibility_across_adjacent_screens() {
+        let screens = [screen(0, 0, 1920, 1080), screen(1920, 0, 1440, 900)];
+
+        assert!(frame_is_visible(frame(1700, 100, 900, 700), &screens));
+        assert!(!frame_is_visible(frame(1700, 850, 900, 300), &screens));
+    }
+
+    #[test]
+    fn computes_frame_and_screen_edges_for_overlap_checks() {
+        let saved = frame(10, 20, 800, 600);
+        let area = screen(0, 0, 500, 400);
+
+        assert_eq!(saved.right(), 810);
+        assert_eq!(saved.bottom(), 620);
+        assert_eq!(area.right(), 500);
+        assert_eq!(area.bottom(), 400);
+        assert_eq!(intersection_area(saved, area), 490 * 380);
+        assert_eq!(intersection_area(saved, screen(900, 900, 200, 200)), 0);
+    }
+
+    #[test]
+    fn rejects_corrupted_tiny_saved_frames() {
+        assert!(!is_valid_saved_frame(&frame(100, 100, 1, 900)));
+        assert!(!is_valid_saved_frame(&frame(100, 100, 1400, 1)));
+    }
+
+    #[test]
+    fn restores_again_after_runtime_ready() {
+        assert!(restores_window_frame_after_runtime_ready(&RunEvent::Ready));
+        assert!(!restores_window_frame_after_runtime_ready(
+            &RunEvent::Resumed
+        ));
+    }
+}

src-tauri/tauri.conf.json

@@ -23,7 +23,7 @@
         "titleBarStyle": "Overlay",
         "hiddenTitle": true,
         "backgroundColor": "#F7F6F3",
-        "dragDropEnabled": false
+        "dragDropEnabled": true
       }
     ],
     "security": {
@@ -33,6 +33,8 @@
         "connect-src": "'self' ipc: http://ipc.localhost ws://localhost:9710 ws://127.0.0.1:9710 ws://localhost:9711 ws://127.0.0.1:9711 https:",
         "img-src": "'self' asset: http://asset.localhost data: blob: https:",
         "style-src": "'self' 'unsafe-inline' https://fonts.googleapis.com",
+        "style-src-elem": "'self' 'nonce-tolaria-runtime-style' https://fonts.googleapis.com",
+        "style-src-attr": "'unsafe-inline'",
         "font-src": "'self' data: https://fonts.gstatic.com",
         "media-src": "'self' data: blob: https:",
         "object-src": "'none'"
@@ -47,6 +49,11 @@
     "active": true,
     "targets": "all",
     "createUpdaterArtifacts": true,
+    "windows": {
+      "webviewInstallMode": {
+        "type": "downloadBootstrapper"
+      }
+    },
     "resources": {
       "resources/mcp-server/**/*": "mcp-server/"
     },
@@ -63,6 +70,9 @@
       "endpoints": [
         "https://refactoringhq.github.io/tolaria/stable/latest.json"
       ],
+      "windows": {
+        "installMode": "passive"
+      },
       "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEE4NkQ5MDI3REVCRkFGNUMKUldSY3I3L2VKNUJ0cU5JRlRZZlp3NGhnU3ZwbkVKeGVvREpmb2sxRVJndHFpVFZPNlArbEE5R1IK"
     }
   }

src/App.css

@@ -68,9 +68,9 @@
 
 /* AI highlight animation — applied by useAiActivity when MCP calls ui_highlight */
 @keyframes ai-highlight-glow {
-  0% { box-shadow: inset 0 0 0 2px rgba(99, 102, 241, 0.8); }
-  50% { box-shadow: inset 0 0 8px 2px rgba(99, 102, 241, 0.4); }
-  100% { box-shadow: inset 0 0 0 2px rgba(99, 102, 241, 0); }
+  0% { box-shadow: inset 0 0 0 2px color-mix(in srgb, var(--accent-blue) 80%, transparent); }
+  50% { box-shadow: inset 0 0 8px 2px color-mix(in srgb, var(--accent-blue) 40%, transparent); }
+  100% { box-shadow: inset 0 0 0 2px color-mix(in srgb, var(--accent-blue) 0%, transparent); }
 }
 
 .ai-highlight {

src/App.test.tsx

@@ -2,6 +2,9 @@ import { act, render, screen, fireEvent, waitFor, within } from '@testing-librar
 import type { ReactNode } from 'react'
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { DEFAULT_VAULTS } from './hooks/useVaultSwitcher'
+import { formatShortcutDisplay } from './hooks/appCommandCatalog'
+import { invoke } from '@tauri-apps/api/core'
+import type { Settings, ViewDefinition, ViewFile } from './types'
 
 // Provide a localStorage mock that supports all methods (jsdom's may be incomplete)
 const localStorageMock = (() => {
@@ -58,13 +61,30 @@ const mockEntries = [
     belongsTo: [],
     relatedTo: [],
     status: 'Active',
+    archived: false,
     owner: 'Luca',
     cadence: null,
     modifiedAt: 1700000000,
     createdAt: null,
     fileSize: 1024,
+    snippet: '',
+    wordCount: 0,
+    relationships: {},
+    icon: null,
+    color: null,
+    order: null,
+    sidebarLabel: null,
     template: null, sort: null,
+    view: null,
+    visible: true,
+    organized: false,
+    favorite: false,
+    favoriteIndex: null,
+    listPropertiesDisplay: [],
     outgoingLinks: [],
+    properties: {},
+    hasH1: true,
+    fileKind: 'markdown',
   },
   {
     path: '/vault/topic/dev.md',
@@ -75,13 +95,30 @@ const mockEntries = [
     belongsTo: [],
     relatedTo: [],
     status: null,
+    archived: false,
     owner: null,
     cadence: null,
     modifiedAt: 1700000000,
     createdAt: null,
     fileSize: 256,
+    snippet: '',
+    wordCount: 0,
+    relationships: {},
+    icon: null,
+    color: null,
+    order: null,
+    sidebarLabel: null,
     template: null, sort: null,
+    view: null,
+    visible: true,
+    organized: false,
+    favorite: false,
+    favoriteIndex: null,
+    listPropertiesDisplay: [],
     outgoingLinks: [],
+    properties: {},
+    hasH1: true,
+    fileKind: 'markdown',
   },
 ]
 
@@ -107,8 +144,12 @@ const mockCommandResults: Record<string, unknown> = {
   get_all_content: mockAllContent,
   get_modified_files: [],
   get_note_content: mockAllContent['/vault/project/test.md'] || '',
+  reload_vault_entry: ({ path }: { path: string }) => mockEntries.find((entry) => entry.path === path) ?? null,
+  sync_vault_asset_scope_for_window: null,
   get_file_history: [],
   get_settings: { auto_pull_interval_minutes: null, telemetry_consent: true, crash_reporting_enabled: null, analytics_enabled: null, anonymous_id: null, release_channel: null },
+  is_git_repo: true,
+  init_git_repo: null,
   git_pull: { status: 'up_to_date', message: 'Already up to date', updatedFiles: [], conflictFiles: [] },
   save_settings: null,
   check_vault_exists: true,
@@ -238,15 +279,20 @@ function resetMockCommandResults() {
     get_all_content: mockAllContent,
     get_modified_files: [],
     get_note_content: mockAllContent['/vault/project/test.md'] || '',
+    reload_vault_entry: ({ path }: { path: string }) => mockEntries.find((entry) => entry.path === path) ?? null,
+    sync_vault_asset_scope_for_window: null,
     get_file_history: [],
     get_settings: {
       auto_pull_interval_minutes: null,
+      auto_advance_inbox_after_organize: null,
       telemetry_consent: true,
       crash_reporting_enabled: null,
       analytics_enabled: null,
       anonymous_id: null,
       release_channel: null,
     },
+    is_git_repo: true,
+    init_git_repo: null,
     save_settings: null,
     check_vault_exists: true,
     get_default_vault_path: expectedDefaultVaultPath,
@@ -263,19 +309,47 @@ function resolveMockCommandResult(cmd: string, args?: unknown) {
 }
 
 vi.mock('./mock-tauri', () => ({
-  isTauri: () => false,
+  isTauri: vi.fn(() => false),
   mockInvoke: vi.fn(async (cmd: string, args?: unknown) => resolveMockCommandResult(cmd, args)),
   addMockEntry: vi.fn(),
   updateMockContent: vi.fn(),
+  trackMockChange: vi.fn(),
 }))
 
 // Mock ai-chat utilities
-vi.mock('./utils/ai-chat', () => ({
-  buildSystemPrompt: vi.fn(() => ({ prompt: '', totalTokens: 0, truncated: false })),
-  checkClaudeCli: vi.fn(async () => ({ installed: false })),
-  streamClaudeChat: vi.fn(async () => 'mock-session'),
+vi.mock('./utils/ai-chat', async () => {
+  const actual = await vi.importActual<typeof import('./utils/ai-chat')>('./utils/ai-chat')
+
+  return {
+    ...actual,
+    buildSystemPrompt: vi.fn(() => ({ prompt: '', totalTokens: 0, truncated: false })),
+    checkClaudeCli: vi.fn(async () => ({ installed: false })),
+    streamClaudeChat: vi.fn(async () => 'mock-session'),
+  }
+})
+
+vi.mock('./utils/streamAiAgent', () => ({
+  streamAiAgent: vi.fn(async () => {}),
 }))
 
+vi.mock('./hooks/useUpdater', async () => {
+  const actual = await vi.importActual<typeof import('./hooks/useUpdater')>('./hooks/useUpdater')
+
+  return {
+    ...actual,
+    useUpdater: vi.fn(() => ({
+      status: { state: 'idle' },
+      actions: {
+        checkForUpdates: vi.fn(async () => ({ kind: 'up-to-date' })),
+        startDownload: vi.fn(),
+        openReleaseNotes: vi.fn(),
+        dismiss: vi.fn(),
+      },
+    })),
+    restartApp: vi.fn(),
+  }
+})
+
 // Mock BlockNote components (they need DOM APIs not available in jsdom)
 vi.mock('@blocknote/core', () => ({
   BlockNoteSchema: { create: () => ({ extend: () => ({}) }) },
@@ -294,6 +368,7 @@ vi.mock('@blocknote/core/extensions', () => ({
 }))
 
 vi.mock('@blocknote/react', () => ({
+  createReactBlockSpec: () => () => ({}),
   createReactInlineContentSpec: () => ({ render: () => null }),
   BlockNoteViewRaw: ({ children }: { children?: ReactNode }) => (
     <div data-testid="blocknote-view">
@@ -303,6 +378,7 @@ vi.mock('@blocknote/react', () => ({
       {children}
     </div>
   ),
+  LinkToolbar: ({ children }: { children?: ReactNode }) => <>{children}</>,
   ComponentsContext: {
     Provider: ({ children }: { children?: ReactNode }) => <>{children}</>,
   },
@@ -315,8 +391,30 @@ vi.mock('@blocknote/react', () => ({
     focus: () => {},
     onMount: (cb: () => void) => { cb(); return () => {} },
   }),
+  LinkToolbarController: () => null,
+  EditLinkButton: () => null,
+  DeleteLinkButton: () => null,
   SideMenuController: () => null,
   SuggestionMenuController: () => null,
+  useComponentsContext: () => ({
+    LinkToolbar: {
+      Button: ({
+        children,
+        label,
+        onClick,
+      }: { children?: ReactNode; label?: string; onClick?: () => void }) => (
+        <button onClick={onClick} type="button">
+          {label}
+          {children}
+        </button>
+      ),
+    },
+  }),
+  useDictionary: () => ({
+    link_toolbar: {
+      open: { tooltip: 'Open in a new tab' },
+    },
+  }),
 }))
 
 vi.mock('@blocknote/mantine', () => ({
@@ -332,15 +430,36 @@ vi.mock('./components/tolariaEditorFormatting', () => ({
 }))
 
 import App from './App'
+import { useUpdater } from './hooks/useUpdater'
+import { isTauri } from './mock-tauri'
+import { streamAiAgent } from './utils/streamAiAgent'
 
 const AI_AGENTS_ONBOARDING_DISMISSED_KEY = 'tolaria:ai-agents-onboarding-dismissed'
 const CLAUDE_CODE_ONBOARDING_DISMISSED_KEY = 'tolaria:claude-code-onboarding-dismissed'
 
+function createMockUpdaterResult(
+  checkForUpdates: () => Promise<{ kind: 'up-to-date' } | { kind: 'available'; version: string; displayVersion: string } | { kind: 'error'; message: string }> = async () => ({ kind: 'up-to-date' }),
+) {
+  return {
+    status: { state: 'idle' as const },
+    actions: {
+      checkForUpdates,
+      startDownload: vi.fn(),
+      openReleaseNotes: vi.fn(),
+      dismiss: vi.fn(),
+    },
+  }
+}
+
 describe('App', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     resetMockCommandResults()
+    vi.mocked(invoke).mockImplementation(async (cmd: string, args?: unknown) => resolveMockCommandResult(cmd, args))
+    vi.mocked(isTauri).mockReturnValue(false)
+    vi.mocked(useUpdater).mockReturnValue(createMockUpdaterResult())
     localStorage.clear()
+    window.history.replaceState({}, '', '/')
     localStorage.setItem(CLAUDE_CODE_ONBOARDING_DISMISSED_KEY, '1')
   })
 
@@ -349,6 +468,35 @@ describe('App', () => {
     expect(await screen.findByText('All Notes', {}, { timeout: 5000 })).toBeInTheDocument()
   })
 
+  it('creates custom views with a portable fallback filename for symbol-only names', async () => {
+    const savedViews: ViewFile[] = []
+    const saveView = vi.fn(({ filename, definition }: { filename: string; definition: ViewDefinition }) => {
+      if (filename === '.yml') throw new Error('Invalid view filename')
+      savedViews.push({ filename, definition })
+      return null
+    })
+    mockCommandResults.save_view_cmd = saveView
+    mockCommandResults.list_views = () => savedViews
+    mockCommandResults.reload_vault = mockEntries
+
+    render(<App />)
+
+    await screen.findByText('All Notes')
+    fireEvent.click(screen.getByRole('button', { name: 'Create view' }))
+    const dialog = await screen.findByRole('dialog')
+    fireEvent.change(within(dialog).getByPlaceholderText(/Active Projects|Reading List/i), {
+      target: { value: '🚀' },
+    })
+    fireEvent.click(within(dialog).getByRole('button', { name: 'Create' }))
+
+    await waitFor(() => {
+      expect(saveView).toHaveBeenCalledWith(expect.objectContaining({
+        filename: 'view.yml',
+        definition: expect.objectContaining({ name: '🚀' }),
+      }))
+    })
+  })
+
   it('loads and displays vault entries in sidebar', async () => {
     render(<App />)
     await waitFor(() => {
@@ -358,6 +506,31 @@ describe('App', () => {
     })
   })
 
+  it('shows the app shell skeleton while the vault note scan is pending', async () => {
+    let resolveListVault: ((value: typeof mockEntries) => void) | null = null
+    const listVaultPromise = new Promise<typeof mockEntries>((resolve) => {
+      resolveListVault = resolve
+    })
+    mockCommandResults.list_vault = () => listVaultPromise
+
+    render(<App />)
+
+    await waitFor(() => {
+      expect(screen.getByTestId('vault-loading-skeleton')).toBeInTheDocument()
+    })
+    expect(screen.queryByText('Select a note to start editing')).not.toBeInTheDocument()
+
+    await act(async () => {
+      resolveListVault?.(mockEntries)
+      await Promise.resolve()
+    })
+
+    await waitFor(() => {
+      expect(screen.queryByTestId('vault-loading-skeleton')).not.toBeInTheDocument()
+      expect(screen.getAllByText('Test Project').length).toBeGreaterThan(0)
+    })
+  })
+
   it('shows empty state in editor when no note is selected', async () => {
     render(<App />)
     await waitFor(() => {
@@ -365,10 +538,40 @@ describe('App', () => {
     })
   })
 
-  it('shows keyboard shortcut hints', async () => {
+  it('opens a note window by loading only the requested entry', async () => {
+    const listVault = vi.fn(() => mockEntries)
+    const reloadVaultEntry = vi.fn(({ path }: { path: string }) =>
+      mockEntries.find((entry) => entry.path === path) ?? null,
+    )
+    const getNoteContent = vi.fn(({ path }: { path: string }) => mockAllContent[path] ?? '')
+    mockCommandResults.list_vault = listVault
+    mockCommandResults.reload_vault_entry = reloadVaultEntry
+    mockCommandResults.get_note_content = getNoteContent
+    window.history.replaceState(
+      {},
+      '',
+      '/?window=note&path=%2Fvault%2Fproject%2Ftest.md&vault=%2Fvault&title=Test+Project',
+    )
+
     render(<App />)
+
+    await waitFor(() => expect(reloadVaultEntry).toHaveBeenCalled())
+    expect(reloadVaultEntry).toHaveBeenCalledWith({ path: '/vault/project/test.md', vaultPath: '/vault' })
+    await waitFor(() => expect(getNoteContent).toHaveBeenCalled())
+    expect(getNoteContent).toHaveBeenCalledWith({ path: '/vault/project/test.md', vaultPath: '/vault' })
+    await waitFor(() => expect(window.__laputaTest?.activeTabPath).toBe('/vault/project/test.md'))
+    expect(listVault).not.toHaveBeenCalled()
+  })
+
+  it('shows keyboard shortcut hints', async () => {
+    const quickOpenHint = formatShortcutDisplay({ display: '⌘P / ⌘O' })
+    const newNoteHint = formatShortcutDisplay({ display: '⌘N' })
+    const { container } = render(<App />)
     await waitFor(() => {
-      expect(screen.getByText(/Cmd\+P or Cmd\+O to search/)).toBeInTheDocument()
+      const shortcutHint = Array.from(container.querySelectorAll('span.text-xs.text-muted-foreground'))
+        .find((element) => element.textContent === `${quickOpenHint} to search · ${newNoteHint} to create`)
+
+      expect(shortcutHint).toBeInTheDocument()
     })
   })
 
@@ -385,12 +588,53 @@ describe('App', () => {
     })
   })
 
+  it('shows visible feedback when a manual update check finds an update', async () => {
+    vi.mocked(useUpdater).mockReturnValue(createMockUpdaterResult(async () => ({
+      kind: 'available',
+      version: '2026.4.25',
+      displayVersion: '2026.4.25',
+    })))
+
+    render(<App />)
+
+    await waitFor(() => {
+      expect(screen.getByText('All Notes')).toBeInTheDocument()
+    })
+
+    fireEvent.click(screen.getByTestId('status-build-number'))
+
+    await waitFor(() => {
+      expect(screen.getByText('Tolaria 2026.4.25 is available')).toBeInTheDocument()
+    })
+  })
+
+  it('shows visible feedback when a menu-driven update check finds no eligible update', async () => {
+    vi.mocked(useUpdater).mockReturnValue(createMockUpdaterResult(async () => ({ kind: 'up-to-date' })))
+
+    render(<App />)
+
+    await waitFor(() => {
+      expect(screen.getByText('All Notes')).toBeInTheDocument()
+      expect(typeof window.__laputaTest?.dispatchBrowserMenuCommand).toBe('function')
+    })
+
+    act(() => {
+      window.__laputaTest?.dispatchBrowserMenuCommand?.('app-check-for-updates')
+    })
+
+    await waitFor(() => {
+      expect(screen.getByText('No newer stable update is available right now')).toBeInTheDocument()
+    })
+  })
+
   it('shows the external AI setup dialog from the menu when AI onboarding is active', async () => {
     localStorage.removeItem(AI_AGENTS_ONBOARDING_DISMISSED_KEY)
     localStorage.removeItem(CLAUDE_CODE_ONBOARDING_DISMISSED_KEY)
     mockCommandResults.get_ai_agents_status = {
       claude_code: { installed: true, version: '2.1.90' },
       codex: { installed: true, version: '0.122.0-alpha.1' },
+      opencode: { installed: false, version: null },
+      pi: { installed: false, version: null },
     }
     mockCommandResults.check_mcp_status = 'installed'
 
@@ -415,6 +659,98 @@ describe('App', () => {
     expect(screen.queryByText('AI agents ready')).not.toBeInTheDocument()
   })
 
+  it('routes right-panel AI chat messages to the selected default agent', async () => {
+    mockCommandResults.get_settings = {
+      auto_pull_interval_minutes: null,
+      auto_advance_inbox_after_organize: null,
+      telemetry_consent: true,
+      crash_reporting_enabled: null,
+      analytics_enabled: null,
+      anonymous_id: null,
+      release_channel: null,
+      default_ai_agent: 'codex',
+    }
+    mockCommandResults.get_ai_agents_status = {
+      claude_code: { installed: true, version: '2.1.90' },
+      codex: { installed: true, version: '0.122.0-alpha.1' },
+      opencode: { installed: false, version: null },
+      pi: { installed: false, version: null },
+    }
+
+    render(<App />)
+
+    await screen.findByText('All Notes')
+    fireEvent.keyDown(window, { key: 'l', code: 'KeyL', metaKey: true, shiftKey: true })
+
+    const input = await screen.findByTestId('agent-input')
+    await waitFor(() => {
+      expect(input).toHaveAttribute('aria-placeholder', 'Ask Codex')
+    })
+
+    input.textContent = 'Summarize the active vault'
+    fireEvent.input(input)
+    fireEvent.click(screen.getByTestId('agent-send'))
+
+    await waitFor(() => {
+      expect(streamAiAgent).toHaveBeenCalledWith(expect.objectContaining({
+        agent: 'codex',
+      }))
+    })
+  })
+
+  it('waits for saved AI agent settings before sending right-panel messages', async () => {
+    let resolveSettings: ((settings: Settings) => void) | null = null
+    mockCommandResults.get_settings = () => new Promise((resolve) => {
+      resolveSettings = resolve
+    })
+    mockCommandResults.get_ai_agents_status = {
+      claude_code: { installed: true, version: '2.1.90' },
+      codex: { installed: true, version: '0.122.0-alpha.1' },
+      opencode: { installed: false, version: null },
+      pi: { installed: false, version: null },
+    }
+
+    render(<App />)
+
+    await screen.findByText('All Notes')
+    fireEvent.keyDown(window, { key: 'l', code: 'KeyL', metaKey: true, shiftKey: true })
+
+    const input = await screen.findByTestId('agent-input')
+    input.textContent = 'Summarize the active vault'
+    fireEvent.input(input)
+    fireEvent.click(screen.getByTestId('agent-send'))
+
+    await act(async () => {
+      await Promise.resolve()
+    })
+    expect(streamAiAgent).not.toHaveBeenCalled()
+
+    await act(async () => {
+      resolveSettings?.({
+        auto_pull_interval_minutes: null,
+        auto_advance_inbox_after_organize: null,
+        telemetry_consent: true,
+        crash_reporting_enabled: null,
+        analytics_enabled: null,
+        anonymous_id: null,
+        release_channel: null,
+        default_ai_agent: 'codex',
+      })
+    })
+
+    await waitFor(() => {
+      expect(input).toHaveAttribute('aria-placeholder', 'Ask Codex')
+    })
+
+    fireEvent.click(screen.getByTestId('agent-send'))
+
+    await waitFor(() => {
+      expect(streamAiAgent).toHaveBeenCalledWith(expect.objectContaining({
+        agent: 'codex',
+      }))
+    })
+  })
+
   it('shows onboarding after telemetry consent when no active vault is configured', async () => {
     mockCommandResults.get_settings = {
       auto_pull_interval_minutes: null,
@@ -496,7 +832,7 @@ describe('App', () => {
       await Promise.resolve()
     })
 
-    expect(screen.getByText('Loading…')).toBeInTheDocument()
+    expect(screen.getByTestId('vault-loading-skeleton')).toBeInTheDocument()
     expect(screen.queryByText('Vault not found')).not.toBeInTheDocument()
 
     await act(async () => {
@@ -654,7 +990,7 @@ describe('App', () => {
 
     render(<App />)
 
-    const noteListContainer = await screen.findByTestId('note-list-container')
+    const noteListContainer = await screen.findByTestId('note-list-container', {}, { timeout: 5000 })
     const getHeader = () => getHeaderForNoteList(noteListContainer)
 
     await waitFor(() => {
@@ -740,6 +1076,44 @@ describe('App', () => {
     })
   })
 
+  it('auto-advances to the next inbox item after organizing when the setting is enabled', async () => {
+    configureNeighborhoodVault()
+    mockCommandResults.get_settings = {
+      auto_pull_interval_minutes: null,
+      auto_advance_inbox_after_organize: true,
+      telemetry_consent: true,
+      crash_reporting_enabled: null,
+      analytics_enabled: null,
+      anonymous_id: null,
+      release_channel: null,
+    }
+
+    render(<App />)
+
+    const noteListContainer = await screen.findByTestId('note-list-container')
+    await waitFor(() => {
+      expect(getHeaderForNoteList(noteListContainer)).toHaveTextContent('Inbox')
+    })
+
+    await act(async () => {
+      fireEvent.click(within(noteListContainer).getByText('Alpha'))
+      await Promise.resolve()
+    })
+
+    await waitFor(() => {
+      expect(screen.getByRole('button', { name: 'Set note as organized' })).toBeInTheDocument()
+    })
+
+    await act(async () => {
+      fireEvent.click(screen.getByRole('button', { name: 'Set note as organized' }))
+      await Promise.resolve()
+    })
+
+    await waitFor(() => {
+      expect(window.__laputaTest?.activeTabPath).toBe('/vault/beta.md')
+    })
+  })
+
   it('renders status bar', async () => {
     render(<App />)
     // StatusBar should be present
@@ -775,6 +1149,32 @@ describe('App', () => {
     })
   })
 
+  it('clears the Git setup dialog when switching to a Git-enabled vault', async () => {
+    mockCommandResults.load_vault_list = {
+      vaults: [
+        { label: 'Missing Git', path: '/work' },
+        { label: 'Git Vault', path: '/vault-2' },
+      ],
+      active_vault: '/work',
+      hidden_defaults: [],
+    }
+    mockCommandResults.is_git_repo = ({ vaultPath }: { vaultPath?: string } = {}) => vaultPath === '/vault-2'
+
+    render(<App />)
+
+    expect(await screen.findByText('Enable Git for this vault?')).toBeInTheDocument()
+
+    fireEvent.click(screen.getByTestId('status-vault-trigger'))
+    fireEvent.click(screen.getByTestId('vault-menu-item-Git Vault'))
+
+    await waitFor(() => {
+      expect(screen.getByTestId('status-vault-trigger')).toHaveTextContent('Git Vault')
+    })
+    await waitFor(() => {
+      expect(screen.queryByText('Enable Git for this vault?')).not.toBeInTheDocument()
+    })
+  })
+
   it('Cmd+1 hides sidebar and note list (editor-only mode)', async () => {
     render(<App />)
     await waitFor(() => {

src/App.tsx

@@ -16,12 +16,12 @@ import { StatusBar } from './components/StatusBar'
 import { SettingsPanel } from './components/SettingsPanel'
 import { CloneVaultModal } from './components/CloneVaultModal'
 import { WelcomeScreen } from './components/WelcomeScreen'
+import { AppLoadingSkeleton } from './components/AppLoadingSkeleton'
 import { AiAgentsOnboardingPrompt } from './components/AiAgentsOnboardingPrompt'
 import { TelemetryConsentDialog } from './components/TelemetryConsentDialog'
 import { FeedbackDialog } from './components/FeedbackDialog'
 import { McpSetupDialog } from './components/McpSetupDialog'
 import { NoteRetargetingDialogs } from './components/note-retargeting/NoteRetargetingDialogs'
-import { NoteRetargetingProvider } from './components/note-retargeting/noteRetargetingContext'
 import { useTelemetry } from './hooks/useTelemetry'
 import { useMcpStatus } from './hooks/useMcpStatus'
 import { useAiAgentsOnboarding } from './hooks/useAiAgentsOnboarding'
@@ -29,13 +29,17 @@ import { useAiAgentsStatus } from './hooks/useAiAgentsStatus'
 import { useVaultAiGuidanceStatus } from './hooks/useVaultAiGuidanceStatus'
 import { useAutoGit } from './hooks/useAutoGit'
 import { useVaultLoader } from './hooks/useVaultLoader'
+import { useRecentVaultWrites, useVaultWatcher } from './hooks/useVaultWatcher'
 import { useAiAgentPreferences } from './hooks/useAiAgentPreferences'
 import { useSettings } from './hooks/useSettings'
+import { useDocumentThemeMode } from './hooks/useDocumentThemeMode'
+import { useThemeMode } from './hooks/useThemeMode'
 import { useNoteActions } from './hooks/useNoteActions'
 import { planNewTypeCreation } from './hooks/useNoteCreation'
 import { useCommitFlow } from './hooks/useCommitFlow'
 import { useGitRemoteStatus } from './hooks/useGitRemoteStatus'
 import { useViewMode, type ViewMode } from './hooks/useViewMode'
+import { useNoteLayout } from './hooks/useNoteLayout'
 import { useEntryActions } from './hooks/useEntryActions'
 import { useAppCommands } from './hooks/useAppCommands'
 import { triggerCommitEntryAction } from './utils/commitEntryAction'
@@ -62,11 +66,13 @@ import { useAiActivity } from './hooks/useAiActivity'
 import { useBulkActions } from './hooks/useBulkActions'
 import { useDeleteActions } from './hooks/useDeleteActions'
 import { useFolderActions } from './hooks/useFolderActions'
+import { useFileActions } from './hooks/useFileActions'
 import { useLayoutPanels } from './hooks/useLayoutPanels'
 import { useConflictFlow } from './hooks/useConflictFlow'
 import { useAppSave } from './hooks/useAppSave'
 import { useNoteRetargetingUi } from './hooks/useNoteRetargetingUi'
 import { useVaultBridge } from './hooks/useVaultBridge'
+import { createViewFilename } from './utils/viewFilename'
 import type { CommitDiffRequest } from './hooks/useDiffMode'
 import { ConflictResolverModal } from './components/ConflictResolverModal'
 import { ConfirmDeleteDialog } from './components/ConfirmDeleteDialog'
@@ -80,13 +86,21 @@ import { initializeNoteProperties } from './utils/initializeNoteProperties'
 import { filterEntries, filterInboxEntries, type NoteListFilter } from './utils/noteListHelpers'
 import { openNoteInNewWindow } from './utils/openNoteWindow'
 import { refreshPulledVaultState } from './utils/pulledVaultRefresh'
-import { isNoteWindow, getNoteWindowParams, getNoteWindowPathCandidates, findNoteWindowEntry, type NoteWindowParams } from './utils/windowMode'
-import { GitRequiredModal } from './components/GitRequiredModal'
+import { isNoteWindow, getNoteWindowParams, getNoteWindowPathCandidates, type NoteWindowParams } from './utils/windowMode'
+import { GitSetupDialog } from './components/GitRequiredModal'
 import { RenameDetectedBanner, type DetectedRename } from './components/RenameDetectedBanner'
 import { openNoteListPropertiesPicker } from './components/note-list/noteListPropertiesEvents'
 import type { NoteListMultiSelectionCommands } from './components/note-list/multiSelectionCommands'
 import { focusNoteIconPropertyEditor } from './components/noteIconPropertyEvents'
 import { trackEvent } from './lib/telemetry'
+import {
+  SYSTEM_UI_LANGUAGE,
+  getBrowserLanguagePreferences,
+  resolveEffectiveLocale,
+  serializeUiLanguagePreference,
+  type UiLanguagePreference,
+} from './lib/i18n'
+import { normalizeReleaseChannel } from './lib/releaseChannel'
 import {
   buildVaultAiGuidanceRefreshKey,
 } from './lib/vaultAiGuidance'
@@ -120,6 +134,12 @@ declare global {
 
 const DEFAULT_SELECTION: SidebarSelection = INBOX_SELECTION
 
+function getNextVisibleInboxEntry(entries: VaultEntry[], currentPath: string): VaultEntry | null {
+  const currentIndex = entries.findIndex((entry) => entry.path === currentPath)
+  if (currentIndex < 0) return null
+  return entries[currentIndex + 1] ?? null
+}
+
 function shouldPreferOnboardingVaultPath(
   onboardingState: { status: string; vaultPath?: string },
   vaults: Array<{ path: string }>,
@@ -130,26 +150,26 @@ function shouldPreferOnboardingVaultPath(
     && !vaults.some((vault) => vault.path === onboardingState.vaultPath)
 }
 
-async function resolveNoteWindowEntry(
-  noteWindowParams: NoteWindowParams,
-  entries: VaultEntry[],
-): Promise<VaultEntry | undefined> {
-  const fallbackEntry = () =>
-    findNoteWindowEntry(entries, noteWindowParams)
-
-  if (!isTauri()) {
-    return fallbackEntry()
-  }
-
+async function resolveNoteWindowEntry(noteWindowParams: NoteWindowParams): Promise<VaultEntry | undefined> {
   for (const path of getNoteWindowPathCandidates(noteWindowParams)) {
     try {
-      return await invoke<VaultEntry>('reload_vault_entry', { path })
+      const request = { path, vaultPath: noteWindowParams.vaultPath }
+      const entry = isTauri()
+        ? await invoke<VaultEntry | null>('reload_vault_entry', request)
+        : await mockInvoke<VaultEntry | null>('reload_vault_entry', request)
+      if (entry) return entry
     } catch {
-      // Try the next normalized candidate before falling back to the scanned entries.
+      // Try the next normalized candidate before reporting the note as unavailable.
     }
   }
+}
 
-  return fallbackEntry()
+async function loadNoteWindowContent(path: string, vaultPath: string): Promise<string> {
+  const request = { path, vaultPath }
+  if (!isTauri()) return mockInvoke<string>('get_note_content', request)
+
+  await invoke('sync_vault_asset_scope_for_window', { vaultPath })
+  return invoke<string>('get_note_content', request)
 }
 
 function createPulseDeletedNoteEntry(fullPath: string, relativePath: string): DeletedNoteEntry {
@@ -245,7 +265,11 @@ function App() {
   // called on user interaction, never during render (refs inside the hook
   // guarantee the latest closure is always used).
   const vaultSwitcher = useVaultSwitcher({
-    onSwitch: () => { handleSetSelection(DEFAULT_SELECTION); notes.closeAllTabs() },
+    onSwitch: () => {
+      if (noteWindowParams) return
+      handleSetSelection(DEFAULT_SELECTION)
+      notes.closeAllTabs()
+    },
     onToast: (msg) => setToastMessage(msg),
   })
   const {
@@ -298,25 +322,56 @@ function App() {
       ? onboarding.state.vaultPath
       : vaultSwitcher.vaultPath
   )
-  // Git repo check: 'checking' | 'required' | 'ready'
-  const [gitRepoState, setGitRepoState] = useState<'checking' | 'required' | 'ready'>('checking')
+  // Git repo check: 'checking' | 'missing' | 'ready'
+  const [gitRepoState, setGitRepoState] = useState<'checking' | 'missing' | 'ready'>('checking')
+  const [showGitSetupDialog, setShowGitSetupDialog] = useState(false)
+  const dismissedGitSetupPathRef = useRef<string | null>(null)
   useEffect(() => {
     if (!resolvedPath) return
     setGitRepoState('checking')
     const check = isTauri()
       ? invoke<boolean>('is_git_repo', { vaultPath: resolvedPath })
-      : Promise.resolve(true) // browser mock: assume git
+      : mockInvoke<boolean>('is_git_repo', { vaultPath: resolvedPath })
     check
-      .then(isGit => setGitRepoState(isGit ? 'ready' : 'required'))
+      .then(isGit => setGitRepoState(isGit ? 'ready' : 'missing'))
       .catch(() => setGitRepoState('ready')) // fail open
   }, [resolvedPath])
 
-  const handleInitGitRepo = useCallback(async () => {
-    if (isTauri()) await invoke('init_git_repo', { vaultPath: resolvedPath })
-    setGitRepoState('ready')
+  useEffect(() => {
+    if (noteWindowParams || gitRepoState !== 'missing' || !resolvedPath) return
+    if (dismissedGitSetupPathRef.current === resolvedPath) return
+    setShowGitSetupDialog(true)
+  }, [gitRepoState, noteWindowParams, resolvedPath])
+
+  useEffect(() => {
+    if (gitRepoState === 'missing') return
+    setShowGitSetupDialog(false)
+  }, [gitRepoState])
+
+  const openGitSetupDialog = useCallback(() => {
+    if (gitRepoState !== 'missing') return
+    setShowGitSetupDialog(true)
+  }, [gitRepoState])
+
+  const dismissGitSetupDialog = useCallback(() => {
+    dismissedGitSetupPathRef.current = resolvedPath
+    setShowGitSetupDialog(false)
   }, [resolvedPath])
 
-  const vault = useVaultLoader(resolvedPath)
+  const handleInitGitRepo = useCallback(async () => {
+    if (isTauri()) {
+      await invoke('init_git_repo', { vaultPath: resolvedPath })
+    } else {
+      await mockInvoke('init_git_repo', { vaultPath: resolvedPath })
+    }
+    setGitRepoState('ready')
+    dismissedGitSetupPathRef.current = null
+    setShowGitSetupDialog(false)
+    setToastMessage('Git initialized for this vault')
+  }, [resolvedPath, setToastMessage])
+
+  const vault = useVaultLoader(noteWindowParams ? '' : resolvedPath)
+  const recentVaultWrites = useRecentVaultWrites({ vaultPath: noteWindowParams ? '' : resolvedPath })
   const {
     status: vaultAiGuidanceStatus,
     refresh: refreshVaultAiGuidance,
@@ -361,8 +416,30 @@ function App() {
     })
   }, [updateConfig, vaultConfig.inbox?.noteListProperties])
   const { settings, loaded: settingsLoaded, saveSettings } = useSettings()
+  const systemLocale = useMemo(
+    () => resolveEffectiveLocale(SYSTEM_UI_LANGUAGE, getBrowserLanguagePreferences()),
+    [],
+  )
+  const appLocale = useMemo(
+    () => resolveEffectiveLocale(settings.ui_language, [systemLocale]),
+    [settings.ui_language, systemLocale],
+  )
+  const selectedUiLanguage = settings.ui_language ?? SYSTEM_UI_LANGUAGE
+  useEffect(() => {
+    document.documentElement.lang = appLocale
+  }, [appLocale])
+  useThemeMode(settings.theme_mode, settingsLoaded)
+  const documentThemeMode = useDocumentThemeMode()
+  const handleToggleThemeMode = useCallback(() => {
+    const theme_mode = documentThemeMode === 'dark' ? 'light' : 'dark'
+    void saveSettings({ ...settings, theme_mode })
+  }, [documentThemeMode, saveSettings, settings])
+  const handleSetUiLanguage = useCallback((uiLanguage: UiLanguagePreference) => {
+    void saveSettings({ ...settings, ui_language: serializeUiLanguagePreference(uiLanguage) })
+  }, [saveSettings, settings])
   const aiAgentPreferences = useAiAgentPreferences({
     settings,
+    settingsLoaded,
     saveSettings,
     aiAgentsStatus,
     onToast: setToastMessage,
@@ -376,8 +453,25 @@ function App() {
       trackEvent('vault_opened', { has_git: gitRepoState === 'ready' ? 1 : 0, note_count: vault.entries.length })
     }
   }, [vault.entries.length, gitRepoState, resolvedPath])
-  const { mcpStatus, connectMcp, disconnectMcp } = useMcpStatus(resolvedPath, setToastMessage)
+  const {
+    mcpStatus,
+    connectMcp,
+    disconnectMcp,
+    mcpConfigSnippet,
+    mcpConfigLoading,
+    mcpConfigError,
+    loadMcpConfigSnippet,
+    copyMcpConfig,
+  } = useMcpStatus(resolvedPath, setToastMessage)
   const gitRemoteStatus = useGitRemoteStatus(resolvedPath)
+  const loadVaultModifiedFiles = vault.loadModifiedFiles
+  const refreshGitRemoteStatus = gitRemoteStatus.refreshRemoteStatus
+
+  useEffect(() => {
+    if (gitRepoState !== 'ready') return
+    void loadVaultModifiedFiles()
+    void refreshGitRemoteStatus()
+  }, [gitRepoState, loadVaultModifiedFiles, refreshGitRemoteStatus])
 
   const openMcpSetupDialog = useCallback(() => {
     setShowMcpSetupDialog(true)
@@ -408,6 +502,14 @@ function App() {
     }
   }, [disconnectMcp])
 
+  const handleCopyMcpConfig = useCallback(() => {
+    void copyMcpConfig()
+  }, [copyMcpConfig])
+
+  const handleLoadMcpConfigSnippet = useCallback(() => {
+    void loadMcpConfigSnippet().catch(() => undefined)
+  }, [loadMcpConfigSnippet])
+
   // Detect external file renames on window focus
   const [detectedRenames, setDetectedRenames] = useState<DetectedRename[]>([])
   useEffect(() => {
@@ -415,7 +517,7 @@ function App() {
     const handleFocus = () => {
       invoke<DetectedRename[]>('detect_renames', { vaultPath: resolvedPath })
         .then(renames => { if (renames.length > 0) setDetectedRenames(renames) })
-        .catch(() => {}) // ignore errors (e.g., no git)
+        .catch((err) => console.warn('[vault] Git rename detection failed:', err))
     }
     window.addEventListener('focus', handleFocus)
     return () => window.removeEventListener('focus', handleFocus)
@@ -457,8 +559,7 @@ function App() {
     removeEntry: vault.removeEntry,
     entries: vault.entries,
     flushBeforeNoteSwitch: flushEditorStateBeforeAction,
-    flushBeforeFrontmatterChange: flushEditorStateBeforeAction,
-    flushBeforePathRename: flushEditorStateBeforeAction,
+    flushBeforeNoteMutation: flushEditorStateBeforeAction,
     reloadVault: vault.reloadVault,
     setToastMessage,
     updateEntry: vault.updateEntry,
@@ -470,6 +571,7 @@ function App() {
     unsavedPaths: vault.unsavedPaths,
     markContentPending: (path, content) => appSave.contentChangeRef.current(path, content),
     onNewNotePersisted: vault.loadModifiedFiles,
+    onTypeStateChanged: async () => { await vault.reloadVault() },
     replaceEntry: vault.replaceEntry,
     onFrontmatterPersisted: vault.loadModifiedFiles,
     onPathRenamed: (oldPath, newPath) => appSave.trackRenamedPath(oldPath, newPath),
@@ -480,6 +582,10 @@ function App() {
     closeAllTabs,
     openTabWithContent,
   } = notes
+  const noteWindowActionsRef = useRef({ handleSelectNote, openTabWithContent })
+  useEffect(() => {
+    noteWindowActionsRef.current = { handleSelectNote, openTabWithContent }
+  }, [handleSelectNote, openTabWithContent])
   const handlePulledVaultUpdate = useCallback(async (updatedFiles: string[]) => {
     await refreshPulledVaultState({
       activeTabPath: notes.activeTabPath,
@@ -502,7 +608,13 @@ function App() {
       vault.reloadViews,
       vault.unsavedPaths,
     ])
+  useVaultWatcher({
+    vaultPath: noteWindowParams ? '' : resolvedPath,
+    onVaultChanged: handlePulledVaultUpdate,
+    filterChangedPaths: recentVaultWrites.filterExternalPaths,
+  })
   const autoSync = useAutoSync({
+    enabled: gitRepoState === 'ready',
     vaultPath: resolvedPath,
     intervalMinutes: settings.auto_pull_interval_minutes,
     onVaultUpdated: handlePulledVaultUpdate,
@@ -512,33 +624,37 @@ function App() {
     },
     onToast: (msg) => setToastMessage(msg),
   })
-  const pulseCommitDiffRequestIdRef = useRef(0)
-  const [pulseCommitDiffRequest, setPulseCommitDiffRequest] = useState<CommitDiffRequest | null>(null)
+  const pendingDiffRequestIdRef = useRef(0)
+  const [pendingDiffRequest, setPendingDiffRequest] = useState<CommitDiffRequest | null>(null)
 
-  // Note window: auto-open the note from URL params once vault entries load
+  // Note window: auto-open the note from URL params without scanning the whole vault.
   const noteWindowOpenedRef = useRef(false)
   const noteWindowMissingPathRef = useRef<string | null>(null)
   useEffect(() => {
     if (!noteWindowParams || noteWindowOpenedRef.current) return
-    let cancelled = false
 
-    void resolveNoteWindowEntry(noteWindowParams, vault.entries).then((entry) => {
-      if (cancelled || noteWindowOpenedRef.current) return
+    void resolveNoteWindowEntry(noteWindowParams).then(async (entry) => {
+      if (noteWindowOpenedRef.current) return
       if (entry) {
-        noteWindowOpenedRef.current = true
-        noteWindowMissingPathRef.current = null
-        void handleSelectNote(entry)
+        try {
+          const content = await loadNoteWindowContent(entry.path, noteWindowParams.vaultPath)
+          if (noteWindowOpenedRef.current) return
+          noteWindowOpenedRef.current = true
+          noteWindowMissingPathRef.current = null
+          noteWindowActionsRef.current.openTabWithContent(entry, content)
+        } catch {
+          if (noteWindowOpenedRef.current) return
+          noteWindowOpenedRef.current = true
+          noteWindowMissingPathRef.current = null
+          void noteWindowActionsRef.current.handleSelectNote(entry)
+        }
         return
       }
       if (noteWindowMissingPathRef.current === noteWindowParams.notePath) return
       noteWindowMissingPathRef.current = noteWindowParams.notePath
       setToastMessage(`Could not open "${noteWindowParams.noteTitle}" in this window`)
     })
-
-    return () => {
-      cancelled = true
-    }
-  }, [handleSelectNote, noteWindowParams, setToastMessage, vault.entries])
+  }, [noteWindowParams, setToastMessage])
 
   // Note window: update window title when active note changes
   useEffect(() => {
@@ -548,7 +664,7 @@ function App() {
     if (!isTauri()) { document.title = title; return }
     import('@tauri-apps/api/window').then(({ getCurrentWindow }) => {
       getCurrentWindow().setTitle(title)
-    }).catch(() => {})
+    }).catch((err) => console.warn('[window] Failed to update note window title:', err))
   }, [noteWindowParams, notes.tabs, notes.activeTabPath])
 
   // Keep note entry in sync with vault entries so banners (trash/archive)
@@ -574,17 +690,17 @@ function App() {
     onSelectNote: notes.handleSelectNote,
   })
 
-  const queuePulseCommitDiff = useCallback((path: string, commitHash: string) => {
-    pulseCommitDiffRequestIdRef.current += 1
-    setPulseCommitDiffRequest({
-      requestId: pulseCommitDiffRequestIdRef.current,
+  const queuePendingDiff = useCallback((path: string, commitHash?: string) => {
+    pendingDiffRequestIdRef.current += 1
+    setPendingDiffRequest({
+      requestId: pendingDiffRequestIdRef.current,
       path,
       commitHash,
     })
   }, [])
 
-  const handlePulseCommitDiffHandled = useCallback((requestId: number) => {
-    setPulseCommitDiffRequest((current) =>
+  const handlePendingDiffHandled = useCallback((requestId: number) => {
+    setPendingDiffRequest((current) =>
       current?.requestId === requestId ? null : current,
     )
   }, [])
@@ -595,7 +711,7 @@ function App() {
 
     if (commitHash) {
       const targetPath = entry?.path ?? fullPath
-      queuePulseCommitDiff(targetPath, commitHash)
+      queuePendingDiff(targetPath, commitHash)
       if (entry) {
         void handleSelectNote(entry)
       } else {
@@ -607,7 +723,7 @@ function App() {
     if (entry) {
       void handleSelectNote(entry)
     }
-  }, [entriesByPath, resolvedPath, queuePulseCommitDiff, handleSelectNote, openTabWithContent])
+  }, [entriesByPath, resolvedPath, queuePendingDiff, handleSelectNote, openTabWithContent])
 
   const handleOpenFavorite = useCallback(async (entry: VaultEntry) => {
     await handleReplaceActiveTab(entry)
@@ -648,6 +764,7 @@ function App() {
     handleRenameNote: notes.handleRenameNote, handleRenameFilename: notes.handleRenameFilename,
     replaceEntry: vault.replaceEntry, resolvedPath,
     initialH1AutoRenameEnabled: settings.initial_h1_auto_rename_enabled !== false,
+    onInternalVaultWrite: recentVaultWrites.markInternalWrite,
   })
 
   const aiActivity = useAiActivity({
@@ -656,7 +773,7 @@ function App() {
     onSetFilter: (filterType) => {
       handleSetSelection({ kind: 'sectionGroup', type: filterType })
     },
-    onVaultChanged: () => { vault.reloadVault() },
+    onVaultChanged: (path) => { void handlePulledVaultUpdate(path ? [path] : []) },
   })
 
   const handleInitializeProperties = useCallback(async (path: string) => {
@@ -734,6 +851,11 @@ function App() {
     reloadFolders: vault.reloadFolders,
     setToastMessage,
   })
+  const fileActions = useFileActions({
+    selection: effectiveSelection,
+    setToastMessage,
+    vaultPath: resolvedPath,
+  })
 
   const handleRemoveNoteIconCommand = useCallback(() => {
     if (notes.activeTabPath) handleRemoveNoteIcon(notes.activeTabPath)
@@ -786,11 +908,18 @@ function App() {
     }
     notes.openTabWithContent(entry, previewContent)
     if (hasDiff) {
-      setTimeout(() => diffToggleRef.current(), 50)
+      queuePendingDiff(entry.path)
     } else {
       setToastMessage('Content not available (untracked)')
     }
-  }, [vault, notes, setToastMessage])
+  }, [vault, notes, queuePendingDiff, setToastMessage])
+
+  const handleReplaceActiveTabWithQueuedDiff = useCallback((entry: VaultEntry) => {
+    notes.handleReplaceActiveTab(entry)
+    if (effectiveSelection.kind === 'filter' && effectiveSelection.filter === 'changes') {
+      queuePendingDiff(entry.path)
+    }
+  }, [effectiveSelection, notes, queuePendingDiff])
 
   const commitFlow = useCommitFlow({
     savePending: appSave.savePending,
@@ -801,7 +930,8 @@ function App() {
     vaultPath: resolvedPath,
   })
   const suggestedCommitMessage = useMemo(() => generateCommitMessage(vault.modifiedFiles), [vault.modifiedFiles])
-  const isGitVault = !vault.modifiedFilesError
+  const isGitVault = gitRepoState !== 'missing'
+  const shouldShowGitSetupDialog = !noteWindowParams && gitRepoState === 'missing' && showGitSetupDialog
   const modifiedFilesSignature = useMemo(
     () => vault.modifiedFiles.map((file) => `${file.relativePath}:${file.status}`).sort().join('|'),
     [vault.modifiedFiles],
@@ -875,6 +1005,7 @@ function App() {
   useEffect(() => {
     window.__laputaTest = {
       ...window.__laputaTest,
+      activeTabPath: notes.activeTabPath,
       seedAutoGitSavedChange,
     }
 
@@ -883,7 +1014,7 @@ function App() {
         delete window.__laputaTest.seedAutoGitSavedChange
       }
     }
-  }, [seedAutoGitSavedChange])
+  }, [notes.activeTabPath, seedAutoGitSavedChange])
 
   const entryActions = useEntryActions({
     entries: vault.entries, updateEntry: vault.updateEntry,
@@ -944,17 +1075,24 @@ function App() {
     const editing = dialogs.editingView
     const filename = editing
       ? editing.filename
-      : definition.name.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/(^-|-$)/g, '') + '.yml'
+      : createViewFilename(definition.name, vault.views.map((view) => view.filename))
     const nextDefinition = editing ? { ...editing.definition, ...definition } : definition
     const target = isTauri() ? invoke : mockInvoke
-    await target('save_view_cmd', { vaultPath: resolvedPath, filename, definition: nextDefinition })
-    trackEvent(editing ? 'view_updated' : 'view_created')
-    await vault.reloadViews()
-    await vault.reloadVault()
-    vault.reloadFolders()
-    setToastMessage(editing ? `View "${nextDefinition.name}" updated` : `View "${nextDefinition.name}" created`)
-    handleSetSelection({ kind: 'view', filename })
-  }, [resolvedPath, vault, handleSetSelection, dialogs.editingView])
+    try {
+      await target('save_view_cmd', { vaultPath: resolvedPath, filename, definition: nextDefinition })
+      trackEvent(editing ? 'view_updated' : 'view_created')
+      await vault.reloadViews()
+      await vault.reloadVault()
+      vault.reloadFolders()
+      setToastMessage(editing ? `View "${nextDefinition.name}" updated` : `View "${nextDefinition.name}" created`)
+      handleSetSelection({ kind: 'view', filename })
+      return true
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err)
+      setToastMessage(`Could not save view: ${message}`)
+      return false
+    }
+  }, [resolvedPath, vault, handleSetSelection, dialogs.editingView, setToastMessage])
 
   const handleUpdateViewDefinition = useCallback(async (filename: string, patch: Partial<ViewDefinition>) => {
     const existing = vault.views.find((view) => view.filename === filename)
@@ -1007,8 +1145,10 @@ function App() {
   const rawToggleRef = useRef<() => void>(() => {})
   // Diff-toggle ref: Editor registers its handleToggleDiff here so the command palette can call it
   const diffToggleRef = useRef<() => void>(() => {})
+  const findInNoteRef = useRef<((options?: { replace?: boolean }) => void) | null>(null)
 
   const { setViewMode, sidebarVisible, noteListVisible } = useViewMode(noteWindowParams ? 'editor-only' : undefined)
+  const { noteLayout, toggleNoteLayout } = useNoteLayout()
   const zoom = useZoom()
   const buildNumber = useBuildNumber()
 
@@ -1025,7 +1165,7 @@ function App() {
       inspectorCollapsed: nextInspectorCollapsed,
     })
 
-    void applyMainWindowSizeConstraints(minWidth).catch(() => {})
+    void applyMainWindowSizeConstraints(minWidth).catch((err) => console.warn('[window] Size constraints failed:', err))
   }, [layout.inspectorCollapsed, noteWindowParams])
 
   const handleSetViewMode = useCallback((mode: ViewMode) => {
@@ -1063,12 +1203,15 @@ function App() {
       return
     }
     const result = await updateActions.checkForUpdates()
-    if (result === 'up-to-date') {
-      setToastMessage("You're on the latest version")
-    } else if (result === 'error') {
-      setToastMessage('Could not check for updates')
+    if (result.kind === 'up-to-date') {
+      const checkedChannel = normalizeReleaseChannel(settings.release_channel)
+      setToastMessage(`No newer ${checkedChannel} update is available right now`)
+    } else if (result.kind === 'available') {
+      setToastMessage(`Tolaria ${result.displayVersion} is available`)
+    } else {
+      setToastMessage(result.message)
     }
-  }, [updateActions, updateStatus.state, setToastMessage])
+  }, [settings.release_channel, updateActions, updateStatus.state, setToastMessage])
 
   const handleRepairVault = useCallback(async () => {
     if (!resolvedPath) return
@@ -1185,6 +1328,12 @@ function App() {
     () => canToggleRichEditor ? () => rawToggleRef.current() : undefined,
     [canToggleRichEditor],
   )
+  const findInNoteCommand = useCallback(() => {
+    findInNoteRef.current?.({ replace: false })
+  }, [])
+  const replaceInNoteCommand = useCallback(() => {
+    findInNoteRef.current?.({ replace: true })
+  }, [])
   const removeActiveVaultCommand = useCallback(() => {
     vaultSwitcher.removeVault(vaultSwitcher.vaultPath)
   }, [vaultSwitcher])
@@ -1203,7 +1352,26 @@ function App() {
     const entry = vault.entries.find((candidate) => candidate.path === notes.activeTabPath)
     return hasNoteIconValue(entry?.icon)
   }, [notes.activeTabPath, vault.entries])
-  const toggleOrganizedCommand = explicitOrganizationEnabled ? entryActions.handleToggleOrganized : undefined
+  const handleToggleOrganizedWithInboxAdvance = useCallback(async (path: string) => {
+    const entry = vault.entries.find((candidate) => candidate.path === path)
+    if (!entry) return
+
+    const shouldAutoAdvance = settings.auto_advance_inbox_after_organize === true
+      && !entry.organized
+      && notes.activeTabPath === path
+      && effectiveSelection.kind === 'filter'
+      && effectiveSelection.filter === 'inbox'
+    const nextVisibleInboxEntry = shouldAutoAdvance
+      ? getNextVisibleInboxEntry(visibleNotesRef.current, path)
+      : null
+
+    const organized = await entryActions.handleToggleOrganized(path)
+
+    if (organized && nextVisibleInboxEntry) {
+      void notes.handleSelectNote(nextVisibleInboxEntry)
+    }
+  }, [effectiveSelection, entryActions, notes, settings.auto_advance_inbox_after_organize, vault.entries])
+  const toggleOrganizedCommand = explicitOrganizationEnabled ? handleToggleOrganizedWithInboxAdvance : undefined
   const canCustomizeNoteListColumns = useMemo(() => (
     effectiveSelection.kind === 'view'
       || (
@@ -1215,6 +1383,12 @@ function App() {
     () => activeDeletedFile ? () => { void handleDiscardFile(activeDeletedFile.relativePath) } : undefined,
     [activeDeletedFile, handleDiscardFile],
   )
+  const reloadVaultForCommand = vault.reloadVault
+  const handleManualVaultReload = useCallback(async () => {
+    const entries = await reloadVaultForCommand()
+    setToastMessage(`Vault reloaded (${entries.length} ${entries.length === 1 ? 'entry' : 'entries'})`)
+    return entries
+  }, [reloadVaultForCommand, setToastMessage])
 
   const commands = useAppCommands({
     activeTabPath: notes.activeTabPath, activeTabPathRef: notes.activeTabPathRef,
@@ -1226,6 +1400,8 @@ function App() {
     selection: effectiveSelection,
     onQuickOpen: dialogs.openQuickOpen, onCommandPalette: dialogs.openCommandPalette,
     onSearch: dialogs.openSearch,
+    onFindInNote: findInNoteCommand,
+    onReplaceInNote: activeDeletedFile ? undefined : replaceInNoteCommand,
     onCreateNote: notes.handleCreateNoteImmediate,
     onCreateNoteOfType: notes.handleCreateNoteImmediate,
     onSave: appSave.handleSave,
@@ -1234,17 +1410,23 @@ function App() {
     onDeleteNote: deleteActions.handleDeleteNote,
     onArchiveNote: entryActions.handleArchiveNote, onUnarchiveNote: entryActions.handleUnarchiveNote,
     onCommitPush: handleCommitPush,
+    isGitVault,
+    onInitializeGit: openGitSetupDialog,
     onPull: autoSync.triggerSync,
     onResolveConflicts: conflictFlow.handleOpenConflictResolver,
     onSetViewMode: handleSetViewMode,
     onToggleInspector: handleToggleInspector,
     onToggleDiff: toggleDiffCommand,
     onToggleRawEditor: toggleRawEditorCommand,
+    noteLayout,
+    onToggleNoteLayout: toggleNoteLayout,
     onZoomIn: zoom.zoomIn, onZoomOut: zoom.zoomOut, onZoomReset: zoom.zoomReset,
     zoomLevel: zoom.zoomLevel,
     onSelect: handleSetSelection,
     onRenameFolder: folderActions.renameSelectedFolder,
     onDeleteFolder: folderActions.deleteSelectedFolder,
+    onRevealSelectedFolder: fileActions.revealSelectedFolder,
+    onCopySelectedFolderPath: fileActions.copySelectedFolderPath,
     showInbox: explicitOrganizationEnabled,
     onReplaceActiveTab: notes.handleReplaceActiveTab,
     onSelectNote: notes.handleSelectNote,
@@ -1259,6 +1441,10 @@ function App() {
     onRestoreGettingStarted: cloneGettingStartedVault,
     isGettingStartedHidden: vaultSwitcher.isGettingStartedHidden,
     vaultCount: vaultSwitcher.allVaults.length,
+    locale: appLocale,
+    systemLocale,
+    selectedUiLanguage,
+    onSetUiLanguage: handleSetUiLanguage,
     mcpStatus,
     onInstallMcp: openMcpSetupDialog,
     onOpenAiAgents: dialogs.openSettings,
@@ -1269,7 +1455,7 @@ function App() {
     onSetDefaultAiAgent: aiAgentPreferences.setDefaultAiAgent,
     onCycleDefaultAiAgent: aiAgentPreferences.cycleDefaultAiAgent,
     selectedAiAgentLabel: aiAgentPreferences.defaultAiAgentLabel,
-    onReloadVault: vault.reloadVault,
+    onReloadVault: handleManualVaultReload,
     onRepairVault: handleRepairVault,
     onSetNoteIcon: handleSetNoteIconCommand,
     onRemoveNoteIcon: handleRemoveNoteIconCommand,
@@ -1280,6 +1466,9 @@ function App() {
     noteListFilter,
     onSetNoteListFilter: setNoteListFilter,
     onOpenInNewWindow: handleOpenInNewWindow,
+    onRevealActiveFile: fileActions.revealFile,
+    onCopyActiveFilePath: fileActions.copyFilePath,
+    onOpenActiveFileExternal: fileActions.openExternalFile,
     onToggleFavorite: entryActions.handleToggleFavorite,
     onToggleOrganized: toggleOrganizedCommand,
     onCustomizeNoteListColumns: handleCustomizeNoteListColumns,
@@ -1317,9 +1506,9 @@ function App() {
       && onboarding.state.vaultPath === vaultSwitcher.vaultPath
   }, [onboarding.state, selectedVaultPath, vaultSwitcher.allVaults, vaultSwitcher.loaded, vaultSwitcher.vaultPath])
 
-  // Show loading spinner while checking vault (skip for note windows)
+  // Show loading skeleton while checking vault (skip for note windows)
   if (!noteWindowParams && onboarding.state.status === 'loading') {
-    return <LoadingView />
+    return <AppLoadingSkeleton />
   }
 
   // Show telemetry consent dialog on first launch (skip for note windows).
@@ -1363,31 +1552,25 @@ function App() {
     )
   }
 
-  // Show git-required modal when vault has no git repo (skip for note windows)
-  if (!noteWindowParams && gitRepoState === 'required' && !showMcpSetupDialog) {
+  // Show loading skeleton while checking git status or scanning vault notes.
+  if (!noteWindowParams && onboarding.state.status === 'ready' && (gitRepoState === 'checking' || vault.isLoading)) {
     return (
-      <div className="app-shell">
-        <GitRequiredModal
-          onCreateRepo={handleInitGitRepo}
-          onChooseVault={vaultSwitcher.handleOpenLocalFolder}
-        />
-      </div>
+      <AppLoadingSkeleton
+        noteListWidth={layout.noteListWidth}
+        showNoteList={noteListVisible}
+        showSidebar={sidebarVisible}
+        sidebarWidth={layout.sidebarWidth}
+      />
     )
   }
 
-  // Show loading spinner while checking git status
-  if (!noteWindowParams && gitRepoState === 'checking' && onboarding.state.status === 'ready') {
-    return <LoadingView />
-  }
-
   return (
-    <NoteRetargetingProvider value={noteRetargetingUi.contextValue}>
-      <div className="app-shell">
+    <div className="app-shell">
         <div className="app">
           {sidebarVisible && (
             <>
               <div className="app__sidebar" style={{ width: layout.sidebarWidth }}>
-                <Sidebar entries={vault.entries} folders={vault.folders} views={vault.views} selection={effectiveSelection} onSelect={handleSetSelection} onSelectNote={notes.handleSelectNote} onSelectFavorite={handleOpenFavorite} onReorderFavorites={entryActions.handleReorderFavorites} onCreateType={notes.handleCreateNoteImmediate} onCreateNewType={dialogs.openCreateType} onCustomizeType={entryActions.handleCustomizeType} onUpdateTypeTemplate={entryActions.handleUpdateTypeTemplate} onReorderSections={entryActions.handleReorderSections} onRenameSection={entryActions.handleRenameSection} onToggleTypeVisibility={entryActions.handleToggleTypeVisibility} onCreateFolder={handleCreateFolder} onRenameFolder={folderActions.renameFolder} onDeleteFolder={folderActions.requestDeleteFolder} renamingFolderPath={folderActions.renamingFolderPath} onStartRenameFolder={folderActions.startFolderRename} onCancelRenameFolder={folderActions.cancelFolderRename} onCreateView={dialogs.openCreateView} onEditView={handleEditView} onDeleteView={handleDeleteView} showInbox={explicitOrganizationEnabled} inboxCount={inboxCount} />
+                <Sidebar entries={vault.entries} folders={vault.folders} views={vault.views} selection={effectiveSelection} onSelect={handleSetSelection} onSelectNote={notes.handleSelectNote} onSelectFavorite={handleOpenFavorite} onReorderFavorites={entryActions.handleReorderFavorites} onCreateType={notes.handleCreateNoteImmediate} onCreateNewType={dialogs.openCreateType} onCustomizeType={entryActions.handleCustomizeType} onUpdateTypeTemplate={entryActions.handleUpdateTypeTemplate} onReorderSections={entryActions.handleReorderSections} onRenameSection={entryActions.handleRenameSection} onToggleTypeVisibility={entryActions.handleToggleTypeVisibility} onCreateFolder={handleCreateFolder} onRenameFolder={folderActions.renameFolder} onDeleteFolder={folderActions.requestDeleteFolder} folderFileActions={fileActions.folderActions} renamingFolderPath={folderActions.renamingFolderPath} onStartRenameFolder={folderActions.startFolderRename} onCancelRenameFolder={folderActions.cancelFolderRename} onCreateView={dialogs.openCreateView} onEditView={handleEditView} onDeleteView={handleDeleteView} showInbox={explicitOrganizationEnabled} inboxCount={inboxCount} locale={appLocale} />
               </div>
               <ResizeHandle onResize={layout.handleSidebarResize} />
             </>
@@ -1396,9 +1579,9 @@ function App() {
             <>
               <div className={`app__note-list${aiActivity.highlightElement === 'notelist' ? ' ai-highlight' : ''}`} style={{ width: layout.noteListWidth }}>
                 {effectiveSelection.kind === 'filter' && effectiveSelection.filter === 'pulse' ? (
-                  <PulseView vaultPath={resolvedPath} onOpenNote={handlePulseOpenNote} sidebarCollapsed={!sidebarVisible} onExpandSidebar={() => handleSetViewMode('all')} />
+                  <PulseView vaultPath={resolvedPath} onOpenNote={handlePulseOpenNote} sidebarCollapsed={!sidebarVisible} onExpandSidebar={() => handleSetViewMode('all')} locale={appLocale} />
                 ) : (
-                  <NoteList entries={vault.entries} selection={effectiveSelection} selectedNote={activeTab?.entry ?? null} noteListFilter={noteListFilter} onNoteListFilterChange={setNoteListFilter} inboxPeriod={inboxPeriod} modifiedFiles={vault.modifiedFiles} modifiedFilesError={vault.modifiedFilesError} getNoteStatus={vault.getNoteStatus} sidebarCollapsed={!sidebarVisible} onSelectNote={notes.handleSelectNote} onReplaceActiveTab={notes.handleReplaceActiveTab} onEnterNeighborhood={handleEnterNeighborhood} onCreateNote={notes.handleCreateNoteImmediate} onBulkOrganize={explicitOrganizationEnabled ? bulkActions.handleBulkOrganize : undefined} onBulkArchive={bulkActions.handleBulkArchive} onBulkDeletePermanently={deleteActions.handleBulkDeletePermanently} onUpdateTypeSort={notes.handleUpdateFrontmatter} onUpdateViewDefinition={handleUpdateViewDefinition} updateEntry={vault.updateEntry} onOpenInNewWindow={handleOpenEntryInNewWindow} onDiscardFile={handleDiscardFile} onAutoTriggerDiff={() => diffToggleRef.current()} onOpenDeletedNote={handleOpenDeletedNote} allNotesNoteListProperties={vaultConfig.allNotes?.noteListProperties ?? null} onUpdateAllNotesNoteListProperties={handleUpdateAllNotesNoteListProperties} inboxNoteListProperties={vaultConfig.inbox?.noteListProperties ?? null} onUpdateInboxNoteListProperties={handleUpdateInboxNoteListProperties} views={vault.views} visibleNotesRef={visibleNotesRef} multiSelectionCommandRef={multiSelectionCommandRef} />
+                  <NoteList entries={vault.entries} selection={effectiveSelection} selectedNote={activeTab?.entry ?? null} noteListFilter={noteListFilter} onNoteListFilterChange={setNoteListFilter} inboxPeriod={inboxPeriod} modifiedFiles={vault.modifiedFiles} modifiedFilesError={vault.modifiedFilesError} getNoteStatus={vault.getNoteStatus} sidebarCollapsed={!sidebarVisible} onSelectNote={notes.handleSelectNote} onReplaceActiveTab={handleReplaceActiveTabWithQueuedDiff} onEnterNeighborhood={handleEnterNeighborhood} onCreateNote={notes.handleCreateNoteImmediate} onBulkOrganize={explicitOrganizationEnabled ? bulkActions.handleBulkOrganize : undefined} onBulkArchive={bulkActions.handleBulkArchive} onBulkDeletePermanently={deleteActions.handleBulkDeletePermanently} onUpdateTypeSort={notes.handleUpdateFrontmatter} onUpdateViewDefinition={handleUpdateViewDefinition} updateEntry={vault.updateEntry} onOpenInNewWindow={handleOpenEntryInNewWindow} onDiscardFile={handleDiscardFile} onOpenDeletedNote={handleOpenDeletedNote} allNotesNoteListProperties={vaultConfig.allNotes?.noteListProperties ?? null} onUpdateAllNotesNoteListProperties={handleUpdateAllNotesNoteListProperties} inboxNoteListProperties={vaultConfig.inbox?.noteListProperties ?? null} onUpdateInboxNoteListProperties={handleUpdateInboxNoteListProperties} views={vault.views} visibleNotesRef={visibleNotesRef} multiSelectionCommandRef={multiSelectionCommandRef} locale={appLocale} />
                 )}
               </div>
               <ResizeHandle onResize={layout.handleNoteListResize} />
@@ -1412,15 +1595,17 @@ function App() {
               onNavigateWikilink={notes.handleNavigateWikilink}
               onLoadDiff={vault.loadDiff}
               onLoadDiffAtCommit={vault.loadDiffAtCommit}
-              pendingCommitDiffRequest={pulseCommitDiffRequest}
-              onPendingCommitDiffHandled={handlePulseCommitDiffHandled}
+              pendingCommitDiffRequest={pendingDiffRequest}
+              onPendingCommitDiffHandled={handlePendingDiffHandled}
               getNoteStatus={vault.getNoteStatus}
               onCreateNote={notes.handleCreateNoteImmediate}
               inspectorCollapsed={layout.inspectorCollapsed}
               onToggleInspector={handleToggleInspector}
               inspectorWidth={layout.inspectorWidth}
               defaultAiAgent={aiAgentPreferences.defaultAiAgent}
+              defaultAiAgentReadiness={aiAgentPreferences.defaultAiAgentReadiness}
               defaultAiAgentReady={aiAgentPreferences.defaultAiAgentReady}
+              onUnsupportedAiPaste={setToastMessage}
               onInspectorResize={layout.handleInspectorResize}
               inspectorEntry={activeTab?.entry ?? null}
               inspectorContent={activeTab?.content ?? null}
@@ -1433,18 +1618,25 @@ function App() {
               onInitializeProperties={handleInitializeProperties}
               showAIChat={dialogs.showAIChat}
               onToggleAIChat={dialogs.toggleAIChat}
+              onCopyMcpConfig={handleCopyMcpConfig}
               vaultPath={resolvedPath}
               noteList={aiNoteList}
               noteListFilter={aiNoteListFilter}
               onToggleFavorite={activeDeletedFile ? undefined : entryActions.handleToggleFavorite}
-              onToggleOrganized={activeDeletedFile || !explicitOrganizationEnabled ? undefined : entryActions.handleToggleOrganized}
+              onToggleOrganized={activeDeletedFile || !explicitOrganizationEnabled ? undefined : toggleOrganizedCommand}
+              onRevealFile={fileActions.revealFile}
+              onCopyFilePath={fileActions.copyFilePath}
+              onOpenExternalFile={fileActions.openExternalFile}
               onDeleteNote={activeDeletedFile ? undefined : deleteActions.handleDeleteNote}
               onArchiveNote={activeDeletedFile ? undefined : entryActions.handleArchiveNote}
               onUnarchiveNote={activeDeletedFile ? undefined : entryActions.handleUnarchiveNote}
               onContentChange={handleTrackedContentChange}
               onSave={handleTrackedSave}
               onRenameFilename={activeDeletedFile ? undefined : appSave.handleFilenameRename}
+              noteLayout={noteLayout}
+              onToggleNoteLayout={toggleNoteLayout}
               rawToggleRef={rawToggleRef}
+              findInNoteRef={findInNoteRef}
               diffToggleRef={diffToggleRef}
               canGoBack={canGoBack}
               canGoForward={canGoForward}
@@ -1458,12 +1650,14 @@ function App() {
               onKeepMine={conflictFlow.handleKeepMine}
               onKeepTheirs={conflictFlow.handleKeepTheirs}
               flushPendingRawContentRef={flushPendingRawContentRef}
+              locale={appLocale}
             />
           </div>
         </div>
-        <UpdateBanner status={updateStatus} actions={updateActions} />
+        <UpdateBanner status={updateStatus} actions={updateActions} locale={appLocale} />
         <RenameDetectedBanner renames={detectedRenames} onUpdate={handleUpdateWikilinks} onDismiss={handleDismissRenames} />
-        <StatusBar noteCount={vault.entries.length} modifiedCount={vault.modifiedFiles.length} vaultPath={resolvedPath} vaults={vaultSwitcher.allVaults} onSwitchVault={vaultSwitcher.switchVault} onOpenSettings={dialogs.openSettings} onOpenFeedback={openFeedback} onOpenLocalFolder={vaultSwitcher.handleOpenLocalFolder} onCreateEmptyVault={vaultSwitcher.handleCreateEmptyVault} onCloneVault={dialogs.openCloneVault} onCloneGettingStarted={cloneGettingStartedVault} onClickPending={() => handleSetSelection({ kind: 'filter', filter: 'changes' })} onClickPulse={() => handleSetSelection({ kind: 'filter', filter: 'pulse' })} onCommitPush={handleCommitPush} isOffline={networkStatus.isOffline} isGitVault={isGitVault} syncStatus={autoSync.syncStatus} lastSyncTime={autoSync.lastSyncTime} conflictCount={autoSync.conflictFiles.length} remoteStatus={autoSync.remoteStatus} onTriggerSync={autoSync.triggerSync} onPullAndPush={autoSync.pullAndPush} onOpenConflictResolver={conflictFlow.handleOpenConflictResolver} zoomLevel={zoom.zoomLevel} onZoomReset={zoom.zoomReset} buildNumber={buildNumber} onCheckForUpdates={handleCheckForUpdates} onRemoveVault={vaultSwitcher.removeVault} mcpStatus={mcpStatus} onInstallMcp={openMcpSetupDialog} aiAgentsStatus={aiAgentsStatus} vaultAiGuidanceStatus={vaultAiGuidanceStatus} defaultAiAgent={aiAgentPreferences.defaultAiAgent} onSetDefaultAiAgent={aiAgentPreferences.setDefaultAiAgent} onRestoreVaultAiGuidance={() => { void restoreVaultAiGuidance() }} />
+        <StatusBar noteCount={vault.entries.length} modifiedCount={vault.modifiedFiles.length} vaultPath={resolvedPath} vaults={vaultSwitcher.allVaults} onSwitchVault={vaultSwitcher.switchVault} onOpenSettings={dialogs.openSettings} onOpenFeedback={openFeedback} onOpenLocalFolder={vaultSwitcher.handleOpenLocalFolder} onCreateEmptyVault={vaultSwitcher.handleCreateEmptyVault} onCloneVault={dialogs.openCloneVault} onCloneGettingStarted={cloneGettingStartedVault} onClickPending={() => handleSetSelection({ kind: 'filter', filter: 'changes' })} onClickPulse={() => handleSetSelection({ kind: 'filter', filter: 'pulse' })} onCommitPush={handleCommitPush} onInitializeGit={openGitSetupDialog} isOffline={networkStatus.isOffline} isGitVault={isGitVault} isVaultReloading={vault.isReloading} syncStatus={autoSync.syncStatus} lastSyncTime={autoSync.lastSyncTime} conflictCount={autoSync.conflictFiles.length} remoteStatus={autoSync.remoteStatus} onTriggerSync={autoSync.triggerSync} onPullAndPush={autoSync.pullAndPush} onOpenConflictResolver={conflictFlow.handleOpenConflictResolver} zoomLevel={zoom.zoomLevel} themeMode={documentThemeMode} onZoomReset={zoom.zoomReset} onToggleThemeMode={settingsLoaded ? handleToggleThemeMode : undefined} buildNumber={buildNumber} onCheckForUpdates={handleCheckForUpdates} onRemoveVault={vaultSwitcher.removeVault} mcpStatus={mcpStatus} onInstallMcp={openMcpSetupDialog} aiAgentsStatus={aiAgentsStatus} vaultAiGuidanceStatus={vaultAiGuidanceStatus} defaultAiAgent={aiAgentPreferences.defaultAiAgent} onSetDefaultAiAgent={aiAgentPreferences.setDefaultAiAgent} onRestoreVaultAiGuidance={() => { void restoreVaultAiGuidance() }} locale={appLocale} />
+        <GitSetupDialog open={shouldShowGitSetupDialog} onInitGit={handleInitGitRepo} onDismiss={dismissGitSetupDialog} />
         <DeleteProgressNotice count={deleteActions.pendingDeleteCount} />
         <Toast message={toastMessage} onDismiss={() => setToastMessage(null)} />
         <QuickOpenPalette open={dialogs.showQuickOpen} entries={vault.entries} onSelect={notes.handleSelectNote} onClose={dialogs.closeQuickOpen} />
@@ -1473,6 +1667,7 @@ function App() {
           entries={vault.entries}
           aiAgentReady={aiAgentPreferences.defaultAiAgentReady}
           aiAgentLabel={aiAgentPreferences.defaultAiAgentLabel}
+          locale={appLocale}
           onClose={dialogs.closeCommandPalette}
         />
         <SearchPanel open={dialogs.showSearch} vaultPath={resolvedPath} entries={vault.entries} onSelectNote={notes.handleSelectNote} onClose={dialogs.closeSearch} />
@@ -1506,9 +1701,9 @@ function App() {
           onCommit={conflictResolver.commitResolution}
           onClose={conflictFlow.handleCloseConflictResolver}
         />
-        <SettingsPanel open={dialogs.showSettings} settings={settings} aiAgentsStatus={aiAgentsStatus} isGitVault={isGitVault} onSave={saveSettings} explicitOrganizationEnabled={explicitOrganizationEnabled} onSaveExplicitOrganization={handleSaveExplicitOrganization} onClose={dialogs.closeSettings} />
+        <SettingsPanel open={dialogs.showSettings} settings={settings} aiAgentsStatus={aiAgentsStatus} locale={appLocale} systemLocale={systemLocale} isGitVault={isGitVault} onSave={saveSettings} explicitOrganizationEnabled={explicitOrganizationEnabled} onSaveExplicitOrganization={handleSaveExplicitOrganization} onClose={dialogs.closeSettings} />
         <FeedbackDialog open={showFeedback} onClose={closeFeedback} />
-        <McpSetupDialog open={showMcpSetupDialog} status={mcpStatus} busyAction={mcpDialogAction} onClose={closeMcpSetupDialog} onConnect={handleConnectMcp} onDisconnect={handleDisconnectMcp} />
+        <McpSetupDialog open={showMcpSetupDialog} status={mcpStatus} busyAction={mcpDialogAction} manualConfigSnippet={mcpConfigSnippet} manualConfigLoading={mcpConfigLoading} manualConfigError={mcpConfigError} onClose={closeMcpSetupDialog} onConnect={handleConnectMcp} onCopyManualConfig={handleCopyMcpConfig} onDisconnect={handleDisconnectMcp} onLoadManualConfig={handleLoadMcpConfigSnippet} />
         <CloneVaultModal key={dialogs.showCloneVault ? 'clone-open' : 'clone-closed'} open={dialogs.showCloneVault} onClose={dialogs.closeCloneVault} onVaultCloned={vaultSwitcher.handleVaultCloned} />
         {deleteActions.confirmDelete && (
           <ConfirmDeleteDialog
@@ -1530,8 +1725,7 @@ function App() {
             onCancel={folderActions.cancelDeleteFolder}
           />
         )}
-      </div>
-    </NoteRetargetingProvider>
+    </div>
   )
 }
 
@@ -1573,15 +1767,4 @@ function AiAgentsOnboardingView({
   )
 }
 
-/** Loading spinner view - extracted from main App component */
-function LoadingView() {
-  return (
-    <div className="app-shell">
-      <div style={{ width: '100%', height: '100%', display: 'flex', alignItems: 'center', justifyContent: 'center', background: 'var(--sidebar)' }}>
-        <span style={{ color: 'var(--muted-foreground)', fontSize: 14 }}>Loading…</span>
-      </div>
-    </div>
-  )
-}
-
 export default App

src/components/AddPropertyForm.tsx

@@ -12,6 +12,7 @@ import {
 } from '../utils/propertyTypes'
 import { StatusPill, StatusDropdown } from './StatusDropdown'
 import { DISPLAY_MODE_OPTIONS, DISPLAY_MODE_ICONS } from '../utils/propertyTypes'
+import { translate, type AppLocale } from '../lib/i18n'
 
 function parseDateValue(value: string): Date | undefined {
   const iso = toISODate(value)
@@ -39,7 +40,7 @@ function canSubmitProperty({ key, value, displayMode }: { key: string; value: st
   return displayMode !== 'number' || isValidNumberValue(value)
 }
 
-function AddBooleanInput({ value, onChange }: { value: string; onChange: (v: string) => void }) {
+function AddBooleanInput({ value, locale, onChange }: { value: string; locale: AppLocale; onChange: (v: string) => void }) {
   const boolVal = value.toLowerCase() === 'true'
   return (
     <button
@@ -47,12 +48,12 @@ function AddBooleanInput({ value, onChange }: { value: string; onChange: (v: str
       onClick={() => onChange(boolVal ? 'false' : 'true')}
       data-testid="add-property-boolean-toggle"
     >
-      {boolVal ? '\u2713 Yes' : '\u2717 No'}
+      {boolVal ? `\u2713 ${translate(locale, 'inspector.properties.yes')}` : `\u2717 ${translate(locale, 'inspector.properties.no')}`}
     </button>
   )
 }
 
-function AddDateInput({ value, onChange }: { value: string; onChange: (v: string) => void }) {
+function AddDateInput({ value, locale, onChange }: { value: string; locale: AppLocale; onChange: (v: string) => void }) {
   const selectedDate = value ? parseDateValue(value) : undefined
   const formatted = value ? formatDateValue(value) : ''
   return (
@@ -64,7 +65,7 @@ function AddDateInput({ value, onChange }: { value: string; onChange: (v: string
         >
           <CalendarIcon className="size-3 shrink-0 text-muted-foreground" />
           <span className={`min-w-0 truncate${!formatted ? ' text-muted-foreground' : ' text-foreground'}`}>
-            {formatted || 'Pick a date\u2026'}
+            {formatted || translate(locale, 'inspector.properties.pickDate')}
           </span>
         </button>
       </PopoverTrigger>
@@ -122,15 +123,16 @@ function AddNumberInput({ value, onChange, onKeyDown }: {
   )
 }
 
-function AddPropertyValueInput({ displayMode, value, onChange, onKeyDown, vaultStatuses }: {
+function AddPropertyValueInput({ displayMode, value, onChange, onKeyDown, vaultStatuses, locale }: {
   displayMode: PropertyDisplayMode; value: string; onChange: (v: string) => void
   onKeyDown: (e: React.KeyboardEvent) => void; vaultStatuses: string[]
+  locale: AppLocale
 }) {
   switch (displayMode) {
     case 'number':
       return <AddNumberInput value={value} onChange={onChange} onKeyDown={onKeyDown} />
-    case 'boolean': return <AddBooleanInput value={value} onChange={onChange} />
-    case 'date': return <AddDateInput value={value} onChange={onChange} />
+    case 'boolean': return <AddBooleanInput value={value} locale={locale} onChange={onChange} />
+    case 'date': return <AddDateInput value={value} locale={locale} onChange={onChange} />
     case 'status': return <AddStatusInput value={value} onChange={onChange} vaultStatuses={vaultStatuses} />
     case 'tags': return (
       <Input className={ADD_INPUT_CLASS} type="text" placeholder="tag1, tag2, ..." value={value}
@@ -138,16 +140,17 @@ function AddPropertyValueInput({ displayMode, value, onChange, onKeyDown, vaultS
       />
     )
     default: return (
-      <Input className={ADD_INPUT_CLASS} type="text" placeholder="Value" value={value}
+      <Input className={ADD_INPUT_CLASS} type="text" placeholder={translate(locale, 'inspector.properties.valuePlaceholder')} value={value}
         onChange={(e) => onChange(e.target.value)} onKeyDown={onKeyDown}
       />
     )
   }
 }
 
-export function AddPropertyForm({ onAdd, onCancel, vaultStatuses }: {
+export function AddPropertyForm({ onAdd, onCancel, vaultStatuses, locale = 'en' }: {
   onAdd: (key: string, value: string, displayMode: PropertyDisplayMode) => void; onCancel: () => void
   vaultStatuses: string[]
+  locale?: AppLocale
 }) {
   const [newKey, setNewKey] = useState('')
   const [newValue, setNewValue] = useState('')
@@ -169,7 +172,7 @@ export function AddPropertyForm({ onAdd, onCancel, vaultStatuses }: {
     <div className="mt-1 flex flex-wrap items-center gap-1.5 rounded px-1.5 py-1" data-testid="add-property-form">
       <Input
         className="h-[26px] w-20 shrink-0 rounded border border-border bg-muted px-1.5 text-[12px] text-foreground outline-none focus:border-primary"
-        type="text" placeholder="Property name" value={newKey}
+        type="text" placeholder={translate(locale, 'inspector.properties.propertyName')} value={newKey}
         onChange={(e) => setNewKey(e.target.value)} onKeyDown={handleKeyDown} autoFocus
       />
       <Select value={displayMode} onValueChange={(v) => handleModeChange(v as PropertyDisplayMode)}>
@@ -193,15 +196,15 @@ export function AddPropertyForm({ onAdd, onCancel, vaultStatuses }: {
           })}
         </SelectContent>
       </Select>
-      <AddPropertyValueInput displayMode={displayMode} value={newValue} onChange={setNewValue} onKeyDown={handleKeyDown} vaultStatuses={vaultStatuses} />
+      <AddPropertyValueInput displayMode={displayMode} value={newValue} onChange={setNewValue} onKeyDown={handleKeyDown} vaultStatuses={vaultStatuses} locale={locale} />
       <Button
         size="icon-xs" onClick={() => onAdd(newKey, newValue, displayMode)}
-        disabled={!canSubmit} title="Add property"
+        disabled={!canSubmit} title={translate(locale, 'inspector.properties.addProperty')}
         data-testid="add-property-confirm"
       >
         <Check className="size-3.5" />
       </Button>
-      <Button size="icon-xs" variant="outline" onClick={onCancel} title="Cancel" data-testid="add-property-cancel">
+      <Button size="icon-xs" variant="outline" onClick={onCancel} title={translate(locale, 'common.cancel')} data-testid="add-property-cancel">
         <X className="size-3.5" />
       </Button>
     </div>