feat(settings): follow system theme

- Inbox: '받은 편지함' → 'Inbox' (이메일 용어 오역. 다른 언어 전부 Inbox 유지)
- Note: '메모' → '노트' (앱 전체 용어 불일치 수정)
- Vault: '보관소/보관함' → 'Vault' (다른 언어 전부 Vault 유지)
- Views: '조회수' → '뷰' (YouTube 조회수 뉘앙스 제거)
- Guidance: '가이드ANCE' → '가이던스' (오타 수정)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

.github/workflows/ci.yml

@@ -16,8 +16,8 @@ env:
   RUST_TARGET_CACHE_VERSION: v2026-04-14-tolaria
 
 jobs:
-  test:
-    name: Tests & Quality Checks
+  frontend-quality:
+    name: Frontend Tests & Quality Checks
     runs-on: macos-15
 
     steps:
@@ -36,28 +36,11 @@ jobs:
           node-version: '22'
           cache: 'pnpm'
 
-      - name: Setup Rust
-        uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt, clippy, llvm-tools-preview
-
-      - name: Cache Rust dependencies
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            src-tauri/target
-          key: ${{ runner.os }}-cargo-${{ env.RUST_TARGET_CACHE_VERSION }}-${{ hashFiles('src-tauri/Cargo.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-cargo-${{ env.RUST_TARGET_CACHE_VERSION }}-
-
-      - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@cargo-llvm-cov
-
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      # Keep frontend and Rust quality gates in separate macOS jobs so the
+      # expensive Rust target cache restore no longer blocks the frontend lane.
       # ── 0. Build check (catches type errors and bundler failures) ─────────
       - name: TypeScript type check
         run: pnpm exec tsc --noEmit
@@ -66,8 +49,7 @@ jobs:
         run: pnpm build
 
       # ── 1. Coverage-backed tests ──────────────────────────────────────────
-      # The coverage commands run the same frontend and Rust test suites, so keep
-      # them as the canonical test lane instead of running every suite twice.
+      # The coverage command runs the canonical frontend test suite.
       - name: Bundle MCP server resources (required by Tauri build)
         run: node scripts/bundle-mcp-server.mjs
 
@@ -76,25 +58,15 @@ jobs:
         run: pnpm test:coverage
         # Thresholds configured in vite.config.ts — exits non-zero if coverage drops
 
-      - name: Rust tests + coverage (≥85% lines)
-        run: |
-          cargo llvm-cov \
-            --manifest-path src-tauri/Cargo.toml \
-            --ignore-filename-regex 'lib\.rs|main\.rs|menu\.rs' \
-            --lcov \
-            --output-path coverage/rust.lcov \
-            --fail-under-lines 85
-        # cargo-llvm-cov exits non-zero if line coverage drops below 85%
-        # lib.rs/main.rs/menu.rs are Tauri boilerplate -- not meaningfully unit-testable.
-
-      - name: Upload coverage to Codecov
+      - name: Upload frontend coverage to Codecov
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         uses: codecov/codecov-action@v5
         with:
           use_oidc: true
           fail_ci_if_error: true
           disable_search: true
-          files: ./coverage/lcov.info,./coverage/rust.lcov
+          files: ./coverage/lcov.info
+          flags: frontend
           verbose: true
         # OIDC avoids long-lived CODECOV_TOKEN secrets.
 
@@ -158,6 +130,56 @@ jobs:
       - name: Lint frontend
         run: pnpm lint
 
+  rust-quality:
+    name: Rust Tests & Quality Checks
+    runs-on: macos-15
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy, llvm-tools-preview
+
+      - name: Cache Rust dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            src-tauri/target
+          key: ${{ runner.os }}-cargo-${{ env.RUST_TARGET_CACHE_VERSION }}-${{ hashFiles('src-tauri/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-${{ env.RUST_TARGET_CACHE_VERSION }}-
+
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+
+      - name: Rust tests + coverage (≥85% lines)
+        run: |
+          mkdir -p coverage
+          cargo llvm-cov \
+            --manifest-path src-tauri/Cargo.toml \
+            --ignore-filename-regex 'lib\.rs|main\.rs|menu\.rs' \
+            --lcov \
+            --output-path coverage/rust.lcov \
+            --fail-under-lines 85
+        # cargo-llvm-cov exits non-zero if line coverage drops below 85%
+        # lib.rs/main.rs/menu.rs are Tauri boilerplate -- not meaningfully unit-testable.
+
+      - name: Upload Rust coverage to Codecov
+        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        uses: codecov/codecov-action@v5
+        with:
+          use_oidc: true
+          fail_ci_if_error: true
+          disable_search: true
+          files: ./coverage/rust.lcov
+          flags: rust
+          verbose: true
+        # OIDC avoids long-lived CODECOV_TOKEN secrets.
+
       - name: Clippy (Rust)
         run: cargo clippy --manifest-path=src-tauri/Cargo.toml -- -D warnings
 

.github/workflows/release-stable.yml

@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - 'stable-v*'
+      - 'v20*'
 
 env:
   # Bump this when Tauri/Rust target artifacts capture stale absolute paths.
@@ -34,14 +35,24 @@ jobs:
           from datetime import date
 
           tag = os.environ["GITHUB_REF_NAME"]
-          version = tag.removeprefix("stable-v")
-          match = re.fullmatch(r"(\d{4})\.(\d{1,2})\.(\d{1,2})", version)
-          if not match:
-              raise SystemExit(f"Stable tags must use stable-vYYYY.M.D, got {tag}")
+          legacy_match = re.fullmatch(r"stable-v(\d{4})\.(\d{1,2})\.(\d{1,2})", tag)
+          date_match = re.fullmatch(r"v(\d{4})-(\d{2})-(\d{2})", tag)
+
+          if date_match:
+              year, month, day = map(int, date_match.groups())
+              date(year, month, day)
+              version = f"{year}.{month}.{day}"
+              display_version = tag
+          elif legacy_match:
+              year, month, day = map(int, legacy_match.groups())
+              date(year, month, day)
+              version = f"{year}.{month}.{day}"
+              display_version = version
+          else:
+              raise SystemExit(f"Stable tags must use vYYYY-MM-DD or stable-vYYYY.M.D, got {tag}")
 
-          date(*map(int, match.groups()))
           print(f"version={version}")
-          print(f"display_version={version}")
+          print(f"display_version={display_version}")
           print(f"tag={tag}")
           PY
 
@@ -565,16 +576,23 @@ jobs:
 
       - name: Generate release notes
         run: |
-          PREV_TAG=$(git tag --list 'stable-v*' --sort=-version:refname | grep -vx "${{ needs.version.outputs.tag }}" | head -n 1 || echo "")
-          if [ -z "$PREV_TAG" ]; then
-            NOTES=$(git log --oneline --no-merges -20)
+          NOTES_FILE="release-notes/${{ needs.version.outputs.tag }}.md"
+          if [ -f "$NOTES_FILE" ]; then
+            cat "$NOTES_FILE" > release_notes.md
           else
-            NOTES=$(git log --oneline --no-merges "${PREV_TAG}..${{ needs.version.outputs.tag }}")
+            PREV_TAG=$(git for-each-ref --sort=-creatordate --format='%(refname:short)' refs/tags/v20* refs/tags/stable-v* | grep -vx "${{ needs.version.outputs.tag }}" | head -n 1 || echo "")
+            if [ -z "$PREV_TAG" ]; then
+              NOTES=$(git log --oneline --no-merges -20)
+            else
+              NOTES=$(git log --oneline --no-merges "${PREV_TAG}..${{ needs.version.outputs.tag }}")
+            fi
+            {
+              echo "## What's Changed"
+              echo ""
+              echo "$NOTES" | while IFS= read -r line; do echo "- $line"; done
+            } > release_notes.md
           fi
           {
-            echo "## What's Changed"
-            echo ""
-            echo "$NOTES" | while IFS= read -r line; do echo "- $line"; done
             echo ""
             echo "---"
             echo "**Stable release — manually promoted from \`main\`**"
@@ -582,7 +600,7 @@ jobs:
             echo "**Includes macOS (Apple Silicon and Intel), Windows x64, and Linux x64 bundles**"
             echo ""
             echo "*Built from \`$(git rev-parse --short ${{ needs.version.outputs.tag }})\` on $(date -u +%Y-%m-%d)*"
-          } > release_notes.md
+          } >> release_notes.md
 
       - name: Build stable-latest.json
         run: |
@@ -727,7 +745,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          mkdir -p _site/alpha _site/stable
+          mkdir -p _site/alpha _site/stable _site/release-notes
+          if [ -d release-notes ]; then cp release-notes/*.md _site/release-notes/ 2>/dev/null || true; fi
           gh api -H "Accept: application/vnd.github.html+json" repos/${{ github.repository }}/releases --paginate > _site/releases.json
           PAGES_URL="https://refactoringhq.github.io/${GITHUB_REPOSITORY#*/}"
 

.github/workflows/release.yml

@@ -69,10 +69,18 @@ jobs:
           else:
               today = datetime.now(timezone.utc).date()
               stable_date = None
-              stable_pattern = re.compile(r"^stable-v(\d{4})\.(\d{1,2})\.(\d{1,2})$")
+              stable_patterns = (
+                  re.compile(r"^v(\d{4})-(\d{2})-(\d{2})$"),
+                  re.compile(r"^stable-v(\d{4})\.(\d{1,2})\.(\d{1,2})$"),
+              )
 
-              for stable_tag in lines(["git", "tag", "--list", "stable-v*", "--sort=-version:refname"]):
-                  match = stable_pattern.fullmatch(stable_tag)
+              stable_tags = lines([
+                  "git", "for-each-ref", "--sort=-creatordate", "--format=%(refname:short)",
+                  "refs/tags/v20*", "refs/tags/stable-v*",
+              ])
+
+              for stable_tag in stable_tags:
+                  match = next((pattern.fullmatch(stable_tag) for pattern in stable_patterns if pattern.fullmatch(stable_tag)), None)
                   if not match:
                       continue
 
@@ -778,7 +786,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          mkdir -p _site/alpha _site/stable
+          mkdir -p _site/alpha _site/stable _site/release-notes
+          if [ -d release-notes ]; then cp release-notes/*.md _site/release-notes/ 2>/dev/null || true; fi
           gh api -H "Accept: application/vnd.github.html+json" repos/${{ github.repository }}/releases --paginate > _site/releases.json
           PAGES_URL="https://refactoringhq.github.io/${GITHUB_REPOSITORY#*/}"
 

.gitignore

@@ -73,3 +73,6 @@ CODE-HEALTH-REPORT.md
 .env
 .env.local
 .env.*.local
+
+# Local Codacy CLI runtime/config generated by the MCP server
+.codacy/

demo-vault-v2/.fixture-manifest.json

@@ -49,7 +49,13 @@
         "laputa-qa-reference.md",
         "attachments/laputa-reference.png"
       ]
+    },
+    {
+      "id": "rtl-mixed-direction",
+      "reason": "Arabic and mixed English/Arabic paragraphs keep rich editor and raw editor BiDi QA anchored to the fixture.",
+      "files": [
+        "rtl-mixed-direction-qa.md"
+      ]
     }
   ]
 }
-

demo-vault-v2/rtl-mixed-direction-qa.md

@@ -0,0 +1,17 @@
+---
+type: Note
+topics:
+  - "[[topic-writing]]"
+---
+
+# RTL Mixed Direction QA
+
+مرحبا بالعالم. هذه فقرة عربية لاختبار اتجاه النص من اليمين إلى اليسار داخل محرر تولاريا.
+
+English text should keep reading left to right when it appears next to Arabic content.
+
+English then مرحبا بالعالم keeps both scripts readable on one line.
+
+مرحبا بالعالم then English keeps the Arabic run anchored correctly while preserving the English words.
+
+Use this note when checking rich editor and raw Markdown editor behavior for automatic LTR/RTL direction.

docs/ABSTRACTIONS.md

@@ -160,9 +160,9 @@ interface VaultEntry {
 |---|---|---|
 | `markdown` or absent | `.md`, `.markdown` | Full Tolaria note model: frontmatter, BlockNote, raw editor, relationships, title sync |
 | `text` | UTF-8 editable formats such as `.yml`, `.json`, `.ts`, `.py`, `.sh` | Opens through the raw editor without Markdown note semantics |
-| `binary` | Images, PDFs, archives, other non-text files | Stays a normal vault file; previewable images and PDFs open in `FilePreview`, unsupported or broken binaries show an explicit fallback |
+| `binary` | Images, audio, video, PDFs, archives, other non-text files | Stays a normal vault file; previewable media and PDFs open in `FilePreview`, unsupported or broken binaries show an explicit fallback |
 
-Asset previewability is inferred in the renderer from the filename extension (`src/utils/filePreview.ts`) rather than stored as a new persisted kind. Supported images render through `<img>` and supported PDFs render through the webview's PDF object renderer, both backed by Tauri asset URLs. Runtime asset access is accumulated only for vault roots Tolaria has loaded in the current app session, because Tauri directory forbids cannot be safely reversed after a vault switch. The "open in default app" action re-enters the active-vault command boundary through `open_vault_file_external` before delegating to the native opener. This keeps the filesystem as source of truth and avoids converting assets into proprietary objects.
+Asset previewability is inferred in the renderer from the filename extension (`src/utils/filePreview.ts`) rather than stored as a new persisted kind. Supported images render through `<img>`, supported audio/video render through native HTML media controls, and supported PDFs render through the webview's PDF object renderer, all backed by Tauri asset URLs. Runtime asset access is accumulated only for vault roots Tolaria has loaded in the current app session, because Tauri directory forbids cannot be safely reversed after a vault switch. The "open in default app" action re-enters the active-vault command boundary through `open_vault_file_external` before delegating to the native opener. This keeps the filesystem as source of truth and avoids converting assets into proprietary objects.
 
 ### Note Content Freshness
 
@@ -170,6 +170,10 @@ The renderer may cache recently opened or preloaded markdown content, but cached
 
 `useEditorTabSwap` may reuse BlockNote blocks that were already opened successfully or warmed from prefetched raw content, keyed by vault, path, and exact source content. Background warming is limited to likely next large Markdown notes and defers while the editor is unmounted, raw mode is active, or recent typing/navigation is still inside the foreground idle window. Every async editor swap carries a generation and source-content token so stale conversion results cannot overwrite newer file content or dirty editor state.
 
+### Table of Contents Outline
+
+The editor Table of Contents is derived from the live BlockNote document, not from saved Markdown text. `src/utils/tableOfContents.ts` reads structural `heading` blocks with stable ids and levels, extracts inline text from nested BlockNote content, and nests headings by level while preserving document order. `TableOfContentsPanel` receives a document revision from `Editor`, so rich-editor edits refresh the outline immediately without waiting for autosave or a vault reload. Selecting a heading focuses BlockNote and moves the cursor to that block id, while nested headings can be collapsed independently in panel-local UI state.
+
 ### Entity Types (isA / type)
 
 Entity type is stored in the `type:` frontmatter field (e.g. `type: Quarter`). The legacy field name `Is A:` is still accepted as an alias for backwards compatibility but new notes use `type:`. The `VaultEntry.isA` property in TypeScript/Rust holds the resolved value.
@@ -200,6 +204,7 @@ Each entity type can have a corresponding **type document**: any markdown note w
 
 - Have `type: Type` in their frontmatter (`Is A: Type` also accepted as legacy alias)
 - Define type metadata: icon, color, order, sidebar label, template, sort, view, visibility
+- Define instance schema/defaults through ordinary custom frontmatter properties and relationship fields
 - Are navigable entities — they appear in the sidebar under "Types" and can be opened/edited like any note
 - Serve as the "definition" for their type category
 
@@ -218,6 +223,8 @@ Each entity type can have a corresponding **type document**: any markdown note w
 
 **Type relationship**: When any entry has an `isA` value (e.g., "Project"), the Rust backend automatically adds a `"Type"` entry to its `relationships` map pointing to `[[project]]`. This makes the type navigable from the Inspector panel while keeping location as an implementation detail.
 
+**Instance schema/defaults**: Custom scalar properties and relationship fields on a type document define the expected shape for notes of that type. Existing instances do not get mutated when a type changes; the Inspector enriches their real frontmatter with gray placeholders for missing type-defined properties/relationships. Valued type fields are copied into frontmatter only when Tolaria creates a new instance of that type. Blank type fields stay as placeholders.
+
 **UI behavior**:
 - Clicking a section group header pins the type document at the top of the NoteList if it exists
 - Viewing a type document in entity view shows an "Instances" group listing all entries of that type
@@ -278,8 +285,9 @@ Tolaria separates **display title** from the file identifier:
 - **Opening a note is read-only**: selecting a note does not inject or auto-correct `title:` frontmatter.
 - **Explicit filename actions** (`rename_note`): breadcrumb rename/sync actions stage crash-safe note renames through a hidden `.tolaria-rename-txn/` transaction directory, recover unfinished renames on the next vault scan, update wikilinks across the vault, and surface any failed backlink rewrites instead of silently reporting partial success. The editor body remains the title editing surface.
 - **Unicode-aware note stems** (`src/utils/noteSlug.ts`, `vault/rename.rs`): frontend and backend slugging preserve Unicode letters/digits in note filenames, untitled-rename detection, and fallback wikilink targets while still collapsing symbol-only titles to `untitled`.
+- **Path identity rules** (`src/utils/notePathIdentity.ts`, `vault/path_identity.rs`): note creation, tab selection, rename bookkeeping, pull refresh, git history, and vault cache updates normalize path separators and macOS `/private/tmp` aliases through one owner. Case folding is reserved for collision/deduplication checks; active-note identity remains case-sensitive.
 - **Portable filename validation** (`vault/filename_rules.rs`): note filenames, folder names, and custom view filenames all reject Windows-reserved device names, invalid characters, and trailing dot/space suffixes so a vault created on macOS/Linux still clones and syncs cleanly on Windows.
-- **Recoverable save failures** (`useEditorSave`, `vault/file.rs`): invalid platform path syntax is reported as a clear retryable save error, while the editor keeps the unsaved buffer intact for another attempt.
+- **Recoverable save failures** (`useEditorSave`, `vault/file.rs`): invalid platform path syntax is reported as a clear retryable save error, while transient access-denied writes are retried briefly before surfacing failure. The editor keeps the unsaved buffer intact for another attempt.
 - **Untitled drafts** start as `untitled-*.md` and are auto-renamed on save once the note gains an H1.
 
 ### Title Surface (UI)
@@ -336,7 +344,7 @@ The renderer uses `viewOrdering` helpers to convert drag or command-palette move
 
 ## Command Surface
 
-`src/shared/appCommandManifest.json` is the cross-runtime source for stable app command IDs, menu structure, display labels, accelerators, deterministic shortcut QA metadata, and native menu enablement groups. The renderer imports it through `src/hooks/appCommandCatalog.ts`, which derives `APP_COMMAND_IDS`, shortcut lookup maps, Linux titlebar menu sections, native-menu command membership, and test helpers. Tauri includes the same JSON in `src-tauri/src/menu.rs` and uses it to build custom menu items, emit overridden menu item IDs such as the quick-open alias as their primary command IDs, and toggle state-dependent menu items from manifest groups.
+`src/shared/appCommandManifest.json` is the cross-runtime source for stable app command IDs, menu structure, display labels, accelerators, deterministic shortcut QA metadata, and native menu enablement groups. The renderer imports it through `src/hooks/appCommandCatalog.ts`, which derives `APP_COMMAND_IDS`, shortcut lookup maps, Linux titlebar menu sections, native-menu command membership, and test helpers. Tauri includes the same JSON in `src-tauri/src/menu.rs` and uses it to build custom menu items, emit overridden menu item IDs such as the quick-open alias as their primary command IDs, register the Windows main-window menu event bridge, and toggle state-dependent menu items from manifest groups.
 
 Domain command builders still own context-sensitive command-palette entries, availability, and execution callbacks. The manifest owns metadata that must stay identical across native menus, renderer shortcuts, deterministic QA bridges, and the Linux fallback menu; OS-native menu items such as Undo, Copy/Paste, Services, Quit, and Window controls remain local to the native menu implementation.
 
@@ -367,7 +375,7 @@ Command-facing vault content is filtered through `vault::filter_gitignored_entri
 
 A `vault_health_check` command detects stray files in non-protected subfolders and filename-title mismatches. On vault load, a migration banner offers to flatten stray files to the root via `flatten_vault`.
 
-Command-layer path access is fenced to the active vault before file operations reach the vault backend. `src-tauri/src/commands/vault/boundary.rs` canonicalizes the configured/requested vault root, rejects `..` escapes and absolute paths outside that root, and validates writable targets through the nearest existing ancestor so note reads, saves, deletes, view-file edits, folder mutations, and image attachment writes cannot step outside the active vault. Image attachment commands add the current vault root to the runtime asset scope after saving so files created under a previously missing `attachments/` directory can render immediately.
+Command-layer path access is fenced to the active vault before file operations reach the vault backend. `src-tauri/src/commands/vault/boundary.rs` canonicalizes the configured/requested vault root, rejects `..` escapes and absolute paths outside that root, and validates writable targets through the nearest existing ancestor so note reads, saves, deletes, view-file edits, folder mutations, and image attachment writes cannot step outside the active vault. If the active root itself cannot be canonicalized, the renderer treats `Active vault is not available` the same as no active vault: it clears stale vault state, drops prefetched note content, and shows the missing-vault recovery screen instead of continuing note/view requests against the disappeared path. Image attachment commands add the current vault root to the runtime asset scope after saving so files created under a previously missing `attachments/` directory can render immediately.
 
 UI-only file actions operate on paths that are already selected or indexed in React state. Reveal-in-Finder routes through the Tauri opener plugin, external-open routes through the `open_vault_file_external` command and active-vault boundary before invoking the native opener, and copy-path uses the browser clipboard API. Plain-text paste reads the desktop clipboard through `read_text_from_clipboard` in Tauri so macOS WKWebView clipboard permissions do not block the command; browser/mock mode falls back to the Web Clipboard API or mock handlers. None of those actions mutate vault contents or bypass the backend write boundary.
 
@@ -405,7 +413,7 @@ The `with_frontmatter()` helper wraps this in a read-transform-write cycle on th
 
 ## Git Integration
 
-Git operations live in `src-tauri/src/git/`. All operations shell out to the `git` CLI (not libgit2).
+Git operations live in `src-tauri/src/git/`. All operations shell out to the `git` CLI (not libgit2). Path-producing commands use `core.quotePath=false` so Unicode note filenames stay as UTF-8 paths across status, history, cache invalidation, and rename detection.
 
 ### Data Types
 
@@ -532,8 +540,8 @@ Defined in `src/components/editorSchema.tsx` and styled in `src/components/Edito
 
 - The schema overrides BlockNote's default `codeBlock` spec with `createCodeBlockSpec({ ...codeBlockOptions, defaultLanguage: "text" })` from `@blocknote/code-block`.
 - Fenced code blocks now use BlockNote's supported Shiki-backed highlighter path, which renders `.shiki` token spans directly inside the editor DOM.
-- Tolaria keeps `defaultLanguage: "text"` so unlabeled code blocks do not silently become JavaScript while still supporting the packaged language aliases such as `ts` → `typescript`.
-- Inline-code chip styling remains scoped to `.bn-inline-content code`, so fenced `pre > code` nodes keep BlockNote's dark shell instead of inheriting the muted inline surface.
+- Tolaria keeps `defaultLanguage: "text"` so unlabeled code blocks do not silently become JavaScript at creation time. Parsed unlabeled code blocks then run through Tolaria's lightweight language inference, while explicit fence languages and user dropdown choices still win.
+- Inline-code chip styling remains scoped to `.bn-inline-content code`, so fenced `pre > code` nodes keep the dedicated code-block shell instead of inheriting the muted inline surface.
 
 ### Markdown Math
 
@@ -546,12 +554,23 @@ Defined in `src/utils/mathMarkdown.ts`, `src/components/editorSchema.tsx`, and s
 
 ### Mermaid Diagrams
 
-Defined in `src/utils/mermaidMarkdown.ts`, `src/components/MermaidDiagram.tsx`, `src/components/editorSchema.tsx`, and styled in `src/components/EditorTheme.css`:
+Defined in `src/utils/durableMarkdownBlocks.ts`, `src/utils/editorDurableMarkdown.ts`, `src/utils/mermaidMarkdown.ts`, `src/components/MermaidDiagram.tsx`, `src/components/editorSchema.tsx`, and styled in `src/components/EditorTheme.css`:
 
 - Fenced `mermaid` blocks become `mermaidBlock` schema nodes before BlockNote sees the Markdown body.
 - Each `mermaidBlock` stores the original fenced Markdown plus the diagram body, so raw-mode entry and saves can restore the canonical source instead of serializing generated SVG.
 - The rich editor renders diagrams with the `mermaid` package and uses the original source as an inline fallback when rendering fails.
-- `serializeMermaidAwareBlocks()` wraps the math-aware serializer so math, wikilinks, and diagrams share the same Markdown-first save path.
+- `serializeDurableEditorBlocks()` wraps the math-aware serializer so math, wikilinks, Mermaid diagrams, and whiteboards share the same Markdown-first save path.
+- The `/mermaid` slash command inserts a placeholder rectangle diagram using the same schema-backed Markdown storage path, avoiding an invalid empty diagram state.
+
+### Tldraw Whiteboards
+
+Defined in `src/utils/durableMarkdownBlocks.ts`, `src/utils/editorDurableMarkdown.ts`, `src/utils/tldrawMarkdown.ts`, `src/components/TldrawWhiteboard.tsx`, `src/components/editorSchema.tsx`, and styled in `src/components/EditorTheme.css`:
+
+- Fenced `tldraw` blocks become `tldrawBlock` schema nodes before BlockNote sees the Markdown body.
+- Each `tldrawBlock` stores a stable `boardId` plus the tldraw document snapshot JSON. Session state such as camera, selected tool, and current selection is not persisted into the note.
+- The rich editor renders the block with the `tldraw` package and saves debounced document snapshot changes back into the block props, so normal Tolaria autosave writes the board into the `.md` file.
+- Mermaid and tldraw both register small codecs with the shared durable fenced-block pipeline; scanner, token, block injection, and mixed serialization mechanics live in one owner.
+- The `/whiteboard` slash command inserts an empty tldraw block using the same Markdown-durable storage path. Preview images are intentionally omitted; thumbnails can be added later as derived cache artifacts.
 
 ### Formatting Surface Policy
 
@@ -560,10 +579,12 @@ Defined in `src/components/tolariaEditorFormatting.tsx` and `src/components/tola
 - `SingleEditorView` disables BlockNote's default formatting toolbar, `/` menu, and side menu, then mounts Tolaria-owned controllers so the visible formatting surface matches Tolaria's markdown round-trip guarantees.
 - The formatting toolbar only exposes inline controls that persist through `blocksToMarkdownLossy()` in Tolaria's save pipeline: bold, italic, strike, nesting, and link creation. Controls that BlockNote can render temporarily but Tolaria cannot faithfully persist, such as underline, color, alignment, and the block-type dropdown, are hidden instead of appearing to work and later disappearing.
 - Tolaria's formatting-toolbar controller also keeps file/image actions mounted across the tiny hover gap between an image block and the floating toolbar, and while the toolbar itself is hovered, so image controls remain usable instead of collapsing mid-interaction.
+- `useEditorComposing` tracks editor-owned IME composition events and closes the floating formatting toolbar during composition plus a short post-composition settle window, keeping CJK candidate windows unobstructed without changing normal selection toolbar behavior.
+- `createImeCompositionKeyGuardExtension()` intercepts composing `Enter` keydown events before BlockNote's list shortcuts see them, so Korean/Japanese/Chinese IMEs can commit text at the start of list items without Tolaria splitting the current bullet. It stops editor shortcut propagation only; it does not prevent the browser/IME default composition action.
 - `useImageLightbox` listens for `dblclick` on the rich-editor container and opens `ImageLightbox` only when the event target resolves to a viewable BlockNote image. The target resolver handles media wrappers, ignores image captions/resize controls, missing sources, and tiny tracking-style images, preserving BlockNote's ordinary single-click image selection path.
-- The `/` slash menu remains the supported path for markdown-safe block transformations such as headings, quotes, and list blocks. Tolaria filters out BlockNote's toggle-heading and toggle-list variants because those do not map cleanly to the markdown note model.
-- The block-handle side menu keeps only actions that survive Tolaria's markdown round-trip. Delete and table-header toggles remain available; BlockNote's `Colors` submenu is removed because block colors are not part of Tolaria's supported markdown surface. Tolaria renders the add-block button outside the drag handle so the handle stays next to the block content. The side menu aligns itself to the rendered text range for the hovered block, so H1/H2 typography, line-height, and theme changes do not need per-heading offsets. Block reordering uses a Tolaria-owned pointer gesture and direct BlockNote block moves instead of HTML5 `DataTransfer`, keeping it independent from Tauri's native file-drop system. Block-handle actions re-resolve the current live BlockNote block before mutating or dragging, so note reloads and sync churn cannot leave controls acting on stale block references.
-- BlockNote's table row/column handles are patched so stale or missing hovered-table state cancels the drag and hides handles instead of throwing. Add/remove row and column actions also validate the table position and cell indexes before resolving a ProseMirror `CellSelection`, so reloads or menu lag cannot turn stale handles into invalid table-selection positions. Browser and native table regressions should exercise row and column dragging plus add-menu actions because the state is tracked per orientation.
+- The `/` slash menu remains the supported path for markdown-safe block transformations such as headings, quotes, list blocks, Mermaid diagrams, and whiteboards. Tolaria filters out BlockNote's toggle-heading and toggle-list variants because those do not map cleanly to the markdown note model.
+- The block-handle side menu keeps only actions that survive Tolaria's markdown round-trip. Delete and table-header toggles remain available; BlockNote's `Colors` submenu is removed because block colors are not part of Tolaria's supported markdown surface. Tolaria renders the add-block button outside the drag handle so the handle stays next to the block content. The side menu aligns itself to the first rendered text line for the hovered block, so H1/H2 typography, line-height, wrapping, and theme changes do not need per-heading offsets. Block reordering uses a Tolaria-owned pointer gesture and direct BlockNote block moves instead of HTML5 `DataTransfer`, keeping it independent from Tauri's native file-drop system. Block-handle actions re-resolve the current live BlockNote block before mutating or dragging, so note reloads and sync churn cannot leave controls acting on stale block references.
+- BlockNote's table row/column handles are patched so stale or missing hovered-table state cancels the drag and hides handles instead of throwing. Add/remove row and column actions also validate the table position and cell indexes before resolving a ProseMirror `CellSelection`, so reloads or menu lag cannot turn stale handles into invalid table-selection positions. Checklist checkbox handlers also re-resolve the live block before updating `checked`, making delayed clicks after note reloads a no-op instead of a stale block mutation. Browser and native table regressions should exercise row and column dragging plus add-menu actions because the state is tracked per orientation.
 - `useNoteWikilinkDrop()` is the shared editor-drop abstraction for dragging note rows into either editor mode. It reads the existing note-retargeting drag payload, resolves the vault-relative stem, and inserts a canonical `[[wikilink]]` without hijacking unrelated plain-text drags.
 - `plainTextPaste.ts` is the shared plain-text paste target registry. Rich BlockNote and raw CodeMirror surfaces register focused insertion targets, while ordinary focused text controls use DOM selection replacement, so the `Cmd+Shift+V` command can preserve caret/selection behavior without each surface inventing its own clipboard reader.
 - `useTauriDragDropEvent()` owns the shared Tauri window drag/drop subscription and duplicate-unlisten cleanup used by native drop features.
@@ -574,25 +595,25 @@ Defined in `src/components/tolariaEditorFormatting.tsx` and `src/components/tola
 ```mermaid
 flowchart LR
     A["📄 Raw markdown\n(from disk)"] --> B["splitFrontmatter()\n→ yaml + body"]
-    B --> C["preProcessMermaidMarkdown(body)\nmermaid fence → token"]
+    B --> C["preProcessDurableEditorMarkdown(body)\nmermaid/tldraw fences → tokens"]
     C --> D["preProcessWikilinks(body)\n[[target]] → ‹token›"]
     D --> E["preProcessMathMarkdown(body)\n$...$ / $$...$$ → tokens"]
     E --> F["tryParseMarkdownToBlocks()\n→ BlockNote block tree"]
-    F --> G["injectWikilinks + injectMathInBlocks + injectMermaidInBlocks\n tokens → schema nodes"]
+    F --> G["injectWikilinks + injectMathInBlocks + injectDurableEditorMarkdownBlocks\n tokens → schema nodes"]
     G --> H["editor.replaceBlocks()\n→ rendered editor"]
 
     style A fill:#f8f9fa,stroke:#6c757d,color:#000
     style H fill:#d4edda,stroke:#28a745,color:#000
 ```
 
-> Wikilink placeholder tokens use `\u2039` and `\u203A`; math and Mermaid placeholder tokens use ASCII sentinels with URI-encoded payloads.
+> Wikilink placeholder tokens use `\u2039` and `\u203A`; math, Mermaid, and tldraw placeholder tokens use ASCII sentinels with URI-encoded payloads.
 
 ### BlockNote-to-Markdown Pipeline (Save)
 
 ```mermaid
 flowchart LR
     A["✏️ BlockNote blocks\n(editor state)"] --> B["blocksToMarkdownLossy()"]
-    B --> C["restoreWikilinks + serializeMermaidAwareBlocks()\nschema nodes → Markdown source"]
+    B --> C["restoreWikilinks + serializeDurableEditorBlocks()\nschema nodes → Markdown source"]
     C --> D["prepend frontmatter yaml"]
     D --> E["invoke('save_note_content')\n→ disk write"]
 
@@ -637,12 +658,12 @@ Typed ASCII arrow sequences are normalized consistently in both editor modes:
 
 ## Styling
 
-The app uses internal light and dark themes owned by Tolaria (see [ADR-0081](adr/0081-internal-light-dark-theme-runtime.md)). The previous vault-authored theming system remains removed; theme mode is an installation-local app preference.
+The app uses internal light and dark themes owned by Tolaria, with System as an installation-local preference that follows the OS appearance (see [ADR-0081](adr/0081-internal-light-dark-theme-runtime.md) and [ADR-0112](adr/0112-system-theme-mode.md)). The previous vault-authored theming system remains removed.
 
 1. **Global CSS variables** (`src/index.css`): Semantic app colors, borders, surfaces, and interaction states via `:root` / `[data-theme]`, bridged to Tailwind v4
 2. **Editor theme** (`src/theme.json`): BlockNote typography, flattened to CSS vars by `useEditorTheme`
-3. **Runtime theme bridge**: Applies `data-theme` and `.dark` for shadcn/ui, while CodeMirror and editor-specific consumers derive any non-CSS-variable values from the same semantic contract
-4. **Theme mode commands**: Command-palette actions for light and dark mode call the same `saveSettings` path as the Settings panel and persist only `settings.theme_mode`
+3. **Runtime theme bridge**: Resolves the selected preference to `light` / `dark`, applies `data-theme` and `.dark` for shadcn/ui, and subscribes to `prefers-color-scheme` while System is selected
+4. **Theme mode commands**: Command-palette actions for Light, Dark, and System call the same `saveSettings` path as the Settings panel and persist only `settings.theme_mode`
 
 ## Localization
 
@@ -663,10 +684,12 @@ The Inspector panel (`src/components/Inspector.tsx`) is composed of sub-panels:
 1. **DynamicPropertiesPanel** (`src/components/DynamicPropertiesPanel.tsx`): Renders frontmatter as editable key-value pairs:
    - **Editable properties** (top): Type badge, Status pill with dropdown, number fields, boolean toggles, array tag pills, text fields. Click-to-edit interaction.
    - **Property display modes**: `text`, `number`, `date`, `boolean`, `status`, `url`, `tags`, and `color`. Numeric frontmatter values auto-detect as `number`, and custom scalar keys can be explicitly switched to `Number` through the property-type control.
+   - **Present empty properties**: A top-level frontmatter key with a blank scalar value (for example `start date:`) is treated as present and renders as an editable empty row. Only absent keys are omitted.
+   - **Type-derived placeholders**: For typed instances, missing custom properties declared on the type document render as gray editable placeholders. Editing one writes the value to the instance frontmatter; merely displaying it does not backfill the note.
    - **Info section** (bottom, separated by border): Read-only derived metadata — Modified, Created, Words, File Size. Uses muted styling with no interaction.
    - Keys in `SKIP_KEYS` (`type`, `aliases`, `notion_id`, `workspace`, `is_a`, `Is A`) are hidden from the editable section.
 
-2. **RelationshipsPanel**: Shows `belongs_to`, `related_to`, `has`, and all custom relationship fields as clickable wikilink chips. Relationship labels are humanized for display, but stored keys remain unchanged.
+2. **RelationshipsPanel**: Shows `belongs_to`, `related_to`, `has`, and all custom relationship fields as clickable wikilink chips. Relationship labels are humanized for display, but stored keys remain unchanged. For typed instances, missing relationship fields declared on the type document render as gray editable placeholders without copying any default relationship targets into existing notes.
 
 3. **BacklinksPanel**: Scans `allContent` for notes that reference the current note via `[[title]]` or `[[path]]`.
 
@@ -751,6 +774,7 @@ Tolaria delegates remote auth to the user's system git setup:
 - `CloneVaultModal` captures a remote URL and local destination
 - `clone_git_repo` and `create_getting_started_vault` both run system git clone work in blocking Tokio tasks so clone UIs stay responsive
 - On Linux AppImage launches, every system-git command removes AppImage loader overrides such as `LD_LIBRARY_PATH`, `LD_PRELOAD`, and `GIT_EXEC_PATH` before spawning `git`, so helpers like `git-remote-https` bind against the host git/library stack instead of Tolaria's bundled WebKit/AppImage libraries
+- On Linux AppImage Wayland launches, startup environment safeguards also set `GTK_IM_MODULE=fcitx` when common input-method variables already indicate fcitx and the user has not explicitly chosen a GTK IM module, allowing WebKitGTK editor input to reach fcitx5 on compositors such as niri without overriding deliberate `GTK_IM_MODULE` choices.
 - `git_add_remote` uses the same system git path and refuses remotes whose history is unrelated or ahead of the local vault
 - Existing `git_pull` / `git_push` commands keep surfacing raw git errors, and clone commands fail fast when git wants interactive terminal input
 - No provider-specific token or username is stored in app settings
@@ -770,10 +794,13 @@ interface Settings {
   analytics_enabled: boolean | null
   anonymous_id: string | null
   release_channel: string | null // null = stable default, "alpha" = every-push prerelease feed
-  theme_mode: 'light' | 'dark' | null
+  theme_mode: 'light' | 'dark' | 'system' | null
   ui_language: AppLocale | null
   note_width_mode: 'normal' | 'wide' | null
+  sidebar_type_pluralization_enabled: boolean | null // null = default true
   default_ai_agent: 'claude_code' | 'codex' | 'opencode' | 'pi' | 'gemini' | null
+  default_ai_target: string | null // "agent:codex" or "model:<provider>/<model>"
+  ai_model_providers: AiModelProvider[] | null
   hide_gitignored_files: boolean | null // null = default true
   all_notes_show_pdfs: boolean | null // null = default false
   all_notes_show_images: boolean | null // null = default false
@@ -781,7 +808,7 @@ interface Settings {
 }
 ```
 
-Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is installation-local because it controls device comfort rather than vault structure; the Settings panel and command-palette light/dark actions both update that same value. `ui_language` is also installation-local: `null` follows the supported system language with English fallback, while explicit values pin the UI language for this installation. Stored legacy aliases such as `zh-Hans` are normalized to canonical locale codes before the setting reaches React state. `note_width_mode` is the installation-local default for rich-editor note width; individual notes can override it with `_width` when they already have frontmatter. `default_ai_agent` is an installation-local preference that selects which supported CLI agent the AI panel, command palette AI mode, and status bar should target by default. `hide_gitignored_files` is also installation-local and defaults to `true`; changing it reloads entries, search, saved views, and folders without restarting. The `all_notes_show_pdfs`, `all_notes_show_images`, and `all_notes_show_unsupported` flags are installation-local All Notes category toggles that default off and update the list/counts without changing vault files. The AutoGit fields are also installation-local: `useAutoGit` consumes them to schedule automatic checkpoints, while `useCommitFlow` and the status bar quick action reuse the same checkpoint runner and deterministic automatic commit message generation.
+Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is installation-local because it controls device comfort rather than vault structure; the Settings panel and command-palette Light/Dark/System actions both update that same value. `system` remains a stored preference, while the runtime resolves it to `light` or `dark` for `data-theme` and app consumers. `ui_language` is also installation-local: `null` follows the supported system language with English fallback, while explicit values pin the UI language for this installation. Stored legacy aliases such as `zh-Hans` are normalized to canonical locale codes before the setting reaches React state. `note_width_mode` is the installation-local default for rich-editor note width; individual notes can override it with `_width` when they already have frontmatter. `sidebar_type_pluralization_enabled` is installation-local and defaults to `true`; when false, type rows use exact type names unless the type document defines an explicit `sidebar_label` override. `default_ai_agent` remains the legacy installation-local CLI fallback. `default_ai_target` is the active AI target used by the AI panel and status bar; it can point at a coding agent or a configured direct model. `ai_model_providers` stores non-secret provider metadata for local/API model targets, while hosted API keys live in Tolaria's local app-data secrets file or user-managed environment variables instead of being persisted in app settings. Provider defaults and local/API grouping come from the shared `src/shared/aiModelProviderCatalog.json` catalog used by both renderer settings and the Tauri direct-model runtime. `hide_gitignored_files` is also installation-local and defaults to `true`; changing it reloads entries, search, saved views, and folders without restarting. The `all_notes_show_pdfs`, `all_notes_show_images`, and `all_notes_show_unsupported` flags are installation-local All Notes category toggles that default off and update the list/counts without changing vault files. The AutoGit fields are also installation-local: `useAutoGit` consumes them to schedule automatic checkpoints, while `useCommitFlow` and the status bar quick action reuse the same checkpoint runner and deterministic automatic commit message generation.
 
 ## Telemetry
 
@@ -800,6 +827,7 @@ Managed by `useSettings` hook and `SettingsPanel` component. `theme_mode` is ins
 ### Product Events
 - **File previews** — `file_preview_opened`, `file_preview_action`, and `file_preview_failed` report only preview/action categories such as `image`, `pdf`, `unsupported`, `open_external`, `copy_path`, and `reveal`.
 - **Inline image lightbox** — `inline_image_lightbox_opened` records that a rich-editor inline image was opened from double-click, without sending note paths, image URLs, alt text, or file names.
+- **Code block copy** — `code_block_copied` records that the rich-editor code-block copy action was used, without sending note paths, languages, or code content.
 - **AI agent sessions** — `ai_agent_message_sent`, `ai_agent_message_blocked`, `ai_agent_response_completed`, `ai_agent_response_failed`, and `ai_agent_permission_mode_changed` use only agent ids, permission modes, counts, and coarse status categories.
 - **All Notes visibility** — `all_notes_visibility_changed` records only the toggled category and enabled state.
 

docs/ARCHITECTURE.md

@@ -27,6 +27,7 @@ When deciding where to persist a piece of data, ask: **"Would the user want this
 | Per-note `_width` rich-editor width override | Default rich-editor note width |
 | Vault-authored `.gitignore` patterns | Whether this installation hides Gitignored files |
 | Per-vault All Notes note-list column overrides | All Notes PDF/image/unsupported file visibility |
+| Type `_sidebar_label` overrides | Whether this installation auto-pluralizes type labels |
 | Any user-visible customization of how content is organized or displayed | Any machine-specific or credential-type setting |
 
 **Rule:** If the information is about *how the content is structured or presented* and the user would expect it to be consistent wherever they open their vault, store it in the vault (frontmatter of the relevant note, using the `_field` underscore convention for system properties). If it's about *this specific installation of the app*, store it in `~/.config/com.tolaria.app/settings.json` or localStorage.
@@ -38,6 +39,7 @@ Examples:
 - ✅ App settings: `zoom: 1.3` (machine-specific preference)
 - ✅ App settings: `ui_language: "zh-CN"` (installation-specific UI language)
 - ✅ App settings: `note_width_mode: "wide"` (installation-specific default for notes without an override)
+- ✅ App settings: `sidebar_type_pluralization_enabled: false` (installation-specific sidebar label preference)
 - ✅ App settings: `all_notes_show_images: true` (installation-specific All Notes file-category visibility)
 
 ### No hardcoded exceptions
@@ -115,6 +117,7 @@ The note list opportunistically preloads visible and adjacent markdown/text entr
 | Editor | BlockNote | 0.46.2 |
 | Code block highlighting | @blocknote/code-block | 0.46.2 |
 | Diagram rendering | Mermaid | 11.14.0 |
+| Whiteboard rendering | tldraw | 4.5.10 |
 | Raw editor | CodeMirror 6 | - |
 | Styling | Tailwind CSS v4 + CSS variables | 4.1.18 |
 | UI primitives | Radix UI + shadcn/ui | - |
@@ -141,7 +144,7 @@ flowchart TD
             SB["Sidebar\n(navigation + filters + types)"]
             NL["NoteList / PulseView\n(filtered list / activity)"]
             ED["Editor\n(BlockNote + diff + raw)"]
-            IN["Inspector\n(metadata + relationships)"]
+            IN["Right Panel\n(Inspector + TOC)"]
             AIP["AiPanel\n(selected CLI agent + tools)"]
             SP["SearchPanel\n(keyword search)"]
             ST["StatusBar\n(vault picker + sync + version)"]
@@ -184,10 +187,10 @@ flowchart TD
 
 ```
 ┌────────┬─────────────┬─────────────────────────┬────────────┐
-│Sidebar │ Note List   │ Editor                  │ Inspector  │
+│Sidebar │ Note List   │ Editor                  │ Right Panel│
 │(250px) │ (300px)     │ (flex-1)                │ (280px)    │
 │        │ OR          │                         │ OR         │
-│ All    │ Pulse View  │ [Breadcrumb Bar]        │ AI Chat    │
+│ All    │ Pulse View  │ [Breadcrumb Bar]        │ TOC        │
 │ Changes│             │                         │ OR         │
 │ Pulse  │ [Search]    │ # My Note               │ AI Agent   │
 │ Inbox  │ [Sort/Filt] │                         │            │
@@ -204,20 +207,20 @@ flowchart TD
 ```
 
 - **Sidebar** (220-400px, resizable): Top-level filters (All Notes, Changes, Pulse), saved Views, collapsible type-based section groups, and a dedicated folder tree. The folder tree starts with a vault-root row labeled from the opened vault path, shows root-level files when selected, and nests user-created folders plus default vault folders such as `attachments/` and `views/` underneath it; only the dedicated `type/` directory stays hidden because note types already have their own sidebar section. Saved Views persist a top-level YAML `order` field in each view file and use the same ordered-list mental model as Types: pointer users can drag the existing view row, double-click to rename it, or right-click for edit/rename/appearance/delete actions, while keyboard users can use the row context key for the same menu and command-palette move actions for ordering. The folder tree supports inline folder creation and rename, exposes a right-click menu for rename/delete plus filesystem reveal/copy-path actions on mutable folders, and auto-expands ancestor folders when the current selection or rename target is nested. Type sections and folder rows also act as note drop targets: dropping a note on a type updates its `type:` frontmatter, while dropping it on a folder runs the same crash-safe move path as the command palette flow. Each type can have a custom icon, color, sort, and visibility set via its `type: Type` document; new type documents created by Tolaria are written at the vault root.
-- **Note List / Pulse View** (220-500px, resizable): When a section group, filter, or saved view is selected, shows filtered notes with snippets, modified dates, status indicators, and per-context note-list controls. When `selection.kind === 'entity'`, the same pane enters **Neighborhood** mode: the source note is pinned at the top as a normal active row, outgoing relationship groups render first, inverse/backlink groups follow, empty groups stay visible with `0`, and duplicates across groups are allowed when multiple relationships are true. Plain click / `Enter` open the focused note without replacing the current Neighborhood, while Cmd/Ctrl-click and Cmd/Ctrl-`Enter` pivot the pane into the clicked note's Neighborhood. Folder-backed lists also show non-Markdown files: previewable image and PDF binaries get file indicators and open in the editor pane, while unsupported binaries remain muted instead of auto-launching an external app. Saved views reuse the same sort and visible-column controls as the built-in lists, and those changes persist back into the view `.yml` definition (`sort`, `listPropertiesDisplay`). When Pulse filter is active, shows `PulseView` — a chronological git activity feed grouped by day.
-- **Editor** (flex, fills remaining space): Single note open at a time (no tabs — see ADR-0003). Breadcrumb bar with word count and rich-editor width toggle, BlockNote rich text editor with wikilink support, Markdown-compatible inline/display math rendering, first-class Mermaid diagram blocks, markdown-safe formatting controls, and schema-backed fenced code block highlighting via `@blocknote/code-block`. Can toggle to diff view (modified files), raw CodeMirror view, or a wide rich-editor reading surface with preserved side margins; raw CodeMirror remains full-width and unaffected by note width mode. Inline rich-editor images open in a localized shadcn lightbox on double-click while normal single-click BlockNote selection remains untouched, and tiny tracking-style images are ignored. Binary image and PDF files render through `FilePreview` as ordinary vault files using Tauri asset URLs; external-open actions call `open_vault_file_external` so the target is validated against the active vault before the native default app opens it. Unsupported/broken binaries show explicit fallback states and keyboard focus returns to the note list on `Escape`. Decomposed into `Editor` (orchestrator), `EditorContent`, `FilePreview`, `EditorRightPanel`, `SingleEditorView`, with hooks `useDiffMode`, `useEditorFocus`, and `useEditorSave`, plus the `useRawMode`/`RawEditorView` pair for markdown source editing. Rich BlockNote input and raw CodeMirror input both route typed `->`, `<-`, and `<->` through the shared `src/utils/arrowLigatures.ts` resolver so arrow ligatures stay consistent across mode switches while escaped ASCII sequences remain literal. Navigation history (Cmd+[/]) replaces tabs.
-- **Inspector / AI Agent** (200-500px or 40px collapsed): Toggles between Inspector (frontmatter, relationships, instances, backlinks, git history) and AI Agent panel (the selected CLI agent with tool execution). The Sparkle icon in the breadcrumb bar toggles between them. Per-note `icon` is a suggested Inspector property and the command palette's "Set Note Icon" action opens that field directly. When viewing a Type note, the Inspector shows an **Instances** section listing all notes of that type (sorted by modified_at desc, capped at 50).
+- **Note List / Pulse View** (220-500px, resizable): When a section group, filter, or saved view is selected, shows filtered notes with snippets, modified dates, status indicators, and per-context note-list controls. When `selection.kind === 'entity'`, the same pane enters **Neighborhood** mode: the source note is pinned at the top as a normal active row, outgoing relationship groups render first, inverse/backlink groups follow, empty groups stay visible with `0`, and duplicates across groups are allowed when multiple relationships are true. Plain click / `Enter` open the focused note without replacing the current Neighborhood, while Cmd/Ctrl-click and Cmd/Ctrl-`Enter` pivot the pane into the clicked note's Neighborhood. Folder-backed lists also show non-Markdown files: previewable media and PDF binaries get file indicators and open in the editor pane, while unsupported binaries remain muted instead of auto-launching an external app. Saved views reuse the same sort and visible-column controls as the built-in lists, and those changes persist back into the view `.yml` definition (`sort`, `listPropertiesDisplay`). When Pulse filter is active, shows `PulseView` — a chronological git activity feed grouped by day.
+- **Editor** (flex, fills remaining space): Single note open at a time (no tabs — see ADR-0003). Breadcrumb bar with word count, rich-editor width toggle, and the secondary-overflow Table of Contents action, BlockNote rich text editor with wikilink support, Markdown-compatible inline/display math rendering, first-class Mermaid diagram blocks, markdown-safe formatting controls, and schema-backed fenced code block highlighting via `@blocknote/code-block`. Can toggle to diff view (modified files), raw CodeMirror view, or a wide rich-editor reading surface with preserved side margins; raw CodeMirror remains full-width and unaffected by note width mode. Inline rich-editor images open in a localized shadcn lightbox on double-click while normal single-click BlockNote selection remains untouched, and tiny tracking-style images are ignored. Binary image, audio, video, and PDF files render through `FilePreview` as ordinary vault files using Tauri asset URLs; editor-embedded audio and video use the same scoped asset sources through the CSP `media-src` allow-list. External-open actions call `open_vault_file_external` so the target is validated against the active vault before the native default app opens it. Unsupported/broken binaries show explicit fallback states and keyboard focus returns to the note list on `Escape`. Decomposed into `Editor` (orchestrator), `EditorContent`, `FilePreview`, `EditorRightPanel`, `TableOfContentsPanel`, `SingleEditorView`, with hooks `useDiffMode`, `useEditorFocus`, and `useEditorSave`, plus the `useRawMode`/`RawEditorView` pair for markdown source editing. Rich BlockNote input and raw CodeMirror input both route typed `->`, `<-`, and `<->` through the shared `src/utils/arrowLigatures.ts` resolver so arrow ligatures stay consistent across mode switches while escaped ASCII sequences remain literal. Navigation history (Cmd+[/]) replaces tabs.
+- **Right side panels** (200-500px or hidden): Properties, Table of Contents, and AI Agent are mutually exclusive panels mounted by `EditorRightPanel` and coordinated by `useRightPanelExclusion`. Properties shows frontmatter, relationships, instances, backlinks, and git history; Table of Contents is lazy-mounted only while open, derives a title-rooted H1/H2/H3 hierarchy through a debounced Web Worker per ADR-0109, and reuses folder-tree indentation/guide geometry with heading icons while resolving live BlockNote block IDs at click time for navigation; AI Agent keeps the selected CLI/API target controller mounted for tool execution and chat state. The breadcrumb bar toggles Table of Contents, AI, and Properties actions, and opening one replaces the others. Per-note `icon` is a suggested Properties field and the command palette's "Set Note Icon" action opens that field directly. When viewing a Type note, Properties shows an **Instances** section listing all notes of that type (sorted by modified_at desc, capped at 50).
 
 Panels are separated by `ResizeHandle` components that support drag-to-resize. `useLayoutPanels` clamps the sidebar, note-list, and inspector widths before applying them, keeps the side panes from flex-shrinking below their protected widths, and persists the last chosen widths in installation-local localStorage under `tolaria:layout-panels`.
 
-The main Tauri window derives its minimum width from the visible panes instead of a single fixed floor. `useMainWindowSizeConstraints` treats the editor-only shell as the 480px baseline, adds the current sidebar / note-list / expanded-inspector widths on top with minimum floors, and calls the native `update_current_window_min_size` command whenever view mode, inspector visibility, or restored pane widths change. That same native command also grows the current window back out when a wider pane combination is restored, while note windows skip this path and keep their dedicated 800×700 initial sizing.
+The main Tauri window derives its minimum width from the visible panes instead of a single fixed floor. `useMainWindowSizeConstraints` treats the editor-only shell as the 480px baseline, adds the current sidebar / note-list / expanded-inspector widths on top with minimum floors, and calls the native `update_current_window_min_size` command whenever view mode, inspector visibility, or restored pane widths change. That same native command can grow the current window back out when a wider pane combination is restored, but Windows keeps grow-to-fit disabled so opening or closing the Properties panel does not unmaximize or reposition the main window. Note windows skip this path and keep their dedicated 800×700 initial sizing.
 
 The main Tauri window also persists its last normal size and screen position in the app config directory as `window-state.json`. The state stores logical window points, while `window_state.rs` migrates older physical-pixel state on read so Retina and non-Retina launches restore the same user-facing bounds. On startup, the restored frame applies only to the main window and clamps to the currently available monitor work areas, so stale coordinates from a disconnected display fall back to a visible placement. Maximized, fullscreen, minimized, and detached note-window frames are not written as the restore baseline.
 
 Tauri setup keeps launch-time filesystem and subprocess work off the window creation critical path. Legacy `~/Laputa` housekeeping and the initial persisted-vault MCP bridge sync run on named background threads, so large legacy vaults, stale active-vault paths, or slow process startup cannot beachball the macOS app before React mounts. React still resyncs the bridge from `useVaultSwitcher` after the persisted selection loads, and no selected vault stops the bridge. The HTML bootstrap also installs a Tauri-only one-shot watchdog: React reports readiness from an effect after the root commits, and if that readiness signal never arrives the WebView reloads once instead of leaving macOS users in an inert rendered shell.
 
-Linux uses custom React-rendered window chrome instead of the native Tauri menu bar. `setup_linux_window_chrome()` drops server-side decorations on the main window, `openNoteInNewWindow()` does the same for detached note windows, and `LinuxTitlebar`/`LinuxMenuButton` route both window controls and menu actions back through the same shared command pipeline that the desktop native menus use. The native app menu keeps macOS-only Services/Hide entries off Windows and Linux, while cross-platform custom items such as Check for Updates emit Tolaria command IDs and show visible updater feedback.
-When Tolaria is launched from a Linux AppImage, `run()` also applies AppImage-only WebKitGTK startup safeguards without changing native package installs. It injects `WEBKIT_DISABLE_DMABUF_RENDERER=1` and `WEBKIT_DISABLE_COMPOSITING_MODE=1` independently unless the user already set either variable, and on Wayland sessions it re-execs once with the first architecture-matching system `libwayland-client.so` in `LD_PRELOAD` when the user has not provided their own preload. The candidate order prefers Fedora-style `lib64` and Debian-style `x86_64-linux-gnu` paths before generic `/usr/lib`, and the ELF header is checked so a 64-bit Tolaria process does not retry with a 32-bit Wayland client library. The rendering overrides keep AppImage WebViews from blanking after accelerated compositing/DMA-BUF failures, while the re-exec addresses AppImage library-order failures that can surface as `Could not create default EGL display: EGL_BAD_PARAMETER` before GTK/WebKit create the display.
+Linux uses custom React-rendered window chrome instead of the native Tauri menu bar. `setup_linux_window_chrome()` drops server-side decorations on the main window, `openNoteInNewWindow()` does the same for detached note windows, and `LinuxTitlebar`/`LinuxMenuButton` route both window controls and menu actions back through the same shared command pipeline that the desktop native menus use. The native app menu keeps macOS-only Services/Hide entries off Windows and Linux, registers a window-scoped menu event handler on Windows where Tauri delivers menu clicks through the main `WebviewWindow`, and cross-platform custom items such as Check for Updates emit Tolaria command IDs with visible updater feedback.
+When Tolaria is launched from a Linux AppImage, `run()` also applies AppImage-only WebKitGTK startup safeguards without changing native package installs. It injects `WEBKIT_DISABLE_DMABUF_RENDERER=1` and `WEBKIT_DISABLE_COMPOSITING_MODE=1` independently unless the user already set either variable, and on Wayland sessions it re-execs once with the first architecture-matching system `libwayland-client.so` in `LD_PRELOAD` when the user has not provided their own preload. The candidate order prefers Fedora-style `lib64` and Debian-style `x86_64-linux-gnu` paths before generic `/usr/lib`, and the ELF header is checked so a 64-bit Tolaria process does not retry with a 32-bit Wayland client library. If an AppImage Wayland session advertises fcitx through common input-method environment hints and the user has not already chosen `GTK_IM_MODULE`, Tolaria sets `GTK_IM_MODULE=fcitx` before WebKit starts so GTK/WebKit input contexts reach fcitx5 on compositors that do not reliably provide the Wayland input method frontend. The same AppImage path checks whether `fc-match` resolves the default emoji font to `Noto-COLRv1.ttf`; when the user has not provided `FONTCONFIG_FILE` or `FONTCONFIG_PATH`, Tolaria writes a cache-local fontconfig file that rejects only that matched font file and exports it before WebKit starts. The rendering overrides keep AppImage WebViews from blanking after accelerated compositing/DMA-BUF failures, the re-exec addresses AppImage library-order failures that can surface as `Could not create default EGL display: EGL_BAD_PARAMETER`, the fcitx GTK fallback preserves Chinese/Japanese/Korean IME composition for affected AppImage Wayland users, and the fontconfig guard avoids known WebKit crashes in COLRv1 emoji font rendering while leaving other emoji fonts available.
 
 ## Multi-Window (Note Windows)
 
@@ -243,13 +246,13 @@ Notes can be opened in separate Tauri windows for focused editing. Secondary win
 
 Full agent mode — spawns the selected local CLI agent as a subprocess with tool access and MCP vault integration.
 
-1. **Frontend** (`AiPanel` + `useCliAiAgent` + `aiAgentSession.ts` + `aiAgents.ts`) — one normalized session lifecycle for message state, reasoning blocks, tool action cards, response display, onboarding, default-agent selection, and the per-vault Safe / Power User permission mode shown in the panel header
+1. **Frontend** (`AiPanel` + `useCliAiAgent` + `aiAgentSession.ts` + `aiAgents.ts` + `aiTargets.ts`) — one normalized session lifecycle for message state, reasoning blocks, tool action cards, response display, onboarding, default-target selection, and the per-vault Safe / Power User permission mode shown in the panel header for coding agents
 2. **Backend orchestration** (`ai_agents.rs`) — normalizes agent availability, streaming, and the request permission mode before dispatching to per-agent adapters
 3. **Shared runtime scaffold** (`cli_agent_runtime.rs`) — owns the common request shape, prompt wrapping, JSON-line subprocess lifecycle, normalized error/done handling, version probing, and Tolaria MCP server path resolution used by app-managed CLI agents
-4. **Agent adapters** — Shared prompts are mode-aware on every turn, including turns with note context snapshots: Vault Safe tells agents not to use or advertise shell, while Power User tells shell-capable agents to keep local commands scoped to the active vault. Claude Code still uses `claude_cli.rs` with `acceptEdits`, strict Tolaria MCP config, and a scoped tool list: Safe enables file/search/edit tools only, while Power User adds Bash to the available tools and pre-approves Bash with `--allowedTools` without using dangerous bypass flags. Codex runtime specifics live in `codex_cli.rs`; Safe runs `codex --sandbox read-only --ask-for-approval untrusted exec --json`, while Power User runs `codex --sandbox workspace-write --ask-for-approval never exec --json` so shell execution stays enabled across repeated turns. OpenCode runs through `opencode run --format json` with transient permissions: Safe denies bash and external directories, while Power User allows bash but still denies external directories. Pi runs through `pi --mode json --no-session` with `npm:pi-mcp-adapter`; both modes currently share the same transient MCP config and the prompt does not promise shell for Pi Power User. Gemini runs through `gemini --output-format stream-json --prompt` so assistant message chunks, tool calls, and final errors are mapped from the CLI event stream instead of relying on a buffered `response` field. Gemini Safe uses `auto_edit` plus `tools.exclude=["run_shell_command"]`; Power User intentionally uses `yolo` against a trusted transient Tolaria MCP entry. OpenCode, Pi, and Gemini all launch from the active vault cwd with closed stdin and transient MCP config. All app-launched paths use hidden Windows launches and avoid dangerous permission-bypass flags.
-5. **MCP Integration** — Claude receives the generated MCP config file path, Codex receives the same Tolaria MCP server via transient `-c mcp_servers.tolaria.*` config overrides, OpenCode receives it through `OPENCODE_CONFIG_CONTENT`, Pi receives it through a temporary `PI_CODING_AGENT_DIR/mcp.json` consumed by `pi-mcp-adapter`, and Gemini receives it through a temporary settings file pointed at by `GEMINI_CLI_SYSTEM_SETTINGS_PATH`
+4. **Agent adapters** — Shared prompts are mode-aware on every turn, including turns with note context snapshots: Vault Safe tells agents not to use or advertise shell, while Power User tells shell-capable agents to keep local commands scoped to the active vault. Claude Code still uses `claude_cli.rs` with `acceptEdits`, strict Tolaria MCP config, and a scoped tool list: Safe enables file/search/edit tools only, while Power User adds Bash to the available tools and pre-approves Bash with `--allowedTools` without using dangerous bypass flags. Codex runtime specifics live in `codex_cli.rs`; Safe runs `codex --sandbox read-only --ask-for-approval untrusted exec --json`, while Power User runs `codex --sandbox workspace-write --ask-for-approval never exec --json` so shell execution stays enabled across repeated turns. OpenCode runs through `opencode run --format json` with transient permissions: Safe denies bash and external directories, while Power User allows bash but still denies external directories. Pi runs through `pi --mode json --no-session` with `npm:pi-mcp-adapter`; both modes currently share the same transient MCP config and the prompt does not promise shell for Pi Power User. Gemini runs through `gemini --output-format stream-json --prompt` so assistant message chunks, tool calls, and final errors are mapped from the CLI event stream instead of relying on a buffered `response` field. Gemini Safe uses `auto_edit` plus `tools.exclude=["run_shell_command"]`; Power User intentionally uses `yolo` against a trusted transient Tolaria MCP entry. Codex, OpenCode, Pi, and Gemini all launch from the active vault cwd with closed stdin and transient MCP config. All app-launched paths use hidden Windows launches and avoid dangerous permission-bypass flags.
+5. **MCP Integration** — Claude receives the generated MCP config file path, Codex receives the same Tolaria MCP server via transient `-c mcp_servers.tolaria.*` config overrides using Tolaria's resolved Node path plus `VAULT_PATH` and `WS_UI_PORT`, OpenCode receives it through `OPENCODE_CONFIG_CONTENT`, Pi receives it through a temporary `PI_CODING_AGENT_DIR/mcp.json` consumed by `pi-mcp-adapter`, and Gemini receives it through a temporary settings file pointed at by `GEMINI_CLI_SYSTEM_SETTINGS_PATH`
 
-CLI-agent availability intentionally does not depend only on the desktop app's inherited `PATH`. The detectors check the current process path, the user's login shell, and supported local/toolchain install locations such as native `~/.local/bin`, local `~/.claude/local`, Mise/asdf shims, nvm-managed Node installs, npm-global, Homebrew, Windows `%APPDATA%\npm`/pnpm/Scoop shims, Windows `.exe` launchers, and the macOS Codex app resource path so first-run onboarding works on fresh macOS and Windows installs. App-managed CLI spawns also extend the child process `PATH` with the resolved binary directory plus those common toolchain directories, which lets GUI-launched macOS sessions run Homebrew/npm shims and their `node`-backed MCP subprocesses even when Finder/Dock did not inherit a terminal shell path.
+CLI-agent availability intentionally does not depend only on the desktop app's inherited `PATH`. The detectors check the current process path, the user's login shell, and supported local/toolchain install locations such as native `~/.local/bin`, local `~/.claude/local`, Mise/asdf shims, nvm-managed Node installs, npm-global, Homebrew, Windows `%APPDATA%\npm`/pnpm/Scoop shims, Windows `.exe` launchers, and the macOS Codex app resource path so first-run onboarding works on fresh macOS and Windows installs. App-managed CLI spawns also expand the active vault path before using it as the subprocess working directory, then extend the child process `PATH` with the resolved binary directory plus those common toolchain directories, which lets GUI-launched macOS sessions run Homebrew/npm shims and their `node`-backed MCP subprocesses even when Finder/Dock did not inherit a terminal shell path.
 
 #### Agent Event Flow
 
@@ -298,19 +301,25 @@ The agent panel (`ai-context.ts`) builds a structured JSON snapshot from the act
 
 ```json
 {
-  "activeNote": { "path", "title", "type", "frontmatter", "content" },
-  "linkedNotes": [{ "path", "title", "content" }],
-  "openTabs": [{ "title", "snippet" }],
-  "vaultMetadata": { "noteTypes", "stats", "filter" },
-  "references": [{ "title", "path", "type" }]
+  "activeNote": { "path", "title", "type", "frontmatter", "body", "wordCount", "bodyTruncated?" },
+  "openTabs": [{ "path", "title", "type", "frontmatter" }],
+  "noteList": [{ "path", "title", "type" }],
+  "vault": { "types", "totalNotes" },
+  "referencedNotes": [{ "title", "path", "type" }]
 }
 ```
 
-Token budget: 60% of 180k context limit (~108k tokens max). Active note gets priority, then linked notes, then truncation.
+Large active notes are compacted into a head/tail body snapshot before they enter the CLI prompt. The snapshot records `bodyTruncated` metadata and instructs agents to call `get_note(path)` before content-sensitive edits or summaries, keeping lower-context OpenCode providers from failing on oversized active-note context while preserving access to the full note through MCP.
+
+### Direct Model Targets
+
+Tolaria also supports direct model targets for local servers and API providers. These targets are stored as app-level provider metadata and can be selected in Settings or the status bar alongside coding agents. `src/shared/aiModelProviderCatalog.json` is the shared source for provider defaults, local/API grouping, API-key environment placeholders, and runtime fallback base URLs; the renderer imports it through `aiTargets.ts`, and Tauri includes the same JSON in `ai_models.rs`. Direct model targets run in Chat mode: they receive the same note-context snapshot and conversation history, but they do not receive vault-write tools or shell access. The backend `stream_ai_model` command supports OpenAI-compatible chat completions and Anthropic Messages-compatible calls, including Ollama, LM Studio, OpenRouter, OpenAI, Anthropic, Gemini, and custom compatible endpoints.
+
+Provider secrets are not written to `settings.json`. Hosted API targets can use Tolaria's local app-data secrets file (`ai-provider-secrets.json`, outside vaults/worktrees and owner-only on Unix) or reference an environment variable name. Local endpoints can omit authentication.
 
 ### Authentication
 
-Each CLI agent authenticates itself outside Tolaria. Claude Code uses its existing CLI login; Codex surfaces a friendly prompt to run `codex login` when needed; OpenCode surfaces a friendly prompt to run `opencode auth login` or configure a provider when needed; Pi surfaces a friendly prompt to run `pi /login` or configure a provider API key when needed. Tolaria does not store model-provider API keys in app settings.
+Each CLI agent authenticates itself outside Tolaria. Claude Code uses its existing CLI login; Codex surfaces a friendly prompt to run `codex login` when needed; OpenCode surfaces a friendly prompt to run `opencode auth login` or configure a provider when needed; Pi surfaces a friendly prompt to run `pi /login` or configure a provider API key when needed. Tolaria does not store model-provider API keys in app settings; direct provider secrets stay in local app data or user-managed environment variables.
 
 ## MCP Server
 
@@ -350,7 +359,7 @@ Tolaria can register itself as an MCP server in:
 - `~/.cursor/mcp.json` (Cursor)
 - `~/.config/mcp/mcp.json` (generic MCP-compatible clients)
 
-That setup is user-initiated through the status bar / command palette flow, not a startup side effect. Registration is non-destructive (additive, preserves other servers and Gemini settings), uses `upsert` semantics, and can be reversed by removing Tolaria's entry again. Tolaria verifies Node.js is available before writing config, writes an explicit `type: "stdio"` entry, pins `VAULT_PATH` to the active vault, and sets `WS_UI_PORT=9711` so UI actions route back to the desktop app. The same generated entry is exposed as a manual JSON snippet in the MCP setup dialog and through the AI panel copy action, giving users a transparent fallback for MCP-compatible tools Tolaria does not auto-configure. In the desktop app, `useMcpStatus` copies that snippet through the native `copy_text_to_clipboard` command instead of the Web Clipboard API so macOS WKWebView permission policy cannot block setup. Packaged builds resolve `mcp-server/` from the installed resource directory next to the executable before falling back to macOS `Resources`, Linux package roots such as `/usr/local/Tolaria` and `/usr/lib/tolaria`, and AppImage paths. The `useMcpStatus` hook tracks whether the active vault is explicitly connected (`checking | installed | not_installed`) and owns connect, disconnect, exact-snippet load, and copy-to-clipboard actions. Gemini CLI still owns its own install and sign-in; Tolaria writes the durable external MCP entry only on explicit setup, while app-managed Gemini sessions use transient settings and optional vault guidance. The desktop WebSocket bridge is started only when a persisted active vault exists and is resynced from React state on vault changes; no selected vault stops the bridge instead of falling back to `~/Laputa`. Stdio MCP server processes are owned by the external client that launched them: when that client closes stdin, Tolaria cancels UI-bridge reconnect timers, closes any UI WebSocket, and exits the Node process instead of keeping it alive in the background.
+That setup is user-initiated through the status bar / command palette flow, not a startup side effect. Registration is non-destructive (additive, preserves other servers and Gemini settings), uses `upsert` semantics, and can be reversed by removing Tolaria's entry again. Tolaria verifies Node.js is available before writing config, writes an explicit `type: "stdio"` entry, pins `VAULT_PATH` to the active vault, and sets `WS_UI_PORT=9711` so UI actions route back to the desktop app. The same generated entry is exposed as a manual JSON snippet in the MCP setup dialog and through the AI panel copy action, giving users a transparent fallback for MCP-compatible tools Tolaria does not auto-configure. In the desktop app, `useMcpStatus` copies that snippet through the native `copy_text_to_clipboard` command instead of the Web Clipboard API so macOS WKWebView permission policy cannot block setup. Packaged builds resolve `mcp-server/` from the installed resource directory next to the executable before falling back to macOS `Resources`, Linux package roots such as `/usr/local/Tolaria`, `/usr/lib/tolaria`, and `/usr/lib/tolaria/resources`, and AppImage paths. The `useMcpStatus` hook tracks whether the active vault is explicitly connected (`checking | installed | not_installed`) and owns connect, disconnect, exact-snippet load, and copy-to-clipboard actions. Gemini CLI still owns its own install and sign-in; Tolaria writes the durable external MCP entry only on explicit setup, while app-managed Gemini sessions use transient settings and optional vault guidance. The desktop WebSocket bridge is started only when a persisted active vault exists and is resynced from React state on vault changes; no selected vault stops the bridge instead of falling back to `~/Laputa`. Stdio MCP server processes are owned by the external client that launched them: when that client closes stdin, Tolaria cancels UI-bridge reconnect timers, closes any UI WebSocket, and exits the Node process instead of keeping it alive in the background.
 
 ### Architecture
 
@@ -421,7 +430,7 @@ The vault cache (`src-tauri/src/vault/cache.rs`) accelerates vault scanning usin
 
 ### Cache File
 
-`~/.laputa/cache/<vault-hash>.json` — stored outside the vault directory so it never pollutes the user's git repo. The vault path is hashed (via `DefaultHasher`) to produce a deterministic filename. Stores: vault path, git HEAD commit hash, all VaultEntry objects. Version: v13 (bumped on VaultEntry field changes to force full rescan). Cache replacement is best-effort: Tolaria writes a temp file, fsyncs it, and renames it into place only after a short-lived writer lock plus an on-disk fingerprint check confirm another window/process has not already refreshed the cache. Failures are logged and the app falls back to rebuilding from the filesystem.
+`~/.laputa/cache/<vault-hash>.json` — stored outside the vault directory so it never pollutes the user's git repo. The vault path is normalized through `vault/path_identity.rs` before hashing, so macOS `/tmp` aliases and separator variants share the same cache identity. Stores: vault path, git HEAD commit hash, all VaultEntry objects. Version: v13 (bumped on VaultEntry field changes to force full rescan). Cache replacement is best-effort: Tolaria writes a temp file, fsyncs it, and renames it into place only after a short-lived writer lock plus an on-disk fingerprint check confirm another window/process has not already refreshed the cache. Failures are logged and the app falls back to rebuilding from the filesystem.
 
 `<vault>/.tolaria-rename-txn/` — hidden, scan-ignored staging directory for crash-safe note renames. Tolaria stores temporary backup files plus one manifest per in-flight rename here. On the next vault scan, unfinished transactions are recovered before entries are listed so users do not see a missing note or a visible duplicate after a crash.
 
@@ -443,11 +452,11 @@ flowchart TD
 
 ## Styling
 
-The app uses internal app-owned light and dark themes (see [ADR-0081](adr/0081-internal-light-dark-theme-runtime.md)). This is not the old vault-authored theming system from ADR-0013: users choose a mode, but themes are owned by the app.
+The app uses internal app-owned light and dark themes with an optional System preference (see [ADR-0081](adr/0081-internal-light-dark-theme-runtime.md) and [ADR-0112](adr/0112-system-theme-mode.md)). This is not the old vault-authored theming system from ADR-0013: users choose a mode, but themes are owned by the app.
 
 1. **Global CSS variables** (`src/index.css`): Semantic app colors, borders, surfaces, and interaction states. Bridged to Tailwind v4 via `@theme inline`.
 2. **Editor theme** (`src/theme.json`): BlockNote-specific typography. Flattened to CSS vars by `useEditorTheme`; editor colors resolve through the same semantic app variables.
-3. **Theme runtime**: Applies `data-theme` and the shadcn-compatible `.dark` class before React consumers render, with a localStorage mirror to avoid startup flash when dark mode is selected. Settings and command-palette theme actions both write the same installation-local `settings.theme_mode` value.
+3. **Theme runtime**: Applies resolved `light` / `dark` values to `data-theme` and the shadcn-compatible `.dark` class before React consumers render, with a localStorage mirror to avoid startup flash when dark mode or System-on-dark is selected. Settings and command-palette theme actions both write the same installation-local `settings.theme_mode` value; `system` subscribes to `prefers-color-scheme` changes at runtime while explicit Light/Dark remain overrides.
 
 ## Localization
 
@@ -490,6 +499,8 @@ On first launch, `useOnboarding` checks if the default vault exists. If not, it
 - **Open an existing folder** → system file picker; plain Markdown folders without `.git` open immediately in supported non-git mode
 - **Get started with a template** → pick a parent folder, then call `create_getting_started_vault()` with the derived `.../Getting Started` child path so the cloned vault opens into the populated repo root immediately
 
+If the selected vault disappears after startup, `useVaultLoader` re-checks `check_vault_exists` when reloads or vault-derived surfaces fail. A confirmed missing path clears cached entries, folders, views, modified-file state, and prefetched note content, then `App` reuses the `vault-missing` `WelcomeScreen` state so note and view actions cannot keep targeting the stale active vault.
+
 When an opened folder is not yet a git repo, Tolaria shows a dismissible Git setup dialog and a persistent `Git disabled` status-bar warning. Markdown scanning, note browsing, note editing, and search continue normally. Git-dependent surfaces (history, changes, commit, sync, conflict resolution, remotes, AutoGit, and auto-sync) stay unavailable until the user explicitly initializes Git from the dialog, the status-bar warning, or the `Initialize Git for Current Vault` command-palette action.
 
 When the user enables Git later, `init_git_repo` runs `git init`, ensures Tolaria's default `.gitignore`, stages the vault, and writes the initial `Initial vault setup` commit. Before app-managed setup and remote-connection commits, Tolaria ensures the vault has local `user.name` / `user.email` values, falling back to `Tolaria <vault@tolaria.md>` when the vault has no local Git identity yet. That app-managed setup commit explicitly disables commit signing for the single command so inherited global or local `commit.gpgsign` preferences cannot strand onboarding when GPG is missing or misconfigured. Later `git_commit` calls honor the user's signing configuration first, then retry the same app-managed commit once with `commit.gpgsign=false` only when Git reports a signing-helper failure, so working GPG/SSH signing setups continue to sign while broken GPG setups do not create repeated opaque commit failures.
@@ -556,6 +567,11 @@ sequenceDiagram
         VL->>T: invoke('reload_vault') → allow requested vault roots in asset scope + scan_vault_cached()
         T-->>VL: VaultEntry[]
         VL->>T: invoke('get_modified_files')
+        alt Runtime vault path disappears
+            VL->>T: invoke('check_vault_exists')
+            VL-->>A: unavailable vault path + cleared stale state
+            A-->>U: WelcomeScreen (vault missing)
+        end
         A->>T: useMcpStatus — check explicit MCP setup state
         A->>T: sync_mcp_bridge_vault(selected path)
         VL-->>A: entries ready
@@ -565,9 +581,10 @@ sequenceDiagram
     A->>T: invoke('get_note_content')
     T-->>A: raw markdown
     A->>A: splitFrontmatter → [yaml, body]
+    A->>A: preProcessDurableEditorMarkdown(body)
     A->>A: preProcessWikilinks(body)
     A->>A: tryParseMarkdownToBlocks()
-    A->>A: injectWikilinks(blocks)
+    A->>A: injectWikilinks + injectDurableEditorMarkdownBlocks(blocks)
     A-->>U: Editor renders note
 ```
 
@@ -855,7 +872,7 @@ Shortcut routing is explicit:
 - macOS browser-reserved chords such as `Cmd+O`, `Cmd+F`, and `Cmd+Shift+L` are unblocked at webview init via `tauri-plugin-prevent-default`, then continue through the same renderer-first command path
 - `Cmd+Shift+V` uses the same command path for "Paste without Formatting"; `plainTextPaste.ts` reads text through the native clipboard command in Tauri and inserts it through the active rich/raw editor target or the focused browser text control
 - `Cmd+F` is surface-aware: editor focus opens current-note find/replace in raw CodeMirror, note-list focus preserves note-list search, and native menu enablement follows focus availability events so only one `Cmd+F` menu item is active
-- `menu.rs`, `useMenuEvents`, and Linux's `LinuxMenuButton` emit the same manifest-derived command IDs for native menu clicks, accelerators, and custom titlebar menu actions
+- `menu.rs`, `useMenuEvents`, and Linux's `LinuxMenuButton` emit the same manifest-derived command IDs for native menu clicks, accelerators, and custom titlebar menu actions; on Windows, `menu.rs` also listens to main-window menu events because Tauri attaches the native menu to the `WebviewWindow`
 - `appCommandDispatcher.ts` suppresses the paired native-menu/renderer echo from a single shortcut so the command runs once
 - Deterministic QA uses two explicit proof paths from the shared manifest:
   - renderer shortcut-event proof through `window.__laputaTest.triggerShortcutCommand()`

docs/GETTING-STARTED.md

@@ -316,19 +316,19 @@ tolaria/
 
 | File | Why it matters |
 |------|---------------|
-| `src/index.css` | Semantic CSS custom properties for app-owned light/dark themes. |
+| `src/index.css` | Semantic CSS custom properties for app-owned light/dark themes; System mode resolves to one of these at runtime. |
 | `src/theme.json` | Editor-specific typography theme (fonts, headings, lists, code blocks). |
 
 ### Settings & Config
 
 | File | Why it matters |
 |------|---------------|
-| `src/hooks/useSettings.ts` | App settings (telemetry, release channel, theme mode, UI language, auto-sync interval, default AI agent). |
+| `src/hooks/useSettings.ts` | App settings (telemetry, release channel, theme mode, UI language, auto-sync interval, default note width, sidebar type pluralization, default AI agent). |
 | `src/lib/releaseChannel.ts` | Normalizes persisted updater-channel values (`stable` default, optional `alpha`). |
 | `src/lib/appUpdater.ts` | Frontend wrapper for channel-aware updater commands. |
 | `src/hooks/useMainWindowSizeConstraints.ts` | Derives the main-window minimum width from the visible panes and asks Tauri to grow back to fit wider layouts. |
 | `src/hooks/useVaultConfig.ts` | Per-vault local UI preferences (zoom, view mode, colors, Inbox columns, explicit organization workflow, AI permission mode). |
-| `src/components/SettingsPanel.tsx` | Settings UI for telemetry, release channel, sync interval, UI language, default AI agent, and the vault-level explicit organization toggle. |
+| `src/components/SettingsPanel.tsx` | Settings UI for telemetry, release channel, sync interval, UI language, content display preferences, default AI agent, and the vault-level explicit organization toggle. |
 | `src/hooks/useUpdater.ts` | In-app updates using the selected alpha/stable feed. |
 
 ## Architecture Patterns
@@ -364,7 +364,7 @@ type SidebarSelection =
 
 ### Command Registry
 
-`useCommandRegistry` + `useAppCommands` build a centralized command registry. Commands are registered with labels, shortcuts, and handlers. The `CommandPalette` (Cmd+K) fuzzy-searches this registry. Settings commands can update installation-local preferences directly when they reuse an existing settings path, such as the light/dark theme-mode actions writing `settings.theme_mode`. Shortcut combos live in `appCommandCatalog.ts`; real keypresses always flow through `useAppKeyboard`, native menu clicks emit the same command IDs through `useMenuEvents`, and `appCommandDispatcher.ts` suppresses the duplicate native/renderer echo from a single shortcut. Plain-text paste follows this same path: the command owns `Cmd+Shift+V`, the menu and palette expose the same action, and `plainTextPaste.ts` resolves the active rich/raw editor target or focused text control before reading clipboard text. On macOS, any browser-reserved chord that WKWebView swallows before that path must also be added to the narrow `tauri-plugin-prevent-default` registration in `src-tauri/src/lib.rs`. On Linux, `LinuxTitlebar.tsx` and `LinuxMenuButton.tsx` reuse the same command IDs through `trigger_menu_command` because the native GTK menu bar is intentionally not mounted. The same shortcut manifest also declares the deterministic QA mode for each shortcut-capable command.
+`useCommandRegistry` + `useAppCommands` build a centralized command registry. Commands are registered with labels, shortcuts, and handlers. The `CommandPalette` (Cmd+K) fuzzy-searches this registry. Settings commands can update installation-local preferences directly when they reuse an existing settings path, such as the Light/Dark/System theme-mode actions writing `settings.theme_mode`. Shortcut combos live in `appCommandCatalog.ts`; real keypresses always flow through `useAppKeyboard`, native menu clicks emit the same command IDs through `useMenuEvents`, and `appCommandDispatcher.ts` suppresses the duplicate native/renderer echo from a single shortcut. Plain-text paste follows this same path: the command owns `Cmd+Shift+V`, the menu and palette expose the same action, and `plainTextPaste.ts` resolves the active rich/raw editor target or focused text control before reading clipboard text. On macOS, any browser-reserved chord that WKWebView swallows before that path must also be added to the narrow `tauri-plugin-prevent-default` registration in `src-tauri/src/lib.rs`. On Windows, native menu clicks arrive from the main `WebviewWindow`, so `src-tauri/src/menu.rs` must keep its window-scoped menu event handler in addition to the app-level handler. On Linux, `LinuxTitlebar.tsx` and `LinuxMenuButton.tsx` reuse the same command IDs through `trigger_menu_command` because the native GTK menu bar is intentionally not mounted. The same shortcut manifest also declares the deterministic QA mode for each shortcut-capable command.
 
 Commands whose availability depends on the current note or Git state must also flow through `update_menu_state` so the native menu stays in sync with the command palette. The deleted-note restore action in Changes view is the reference example: the row opens a deleted diff preview, the command palette exposes "Restore Deleted Note", and the Note menu enables the same action only while that preview is active.
 
@@ -449,7 +449,7 @@ BASE_URL="http://localhost:5173" npx playwright test tests/smoke/<slug>.spec.ts
 
 ### Work with external MCP setup
 
-1. **Backend registration/status/snippets**: Edit `src-tauri/src/mcp.rs`; registration and manual config generation must verify Node.js first, resolve the packaged `mcp-server/` for macOS, Windows, Linux package roots (`/usr/local/Tolaria`, `/usr/local/lib/tolaria`, `/usr/lib/tolaria`), and AppImage installs, and use an explicit stdio entry with `VAULT_PATH` plus `WS_UI_PORT=9711`
+1. **Backend registration/status/snippets**: Edit `src-tauri/src/mcp.rs`; registration and manual config generation must verify Node.js first, resolve the packaged `mcp-server/` for macOS, Windows, Linux package roots (`/usr/local/Tolaria`, `/usr/local/lib/tolaria`, `/usr/lib/tolaria`, `/usr/lib/tolaria/resources`), and AppImage installs, and use an explicit stdio entry with `VAULT_PATH` plus `WS_UI_PORT=9711`
 2. **Setup dialog copy/actions**: Edit `src/components/McpSetupDialog.tsx` and `src/hooks/useMcpStatus.ts`; users should see the Node.js prerequisite, the exact generated manual config, and a copy action before Tolaria writes third-party config files
 3. **Status hook/toasts**: Edit `src/hooks/useMcpStatus.ts` when setup, reconnect, disconnect, or failure messaging changes
 4. **Gemini CLI compatibility**: Keep `~/.gemini/settings.json` in the registration path list and keep optional `GEMINI.md` generation behind `restore_vault_ai_guidance`; app-managed Gemini sessions still require the user to install and sign in to Gemini CLI, but Tolaria supplies transient MCP settings when Gemini is selected as the default AI agent

docs/adr/0071-external-vault-refresh-and-clean-tab-reopen.md

@@ -2,8 +2,9 @@
 type: ADR
 id: "0071"
 title: "External vault updates reload derived state and reopen the clean active note"
-status: active
+status: superseded
 date: 2026-04-21
+superseded_by: "0111"
 ---
 
 ## Context

docs/adr/0098-in-app-image-and-pdf-file-previews.md

@@ -2,9 +2,10 @@
 type: ADR
 id: "0098"
 title: "In-app image and PDF previews for binary vault files"
-status: active
+status: superseded
 date: 2026-04-29
 supersedes: "0086"
+superseded_by: "0110"
 ---
 
 ## Context

docs/adr/0107-markdown-durable-tldraw-whiteboards.md

@@ -0,0 +1,43 @@
+---
+type: ADR
+id: "0107"
+title: "Markdown-durable tldraw whiteboards in notes"
+status: active
+date: 2026-05-03
+---
+
+## Context
+
+Tolaria notes are durable Markdown files, while whiteboard editing needs an interactive canvas with structured shape data. tldraw provides a mature React whiteboard runtime and exposes snapshot APIs that can persist the document without using browser-local `persistenceKey` storage.
+
+The storage decision needs to preserve Tolaria's filesystem source-of-truth rule: deleting local caches must not lose a board, raw mode must expose the canonical source, and Git should track the board together with the surrounding note.
+
+## Decision
+
+**Tolaria will support whiteboards as Markdown-durable fenced `tldraw` blocks backed by tldraw document snapshots.**
+
+The implementation:
+
+- Converts fenced `tldraw` blocks into temporary placeholders before BlockNote parses Markdown.
+- Replaces those placeholders with `tldrawBlock` schema blocks that store a stable board id and tldraw document snapshot JSON.
+- Renders each block with the `tldraw` package inside the rich editor.
+- Debounces tldraw document changes into BlockNote block props so Tolaria's normal autosave writes the snapshot into the `.md` file.
+- Serializes `tldrawBlock` nodes back to fenced Markdown before save, raw-mode entry, and editor-position snapshots.
+- Adds a `/whiteboard` slash command that inserts the same block format.
+
+Session state such as camera position, selected shapes, and selected tools is not persisted into the note. Preview images are intentionally omitted from the initial design; they may be introduced later as derived cache artifacts for note lists, search results, or graph cards.
+
+## Options considered
+
+- **Markdown fenced block with tldraw document snapshot** (chosen): keeps the board in the note file, matches Tolaria's Mermaid/math round-trip model, and works for both full whiteboard notes and embedded boards inside larger notes.
+- **tldraw `persistenceKey` / IndexedDB**: simplest app integration, but violates the vault-as-source-of-truth rule and would lose boards when browser storage is cleared.
+- **Separate `.tldr` files embedded from Markdown**: keeps JSON out of prose notes, but fragments note ownership, makes embedded boards harder to move with their parent note, and complicates Git history for small board edits.
+- **Preview-image-first storage**: useful for thumbnails, but not editable source. It would make the PNG an attractive but stale source of truth.
+
+## Consequences
+
+- `src/utils/tldrawMarkdown.ts` is the canonical parser/serializer bridge for whiteboard blocks.
+- `src/components/TldrawWhiteboard.tsx` owns the tldraw runtime integration and only persists document snapshots.
+- Raw mode remains a direct source editor for the fenced JSON.
+- Embedded whiteboards and future full-note whiteboard templates share the same storage format.
+- Asset support is deferred; when added, asset bytes should live in vault-relative attachment paths referenced from the tldraw asset records.

docs/adr/0108-direct-model-ai-targets.md

@@ -0,0 +1,30 @@
+---
+type: ADR
+id: "0108"
+title: "Direct model AI targets alongside coding agents"
+status: active
+date: 2026-05-03
+---
+
+## Context
+
+Tolaria's AI panel originally targeted desktop coding-agent CLIs only. That works well for tool-capable vault editing, but it excludes users who run local model servers, users who prefer OpenAI or Anthropic APIs, and future mobile builds where desktop subprocesses cannot run.
+
+## Decision
+
+**Tolaria models AI selection as an AI target.** Targets can be desktop coding agents or direct model endpoints. Coding agents keep the existing Safe / Power User permission modes and tool access. Direct model targets run in Chat mode: they receive note context and conversation history, but they do not get vault-write tools or shell access.
+
+Direct model provider metadata is stored in app settings. Provider API secrets are not stored in settings; hosted providers can either save a key in Tolaria's local app-data secrets file or read a key from a named environment variable. The local secrets file is outside the vault, outside project worktrees, and written with owner-only file permissions on Unix platforms. Local providers such as Ollama and LM Studio can run without a key.
+
+## Options Considered
+
+- **AI target abstraction** (chosen): supports agents, local models, hosted APIs, and mobile-compatible model runtimes without pretending all AI backends have the same capabilities.
+- **Treat custom providers as OpenCode configuration only**: lower implementation cost on desktop, but does not help mobile and keeps API users dependent on a coding-agent install.
+- **Direct API runtime with write tools immediately**: powerful, but would require Tolaria-owned tool loops, confirmations, retries, and safety semantics before the basic chat value is proven.
+
+## Consequences
+
+- Settings owns durable provider setup and default target selection.
+- The status bar becomes a quick target switcher across agents and configured model targets.
+- The AI panel explains capability differences: agents show Safe / Power User; direct model targets show Chat mode.
+- Future work can migrate local secrets to OS keychain storage and add read/write tool loops without changing the top-level target model.

docs/adr/0108-sanitized-rendered-markup-and-safe-regex.md

@@ -0,0 +1,25 @@
+# 0108. Sanitized Rendered Markup and Safe User Regex
+
+Date: 2026-05-03
+
+## Status
+
+Accepted
+
+## Context
+
+Tolaria renders generated SVG/HTML from trusted libraries such as Mermaid and KaTeX, and it allows users to opt into regex matching in filters and editor find/replace. Codacy SRM flagged the raw markup insertion and direct regex construction as Critical XSS/DoS risks.
+
+## Decision
+
+Add direct runtime dependencies on `dompurify` and `safe-regex2`.
+
+Rendered Mermaid SVG and KaTeX HTML must be sanitized before insertion and mounted through DOM nodes rather than React `dangerouslySetInnerHTML`. User-provided regex sources must be length-bounded and checked with `safe-regex2` before compilation.
+
+SCA-reported vulnerable transitive dependencies are pinned through package-manager overrides so Codacy resolves patched floors until upstream dependencies adopt them naturally. This includes `protobufjs`, the MCP SDK web-server stack, and Vite's parser/build transitive stack. Rust lockfile-only updates keep OpenSSL, rustls-webpki, and tar on patched versions without changing public Tauri APIs.
+
+## Consequences
+
+Markup rendering now has an explicit sanitizer boundary that is shared by Mermaid and math rendering. User regex features remain available, but unsafe or overly large expressions fail validation instead of running in the UI thread.
+
+The overrides should be removed once the dependency graph no longer pulls the vulnerable versions.

docs/adr/0109-debounced-worker-derived-editor-indexes.md

@@ -0,0 +1,32 @@
+---
+type: ADR
+id: "0109"
+title: "Debounced worker-derived editor indexes"
+status: active
+date: 2026-05-04
+---
+
+## Context
+
+Right side panels can need derived indexes of the active note, such as the Table of Contents hierarchy. These indexes are useful while editing, but rebuilding them synchronously during note opening or on every keystroke competes with the editor's main-thread work and violates ADR-0105's responsiveness contract.
+
+The Table of Contents also needs live BlockNote block IDs for navigation, while the fastest and most stable source for the outline itself is the active note's Markdown content. Binding the outline rebuild directly to BlockNote document mutations makes typing and note swaps more expensive than necessary.
+
+## Decision
+
+**Derived editor indexes that are not required for the editor surface itself must be lazy, debounced, and built off the main thread when they can be derived from Markdown.** The Table of Contents does not build while its panel is closed; once opened, it uses a Web Worker to build its Markdown-derived H1/H2/H3 tree after a debounce, while live BlockNote block IDs are resolved only at click time for navigation.
+
+## Options considered
+
+- **Lazy debounced Web Worker for Markdown-derived indexes** (chosen): avoids any TOC work while the panel is closed, keeps outline parsing away from typing and note-opening work once opened, cancels stale panel updates, and lets the rendered editor remain the only editor surface. Cons: adds a small worker/client path and a title-only interim state.
+- **Main-thread deferred rebuild with `setTimeout`**: avoids blocking the first render, but still runs on the UI thread and can still rebuild too often during active edits.
+- **Synchronous rebuild from the BlockNote document**: simplest and gives immediate block IDs, but makes every BlockNote document update a potential side-panel rebuild.
+- **Never update the TOC while editing**: safest for typing performance, but stale outlines make the panel misleading for active authoring.
+
+## Consequences
+
+- TOC tree state is driven by note identity plus debounced Markdown content, not by BlockNote document churn.
+- Closing the TOC panel unmounts the panel and cancels pending debounce callbacks; no worker request is scheduled while the panel is closed.
+- The TOC may briefly show only the note title after a note switch or edit burst; the full tree appears when the debounced worker result returns.
+- Navigation remains tied to the live editor: block IDs are resolved from the current BlockNote document at click time and scrolled/focused then.
+- Future derived side-panel indexes should follow the same pattern when they parse or scan note content and are not needed to render the editor itself.

docs/adr/0110-in-app-media-and-pdf-file-previews.md

@@ -0,0 +1,43 @@
+---
+type: ADR
+id: "0110"
+title: "In-app media and PDF previews for binary vault files"
+status: active
+date: 2026-05-05
+supersedes: "0098"
+---
+
+## Context
+
+ADR-0098 extended Tolaria's file-first preview model from images to PDFs while keeping binary files as ordinary `VaultEntry` records. In practice, vaults also carry voice notes, interview recordings, screen captures, and short clips that users need to inspect in context without round-tripping through another app.
+
+The existing binary preview architecture already had the important constraints in place:
+
+- previewability should stay a renderer concern inferred from filename extension rather than a persisted schema field
+- preview access should stay inside Tauri's scoped asset protocol instead of broad filesystem reads
+- external-open actions must still re-enter the active-vault command boundary before delegating to the OS
+
+Audio and video support should extend that same model rather than introducing a separate asset or media subsystem.
+
+## Decision
+
+**Tolaria previews supported image, audio, video, and PDF files in the editor pane while keeping them as ordinary binary vault files.**
+
+- The scanner keeps the coarse `fileKind: "binary"` representation; `src/utils/filePreview.ts` infers preview support from safe extension allow-lists.
+- `FilePreview` remains the single renderer-owned preview surface for supported binary files.
+- Images continue to render through `<img>`, PDFs through the webview PDF object renderer, and audio/video through native HTML media controls, all backed by Tauri asset URLs from `convertFileSrc`.
+- The Tauri CSP must allow scoped asset URLs in `media-src` for audio/video and in `object-src` for PDFs without broadening script or network permissions.
+- Note-list rows for previewable media stay clickable and use file-specific affordances; unsupported binaries remain ordinary files with explicit fallback/open-external paths.
+
+## Alternatives considered
+
+- **Extend the existing FilePreview model to media** (chosen): keeps one binary-preview surface, reuses scoped asset access, and avoids new persisted file categories. Cons: native media controls are intentionally minimal.
+- **Open audio and video only in the default app**: simpler implementation, but breaks in-context review for media-heavy vaults.
+- **Introduce dedicated persisted media file kinds or a separate media library**: could support richer metadata later, but adds schema and scanner complexity for files that should remain normal vault entries.
+
+## Consequences
+
+- Audio and video do not become notes and do not get special persistence semantics.
+- Tolaria's binary preview surface now covers the common safe media formats without changing cache shape, scanner output, or the filesystem-first model.
+- Scoped runtime asset access and active-vault command validation remain the security boundary for binary previews and external-open actions.
+- Re-evaluate this decision if Tolaria later needs editing, waveform/timeline tooling, subtitles, or transcoding, because those would justify a richer media-specific subsystem.

docs/adr/0111-path-aware-external-vault-refresh-with-focused-editor-preservation.md

@@ -0,0 +1,49 @@
+---
+type: ADR
+id: "0111"
+title: "Path-aware external vault refresh with focused-editor preservation"
+status: active
+date: 2026-05-05
+supersedes: "0071"
+---
+
+## Context
+
+ADR-0071 established a shared reconciliation path for external vault mutations so git pulls, AI-agent writes, and other non-local edits would reload vault-derived state and protect unsaved local changes. That policy was directionally right, but the original "reopen the clean active note" rule was too broad once Tolaria added a native filesystem watcher and more editor-mounted integrations.
+
+Two problems emerged:
+
+- unrelated external updates could remount a clean active editor even when the active file itself did not change
+- remounting while focus was inside the rich or raw editor surface could drop cursor/focus state and disrupt native input flows even when the vault refresh itself was otherwise safe
+
+Tolaria still needs refreshed entries, folders, views, backlinks, and other derived state after external writes. But it should only pay the cost of an active-editor remount when the changed-path batch actually requires one and the user is not actively focused inside the editor.
+
+## Decision
+
+**External vault refreshes now reload shared vault-derived state eagerly, but only remount the active editor when the active file itself changed and the editor is clean and unfocused.**
+
+The shared `refreshPulledVaultState()` path now applies these rules:
+
+1. Reload vault entries, folders, and saved views together for every external change batch.
+2. If there is no active note, stop after the shared reload.
+3. If the active note changed during the async reload, stop rather than reopening stale context.
+4. If the active note has unsaved local edits, keep the current editor buffer mounted.
+5. If focus is currently inside the rich or raw editor surface, keep that editor mounted even for otherwise clean notes.
+6. If the active file disappeared, close the tab instead of leaving a stale editor behind.
+7. Only close and reopen the active tab when the changed-path batch includes that active file and the previous guards did not apply.
+
+Git pulls, AI-agent refresh callbacks, and filesystem-watcher batches should continue to converge through this single reconciliation helper instead of inventing separate reload policies.
+
+## Alternatives considered
+
+- **Path-aware refresh with focused-editor preservation** (chosen): keeps derived vault state fresh while avoiding unnecessary remounts and focus loss. Cons: a focused clean editor can temporarily lag on-disk content until a later safe remount.
+- **Always reopen the clean active note after every external refresh**: strongest immediate convergence, but causes visible churn and drops editor focus for unrelated changes.
+- **Skip shared reloads whenever the editor is focused**: preserves focus, but leaves folders, views, backlinks, and other derived state stale.
+
+## Consequences
+
+- Unrelated external vault updates no longer remount the active editor just because the note is clean.
+- Focused rich/raw editor sessions preserve cursor and native input state across watcher- or agent-driven vault refreshes.
+- The changed-path batch is now part of the external-refresh contract; callers should pass the best available file list instead of treating all refreshes as full active-note invalidations.
+- A focused clean editor may intentionally continue showing pre-refresh content until a later safe reopen, trading immediate active-note convergence for editing continuity.
+- `refreshPulledVaultState()` remains the single place to evolve external-refresh policy; future features should extend that helper rather than layering ad hoc editor reload behavior.

docs/adr/0112-system-theme-mode.md

@@ -0,0 +1,41 @@
+---
+type: ADR
+id: "0112"
+title: "System theme mode"
+status: active
+date: 2026-05-05
+---
+
+## Context
+
+ADR-0081 introduced Tolaria's internal app-owned light and dark theme runtime and deliberately deferred system-follow mode. That kept the first dark-mode release small, but users now need Tolaria to match the operating system appearance automatically, including scheduled macOS light/dark changes.
+
+The previous constraints still apply: themes are app-owned, not vault-authored; the renderer must avoid startup flashes; shadcn/ui, Tailwind variables, editor chrome, and secondary windows must keep sharing the same resolved light/dark contract.
+
+## Decision
+
+**Tolaria now treats `system` as a persisted theme preference that resolves to the current OS light/dark appearance at runtime.**
+
+The selected preference can be `light`, `dark`, or `system`:
+
+1. `settings.theme_mode` remains the source of truth for the installation-local preference.
+2. The localStorage mirror stores the selected preference, including `system`, so the `index.html` prepaint script can resolve the correct appearance before React mounts.
+3. `data-theme` and the shadcn `.dark` class always receive the resolved app theme, `light` or `dark`; they never receive `system`.
+4. When `system` is selected, the renderer subscribes to `prefers-color-scheme` changes and reapplies the resolved theme without reopening the app.
+5. Explicit `light` and `dark` choices remain overrides and do not follow OS changes.
+
+Command-palette theme actions and the Settings panel both save the same preference path. Product analytics record preference changes with the selected mode only, without sending vault or note content.
+
+## Alternatives considered
+
+- **Persist `system` and resolve it into the existing light/dark runtime** (chosen): keeps ADR-0081's small app-owned theme surface while adding OS-follow behavior.
+- **Store the resolved OS theme in settings**: avoids a third stored value, but silently converts System users into explicit Light/Dark users after every save.
+- **Set `data-theme="system"` and branch in CSS**: would require every theme consumer to understand a third state and would break existing Tailwind/shadcn dark-mode assumptions.
+- **Rely only on CSS `prefers-color-scheme` media queries**: helps static CSS, but does not update JavaScript consumers, command state, editor integrations, or the localStorage startup mirror consistently.
+
+## Consequences
+
+- Startup still avoids a light flash when the stored preference is `system` and the OS is dark.
+- Secondary windows that mount the shared theme hook receive the same resolved appearance and update on OS changes.
+- Code that reads `document.documentElement.dataset.theme` must treat it as a resolved `light` or `dark` value, not as the stored user preference.
+- Future theme variants should preserve this split between selected preference and resolved app theme rather than widening `data-theme` to non-renderable preference values.

docs/adr/README.md

@@ -126,7 +126,7 @@ proposed → active → superseded
 | [0068](0068-h1-only-title-surface-with-optional-untitled-auto-rename.md) | H1-only title surface with optional untitled auto-rename | active |
 | [0069](0069-neighborhood-mode-for-note-list-relationship-browsing.md) | Neighborhood mode for note-list relationship browsing | active |
 | [0070](0070-starter-vaults-local-first-with-explicit-remote-connection.md) | Starter vaults are local-first with explicit remote connection | active |
-| [0071](0071-external-vault-refresh-and-clean-tab-reopen.md) | External vault updates reload derived state and reopen the clean active note | active |
+| [0071](0071-external-vault-refresh-and-clean-tab-reopen.md) | External vault updates reload derived state and reopen the clean active note | superseded → [0111](0111-path-aware-external-vault-refresh-with-focused-editor-preservation.md) |
 | [0072](0072-confirmed-vault-paths-gate-startup-state.md) | Confirmed vault paths gate startup state | active |
 | [0073](0073-persistent-linkify-protocol-registry-across-editor-remounts.md) | Persistent linkify protocol registry across editor remounts | active |
 | [0074](0074-explicit-external-ai-tool-setup-and-least-privilege-desktop-scope.md) | Explicit external AI tool setup and least-privilege desktop scope | active |
@@ -150,7 +150,7 @@ proposed → active → superseded
 | [0095](0095-saved-view-order-field.md) | Saved views use an explicit YAML order field | active |
 | [0096](0096-root-created-type-documents.md) | Root-created type documents | active |
 | [0097](0097-gemini-cli-agent-adapter.md) | Gemini CLI agent adapter | active |
-| [0098](0098-in-app-image-and-pdf-file-previews.md) | In-app image and PDF previews for binary vault files | active |
+| [0098](0098-in-app-image-and-pdf-file-previews.md) | In-app image and PDF previews for binary vault files | superseded → [0110](0110-in-app-media-and-pdf-file-previews.md) |
 | [0099](0099-cumulative-vault-asset-scope.md) | Cumulative vault asset scope for previews | active |
 | [0100](0100-synthetic-vault-root-folder-row.md) | Synthetic vault-root row in folder navigation | active |
 | [0101](0101-categorical-product-analytics-events.md) | Categorical product analytics events | active |
@@ -159,4 +159,10 @@ proposed → active → superseded
 | [0104](0104-tauri-frontend-readiness-watchdog.md) | Tauri frontend readiness watchdog | active |
 | [0105](0105-editor-correctness-and-responsiveness-contract.md) | Editor correctness and responsiveness contract | active |
 | [0106](0106-shared-app-command-manifest.md) | Shared app command manifest | active |
+| [0107](0107-markdown-durable-tldraw-whiteboards.md) | Markdown-durable tldraw whiteboards in notes | active |
 | [0107](0107-pointer-owned-editor-block-reordering.md) | Pointer-owned editor block reordering | active |
+| [0108](0108-sanitized-rendered-markup-and-safe-regex.md) | Sanitized rendered markup and safe user regex | active |
+| [0109](0109-debounced-worker-derived-editor-indexes.md) | Debounced worker-derived editor indexes | active |
+| [0110](0110-in-app-media-and-pdf-file-previews.md) | In-app media and PDF previews for binary vault files | active |
+| [0111](0111-path-aware-external-vault-refresh-with-focused-editor-preservation.md) | Path-aware external vault refresh with focused-editor preservation | active |
+| [0112](0112-system-theme-mode.md) | System theme mode | active |

index.html

@@ -30,11 +30,23 @@
       (function () {
         var key = 'tolaria-theme';
         var legacyKey = 'laputa-theme';
+        var systemDarkQuery = '(prefers-color-scheme: dark)';
         function normalizeTheme(value) {
-          return value === 'dark' || value === 'light' ? value : null;
+          return value === 'dark' || value === 'light' || value === 'system' ? value : null;
+        }
+        function prefersDarkTheme() {
+          try {
+            return typeof window.matchMedia === 'function' && window.matchMedia(systemDarkQuery).matches;
+          } catch (err) {
+            return false;
+          }
+        }
+        function resolveTheme(value) {
+          var mode = normalizeTheme(value) || 'light';
+          return mode === 'system' ? (prefersDarkTheme() ? 'dark' : 'light') : mode;
         }
         function applyTheme(value) {
-          var mode = normalizeTheme(value) || 'light';
+          var mode = resolveTheme(value);
           document.documentElement.setAttribute('data-theme', mode);
           document.documentElement.classList.toggle('dark', mode === 'dark');
         }

lara.lock

@@ -93,6 +93,7 @@ files:
     command.settings.repairVault: cee560b1fd5ad9d1ff1c19a0a2afe77a
     command.settings.useLightMode: a76d5b1c076983bc113d247f0520c166
     command.settings.useDarkMode: ba7873c42ae00542ba71db9be3b6761f
+    command.settings.useSystemTheme: 6d8c69d916d3df8ceed8dfc154196d07
     command.settings.toggleGitignoredFilesVisibility: 0a2d3ea4e8ff8b00a801183caeb97a03
     command.ai.openAgents: 612abe804edd0f5ae228a534f77f3d23
     command.ai.restoreGuidance: 23331fecc692d11d85cf24838ed273f2
@@ -104,7 +105,9 @@ files:
     settings.sync.title: 36f62a237420dcdc7096ad3a9018c4d9
     settings.sync.description: 06a6957c40867be2c28783183dc1bf5f
     settings.pullInterval: 4f95ca677398604bca241427261ed07b
+    settings.pullIntervalDescription: 4a75c15f44d59dc8cb100ec2d0693048
     settings.releaseChannel: 2da37055e15a217f18bd403922085c3f
+    settings.releaseChannelDescription: c5ae9b7f25376df383d36603366ac1fa
     settings.releaseStable: fa3aff3c185c6dc7754235f397c2099a
     settings.releaseAlpha: 6132295fcf5570fb8b0a944ef322a598
     settings.appearance.title: a1c58e94227389415de133efdf78ea6e
@@ -112,6 +115,7 @@ files:
     settings.theme.label: d721757161f7f70c5b0949fdb6ec2c30
     settings.theme.light: 9914a0ce04a7b7b6a8e39bec55064b82
     settings.theme.dark: a18366b217ebf811ad1886e4f4f865b2
+    settings.theme.system: a45da96d0bf6575970f2d27af22be28a
     settings.language.title: 4994a8ffeba4ac3140beb89e8d41f174
     settings.language.description: e2bb9b523067fdc32a494b1d6fd97906
     settings.language.label: 244c7b77926f077b863c33ff1244e1ec
@@ -123,37 +127,94 @@ files:
     settings.autogit.enable: 9b205a4ae0e3ad4e6708155880ce9c75
     settings.autogit.enableDescription: a7424a8f90c0b7f290a8144d12374554
     settings.autogit.idleThreshold: 28016cc6fccd951a904ee3020cd733b6
+    settings.autogit.idleThresholdDescription: 521140491e8c9d5a1d7b7739bc333358
     settings.autogit.inactiveThreshold: d28cb60d1e70e020ae8d1294e32dd474
+    settings.autogit.inactiveThresholdDescription: f9e43c90bd10bae937c2cfa5c2767f1c
     settings.titles.title: 761443f70a5067ecf015c6fb3fae9cef
     settings.titles.description: b94aeeca78dd376cc19b9aa019e53f6c
     settings.titles.autoRename: 5383db8e790ebf5f956d9c59cb4c4f67
     settings.titles.autoRenameDescription: cc28c28d8817736e658082a2261d9a6e
     settings.vaultContent.title: 78b883ce9acb9c25e611158a518d9185
     settings.vaultContent.description: a53487bf1c7898a1459dc1510e216f7d
+    settings.noteWidth.default: 66be0f882801fd19468181f31f58dc20
+    settings.noteWidth.defaultDescription: 2b5fb6d7dfa2b1da1e47bcac30f58e8d
+    settings.noteWidth.normal: 960b44c579bc2f6818d2daaf9e4c16f0
+    settings.noteWidth.wide: e7c770a61dbdf81ca922ae0260e327c1
+    settings.sidebarTypePluralization.label: 1e5bd615b1abbf39129ef241f5cf2249
+    settings.sidebarTypePluralization.description: 8d7bb0649fd7e637552429ea91298de8
     settings.vaultContent.hideGitignored: 2c07ee6c8bfe746d356f44275d42f90e
     settings.vaultContent.hideGitignoredDescription: e8b1ddfa416610f9d6eb299fa123a1d6
     settings.allNotesVisibility.title: 0e07c3d48b91e1a4c42c1ff3e5751ec3
     settings.allNotesVisibility.description: bc9caa48296281401aad694fed65a2d9
-    settings.allNotesVisibility.pdfs: 76663c34a88bd4225613a1a947127bcf
-    settings.allNotesVisibility.pdfsDescription: 33bfa167c125ddd713f40af11d233121
-    settings.allNotesVisibility.images: fff0d600f8a0b5e19e88bfb821dd1157
-    settings.allNotesVisibility.imagesDescription: 54e1fe8f20b426de2fe457322862fb4b
-    settings.allNotesVisibility.unsupported: 91de79ad2f20abd62e445f20584d3b8e
-    settings.allNotesVisibility.unsupportedDescription: c1ecaa108af2de4680ab535585c475e8
+    settings.allNotesVisibility.pdfs: 27ce5e1e1761ff362dbf75c76c6b4941
+    settings.allNotesVisibility.pdfsDescription: 8191ed4a095cdd60ef856ce0ff213a48
+    settings.allNotesVisibility.images: ea15460e63b6e8e92f8c03a79eeb6e4e
+    settings.allNotesVisibility.imagesDescription: 1704e10d5e5cdc17d2d2a5fb7b8969bf
+    settings.allNotesVisibility.unsupported: 257fe04419c9f6543a43e58b1edf9eb5
+    settings.allNotesVisibility.unsupportedDescription: a3b8aa66900c742f001cd4533b3df44a
     settings.aiAgents.title: 27f08387b26e1ceeb1b60bd9c97e7a47
-    settings.aiAgents.description: a13222e67eb121676ff6dfc7b085f02d
+    settings.aiAgents.description: 042a8037f1a4f90c76ce31a49fdff59c
     settings.aiAgents.default: 6af573559fd05d8c35bc57b41cc78e24
+    settings.aiAgents.defaultTarget: 5acfc74fd97a6dd2d67d15c66de5eed5
+    settings.aiAgents.agentGroup: 965530cbbec45b1754ed3ece120399f7
+    settings.aiAgents.localGroup: d34f4b997ce78da5aa57d657a5d6fcb5
+    settings.aiAgents.apiGroup: 589a257cbd265eaa7de93de8b4084dff
     settings.aiAgents.installed: 73329564760013a7824ff9d5d1af91ff
     settings.aiAgents.missing: ea21841da70e6405af19fabc4ff8bdd9
     settings.aiAgents.ready: 909a648c713be25fcd050725d0a41e37
     settings.aiAgents.notInstalled: 0ac3f76ef78bfdbab6331731ee56ba22
+    settings.aiAgents.apiReady: e5b06f6ef4ef5f4bc2848d46195e3f48
+    settings.aiAgents.apiLocalKey: 119de2f31867b273a134f05bc56b9e57
+    settings.aiAgents.apiEnv: e011db3dff54ed3deae37a9615e31ebf
+    settings.aiAgents.apiNoKey: 5bbccbfcd09b28902bbf5319dd6e6053
+    settings.aiAgents.installedTitle: 5cb9b5ae5ebc66652814dff4584705cc
+    settings.aiAgents.installedDescription: fb9ba9667725fb40fa1e5d58a2c02692
+    settings.aiAgents.noVersion: 89831adb7114946e916b9c31d57a1e33
+    settings.aiProviders.title: 63eb84d8510f9f086d282ec7d47adaa1
+    settings.aiProviders.description: 6c86c013eb6fb198b51e29ec47d66464
+    settings.aiProviders.localTitle: c7c20443d8aaf04271df9d713f5c02ce
+    settings.aiProviders.localDescription: 7abed40ef2e46741c64ff47e423cca39
+    settings.aiProviders.apiTitle: 66537b9e5200ebbbfbd091144d8afbcc
+    settings.aiProviders.apiDescription: 6ec773352e05a805af3abcebeff4e756
+    settings.aiProviders.kind: 27703c8f150ac4bb0a3a83a7857353af
+    settings.aiProviders.kind.ollama: c23e8db458397f37c8e8d98e94e55a18
+    settings.aiProviders.kind.lmStudio: 7b9b319662715e90583e823a6c3cfdbe
+    settings.aiProviders.kind.openAi: 0523b13262b12c215d8009938f5c14f1
+    settings.aiProviders.kind.anthropic: f431db65cea024a5f19eab835afefee2
+    settings.aiProviders.kind.gemini: 766cc4dd4d5005652e8514e3513683f8
+    settings.aiProviders.kind.openRouter: a0607683815b6585fb80e7cac72ac59a
+    settings.aiProviders.kind.compatible: 1a4dc90a183c26d9026c6ac7727aa4cd
+    settings.aiProviders.name: 49ee3087348e8d44e1feda1917443987
+    settings.aiProviders.baseUrl: ade86bc4899761ad46c52e381b6228bb
+    settings.aiProviders.model: 6bd36c36869288188863bd53a9bc5ed1
+    settings.aiProviders.key: 656a6828d7ef1bb791e42087c4b5ee6e
+    settings.aiProviders.keyPlaceholder: 57dbf3720af3f156018bfff7f5a99b23
+    settings.aiProviders.keyStorage: 3e5b8cfbc66d3a33dad3fda058bf5851
+    settings.aiProviders.keyStorage.local: 7c6189f734f3c66d162a3f06529af1d9
+    settings.aiProviders.keyStorage.env: a71b071971d7c54e9af381c9bea093d9
+    settings.aiProviders.keyStorage.none: 94c841331ccd5179a283487f96285c90
+    settings.aiProviders.keyEnv: cb72671bd5cf65512d4c94e8ad6182ef
+    settings.aiProviders.keySafety: 0d59d7e4def35e51c4bb785d74180afc
+    settings.aiProviders.keySafetyLocal: 8ef2ba0192ac725fa1a3e737e852387c
+    settings.aiProviders.localSafety: 60fb65e4e0d35cec3135584d8219e8fd
+    settings.aiProviders.add: a9f8e8b4ca3cbc4fc3bff5d59d6a5419
+    settings.aiProviders.addLocal: 681985f2e412f22fcd55a0553f6e4bee
+    settings.aiProviders.addApi: 767b46f2a51aa9dd050cb226cd86e192
+    settings.aiProviders.test: 602009d5aea1c1ef06fd777968f7e80e
+    settings.aiProviders.testing: 9d770c909c2c69b09eae2372c4cf405d
+    settings.aiProviders.testSuccess: 51677ed54231e41a4fe40850d90b64b2
+    settings.aiProviders.empty: 9378027dec7f93fcc5011c5e528bdf82
+    settings.aiProviders.defaultEndpoint: 666b355c305dd4c7b4649d3d7b4c5d11
+    settings.aiProviders.keyLocalSaved: f4a102d6a67212e21f0f31f0758aea81
+    settings.aiProviders.keyEnvSaved: bfed2d745dd76dbea9341d27e06c39f2
+    settings.aiProviders.noKey: 1ab089f80ef4dc6c1ce3e173f5b405a0
     settings.workflow.title: 24f47cdbe9ddba774a7cc53e51d9032e
     settings.workflow.description: aa9a07539b87cf407c3edc8a22732d45
     settings.workflow.explicit: 54a5b5c27937d25271c3127d093e8361
     settings.workflow.explicitDescription: ce523427b5dd0f9895f63d1fbb90ad24
     settings.workflow.autoAdvance: 9ed337f5bc61603d19a1ef35f3a3a243
     settings.workflow.autoAdvanceDescription: ae58ad8abf03df7cbdae8c3a725258f7
-    settings.privacy.title: 0dd6c14e00cc9f45a68c1bca88d1317d
+    settings.privacy.title: aa96a21412def0d916f43b639424f8e4
     settings.privacy.description: 33d53059be620b58e38b8e5c5ab26b27
     settings.privacy.crashReporting: b4efc5b61526566d431e99242f5c21b4
     settings.privacy.crashReportingDescription: e9d7c7efce44adc08d0460be1aad5c42
@@ -165,6 +226,7 @@ files:
     common.cancel: ea4788705e6873b424c65e91c2846b19
     common.create: 686e697538050e4664636337cc3b834f
     common.save: c9cc8cce247e49bae79f15173ce97354
+    common.remove: 1063e38cb53d94d386f21227fcd84717
     customize.color: cb5feb1b7314637725a2e73bdc9f7295
     customize.icon: 817434295a673aed431435658b65d9a7
     customize.searchIcons: 0688a8098567785a05cb4cf937cbb880
@@ -194,6 +256,8 @@ files:
     ai.panel.status.checking: 118740af1c4521b917e29791d661db82
     ai.panel.status.missing: fe07f8eac233c229d81cbe9aa25668a0
     ai.panel.status.ready: 296a0ac791eab2df130789f55fdc109b
+    ai.panel.mode.chat: 55dcdf017b51fc96f7b5f9d63013b95d
+    ai.panel.mode.chatDescription: d7744ae39e7920a8eac7b21b58fce348
     ai.panel.copyMcpConfig: 6a8c9fe401557c870e3a90bbfab01b25
     ai.panel.mcpConfig: 53bac93d0314941c8d2c1163026f3ad9
     ai.panel.newChat: 1b0a886d6e77f628ec96c2d71cdb0a9b
@@ -365,12 +429,24 @@ files:
     editor.toolbar.showDiff: 08d579de8d3abdcdfce0953a797362c6
     editor.toolbar.openAi: d2e93006570a66709c8ce0dc27082ef1
     editor.toolbar.closeAi: cd46973ef73076d612dff9903ce54498
+    editor.toolbar.openTableOfContents: b733f053ea3fde4a9acd589ec7f58c10
+    editor.toolbar.closeTableOfContents: d3292972a10edd1a06a627f3552f760a
     editor.toolbar.restoreArchived: 1bff5cf4943af64c05b2e9aeadccbc84
     editor.toolbar.archive: 63dc964c32e715217b49f8739d49636b
     editor.toolbar.delete: f48134a07b016a1de05d4ba6d2fbfb41
     editor.toolbar.revealFile: 76f4ed52da9937ae432dcf5a108fabb4
     editor.toolbar.copyFilePath: 64c6cec5ca57efbb8c9c93ae5fbccd27
+    editor.toolbar.moreActions: 89e19353176b94068dec4c768c25e70b
     editor.toolbar.openProperties: 948b90b60b8ce827f179e8c5b85b112e
+    tableOfContents.title: f61d6c3e3733db355168b7e1aee6780b
+    tableOfContents.close: d3292972a10edd1a06a627f3552f760a
+    tableOfContents.empty: e4f02ad69cbbce1ec65d14215e3d5871
+    tableOfContents.emptyNoNote: 046d95682b747a30ed8a7b0b1d581629
+    tableOfContents.navLabel: 598b8ae10dfce818e73d3218daddbdae
+    tableOfContents.untitledHeading: 93c2dde207965b383b7b22af005ebe4f
+    tableOfContents.expandHeading: 6353ab44fe75f5dd935789bdab8551a0
+    tableOfContents.collapseHeading: 040b4c102283028831ea78713235e478
+    editor.codeBlock.copy: 8e477020fb3f7ab844b91ff1d7de8347
     editor.imageLightbox.title: 2c5a15c875bcdc2478c4a5cad044e10c
     editor.filename.rename: c31c2b468229232ad6287e734fe67d96
     editor.filename.renameToTitle: bff34a6a2dd1eb87c59403946679237f
@@ -489,6 +565,7 @@ files:
     status.ai.noAgentsTooltip: 1bdc02ec2dd7f9701b4371ffd5770318
     status.ai.selectedMissing: a37f3dbc73725219e90d709fe0d3ad97
     status.ai.defaultAgent: 79650d57d1678e56c75dbbcba6ea87f7
+    status.ai.defaultTarget: 65ea5bdb609833c4baffd2cbd0e86542
     status.ai.restoreDetails: 47a913b58ce40add6521bc93e807476f
     status.ai.withGuidance: 1eafd34810db6bba54dac7aa549b5182
     status.ai.active: 059e3a3167c2ab00f4ca872e82a48d98
@@ -498,6 +575,9 @@ files:
     status.ai.vaultGuidance: 7bb4644efe6ae7cec9993c8bd85f1519
     status.ai.restoreGuidance: 23331fecc692d11d85cf24838ed273f2
     status.ai.openOptions: d387b1ab67586c7a2d83db8900a4dd8e
+    status.ai.modelTargets: 8f3ceb96e088f8bdaecc236778401ac9
+    status.ai.localChat: 215a24e3d38fb8b68deea6dad0142326
+    status.ai.apiChat: 6dffd5b9997885efe701631cea5c470d
     pulse.title: 16d2b386b2034b9488996466aaae0b57
     pulse.today: 1dd1c5fb7f25cd41b291d43a89e3aefd
     pulse.yesterday: ebfe9ce86e6e9fb953aa7a25b59c1956

lara.yaml

@@ -21,6 +21,7 @@ locales:
     - zh-TW
     - ja-JP
     - ko-KR
+    - vi
     - pl-PL
 
 files:

mcp-server/index.js

@@ -162,15 +162,6 @@ const TOOLS = [
   },
 ]
 
-const TOOL_HANDLERS = {
-  search_notes: handleSearchNotes,
-  get_vault_context: handleVaultContext,
-  get_note: handleGetNote,
-  open_note: handleOpenNote,
-  highlight_editor: handleHighlightEditor,
-  refresh_vault: handleRefreshVault,
-}
-
 async function handleSearchNotes(args) {
   const results = await searchNotes(VAULT_PATH, args.query, args.limit)
   const text = results.length === 0
@@ -207,6 +198,25 @@ function handleRefreshVault(args) {
   return { content: [{ type: 'text', text: 'Vault refresh triggered' }] }
 }
 
+function callToolHandler(name, args) {
+  switch (name) {
+    case 'search_notes':
+      return handleSearchNotes(args)
+    case 'get_vault_context':
+      return handleVaultContext()
+    case 'get_note':
+      return handleGetNote(args)
+    case 'open_note':
+      return handleOpenNote(args)
+    case 'highlight_editor':
+      return handleHighlightEditor(args)
+    case 'refresh_vault':
+      return handleRefreshVault(args)
+    default:
+      throw new Error(`Unknown tool: ${name}`)
+  }
+}
+
 // --- Server setup ---
 
 const server = new Server(
@@ -220,12 +230,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
 
 server.setRequestHandler(CallToolRequestSchema, async (request) => {
   const { name, arguments: args } = request.params
-  const handler = TOOL_HANDLERS[name]
-  if (!handler) {
-    throw new Error(`Unknown tool: ${name}`)
-  }
   try {
-    return await handler(args)
+    return await callToolHandler(name, args)
   } catch (error) {
     return {
       content: [{ type: 'text', text: `Error: ${error.message}` }],

mcp-server/package-lock.json

@@ -14,9 +14,9 @@
       }
     },
     "node_modules/@hono/node-server": {
-      "version": "1.19.9",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.9.tgz",
-      "integrity": "sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==",
+      "version": "1.19.13",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.13.tgz",
+      "integrity": "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18.14.1"
@@ -431,12 +431,12 @@
       }
     },
     "node_modules/express-rate-limit": {
-      "version": "8.2.1",
-      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.2.1.tgz",
-      "integrity": "sha512-PCZEIEIxqwhzw4KF0n7QF4QqruVTcF73O5kFKUnGOyjbCCgizBBiFaYpd/fnBLUMPw/BWw9OsiN7GgrNYr7j6g==",
+      "version": "8.2.2",
+      "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-8.2.2.tgz",
+      "integrity": "sha512-Ybv7bqtOgA914MLwaHWVFXMpMYeR1MQu/D+z2MaLYteqBsTIp9sY3AU7mGNLMJv8eLg8uQMpE20I+L2Lv49nSg==",
       "license": "MIT",
       "dependencies": {
-        "ip-address": "10.0.1"
+        "ip-address": "10.1.0"
       },
       "engines": {
         "node": ">= 16"
@@ -619,9 +619,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.0",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.0.tgz",
-      "integrity": "sha512-NekXntS5M94pUfiVZ8oXXK/kkri+5WpX2/Ik+LVsl+uvw+soj4roXIsPqO+XsWrAw20mOzaXOZf3Q7PfB9A/IA==",
+      "version": "4.12.14",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.14.tgz",
+      "integrity": "sha512-am5zfg3yu6sqn5yjKBNqhnTX7Cv+m00ox+7jbaKkrLMRJ4rAdldd1xPd/JzbBWspqaQv6RSTrgFN95EsfhC+7w==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -670,9 +670,9 @@
       "license": "ISC"
     },
     "node_modules/ip-address": {
-      "version": "10.0.1",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.0.1.tgz",
-      "integrity": "sha512-NWv9YLW4PoW2B7xtzaS3NCot75m6nK7Icdv0o3lfMceJVRfSoQwqD4wEH5rLwoKJwUiZ/rfpiVBhnaF0FK4HoA==",
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
+      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -882,9 +882,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz",
-      "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==",
+      "version": "8.4.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.0.tgz",
+      "integrity": "sha512-PuseHIvAnz3bjrM2rGJtSgo1zjgxapTLZ7x2pjhzWwlp4SJQgK3f3iZIQwkpEnBaKz6seKBADpM4B4ySkuYypg==",
       "license": "MIT",
       "funding": {
         "type": "opencollective",

mcp-server/package.json

@@ -12,5 +12,11 @@
     "@modelcontextprotocol/sdk": "^1.0.0",
     "gray-matter": "^4.0.3",
     "ws": "^8.19.0"
+  },
+  "overrides": {
+    "@hono/node-server": "1.19.13",
+    "express-rate-limit": "8.2.2",
+    "hono": "4.12.14",
+    "path-to-regexp": "8.4.0"
   }
 }

mcp-server/test.js

@@ -1,7 +1,9 @@
 import { describe, it, before, after } from 'node:test'
 import assert from 'node:assert/strict'
 import { spawn } from 'node:child_process'
-import fs from 'node:fs/promises'
+import {
+  mkdtemp, mkdir, open, rm,
+} from 'node:fs/promises'
 import path from 'node:path'
 import os from 'node:os'
 import { fileURLToPath } from 'node:url'
@@ -16,12 +18,12 @@ const ACTIVE_VAULT_ERROR = 'Note path must stay inside the active vault'
 const MCP_SERVER_DIR = path.dirname(fileURLToPath(import.meta.url))
 
 before(async () => {
-  tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'laputa-mcp-test-'))
+  tmpDir = await mkdtemp(path.join(os.tmpdir(), 'laputa-mcp-test-'))
 
-  await fs.mkdir(path.join(tmpDir, 'project'), { recursive: true })
-  await fs.mkdir(path.join(tmpDir, 'note'), { recursive: true })
+  await mkdir(path.join(tmpDir, 'project'), { recursive: true })
+  await mkdir(path.join(tmpDir, 'note'), { recursive: true })
 
-  await fs.writeFile(path.join(tmpDir, 'project', 'test-project.md'), `---
+  await writeTextFile(path.join(tmpDir, 'project', 'test-project.md'), `---
 title: Test Project
 is_a: Project
 status: Active
@@ -32,7 +34,7 @@ status: Active
 This is a test project for the MCP server.
 `)
 
-  await fs.writeFile(path.join(tmpDir, 'note', 'daily-log.md'), `---
+  await writeTextFile(path.join(tmpDir, 'note', 'daily-log.md'), `---
 title: Daily Log
 is_a: Note
 ---
@@ -42,7 +44,7 @@ is_a: Note
 Today I worked on the MCP server implementation.
 `)
 
-  await fs.writeFile(path.join(tmpDir, 'project', 'second-project.md'), `---
+  await writeTextFile(path.join(tmpDir, 'project', 'second-project.md'), `---
 title: Second Project
 type: Project
 status: Draft
@@ -57,7 +59,7 @@ Another project for testing list and context.
 })
 
 after(async () => {
-  await fs.rm(tmpDir, { recursive: true, force: true })
+  await rm(tmpDir, { recursive: true, force: true })
 })
 
 describe('findMarkdownFiles', () => {
@@ -240,17 +242,26 @@ describe('stdio process lifecycle', () => {
 })
 
 async function assertRejectsOutsideVault(prefix, resolveNotePath) {
-  const outsideDir = await fs.mkdtemp(path.join(os.tmpdir(), prefix))
+  const outsideDir = await mkdtemp(path.join(os.tmpdir(), prefix))
   const outsideNote = path.join(outsideDir, 'outside.md')
 
   try {
-    await fs.writeFile(outsideNote, '# Outside\n')
+    await writeTextFile(outsideNote, '# Outside\n')
     await assert.rejects(
       () => getNote(tmpDir, resolveNotePath(outsideNote)),
       { message: ACTIVE_VAULT_ERROR },
     )
   } finally {
-    await fs.rm(outsideDir, { recursive: true, force: true })
+    await rm(outsideDir, { recursive: true, force: true })
+  }
+}
+
+async function writeTextFile(filePath, content) {
+  const handle = await open(filePath, 'w')
+  try {
+    await handle.writeFile(content, 'utf-8')
+  } finally {
+    await handle.close()
   }
 }
 

mcp-server/vault.js

@@ -3,7 +3,7 @@
  * Write operations are handled by the app-managed agent's active permission
  * profile and native file-edit tools when available.
  */
-import fs from 'node:fs/promises'
+import { open, opendir, realpath } from 'node:fs/promises'
 import path from 'node:path'
 import matter from 'gray-matter'
 
@@ -16,17 +16,17 @@ const ACTIVE_VAULT_ERROR = 'Note path must stay inside the active vault'
  */
 export async function findMarkdownFiles(dir) {
   const results = []
-  const items = await fs.readdir(dir, { withFileTypes: true })
-  for (const item of items) {
+  const items = await opendir(dir)
+  for await (const item of items) {
     await collectMarkdownFile(results, dir, item)
   }
   return results
 }
 
 async function resolveVaultNotePath(vaultPath, notePath) {
-  const vaultRoot = await fs.realpath(vaultPath)
+  const vaultRoot = await realpath(vaultPath)
   const requestedPath = resolveRequestedNotePath(vaultRoot, notePath)
-  const noteRealPath = await fs.realpath(requestedPath)
+  const noteRealPath = await realpath(requestedPath)
   const relativePath = path.relative(vaultRoot, noteRealPath)
 
   if (!isVaultRelativePath(relativePath)) {
@@ -51,7 +51,7 @@ export async function getNote(vaultPath, notePath) {
     noteRealPath,
     relativePath,
   } = await resolveVaultNotePath(vaultPath, notePath)
-  const raw = await fs.readFile(noteRealPath, 'utf-8')
+  const raw = await readUtf8File(noteRealPath)
   const parsed = matter(raw)
   return {
     path: relativePath,
@@ -74,7 +74,7 @@ export async function searchNotes(vaultPath, query, limit = 10) {
 
   for (const filePath of files) {
     if (results.length >= limit) break
-    const content = await fs.readFile(filePath, 'utf-8')
+    const content = await readUtf8File(filePath)
     const filename = path.basename(filePath, '.md')
     const titleMatch = extractTitle(content, filename)
     if (!matchesSearchQuery(titleMatch, content, q)) continue
@@ -126,7 +126,8 @@ export async function vaultContext(vaultPath) {
 async function collectMarkdownFile(results, dir, item) {
   if (item.name.startsWith('.')) return
 
-  const full = path.join(dir, item.name)
+  const full = resolveInside(dir, item.name)
+  if (!full) return
   if (item.isDirectory()) {
     results.push(...await findMarkdownFiles(full))
     return
@@ -139,7 +140,16 @@ async function collectMarkdownFile(results, dir, item) {
 
 function resolveRequestedNotePath(vaultRoot, notePath) {
   if (path.isAbsolute(notePath)) return notePath
-  return path.resolve(vaultRoot, notePath)
+  const resolved = resolveInside(vaultRoot, notePath)
+  if (!resolved) throw new Error(ACTIVE_VAULT_ERROR)
+  return resolved
+}
+
+function resolveInside(root, target) {
+  const resolved = path.resolve(root, target)
+  const relative = path.relative(root, resolved)
+  if (isVaultRelativePath(relative)) return resolved
+  return null
 }
 
 function isVaultRelativePath(relativePath) {
@@ -151,11 +161,11 @@ function matchesSearchQuery(title, content, query) {
 }
 
 async function readVaultContextNote(vaultPath, filePath) {
-  const raw = await fs.readFile(filePath, 'utf-8')
+  const raw = await readUtf8File(filePath)
   const parsed = matter(raw)
   const rel = path.relative(vaultPath, filePath)
   const topFolder = extractTopFolder(rel)
-  const stat = await fs.stat(filePath)
+  const stat = await statFile(filePath)
   const type = parsed.data.type || parsed.data.is_a || null
 
   return {
@@ -179,8 +189,8 @@ async function readConfigFiles(vaultPath) {
   const configFiles = {}
 
   try {
-    const agentsPath = path.join(vaultPath, 'config', 'agents.md')
-    configFiles.agents = await fs.readFile(agentsPath, 'utf-8')
+    const agentsPath = resolveInside(vaultPath, 'config/agents.md')
+    if (agentsPath) configFiles.agents = await readUtf8File(agentsPath)
   } catch {
     // config/agents.md may not exist yet
   }
@@ -188,6 +198,24 @@ async function readConfigFiles(vaultPath) {
   return configFiles
 }
 
+async function readUtf8File(filePath) {
+  const handle = await open(filePath, 'r')
+  try {
+    return await handle.readFile('utf-8')
+  } finally {
+    await handle.close()
+  }
+}
+
+async function statFile(filePath) {
+  const handle = await open(filePath, 'r')
+  try {
+    return await handle.stat()
+  } finally {
+    await handle.close()
+  }
+}
+
 /**
  * Extract title from markdown content (first H1 or frontmatter title).
  * @param {string} content

mcp-server/ws-bridge.js

@@ -38,6 +38,7 @@ const TRUSTED_UI_ORIGINS = new Set([
 /** @type {WebSocketServer | null} */
 let uiBridge = null
 let vaultPath = null
+const UNKNOWN_TOOL = Symbol('unknown tool')
 
 function activeVaultPath() {
   vaultPath ??= requireVaultPath()
@@ -53,30 +54,65 @@ function broadcastUiAction(action, payload) {
 }
 
 
-const TOOL_HANDLERS = {
-  open_note: (args) => getNote(activeVaultPath(), args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
-  read_note: (args) => getNote(activeVaultPath(), args.path).then(note => ({ content: note.content, frontmatter: note.frontmatter })),
-  search_notes: (args) => searchNotes(activeVaultPath(), args.query, args.limit),
-  vault_context: () => vaultContext(activeVaultPath()),
-  ui_open_note: (args) => { broadcastUiAction('vault_changed', { path: args.path }); broadcastUiAction('open_note', { path: args.path }); return { ok: true } },
-  ui_open_tab: (args) => { broadcastUiAction('vault_changed', { path: args.path }); broadcastUiAction('open_tab', { path: args.path }); return { ok: true } },
-  ui_highlight: (args) => { broadcastUiAction('highlight', { element: args.element, path: args.path }); return { ok: true } },
-  ui_set_filter: (args) => { broadcastUiAction('set_filter', { filterType: args.type }); return { ok: true } },
-  highlight_editor: (args) => { broadcastUiAction('highlight', { element: args.element, path: args.path }); return { ok: true } },
-  refresh_vault: (args) => { broadcastUiAction('vault_changed', { path: args?.path }); return { ok: true } },
+async function readNoteTool(args) {
+  const note = await getNote(activeVaultPath(), args.path)
+  return { content: note.content, frontmatter: note.frontmatter }
+}
+
+function uiOpenNoteTool(args) {
+  broadcastUiAction('vault_changed', { path: args.path })
+  broadcastUiAction('open_note', { path: args.path })
+  return { ok: true }
+}
+
+function uiOpenTabTool(args) {
+  broadcastUiAction('vault_changed', { path: args.path })
+  broadcastUiAction('open_tab', { path: args.path })
+  return { ok: true }
+}
+
+function highlightTool(args) {
+  broadcastUiAction('highlight', { element: args.element, path: args.path })
+  return { ok: true }
+}
+
+function uiSetFilterTool(args) {
+  broadcastUiAction('set_filter', { filterType: args.type })
+  return { ok: true }
+}
+
+function refreshVaultTool(args) {
+  broadcastUiAction('vault_changed', { path: args?.path })
+  return { ok: true }
+}
+
+const TOOL_EXECUTORS = [
+  ['open_note', readNoteTool],
+  ['read_note', readNoteTool],
+  ['search_notes', (args) => searchNotes(activeVaultPath(), args.query, args.limit)],
+  ['vault_context', () => vaultContext(activeVaultPath())],
+  ['ui_open_note', uiOpenNoteTool],
+  ['ui_open_tab', uiOpenTabTool],
+  ['ui_highlight', highlightTool],
+  ['highlight_editor', highlightTool],
+  ['ui_set_filter', uiSetFilterTool],
+  ['refresh_vault', refreshVaultTool],
+]
+
+function callToolHandler(tool, args) {
+  const executor = TOOL_EXECUTORS.find(([name]) => name === tool)?.[1]
+  return executor ? executor(args) : UNKNOWN_TOOL
 }
 
 async function handleMessage(data) {
   const msg = JSON.parse(data)
   const { id, tool, args } = msg
 
-  const handler = TOOL_HANDLERS[tool]
-  if (!handler) {
-    return { id, error: `Unknown tool: ${tool}` }
-  }
-
   try {
-    const result = await handler(args || {})
+    const result = await callToolHandler(tool, args || {})
+    if (result === UNKNOWN_TOOL) {
+      return { id, error: `Unknown tool: ${tool}` }
+    }
     return { id, result }
   } catch (err) {
     return { id, error: err.message }

package.json

@@ -17,7 +17,7 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:e2e": "playwright test",
-    "playwright:smoke": "playwright test --config playwright.smoke.config.ts tests/smoke/autosave-low-end-typing.spec.ts tests/smoke/create-note-backing-file.spec.ts tests/smoke/delete-note-nonblocking.spec.ts tests/smoke/example.spec.ts tests/smoke/fix-ai-chat-empty-body-v3.spec.ts tests/smoke/fix-crash-create-note.spec.ts tests/smoke/fresh-start-telemetry-onboarding.spec.ts tests/smoke/frontmatter-date-picker.spec.ts tests/smoke/getting-started-template.spec.ts tests/smoke/h1-title-decoupled.spec.ts tests/smoke/h1-untitled-auto-rename.spec.ts tests/smoke/keyboard-command-routing.spec.ts tests/smoke/linkify-init-warnings.spec.ts tests/smoke/missing-string-metadata-open-note.spec.ts tests/smoke/multibyte-search-snippet.spec.ts tests/smoke/multi-selection-shortcuts.spec.ts tests/smoke/pull-refresh-open-note.spec.ts tests/smoke/vault-loading-skeleton.spec.ts tests/smoke/wikilink-path-fix.spec.ts",
+    "playwright:smoke": "playwright test --config playwright.smoke.config.ts tests/smoke/autosave-low-end-typing.spec.ts tests/smoke/create-note-backing-file.spec.ts tests/smoke/delete-note-nonblocking.spec.ts tests/smoke/example.spec.ts tests/smoke/fix-ai-chat-empty-body-v3.spec.ts tests/smoke/fix-crash-create-note.spec.ts tests/smoke/fresh-start-telemetry-onboarding.spec.ts tests/smoke/frontmatter-date-picker.spec.ts tests/smoke/getting-started-template.spec.ts tests/smoke/h1-title-decoupled.spec.ts tests/smoke/h1-untitled-auto-rename.spec.ts tests/smoke/keyboard-command-routing.spec.ts tests/smoke/linkify-init-warnings.spec.ts tests/smoke/missing-active-vault-recovery.spec.ts tests/smoke/missing-string-metadata-open-note.spec.ts tests/smoke/multibyte-search-snippet.spec.ts tests/smoke/multi-selection-shortcuts.spec.ts tests/smoke/pull-refresh-open-note.spec.ts tests/smoke/type-derived-properties.spec.ts tests/smoke/vault-loading-skeleton.spec.ts tests/smoke/wikilink-path-fix.spec.ts",
     "playwright:regression": "playwright test tests/smoke/",
     "playwright:integration": "playwright test --config playwright.integration.config.ts",
     "test:coverage": "node scripts/run-vitest-coverage.mjs",
@@ -55,9 +55,11 @@
     "@tauri-apps/plugin-opener": "^2.5.3",
     "@tauri-apps/plugin-process": "^2.3.1",
     "@tauri-apps/plugin-updater": "^2.10.0",
+    "@tldraw/assets": "4.5.10",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "date-fns": "^4.1.0",
+    "dompurify": "3.4.2",
     "katex": "^0.16.28",
     "lucide-react": "^0.564.0",
     "mermaid": "^11.14.0",
@@ -70,8 +72,10 @@
     "react-virtuoso": "^4.18.1",
     "rehype-highlight": "^7.0.2",
     "remark-gfm": "^4.0.1",
+    "safe-regex2": "5.1.1",
     "tailwind-merge": "^3.4.1",
     "tailwindcss": "^4.1.18",
+    "tldraw": "^4.5.10",
     "tw-animate-css": "^1.4.0",
     "unicode-emoji-json": "^0.8.0"
   },
@@ -98,8 +102,20 @@
     "jsdom": "^28.0.0",
     "typescript": "~5.9.3",
     "typescript-eslint": "^8.48.0",
-    "vite": "^7.3.1",
+    "vite": "^7.3.2",
     "vitest": "^4.0.18",
     "ws": "^8.19.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "@hono/node-server": "1.19.13",
+      "express-rate-limit": "8.2.2",
+      "hono": "4.12.14",
+      "path-to-regexp": "8.4.0",
+      "picomatch": "4.0.4",
+      "postcss": "8.5.10",
+      "protobufjs": "7.5.6",
+      "rollup": "4.59.0"
+    }
   }
 }

patches/@blocknote__react@0.46.2.patch

@@ -1,8 +1,9 @@
 diff --git a/dist/blocknote-react.js b/dist/blocknote-react.js
-index 6271d12d2cd5152e924c5bfe78f3b8904844dbfe..12bb96bb36d445a77d51a18d0de446a3f9f0ea59 100644
+index d4d36cd4dbb5370c3b7431ffeb577e4870b39825..5a6c325bf0ff9a23f2023169d7fcf6319df91544 100644
 --- a/dist/blocknote-react.js
 +++ b/dist/blocknote-react.js
-@@ -155,8 +155,26 @@ var Rt = (e) => {
+@@ -154,8 +154,26 @@ const co = (e) => {
+ };
  function so(e) {
    let t = new DOMRect();
 -  const n = "getBoundingClientRect" in e ? () => e.getBoundingClientRect() : () => e.element.getBoundingClientRect();
@@ -17,7 +18,7 @@ index 6271d12d2cd5152e924c5bfe78f3b8904844dbfe..12bb96bb36d445a77d51a18d0de446a3
 +      t = n();
 +    return t;
 +  };
- }
++}
 +function __bnSafeDomAtPos(e, t) {
 +  const n = e.prosemirrorView;
 +  if (!n || n.isDestroyed)
@@ -27,11 +28,10 @@ index 6271d12d2cd5152e924c5bfe78f3b8904844dbfe..12bb96bb36d445a77d51a18d0de446a3
 +  } catch {
 +    return null;
 +  }
-+}
+ }
  const z = (e) => {
    var h, b, p;
-   const { refs: t, floatingStyles: n, context: o } = Ze({
-@@ -216,9 +234,7 @@ const Lt = (e) => {
+@@ -216,9 +234,7 @@ const z = (e) => {
        const s = Ue(t, c.doc);
        if (!s)
          return;
@@ -42,7 +42,39 @@ index 6271d12d2cd5152e924c5bfe78f3b8904844dbfe..12bb96bb36d445a77d51a18d0de446a3
        if (a instanceof Element)
          return {
            element: a
-@@ -3306,14 +3322,15 @@ const pi = (e) => {
+@@ -2499,7 +2515,14 @@ function Kr(e) {
+     columns: d
+   } = e, m = H(
+     (C) => {
+-      a(), s(), u == null || u(C);
++      a();
++      try {
++        s();
++      } catch (x) {
++        console.warn("Ignored stale suggestion menu query cleanup:", x);
++        return;
++      }
++      u == null || u(C);
+     },
+     [u, a, s]
+   ), { items: g, usedQuery: f, loadingState: h } = Yt(
+@@ -2734,7 +2757,14 @@ function ti(e) {
+     onItemClick: u
+   } = e, d = H(
+     (p) => {
+-      a(), s(), u == null || u(p);
++      a();
++      try {
++        s();
++      } catch (C) {
++        console.warn("Ignored stale suggestion menu query cleanup:", C);
++        return;
++      }
++      u == null || u(p);
+     },
+     [u, a, s]
+   ), { items: m, usedQuery: g, loadingState: f } = Yt(
+@@ -3306,14 +3336,15 @@ const ii = (e, t = 0.3) => {
      );
      if (!m)
        return {};
@@ -61,7 +93,7 @@ index 6271d12d2cd5152e924c5bfe78f3b8904844dbfe..12bb96bb36d445a77d51a18d0de446a3
      return p instanceof Element ? (d.cellReference = { element: p }, d.rowReference = {
        element: f,
        getBoundingClientRect: () => {
-@@ -4371,7 +4388,7 @@ const El = (e) => {
+@@ -4371,7 +4402,7 @@ const zi = (e) => {
      const a = Ue(t, c.prosemirrorState.doc);
      if (!a)
        return;

release-notes/stable-v2026.5.2.md

@@ -0,0 +1,18 @@
+## New Features
+
+- 📋 **Paste Without Formatting** — Paste copied text as plain content without bringing unwanted styling into a note.
+- 🇵🇱 **Polish Language Support** — Use Tolaria with a new Polish interface translation.
+- 🧭 **Refined Titlebar Navigation** — Navigate with clearer titlebar controls that feel more native on desktop.
+
+## Improvements
+
+- ⚡ **Faster Note Loading** — Switch between notes more smoothly by reusing cached note content and parsed editor blocks.
+- 🗂️ **Cleaner Sidebar and Menus** — Scan folders, sidebar sections, slash commands, icon choices, and release tabs with cleaner spacing and styling.
+- 🖥️ **Better Cross-Platform Window Controls** — Use macOS and Linux window controls that better match each platform.
+- ☀️ **Improved Light Mode Editing** — Read code blocks more comfortably when Tolaria is using the light theme.
+
+## Stability and Fixes
+
+- This release also improves editor reliability around block dragging, table handles, pasted Markdown, stale side-menu actions, and unrelated vault refreshes.
+- Vault, type, and frontmatter handling were hardened to prevent freezes, filename collisions, parse failures, and stale saved-view deletes.
+- Startup, Linux AppImage, release CI, and AI/Codex integration fixes are included in the full commit list.

release-notes/v2026-05-04.md

@@ -0,0 +1,20 @@
+## New Features
+
+- 🤖 **Direct AI Model Providers** — Use OpenAI, Anthropic, Gemini, OpenRouter, Ollama, LM Studio, or a custom OpenAI-compatible endpoint directly from Tolaria.
+- 🖊️ **Markdown Whiteboards** — Create and edit tldraw-powered whiteboards that live as durable Markdown files in your vault.
+- 🧭 **Table of Contents Panel** — Navigate long notes with a lazy, outline-style panel generated from the current document headings.
+- 📄 **Readable Release Notes** — View stable releases through curated notes written for users instead of raw commit lists.
+
+## Improvements
+
+- 🧩 **Cleaner AI Settings** — Configure provider secrets, local models, and AI targets through a more focused settings experience.
+- 💬 **Better Agent Context Handling** — Large AI agent contexts are compacted more safely, and Codex MCP tools are exposed more reliably.
+- 🧱 **Improved Editor Blocks** — Code blocks can be copied more easily, block controls feel steadier, and rich exports avoid unsupported browser APIs.
+- 🗂️ **Smarter Note and Type Handling** — Renames, type changes, frontmatter placeholders, and path identity now behave more consistently across vault flows.
+- 🌍 **Better International Editing** — RTL text direction, IME composition, Korean sidebar copy, and unicode git paths all received focused polish.
+
+## Stability and Fixes
+
+- Embedded diagrams, tldraw whiteboard assets, stale checklist toggles, and stale note open or rename flows were hardened to avoid broken editor states.
+- Vault recovery, missing active vault handling, fresh-note heading paste, and same-path type collisions now fail more gracefully.
+- Linux AppImage startup, MCP resource discovery, release CI, Codacy security findings, and AI provider runtime paths all received stability fixes.

scripts/serve-demo.mjs

@@ -5,7 +5,14 @@
  */
 
 import http from 'http'
-import fs from 'fs'
+import {
+  closeSync,
+  createReadStream,
+  fstatSync,
+  openSync,
+  opendirSync,
+  readFileSync,
+} from 'fs'
 import path from 'path'
 import { fileURLToPath } from 'url'
 import matter from 'gray-matter'
@@ -16,8 +23,71 @@ const REPO_DIR = path.resolve(__dirname, '..')
 const PORT = 5173
 
 function isAllowedPath(p) {
-  const resolved = path.resolve(p)
-  return resolved.startsWith(REPO_DIR)
+  return isInsideRelativePath(path.relative(REPO_DIR, p))
+}
+
+function isInsideRelativePath(relative) {
+  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative))
+}
+
+function resolveInside(root, target) {
+  const normalizedTarget = path.normalize(target)
+  if (path.isAbsolute(normalizedTarget)) return null
+  const candidate = path.normalize(`${root}${path.sep}${normalizedTarget}`)
+  return isInsideRelativePath(path.relative(root, candidate)) ? candidate : null
+}
+
+function readUtf8File(filePath) {
+  const fd = openSync(filePath, 'r')
+  try {
+    return readFileSync(fd, 'utf-8')
+  } finally {
+    closeSync(fd)
+  }
+}
+
+function pathStats(filePath) {
+  const fd = openSync(filePath, 'r')
+  try {
+    return fstatSync(fd)
+  } finally {
+    closeSync(fd)
+  }
+}
+
+function pathExists(filePath) {
+  try {
+    pathStats(filePath)
+    return true
+  } catch {
+    return false
+  }
+}
+
+function directoryEntries(dir) {
+  const directory = opendirSync(dir)
+  try {
+    const entries = []
+    let entry = directory.readSync()
+    while (entry) {
+      entries.push(entry)
+      entry = directory.readSync()
+    }
+    return entries
+  } finally {
+    directory.closeSync()
+  }
+}
+
+function streamFile(filePath) {
+  const fd = openSync(filePath, 'r')
+  return createReadStream(null, { fd, autoClose: true })
+}
+
+function staticAssetPath(url) {
+  const pathname = new URL(url, 'http://localhost').pathname
+  const requested = pathname === '/' ? 'index.html' : decodeURIComponent(pathname).replace(/^\/+/, '')
+  return resolveInside(DIST_DIR, requested) ?? path.normalize(`${DIST_DIR}${path.sep}index.html`)
 }
 
 const MIME = {
@@ -34,8 +104,9 @@ const MIME = {
 function findMarkdownFiles(dir) {
   const results = []
   try {
-    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-      const full = path.join(dir, entry.name)
+    for (const entry of directoryEntries(dir)) {
+      const full = resolveInside(dir, entry.name)
+      if (!full) continue
       if (entry.isDirectory()) results.push(...findMarkdownFiles(full))
       else if (entry.name.endsWith('.md')) results.push(full)
     }
@@ -51,9 +122,9 @@ function extractWikiLinks(value) {
 
 function parseMarkdownFile(filePath) {
   try {
-    const raw = fs.readFileSync(filePath, 'utf-8')
+    const raw = readUtf8File(filePath)
     const { data: fm, content } = matter(raw)
-    const stat = fs.statSync(filePath)
+    const stat = pathStats(filePath)
 
     const DEDICATED = new Set(['aliases','Is A','Belongs to','Related to','Status','Owner','Cadence','Created at'])
     const relationships = {}
@@ -98,7 +169,7 @@ function serveVaultApi(url, res) {
 
   if (params.pathname === '/api/vault/list') {
     const dir = params.searchParams.get('path')
-    if (!dir || !isAllowedPath(dir) || !fs.existsSync(dir)) {
+    if (!dir || !isAllowedPath(dir) || !pathExists(dir)) {
       res.writeHead(400); res.end(JSON.stringify({ error: 'bad path' })); return true
     }
     const entries = findMarkdownFiles(dir).map(parseMarkdownFile).filter(Boolean)
@@ -109,22 +180,22 @@ function serveVaultApi(url, res) {
 
   if (params.pathname === '/api/vault/content') {
     const file = params.searchParams.get('path')
-    if (!file || !isAllowedPath(file) || !fs.existsSync(file)) {
+    if (!file || !isAllowedPath(file) || !pathExists(file)) {
       res.writeHead(400); res.end(JSON.stringify({ error: 'bad path' })); return true
     }
     res.writeHead(200, { 'Content-Type': 'application/json' })
-    res.end(JSON.stringify({ content: fs.readFileSync(file, 'utf-8') }))
+    res.end(JSON.stringify({ content: readUtf8File(file) }))
     return true
   }
 
   if (params.pathname === '/api/vault/all-content') {
     const dir = params.searchParams.get('path')
-    if (!dir || !isAllowedPath(dir) || !fs.existsSync(dir)) {
+    if (!dir || !isAllowedPath(dir) || !pathExists(dir)) {
       res.writeHead(400); res.end(JSON.stringify({ error: 'bad path' })); return true
     }
     const map = {}
     for (const f of findMarkdownFiles(dir)) {
-      try { map[f] = fs.readFileSync(f, 'utf-8') } catch {}
+      try { map[f] = readUtf8File(f) } catch {}
     }
     res.writeHead(200, { 'Content-Type': 'application/json' })
     res.end(JSON.stringify(map))
@@ -146,13 +217,13 @@ const server = http.createServer((req, res) => {
   }
 
   // Static files
-  let filePath = path.join(DIST_DIR, url === '/' ? 'index.html' : url)
-  if (!fs.existsSync(filePath) || fs.statSync(filePath).isDirectory()) {
-    filePath = path.join(DIST_DIR, 'index.html') // SPA fallback
+  let filePath = staticAssetPath(url)
+  if (!pathExists(filePath) || pathStats(filePath).isDirectory()) {
+    filePath = path.normalize(`${DIST_DIR}${path.sep}index.html`) // SPA fallback
   }
   const ext = path.extname(filePath)
   res.writeHead(200, { 'Content-Type': MIME[ext] ?? 'application/octet-stream' })
-  fs.createReadStream(filePath).pipe(res)
+  streamFile(filePath).pipe(res)
 })
 
 server.listen(PORT, '0.0.0.0', () => {

scripts/validate-locales.mjs

@@ -1,4 +1,6 @@
-import fs from 'node:fs'
+import {
+  closeSync, fstatSync, openSync, opendirSync, readFileSync,
+} from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -7,7 +9,42 @@ const localesDir = path.join(root, 'src/lib/locales')
 const sourcePath = path.join(localesDir, 'en.json')
 
 function readCatalog(filePath) {
-  return JSON.parse(fs.readFileSync(filePath, 'utf8'))
+  return JSON.parse(readUtf8File(filePath))
+}
+
+function readUtf8File(filePath) {
+  const fd = openSync(filePath, 'r')
+  try {
+    return readFileSync(fd, 'utf8')
+  } finally {
+    closeSync(fd)
+  }
+}
+
+function directoryFiles(dirPath) {
+  const dir = opendirSync(dirPath)
+  try {
+    const files = []
+    let entry = dir.readSync()
+    while (entry) {
+      if (entry.isFile()) files.push(entry.name)
+      entry = dir.readSync()
+    }
+    return files
+  } finally {
+    dir.closeSync()
+  }
+}
+
+function ensureDirectory(dirPath) {
+  const fd = openSync(dirPath, 'r')
+  try {
+    if (!fstatSync(fd).isDirectory()) {
+      throw new Error(`${dirPath} is not a directory`)
+    }
+  } finally {
+    closeSync(fd)
+  }
 }
 
 function isFlatObject(value) {
@@ -74,7 +111,8 @@ const sourceCatalog = readCatalog(sourcePath)
 assertFlatStringCatalog('en', sourceCatalog)
 
 const sourceKeys = Object.keys(sourceCatalog).sort()
-const localeFiles = fs.readdirSync(localesDir).filter((file) => file.endsWith('.json'))
+ensureDirectory(localesDir)
+const localeFiles = directoryFiles(localesDir).filter((file) => file.endsWith('.json'))
 const issues = []
 
 for (const file of localeFiles) {

src-tauri/Cargo.lock

@@ -892,7 +892,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -1079,7 +1079,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -1486,8 +1486,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1497,9 +1499,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi",
  "wasip2",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -1857,6 +1861,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -2361,6 +2366,12 @@ dependencies = [
  "value-bag",
 ]
 
+[[package]]
+name = "lru-slab"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
+
 [[package]]
 name = "mac"
 version = "0.1.1"
@@ -2897,9 +2908,9 @@ dependencies = [
 
 [[package]]
 name = "openssl"
-version = "0.10.75"
+version = "0.10.78"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08838db121398ad17ab8531ce9de97b244589089e290a384c900cb9ff7434328"
+checksum = "f38c4372413cdaaf3cc79dd92d29d7d9f5ab09b51b10dded508fb90bb70b9222"
 dependencies = [
  "bitflags 2.11.0",
  "cfg-if",
@@ -2929,9 +2940,9 @@ checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
 [[package]]
 name = "openssl-sys"
-version = "0.9.111"
+version = "0.9.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "82cab2d520aa75e3c58898289429321eb788c3106963d0dc886ec7a5f4adc321"
+checksum = "13ce1245cd07fcc4cfdb438f7507b0c7e4f3849a69fd84d52374c66d83741bb6"
 dependencies = [
  "cc",
  "libc",
@@ -3391,6 +3402,61 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quinn"
+version = "0.11.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+dependencies = [
+ "bytes",
+ "cfg_aliases",
+ "pin-project-lite",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
+ "socket2",
+ "thiserror 2.0.18",
+ "tokio",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-proto"
+version = "0.11.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+dependencies = [
+ "bytes",
+ "getrandom 0.3.4",
+ "lru-slab",
+ "rand 0.9.4",
+ "ring",
+ "rustc-hash",
+ "rustls",
+ "rustls-pki-types",
+ "slab",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "web-time",
+]
+
+[[package]]
+name = "quinn-udp"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "addec6a0dcad8a8d96a771f815f0eaf55f9d1805756410b39f5fa81332574cbd"
+dependencies = [
+ "cfg_aliases",
+ "libc",
+ "once_cell",
+ "socket2",
+ "tracing",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.44"
@@ -3437,6 +3503,16 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "rand"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.2.2"
@@ -3457,6 +3533,16 @@ dependencies = [
  "rand_core 0.6.4",
 ]
 
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.5",
+]
+
 [[package]]
 name = "rand_core"
 version = "0.5.1"
@@ -3475,6 +3561,15 @@ dependencies = [
  "getrandom 0.2.17",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
+dependencies = [
+ "getrandom 0.3.4",
+]
+
 [[package]]
 name = "rand_hc"
 version = "0.2.0"
@@ -3612,6 +3707,7 @@ dependencies = [
  "http-body",
  "http-body-util",
  "hyper",
+ "hyper-rustls",
  "hyper-tls",
  "hyper-util",
  "js-sys",
@@ -3619,6 +3715,8 @@ dependencies = [
  "native-tls",
  "percent-encoding",
  "pin-project-lite",
+ "quinn",
+ "rustls",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -3626,6 +3724,7 @@ dependencies = [
  "sync_wrapper",
  "tokio",
  "tokio-native-tls",
+ "tokio-rustls",
  "tower",
  "tower-http",
  "tower-service",
@@ -3633,6 +3732,7 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -3763,6 +3863,12 @@ version = "0.1.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
 
+[[package]]
+name = "rustc-hash"
+version = "2.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+
 [[package]]
 name = "rustc_version"
 version = "0.4.1"
@@ -3782,7 +3888,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3817,6 +3923,7 @@ version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be040f8b0a225e40375822a563fa9524378b9d63112f53e19ffff34df5d33fdd"
 dependencies = [
+ "web-time",
  "zeroize",
 ]
 
@@ -3838,7 +3945,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3849,9 +3956,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "8279bb85272c9f10811ae6a6c547ff594d6a7f3c6c6b02ee9726d1d0dcfcdd06"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -4603,9 +4710,9 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tar"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d863878d212c87a19c1a610eb53bb01fe12951c0501cf5a0d65f724914a667a"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
 dependencies = [
  "filetime",
  "libc",
@@ -5002,7 +5109,7 @@ dependencies = [
  "getrandom 0.4.1",
  "once_cell",
  "rustix",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5185,6 +5292,7 @@ dependencies = [
  "log",
  "notify",
  "regex",
+ "reqwest 0.12.28",
  "sentry",
  "serde",
  "serde_json",
@@ -5808,6 +5916,16 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "web-time"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a6580f308b1fad9207618087a65c04e7a10bc77e02c8e84e9b00dd4b12fa0bb"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
 [[package]]
 name = "webkit2gtk"
 version = "2.0.2"
@@ -5861,6 +5979,15 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52f5ee44c96cf55f1b349600768e3ece3a8f26010c05265ab73f945bb1a2eb9d"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "webview2-com"
 version = "0.38.2"
@@ -5919,7 +6046,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]

src-tauri/Cargo.toml

@@ -39,5 +39,6 @@ tauri-plugin-prevent-default = "4.0.4"
 sentry = "0.37"
 uuid = { version = "1", features = ["v4"] }
 tempfile = "3"
+reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
 
 [dev-dependencies]

src-tauri/src/ai_models.rs

@@ -0,0 +1,701 @@
+use crate::ai_agents::AiAgentStreamEvent;
+use serde::{Deserialize, Serialize};
+use std::collections::BTreeMap;
+use std::fs;
+use std::path::Path;
+use std::sync::OnceLock;
+
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum AiModelProviderKind {
+    OpenAi,
+    Anthropic,
+    OpenAiCompatible,
+    Ollama,
+    LmStudio,
+    OpenRouter,
+    Gemini,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+#[serde(rename_all = "snake_case")]
+pub enum AiModelApiKeyStorage {
+    None,
+    Env,
+    LocalFile,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct AiModelCapabilities {
+    pub streaming: bool,
+    pub tools: bool,
+    pub vision: bool,
+    pub json_mode: bool,
+    pub reasoning: bool,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct AiModelDefinition {
+    pub id: String,
+    pub display_name: Option<String>,
+    pub context_window: Option<u32>,
+    pub max_output_tokens: Option<u32>,
+    pub capabilities: AiModelCapabilities,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)]
+pub struct AiModelProvider {
+    pub id: String,
+    pub name: String,
+    pub kind: AiModelProviderKind,
+    pub base_url: Option<String>,
+    pub api_key_storage: Option<AiModelApiKeyStorage>,
+    pub api_key_env_var: Option<String>,
+    pub headers: Option<BTreeMap<String, String>>,
+    pub models: Vec<AiModelDefinition>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct AiModelStreamRequest {
+    pub provider: AiModelProvider,
+    pub model_id: String,
+    pub message: String,
+    pub system_prompt: Option<String>,
+    pub api_key_override: Option<String>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+pub struct AiModelProviderTestRequest {
+    pub provider: AiModelProvider,
+    pub model_id: String,
+    pub api_key_override: Option<String>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+struct AiModelProviderCatalogEntry {
+    kind: AiModelProviderKind,
+    runtime_base_url: Option<String>,
+}
+
+#[derive(Debug, Clone, Default, Deserialize, Serialize, PartialEq, Eq)]
+struct AiProviderSecrets {
+    provider_api_keys: BTreeMap<String, String>,
+}
+
+static AI_MODEL_PROVIDER_CATALOG: OnceLock<Vec<AiModelProviderCatalogEntry>> = OnceLock::new();
+
+fn provider_catalog() -> &'static [AiModelProviderCatalogEntry] {
+    AI_MODEL_PROVIDER_CATALOG
+        .get_or_init(|| {
+            serde_json::from_str(include_str!("../../src/shared/aiModelProviderCatalog.json"))
+                .expect("bundled AI model provider catalog must be valid JSON")
+        })
+        .as_slice()
+}
+
+fn provider_default_base_url(kind: &AiModelProviderKind) -> Option<&'static str> {
+    provider_catalog()
+        .iter()
+        .find(|entry| entry.kind == *kind)
+        .and_then(|entry| entry.runtime_base_url.as_deref())
+}
+
+pub fn normalize_ai_model_providers(
+    providers: Option<Vec<AiModelProvider>>,
+) -> Option<Vec<AiModelProvider>> {
+    let normalized = providers?
+        .into_iter()
+        .filter_map(normalize_ai_model_provider)
+        .collect::<Vec<_>>();
+    if normalized.is_empty() {
+        None
+    } else {
+        Some(normalized)
+    }
+}
+
+fn normalize_ai_model_provider(mut provider: AiModelProvider) -> Option<AiModelProvider> {
+    provider.id = provider.id.trim().to_ascii_lowercase();
+    provider.name = provider.name.trim().to_string();
+    provider.base_url = normalize_optional_string(provider.base_url);
+    provider.api_key_env_var = normalize_optional_string(provider.api_key_env_var);
+    provider.api_key_storage = normalize_api_key_storage(&provider);
+    provider.models = normalized_models(provider.models);
+
+    is_valid_provider(&provider).then_some(provider)
+}
+
+fn normalize_api_key_storage(provider: &AiModelProvider) -> Option<AiModelApiKeyStorage> {
+    match provider.api_key_storage {
+        Some(AiModelApiKeyStorage::LocalFile) => Some(AiModelApiKeyStorage::LocalFile),
+        Some(AiModelApiKeyStorage::Env) | None if provider.api_key_env_var.is_some() => {
+            Some(AiModelApiKeyStorage::Env)
+        }
+        _ => Some(AiModelApiKeyStorage::None),
+    }
+}
+
+fn normalized_models(models: Vec<AiModelDefinition>) -> Vec<AiModelDefinition> {
+    models
+        .into_iter()
+        .filter_map(|mut model| {
+            model.id = model.id.trim().to_string();
+            model.display_name = normalize_optional_string(model.display_name);
+            (!model.id.is_empty()).then_some(model)
+        })
+        .collect()
+}
+
+fn is_valid_provider(provider: &AiModelProvider) -> bool {
+    !provider.id.is_empty() && !provider.name.is_empty() && !provider.models.is_empty()
+}
+
+fn normalize_optional_string(value: Option<String>) -> Option<String> {
+    value
+        .map(|candidate| candidate.trim().to_string())
+        .filter(|candidate| !candidate.is_empty())
+}
+
+pub fn run_ai_model_stream<F>(request: AiModelStreamRequest, mut emit: F) -> Result<String, String>
+where
+    F: FnMut(AiAgentStreamEvent),
+{
+    emit(AiAgentStreamEvent::Init {
+        session_id: format!("api-{}", uuid::Uuid::new_v4()),
+    });
+
+    let text = send_model_message(&request)?;
+
+    emit(AiAgentStreamEvent::TextDelta { text });
+    emit(AiAgentStreamEvent::Done);
+    Ok(String::new())
+}
+
+pub fn test_ai_model_provider(request: AiModelProviderTestRequest) -> Result<String, String> {
+    let request = AiModelStreamRequest {
+        provider: request.provider,
+        model_id: request.model_id,
+        message: "Reply with exactly OK.".into(),
+        system_prompt: Some(
+            "You are testing whether this model endpoint is reachable. Reply with exactly OK."
+                .into(),
+        ),
+        api_key_override: normalize_optional_string(request.api_key_override),
+    };
+    send_model_message(&request)
+}
+
+fn send_model_message(request: &AiModelStreamRequest) -> Result<String, String> {
+    match request.provider.kind {
+        AiModelProviderKind::Anthropic => send_anthropic_message(request),
+        _ => send_openai_compatible_message(request),
+    }
+}
+
+fn send_openai_compatible_message(request: &AiModelStreamRequest) -> Result<String, String> {
+    let endpoint = format!("{}/chat/completions", normalized_base_url(request)?);
+    let mut messages = Vec::new();
+    if let Some(system_prompt) = non_empty_option(request.system_prompt.as_deref()) {
+        messages.push(serde_json::json!({ "role": "system", "content": system_prompt }));
+    }
+    messages.push(serde_json::json!({ "role": "user", "content": request.message }));
+
+    let payload = serde_json::json!({
+        "model": request.model_id,
+        "messages": messages,
+        "stream": false
+    });
+    let json = send_json_request(request, endpoint, payload)?;
+    extract_openai_text(&json)
+}
+
+fn send_anthropic_message(request: &AiModelStreamRequest) -> Result<String, String> {
+    let endpoint = format!("{}/messages", normalized_base_url(request)?);
+    let mut payload = serde_json::json!({
+        "model": request.model_id,
+        "max_tokens": selected_max_tokens(request),
+        "messages": [{ "role": "user", "content": request.message }]
+    });
+
+    if let Some(system_prompt) = non_empty_option(request.system_prompt.as_deref()) {
+        payload["system"] = serde_json::Value::String(system_prompt.to_string());
+    }
+
+    let json = send_json_request(request, endpoint, payload)?;
+    extract_anthropic_text(&json)
+}
+
+fn selected_max_tokens(request: &AiModelStreamRequest) -> u32 {
+    request
+        .provider
+        .models
+        .iter()
+        .find(|model| model.id == request.model_id)
+        .and_then(|model| model.max_output_tokens)
+        .unwrap_or(4096)
+}
+
+fn normalized_base_url(request: &AiModelStreamRequest) -> Result<String, String> {
+    let fallback = provider_default_base_url(&request.provider.kind).unwrap_or("");
+    let base = request
+        .provider
+        .base_url
+        .as_deref()
+        .and_then(non_empty_str)
+        .unwrap_or(fallback)
+        .trim_end_matches('/');
+    if base.is_empty() {
+        return Err("Custom API providers need a base URL.".into());
+    }
+    Ok(base.to_string())
+}
+
+fn send_json_request(
+    request: &AiModelStreamRequest,
+    endpoint: String,
+    payload: serde_json::Value,
+) -> Result<serde_json::Value, String> {
+    let client = reqwest::blocking::Client::builder()
+        .timeout(std::time::Duration::from_secs(120))
+        .build()
+        .map_err(|error| format!("Failed to create HTTP client: {error}"))?;
+    let builder = client.post(endpoint).json(&payload);
+    let builder = apply_auth_headers(builder, request)?;
+    let builder = apply_provider_headers(builder, request);
+    let response = send_provider_request(builder)?;
+    let status = response.status();
+    let text = response
+        .text()
+        .map_err(|error| format!("Failed to read AI provider response: {error}"))?;
+    if !status.is_success() {
+        return Err(format!(
+            "AI provider returned {status}: {}",
+            truncate_error(&text)
+        ));
+    }
+    serde_json::from_str(&text)
+        .map_err(|error| format!("Failed to parse AI provider response: {error}"))
+}
+
+fn apply_auth_headers(
+    builder: reqwest::blocking::RequestBuilder,
+    request: &AiModelStreamRequest,
+) -> Result<reqwest::blocking::RequestBuilder, String> {
+    let Some(api_key) = api_key_from_provider(request)? else {
+        return Ok(builder);
+    };
+
+    Ok(match request.provider.kind {
+        AiModelProviderKind::Anthropic => builder.header("x-api-key", api_key),
+        _ => builder.bearer_auth(api_key),
+    })
+}
+
+fn apply_provider_headers(
+    mut builder: reqwest::blocking::RequestBuilder,
+    request: &AiModelStreamRequest,
+) -> reqwest::blocking::RequestBuilder {
+    if matches!(request.provider.kind, AiModelProviderKind::Anthropic) {
+        builder = builder.header("anthropic-version", "2023-06-01");
+    }
+    for (key, value) in safe_custom_headers(request) {
+        builder = builder.header(key, value);
+    }
+    builder
+}
+
+fn safe_custom_headers(request: &AiModelStreamRequest) -> Vec<(&String, &String)> {
+    request
+        .provider
+        .headers
+        .as_ref()
+        .into_iter()
+        .flat_map(|headers| headers.iter())
+        .filter(|(key, value)| {
+            !key.eq_ignore_ascii_case("authorization") && non_empty_option(Some(value)).is_some()
+        })
+        .collect()
+}
+
+fn send_provider_request(
+    builder: reqwest::blocking::RequestBuilder,
+) -> Result<reqwest::blocking::Response, String> {
+    builder
+        .send()
+        .map_err(|error| format!("AI provider request failed: {error}"))
+}
+
+pub fn save_provider_api_key(provider_id: String, api_key: String) -> Result<(), String> {
+    let provider_id = normalize_secret_provider_id(&provider_id)?;
+    let api_key = api_key.trim().to_string();
+    if api_key.is_empty() {
+        return Err("API key cannot be empty.".into());
+    }
+    let path = secrets_path()?;
+    let mut secrets = read_secrets_at(&path)?;
+    secrets.provider_api_keys.insert(provider_id, api_key);
+    write_secrets_at(&path, &secrets)
+}
+
+pub fn delete_provider_api_key(provider_id: String) -> Result<(), String> {
+    let provider_id = normalize_secret_provider_id(&provider_id)?;
+    let path = secrets_path()?;
+    let mut secrets = read_secrets_at(&path)?;
+    secrets.provider_api_keys.remove(&provider_id);
+    write_secrets_at(&path, &secrets)
+}
+
+fn normalize_secret_provider_id(provider_id: &str) -> Result<String, String> {
+    let provider_id = provider_id.trim().to_ascii_lowercase();
+    if provider_id.is_empty() {
+        Err("Provider ID cannot be empty.".into())
+    } else {
+        Ok(provider_id)
+    }
+}
+
+fn secrets_path() -> Result<std::path::PathBuf, String> {
+    crate::settings::preferred_app_config_path("ai-provider-secrets.json")
+}
+
+fn read_secrets_at(path: &Path) -> Result<AiProviderSecrets, String> {
+    if !path.exists() {
+        return Ok(AiProviderSecrets::default());
+    }
+    let content = fs::read_to_string(path)
+        .map_err(|error| format!("Failed to read AI provider secrets: {error}"))?;
+    serde_json::from_str(&content)
+        .map_err(|error| format!("Failed to parse AI provider secrets: {error}"))
+}
+
+fn write_secrets_at(path: &Path, secrets: &AiProviderSecrets) -> Result<(), String> {
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent)
+            .map_err(|error| format!("Failed to create AI provider secrets directory: {error}"))?;
+    }
+    let json = serde_json::to_string_pretty(secrets)
+        .map_err(|error| format!("Failed to serialize AI provider secrets: {error}"))?;
+    write_secret_file(path, json)
+}
+
+#[cfg(unix)]
+fn write_secret_file(path: &Path, content: String) -> Result<(), String> {
+    use std::io::Write;
+    use std::os::unix::fs::OpenOptionsExt;
+    use std::os::unix::fs::PermissionsExt;
+
+    let mut file = fs::OpenOptions::new()
+        .create(true)
+        .truncate(true)
+        .write(true)
+        .mode(0o600)
+        .open(path)
+        .map_err(|error| format!("Failed to open AI provider secrets file: {error}"))?;
+    file.write_all(content.as_bytes())
+        .map_err(|error| format!("Failed to write AI provider secrets: {error}"))?;
+    fs::set_permissions(path, fs::Permissions::from_mode(0o600))
+        .map_err(|error| format!("Failed to secure AI provider secrets file: {error}"))
+}
+
+#[cfg(not(unix))]
+fn write_secret_file(path: &Path, content: String) -> Result<(), String> {
+    fs::write(path, content)
+        .map_err(|error| format!("Failed to write AI provider secrets: {error}"))
+}
+
+fn api_key_from_local_file(request: &AiModelStreamRequest) -> Result<Option<String>, String> {
+    let secrets = read_secrets_at(&secrets_path()?)?;
+    let api_key = secrets
+        .provider_api_keys
+        .get(&request.provider.id)
+        .map(|value| value.trim().to_string())
+        .filter(|value| !value.is_empty());
+    if api_key.is_none() {
+        return Err(format!(
+            "No local API key is saved for {}.",
+            request.provider.name
+        ));
+    }
+    Ok(api_key)
+}
+
+fn api_key_from_env(request: &AiModelStreamRequest) -> Result<Option<String>, String> {
+    let Some(name) = request
+        .provider
+        .api_key_env_var
+        .as_deref()
+        .and_then(non_empty_str)
+    else {
+        return Ok(None);
+    };
+
+    std::env::var(name)
+        .map(Some)
+        .map_err(|_| format!("Environment variable {name} is not set for this AI provider."))
+}
+
+fn api_key_from_provider(request: &AiModelStreamRequest) -> Result<Option<String>, String> {
+    if let Some(api_key) = request
+        .api_key_override
+        .as_deref()
+        .and_then(non_empty_str)
+        .map(str::to_string)
+    {
+        return Ok(Some(api_key));
+    }
+
+    match request.provider.api_key_storage {
+        Some(AiModelApiKeyStorage::LocalFile) => api_key_from_local_file(request),
+        Some(AiModelApiKeyStorage::Env) => api_key_from_env(request),
+        _ => Ok(None),
+    }
+}
+
+fn extract_openai_text(json: &serde_json::Value) -> Result<String, String> {
+    json["choices"][0]["message"]["content"]
+        .as_str()
+        .map(str::to_string)
+        .filter(|text| !text.trim().is_empty())
+        .ok_or_else(|| "AI provider response did not include assistant text.".to_string())
+}
+
+fn extract_anthropic_text(json: &serde_json::Value) -> Result<String, String> {
+    let text = json["content"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .filter_map(|block| block["text"].as_str())
+        .collect::<Vec<_>>()
+        .join("");
+    if text.trim().is_empty() {
+        Err("Anthropic response did not include assistant text.".into())
+    } else {
+        Ok(text)
+    }
+}
+
+fn non_empty_option(value: Option<&str>) -> Option<&str> {
+    value.map(str::trim).filter(|value| !value.is_empty())
+}
+
+fn non_empty_str(value: &str) -> Option<&str> {
+    non_empty_option(Some(value))
+}
+
+fn truncate_error(value: &str) -> String {
+    const MAX_ERROR_LENGTH: usize = 600;
+    if value.len() <= MAX_ERROR_LENGTH {
+        return value.to_string();
+    }
+    format!("{}...", &value[..MAX_ERROR_LENGTH])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    fn capabilities() -> AiModelCapabilities {
+        AiModelCapabilities {
+            streaming: true,
+            tools: false,
+            vision: false,
+            json_mode: true,
+            reasoning: false,
+        }
+    }
+
+    fn model(id: &str) -> AiModelDefinition {
+        AiModelDefinition {
+            id: id.into(),
+            display_name: Some(" Demo Model ".into()),
+            context_window: Some(128_000),
+            max_output_tokens: Some(8192),
+            capabilities: capabilities(),
+        }
+    }
+
+    fn provider(kind: AiModelProviderKind) -> AiModelProvider {
+        AiModelProvider {
+            id: " Demo ".into(),
+            name: " Demo Provider ".into(),
+            kind,
+            base_url: Some(" https://example.com/v1/ ".into()),
+            api_key_storage: None,
+            api_key_env_var: Some(" DEMO_API_KEY ".into()),
+            headers: None,
+            models: vec![model(" demo-model "), model("  ")],
+        }
+    }
+
+    fn request(provider: AiModelProvider) -> AiModelStreamRequest {
+        AiModelStreamRequest {
+            provider,
+            model_id: "demo-model".into(),
+            message: "Hello".into(),
+            system_prompt: Some("  Be concise.  ".into()),
+            api_key_override: None,
+        }
+    }
+
+    #[test]
+    fn normalize_providers_trims_values_and_filters_invalid_entries() {
+        let invalid = AiModelProvider {
+            id: " ".into(),
+            name: "Missing".into(),
+            kind: AiModelProviderKind::OpenAiCompatible,
+            base_url: None,
+            api_key_storage: None,
+            api_key_env_var: None,
+            headers: None,
+            models: vec![model("ignored")],
+        };
+
+        let providers = normalize_ai_model_providers(Some(vec![
+            invalid,
+            provider(AiModelProviderKind::OpenAiCompatible),
+        ]))
+        .expect("valid provider should remain");
+
+        assert_eq!(providers.len(), 1);
+        let normalized = &providers[0];
+        assert_eq!(normalized.id, "demo");
+        assert_eq!(normalized.name, "Demo Provider");
+        assert_eq!(
+            normalized.base_url.as_deref(),
+            Some("https://example.com/v1/")
+        );
+        assert_eq!(normalized.api_key_env_var.as_deref(), Some("DEMO_API_KEY"));
+        assert_eq!(normalized.api_key_storage, Some(AiModelApiKeyStorage::Env));
+        assert_eq!(normalized.models.len(), 1);
+        assert_eq!(normalized.models[0].id, "demo-model");
+        assert_eq!(
+            normalized.models[0].display_name.as_deref(),
+            Some("Demo Model")
+        );
+    }
+
+    #[test]
+    fn normalize_providers_returns_none_for_missing_or_empty_sets() {
+        assert_eq!(normalize_ai_model_providers(None), None);
+        assert_eq!(normalize_ai_model_providers(Some(Vec::new())), None);
+    }
+
+    #[test]
+    fn model_request_helpers_resolve_defaults_and_safe_headers() {
+        let mut provider = provider(AiModelProviderKind::Anthropic);
+        provider.base_url = None;
+        provider.headers = Some(BTreeMap::from([
+            ("Authorization".into(), "ignored".into()),
+            ("X-Demo".into(), "demo".into()),
+            ("X-Blank".into(), "   ".into()),
+        ]));
+        provider.models = vec![model("demo-model")];
+        let request = request(provider);
+        let headers = safe_custom_headers(&request)
+            .into_iter()
+            .map(|(key, value)| (key.as_str(), value.as_str()))
+            .collect::<Vec<_>>();
+
+        assert_eq!(
+            normalized_base_url(&request).unwrap(),
+            "https://api.anthropic.com/v1"
+        );
+        assert_eq!(selected_max_tokens(&request), 8192);
+        assert_eq!(headers, vec![("X-Demo", "demo")]);
+    }
+
+    #[test]
+    fn shared_provider_catalog_supplies_runtime_base_urls() {
+        assert_eq!(
+            provider_default_base_url(&AiModelProviderKind::OpenAi),
+            Some("https://api.openai.com/v1")
+        );
+        assert_eq!(
+            provider_default_base_url(&AiModelProviderKind::Ollama),
+            Some("http://localhost:11434/v1")
+        );
+        assert_eq!(
+            provider_default_base_url(&AiModelProviderKind::OpenAiCompatible),
+            None
+        );
+    }
+
+    #[test]
+    fn custom_provider_requires_base_url() {
+        let mut provider = provider(AiModelProviderKind::OpenAiCompatible);
+        provider.base_url = Some(" ".into());
+
+        assert_eq!(
+            normalized_base_url(&request(provider)).unwrap_err(),
+            "Custom API providers need a base URL.",
+        );
+    }
+
+    #[test]
+    fn extracts_provider_text_payloads_and_reports_empty_responses() {
+        let openai = json!({
+            "choices": [{ "message": { "content": "Hello from OpenAI" } }]
+        });
+        let anthropic = json!({
+            "content": [
+                { "text": "Hello " },
+                { "text": "from Anthropic" }
+            ]
+        });
+
+        assert_eq!(extract_openai_text(&openai).unwrap(), "Hello from OpenAI");
+        assert_eq!(
+            extract_anthropic_text(&anthropic).unwrap(),
+            "Hello from Anthropic"
+        );
+        assert_eq!(
+            extract_openai_text(&json!({ "choices": [] })).unwrap_err(),
+            "AI provider response did not include assistant text.",
+        );
+        assert_eq!(
+            extract_anthropic_text(&json!({ "content": [{ "type": "thinking" }] })).unwrap_err(),
+            "Anthropic response did not include assistant text.",
+        );
+    }
+
+    #[test]
+    fn saves_reads_and_validates_local_provider_secrets() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("nested/secrets.json");
+        let secrets = AiProviderSecrets {
+            provider_api_keys: BTreeMap::from([("demo".into(), "secret".into())]),
+        };
+
+        write_secrets_at(&path, &secrets).unwrap();
+
+        assert_eq!(read_secrets_at(&path).unwrap(), secrets);
+        assert_eq!(
+            read_secrets_at(&dir.path().join("missing.json")).unwrap(),
+            AiProviderSecrets::default()
+        );
+        assert_eq!(normalize_secret_provider_id(" Demo ").unwrap(), "demo");
+        assert_eq!(
+            normalize_secret_provider_id(" ").unwrap_err(),
+            "Provider ID cannot be empty.",
+        );
+
+        #[cfg(unix)]
+        {
+            use std::os::unix::fs::PermissionsExt;
+
+            let mode = fs::metadata(&path).unwrap().permissions().mode() & 0o777;
+            assert_eq!(mode, 0o600);
+        }
+    }
+
+    #[test]
+    fn truncates_long_provider_errors_without_touching_short_errors() {
+        let short = "provider unavailable";
+        let long = "x".repeat(605);
+
+        assert_eq!(truncate_error(short), short);
+        assert_eq!(truncate_error(&long).len(), 603);
+        assert!(truncate_error(&long).ends_with("..."));
+    }
+}

src-tauri/src/codex_cli.rs

@@ -39,13 +39,21 @@ fn find_codex_binary() -> Result<PathBuf, String> {
 }
 
 fn find_codex_binary_on_path() -> Option<PathBuf> {
-    crate::hidden_command("which")
+    crate::hidden_command(codex_path_lookup_command())
         .arg("codex")
         .output()
         .ok()
         .and_then(|output| path_from_successful_output(&output))
 }
 
+fn codex_path_lookup_command() -> &'static str {
+    if cfg!(windows) {
+        "where"
+    } else {
+        "which"
+    }
+}
+
 fn find_codex_binary_in_user_shell() -> Option<PathBuf> {
     user_shell_candidates()
         .into_iter()
@@ -102,13 +110,27 @@ fn codex_binary_candidates() -> Vec<PathBuf> {
 fn codex_binary_candidates_for_home(home: &Path) -> Vec<PathBuf> {
     let mut candidates = vec![
         home.join(".local/bin/codex"),
+        home.join(".local/bin/codex.exe"),
         home.join(".codex/bin/codex"),
+        home.join(".codex/bin/codex.exe"),
         home.join(".local/share/mise/shims/codex"),
+        home.join(".local/share/mise/shims/codex.exe"),
         home.join(".asdf/shims/codex"),
+        home.join(".asdf/shims/codex.exe"),
         home.join(".npm-global/bin/codex"),
+        home.join(".npm-global/bin/codex.cmd"),
+        home.join(".npm-global/bin/codex.exe"),
         home.join(".npm/bin/codex"),
+        home.join(".npm/bin/codex.cmd"),
+        home.join(".npm/bin/codex.exe"),
         home.join(".bun/bin/codex"),
+        home.join(".bun/bin/codex.exe"),
         home.join(".linuxbrew/bin/codex"),
+        home.join("AppData/Roaming/npm/codex.cmd"),
+        home.join("AppData/Roaming/npm/codex.exe"),
+        home.join("AppData/Local/pnpm/codex.cmd"),
+        home.join("AppData/Local/pnpm/codex.exe"),
+        home.join("scoop/shims/codex.exe"),
         PathBuf::from("/home/linuxbrew/.linuxbrew/bin/codex"),
         PathBuf::from("/usr/local/bin/codex"),
         PathBuf::from("/opt/homebrew/bin/codex"),
@@ -156,7 +178,7 @@ where
     let last_message_path = last_message_dir.path().join("last-message.txt");
     let args = build_codex_args(&request, Some(&last_message_path))?;
     let prompt = build_codex_prompt(&request);
-    let command = build_codex_command(binary, args, prompt, &request.vault_path);
+    let command = build_codex_command(binary, args, prompt, &request.vault_path)?;
     let emit = with_codex_last_message_fallback(emit, last_message_path);
 
     crate::cli_agent_runtime::run_ai_agent_json_stream(
@@ -201,16 +223,79 @@ fn build_codex_command(
     args: Vec<String>,
     prompt: String,
     vault_path: &str,
-) -> std::process::Command {
-    let mut command = crate::hidden_command(binary);
+) -> Result<std::process::Command, String> {
+    let target = codex_command_target(binary)?;
+    let mut command = crate::hidden_command(&target.program);
     crate::cli_agent_runtime::configure_agent_command_environment(&mut command, binary);
+    if let Some(first_arg) = target.first_arg {
+        command.arg(first_arg);
+    }
     command
         .args(args)
         .arg(prompt)
         .current_dir(vault_path)
+        .stdin(Stdio::null())
         .stdout(Stdio::piped())
         .stderr(Stdio::piped());
-    command
+    Ok(command)
+}
+
+struct CodexCommandTarget {
+    program: PathBuf,
+    first_arg: Option<PathBuf>,
+}
+
+fn codex_command_target(binary: &Path) -> Result<CodexCommandTarget, String> {
+    if is_windows_batch_shim(binary) {
+        if let Some(script) = node_script_from_windows_cmd_shim(binary) {
+            return Ok(CodexCommandTarget {
+                program: crate::mcp::find_node()?,
+                first_arg: Some(script),
+            });
+        }
+    }
+
+    Ok(CodexCommandTarget {
+        program: binary.to_path_buf(),
+        first_arg: None,
+    })
+}
+
+fn is_windows_batch_shim(binary: &Path) -> bool {
+    binary
+        .extension()
+        .and_then(|extension| extension.to_str())
+        .is_some_and(|extension| {
+            extension.eq_ignore_ascii_case("cmd") || extension.eq_ignore_ascii_case("bat")
+        })
+}
+
+fn node_script_from_windows_cmd_shim(binary: &Path) -> Option<PathBuf> {
+    let contents = std::fs::read_to_string(binary).ok()?;
+    contents
+        .split('"')
+        .skip(1)
+        .step_by(2)
+        .filter(|token| is_node_script_token(token))
+        .find_map(|token| resolve_cmd_shim_script_path(binary, token))
+}
+
+fn is_node_script_token(token: &str) -> bool {
+    let lower = token.to_ascii_lowercase();
+    (lower.ends_with(".js") || lower.ends_with(".mjs") || lower.ends_with(".cjs"))
+        && (lower.starts_with("%dp0%") || lower.starts_with("%~dp0"))
+}
+
+fn resolve_cmd_shim_script_path(binary: &Path, token: &str) -> Option<PathBuf> {
+    let relative = token
+        .strip_prefix("%dp0%")
+        .or_else(|| token.strip_prefix("%~dp0"))?
+        .trim_start_matches(['\\', '/']);
+    let mut script = binary.parent()?.to_path_buf();
+    for part in relative.split(['\\', '/']).filter(|part| !part.is_empty()) {
+        script.push(part);
+    }
+    script.is_file().then_some(script)
 }
 
 fn build_codex_args(
@@ -218,6 +303,7 @@ fn build_codex_args(
     last_message_path: Option<&Path>,
 ) -> Result<Vec<String>, String> {
     let mcp_server_path = crate::cli_agent_runtime::mcp_server_path_string()?;
+    let node_path = crate::mcp::find_node()?;
 
     let mut args = vec![
         "--sandbox".into(),
@@ -229,14 +315,11 @@ fn build_codex_args(
         "-C".into(),
         request.vault_path.clone(),
         "-c".into(),
-        r#"mcp_servers.tolaria.command="node""#.into(),
+        codex_config_string("mcp_servers.tolaria.command", &node_path.to_string_lossy()),
         "-c".into(),
-        format!(r#"mcp_servers.tolaria.args=["{}"]"#, mcp_server_path),
+        codex_config_string_list("mcp_servers.tolaria.args", &[mcp_server_path.as_str()]),
         "-c".into(),
-        format!(
-            r#"mcp_servers.tolaria.env={{VAULT_PATH="{}"}}"#,
-            request.vault_path
-        ),
+        codex_mcp_env_config(&request.vault_path),
     ];
 
     if let Some(path) = last_message_path {
@@ -247,6 +330,30 @@ fn build_codex_args(
     Ok(args)
 }
 
+fn codex_config_string(key: &str, value: &str) -> String {
+    format!(r#"{key}="{}""#, toml_escape(value))
+}
+
+fn codex_config_string_list(key: &str, values: &[&str]) -> String {
+    let values = values
+        .iter()
+        .map(|value| format!(r#""{}""#, toml_escape(value)))
+        .collect::<Vec<_>>()
+        .join(",");
+    format!("{key}=[{values}]")
+}
+
+fn codex_mcp_env_config(vault_path: &str) -> String {
+    format!(
+        r#"mcp_servers.tolaria.env={{VAULT_PATH="{}",WS_UI_PORT="9711"}}"#,
+        toml_escape(vault_path)
+    )
+}
+
+fn toml_escape(value: &str) -> String {
+    value.replace('\\', r#"\\"#).replace('"', r#"\""#)
+}
+
 fn codex_sandbox(permission_mode: crate::ai_agents::AiAgentPermissionMode) -> &'static str {
     match permission_mode {
         crate::ai_agents::AiAgentPermissionMode::Safe => "read-only",
@@ -543,11 +650,40 @@ mod tests {
         }
     }
 
+    #[test]
+    fn build_codex_args_uses_resolved_mcp_node_and_ui_bridge_env() {
+        let args = build_codex_args(
+            &AgentStreamRequest {
+                message: "Read [[Test note]]".into(),
+                system_prompt: None,
+                vault_path: "/tmp/vault".into(),
+                permission_mode: AiAgentPermissionMode::Safe,
+            },
+            None,
+        )
+        .unwrap();
+
+        let command_override = args
+            .iter()
+            .find(|arg| arg.starts_with("mcp_servers.tolaria.command="))
+            .expect("Codex should receive a transient Tolaria MCP command");
+
+        assert!(
+            !command_override.ends_with(r#""node""#),
+            "Codex MCP command should use Tolaria's resolved Node path, got {command_override}"
+        );
+        assert!(
+            command_override.contains('/'),
+            "Codex MCP command should be an absolute Node path, got {command_override}"
+        );
+        assert!(args.iter().any(|arg| arg.contains(r#"WS_UI_PORT="9711""#)));
+    }
+
     #[test]
     fn build_codex_command_keeps_agent_process_contract() {
         let binary = PathBuf::from("codex");
         let args = vec!["exec".to_string(), "--json".to_string()];
-        let command = build_codex_command(&binary, args, "Summarize".into(), "/tmp/vault");
+        let command = build_codex_command(&binary, args, "Summarize".into(), "/tmp/vault").unwrap();
         let actual_args: Vec<&OsStr> = command.get_args().collect();
 
         assert_eq!(command.get_program(), OsStr::new("codex"));
@@ -570,7 +706,8 @@ mod tests {
             vec!["exec".to_string(), "--json".to_string()],
             "Summarize".into(),
             "/tmp/vault",
-        );
+        )
+        .unwrap();
         let path_value = command
             .get_envs()
             .find(|(key, _)| *key == OsStr::new("PATH"))
@@ -584,6 +721,51 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_codex_command_avoids_windows_cmd_shim_for_complex_args() {
+        let dir = tempfile::tempdir().unwrap();
+        let shim = dir.path().join("codex.cmd");
+        let script = dir
+            .path()
+            .join("node_modules")
+            .join("@openai")
+            .join("codex")
+            .join("bin")
+            .join("codex.js");
+        std::fs::create_dir_all(script.parent().unwrap()).unwrap();
+        std::fs::write(&script, "console.log('codex')\n").unwrap();
+        std::fs::write(
+            &shim,
+            r#"@ECHO off
+"%_prog%" "%dp0%\node_modules\@openai\codex\bin\codex.js" %*
+"#,
+        )
+        .unwrap();
+
+        let command = build_codex_command(
+            &shim,
+            vec![
+                "exec".to_string(),
+                "-c".to_string(),
+                r#"mcp_servers.tolaria.command="C:\\Program Files\\node.exe""#.to_string(),
+            ],
+            "Summarize".into(),
+            "/tmp/vault",
+        )
+        .unwrap();
+
+        assert_ne!(
+            command.get_program(),
+            shim.as_os_str(),
+            "Codex npm .cmd shims cannot safely receive quoted -c args directly"
+        );
+        let actual_args = command.get_args().collect::<Vec<_>>();
+        assert_eq!(actual_args.first().copied(), Some(script.as_os_str()));
+        assert!(actual_args
+            .iter()
+            .any(|arg| *arg == OsStr::new("Summarize")));
+    }
+
     #[cfg(unix)]
     #[test]
     fn run_codex_agent_stream_reads_ndjson_and_returns_thread_id() {
@@ -664,6 +846,88 @@ exit 2
         assert!(matches!(events.last(), Some(AiAgentStreamEvent::Done)));
     }
 
+    #[cfg(unix)]
+    #[test]
+    fn run_codex_agent_stream_closes_stdin_even_when_parent_stdin_pipe_is_open() {
+        use std::io::Read;
+        use std::time::{Duration, Instant};
+
+        let mut child = std::process::Command::new(std::env::current_exe().unwrap())
+            .arg("codex_stdin_probe_parent_child")
+            .arg("--ignored")
+            .arg("--nocapture")
+            .env("TOLARIA_CODEX_STDIN_PROBE_PARENT_CHILD", "1")
+            .stdin(Stdio::piped())
+            .stdout(Stdio::piped())
+            .stderr(Stdio::piped())
+            .spawn()
+            .unwrap();
+        let child_stdin = child.stdin.take().unwrap();
+        let mut stdout = child.stdout.take().unwrap();
+        let mut stderr = child.stderr.take().unwrap();
+        let deadline = Instant::now() + Duration::from_secs(5);
+
+        let status = loop {
+            if let Some(status) = child.try_wait().unwrap() {
+                break status;
+            }
+            if Instant::now() >= deadline {
+                child.kill().unwrap();
+                drop(child_stdin);
+                panic!("Codex stdin probe child timed out");
+            }
+            std::thread::sleep(Duration::from_millis(10));
+        };
+
+        drop(child_stdin);
+        let mut stdout_text = String::new();
+        let mut stderr_text = String::new();
+        stdout.read_to_string(&mut stdout_text).unwrap();
+        stderr.read_to_string(&mut stderr_text).unwrap();
+
+        assert!(
+            status.success(),
+            "Codex stdin probe child failed with {status}\nstdout:\n{stdout_text}\nstderr:\n{stderr_text}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[ignore = "spawned by run_codex_agent_stream_closes_stdin_even_when_parent_stdin_pipe_is_open"]
+    #[test]
+    fn codex_stdin_probe_parent_child() {
+        if std::env::var_os("TOLARIA_CODEX_STDIN_PROBE_PARENT_CHILD").is_none() {
+            return;
+        }
+
+        let dir = tempfile::tempdir().unwrap();
+        let vault = tempfile::tempdir().unwrap();
+        let binary = executable_script(
+            dir.path(),
+            "codex",
+            r#"stdin="$(cat)"
+if [ -n "$stdin" ]; then
+  echo "stdin was not closed" >&2
+  exit 9
+fi
+printf '%s\n' '{"type":"thread.started","thread_id":"stdin-ok"}'
+printf '%s\n' '{"type":"item.completed","item":{"id":"msg_1","type":"agent_message","text":"stdin closed"}}'
+"#,
+        );
+        let mut events = Vec::new();
+        let result = run_agent_stream_with_binary(
+            &binary,
+            codex_request(vault.path(), AiAgentPermissionMode::Safe),
+            |event| events.push(event),
+        );
+
+        assert_eq!(result.unwrap(), "stdin-ok");
+        assert!(events.iter().any(|event| matches!(
+            event,
+            AiAgentStreamEvent::TextDelta { text } if text == "stdin closed"
+        )));
+        assert!(matches!(events.last(), Some(AiAgentStreamEvent::Done)));
+    }
+
     #[test]
     fn codex_binary_candidates_include_supported_macos_installs() {
         let home = PathBuf::from("/Users/alex");
@@ -705,6 +969,34 @@ exit 2
         }
     }
 
+    #[test]
+    fn codex_binary_candidates_include_windows_npm_and_toolchain_shims() {
+        let home = PathBuf::from("C:/Users/alex");
+        let candidates = codex_binary_candidates_for_home(&home);
+        let expected = [
+            home.join(".local/bin/codex.exe"),
+            home.join(".local/share/mise/shims/codex.exe"),
+            home.join(".asdf/shims/codex.exe"),
+            home.join(".npm-global/bin/codex.cmd"),
+            home.join(".npm-global/bin/codex.exe"),
+            home.join(".npm/bin/codex.cmd"),
+            home.join(".npm/bin/codex.exe"),
+            home.join("AppData/Roaming/npm/codex.cmd"),
+            home.join("AppData/Roaming/npm/codex.exe"),
+            home.join("AppData/Local/pnpm/codex.cmd"),
+            home.join("AppData/Local/pnpm/codex.exe"),
+            home.join("scoop/shims/codex.exe"),
+        ];
+
+        for candidate in expected {
+            assert!(
+                candidates.contains(&candidate),
+                "missing {}",
+                candidate.display()
+            );
+        }
+    }
+
     #[test]
     fn codex_binary_candidates_include_nvm_managed_node_installs() {
         let home = tempfile::tempdir().unwrap();

src-tauri/src/commands/ai.rs

@@ -1,5 +1,7 @@
 #[cfg(desktop)]
 use crate::ai_agents::{AiAgentStreamRequest, AiAgentsStatus};
+#[cfg(desktop)]
+use crate::ai_models::{AiModelProviderTestRequest, AiModelStreamRequest};
 use crate::claude_cli::{ChatStreamRequest, ClaudeCliStatus};
 use crate::vault::VaultAiGuidanceStatus;
 
@@ -81,14 +83,54 @@ define_desktop_stream_command!(
     crate::claude_cli::run_chat_stream
 );
 
+#[cfg(desktop)]
+fn normalize_agent_request(mut request: AiAgentStreamRequest) -> AiAgentStreamRequest {
+    request.vault_path = expand_tilde(&request.vault_path).into_owned();
+    request
+}
+
+#[cfg(desktop)]
+fn run_normalized_ai_agent_stream(
+    request: AiAgentStreamRequest,
+    emitter: StreamEmitter<crate::ai_agents::AiAgentStreamEvent>,
+) -> Result<String, String> {
+    crate::ai_agents::run_ai_agent_stream(normalize_agent_request(request), emitter)
+}
+
 #[cfg(desktop)]
 define_desktop_stream_command!(
     stream_ai_agent,
     AiAgentStreamRequest,
     "ai-agent-stream",
-    crate::ai_agents::run_ai_agent_stream
+    run_normalized_ai_agent_stream
 );
 
+#[cfg(desktop)]
+define_desktop_stream_command!(
+    stream_ai_model,
+    AiModelStreamRequest,
+    "ai-model-stream",
+    crate::ai_models::run_ai_model_stream
+);
+
+#[cfg(desktop)]
+#[tauri::command]
+pub fn save_ai_model_provider_api_key(provider_id: String, api_key: String) -> Result<(), String> {
+    crate::ai_models::save_provider_api_key(provider_id, api_key)
+}
+
+#[cfg(desktop)]
+#[tauri::command]
+pub fn delete_ai_model_provider_api_key(provider_id: String) -> Result<(), String> {
+    crate::ai_models::delete_provider_api_key(provider_id)
+}
+
+#[cfg(desktop)]
+#[tauri::command]
+pub fn test_ai_model_provider(request: AiModelProviderTestRequest) -> Result<String, String> {
+    crate::ai_models::test_ai_model_provider(request)
+}
+
 // ── Claude CLI (mobile stubs) ───────────────────────────────────────────────
 
 #[cfg(mobile)]
@@ -145,11 +187,84 @@ pub async fn stream_ai_agent(
     Err("CLI AI agents are not available on mobile".into())
 }
 
+#[cfg(mobile)]
+#[tauri::command]
+pub async fn stream_ai_model(
+    _app_handle: tauri::AppHandle,
+    _request: crate::ai_models::AiModelStreamRequest,
+) -> Result<String, String> {
+    Err("Direct AI model chat is not available in this mobile build yet.".into())
+}
+
+#[cfg(mobile)]
+#[tauri::command]
+pub fn save_ai_model_provider_api_key(
+    _provider_id: String,
+    _api_key: String,
+) -> Result<(), String> {
+    Err("Local AI provider secret storage is only available in the desktop app.".into())
+}
+
+#[cfg(mobile)]
+#[tauri::command]
+pub fn delete_ai_model_provider_api_key(_provider_id: String) -> Result<(), String> {
+    Err("Local AI provider secret storage is only available in the desktop app.".into())
+}
+
+#[cfg(mobile)]
+#[tauri::command]
+pub fn test_ai_model_provider(
+    _request: crate::ai_models::AiModelProviderTestRequest,
+) -> Result<String, String> {
+    Err("Direct AI model tests are not available in this mobile build yet.".into())
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::vault::AiGuidanceFileState;
 
+    #[cfg(desktop)]
+    #[test]
+    fn normalize_agent_request_expands_tilde_in_vault_path() {
+        use crate::ai_agents::AiAgentId;
+
+        let home = dirs::home_dir().unwrap();
+        let request = AiAgentStreamRequest {
+            agent: AiAgentId::ClaudeCode,
+            message: "hi".into(),
+            system_prompt: None,
+            vault_path: "~/Vaults/content".into(),
+            permission_mode: None,
+        };
+
+        let normalized = normalize_agent_request(request);
+
+        assert_eq!(
+            normalized.vault_path,
+            format!("{}/Vaults/content", home.display()),
+            "vault_path must be tilde-expanded so spawned agents can chdir into it",
+        );
+    }
+
+    #[cfg(desktop)]
+    #[test]
+    fn normalize_agent_request_leaves_absolute_vault_path_untouched() {
+        use crate::ai_agents::AiAgentId;
+
+        let request = AiAgentStreamRequest {
+            agent: AiAgentId::Codex,
+            message: "hi".into(),
+            system_prompt: None,
+            vault_path: "/Users/example/vault".into(),
+            permission_mode: None,
+        };
+
+        let normalized = normalize_agent_request(request);
+
+        assert_eq!(normalized.vault_path, "/Users/example/vault");
+    }
+
     #[test]
     fn guidance_commands_report_and_restore_vault_guidance_files() {
         let dir = tempfile::TempDir::new().unwrap();

src-tauri/src/frontmatter/ops.rs

@@ -22,6 +22,13 @@ struct FrontmatterLine<'a>(&'a str);
 #[derive(Clone, Copy)]
 struct PropertyKey<'a>(&'a str);
 
+#[derive(Clone, Copy)]
+struct FrontmatterBlock<'a> {
+    body: &'a str,
+    rest: &'a str,
+    line_ending: &'static str,
+}
+
 impl<'a> PropertyKey<'a> {
     fn as_str(self) -> &'a str {
         self.0
@@ -59,6 +66,42 @@ fn quoted_yaml_key(raw: &str, quote: char) -> Option<&str> {
     rest.trim_start().starts_with(':').then_some(key)
 }
 
+fn frontmatter_open(content: &str) -> Option<(&str, &'static str)> {
+    content
+        .strip_prefix("---\n")
+        .map(|after| (after, "\n"))
+        .or_else(|| content.strip_prefix("---\r\n").map(|after| (after, "\r\n")))
+}
+
+fn close_marker(line_ending: &str) -> String {
+    format!("{line_ending}---")
+}
+
+fn split_frontmatter_block(content: &str) -> Result<Option<FrontmatterBlock<'_>>, String> {
+    let Some((after_open, line_ending)) = frontmatter_open(content) else {
+        return Ok(None);
+    };
+
+    if let Some(rest) = after_open.strip_prefix("---") {
+        return Ok(Some(FrontmatterBlock {
+            body: "",
+            rest,
+            line_ending,
+        }));
+    }
+
+    let marker = close_marker(line_ending);
+    let close_start = after_open
+        .find(&marker)
+        .ok_or_else(|| "Malformed frontmatter: no closing ---".to_string())?;
+    let rest_start = close_start + marker.len();
+    Ok(Some(FrontmatterBlock {
+        body: &after_open[..close_start],
+        rest: &after_open[rest_start..],
+        line_ending,
+    }))
+}
+
 #[derive(Clone, Copy)]
 struct FieldUpdate<'a> {
     key: PropertyKey<'a>,
@@ -108,26 +151,19 @@ impl<'a> FieldUpdate<'a> {
     }
 
     fn apply_to_content(self, content: DocumentText<'_>) -> Result<String, String> {
-        if !content.0.starts_with("---\n") {
+        let Some(block) = split_frontmatter_block(content.0)? else {
             return match self.value {
                 Some(_) => Ok(self.prepend_to(content)),
                 None => Ok(content.0.to_string()),
             };
-        }
-
-        let after_open = &content.0[4..];
-        let (fm_content, rest) = if let Some(stripped) = after_open.strip_prefix("---") {
-            ("", stripped)
-        } else {
-            let fm_end = after_open
-                .find("\n---")
-                .map(|i| i + 4)
-                .ok_or_else(|| "Malformed frontmatter: no closing ---".to_string())?;
-            (&content.0[4..fm_end], &content.0[fm_end + 4..])
         };
-        let lines: Vec<FrontmatterLine<'_>> = fm_content.lines().map(FrontmatterLine).collect();
-        let new_fm = self.apply_to_lines(&lines).join("\n");
-        Ok(format!("---\n{}\n---{}", new_fm, rest))
+
+        let lines: Vec<FrontmatterLine<'_>> = block.body.lines().map(FrontmatterLine).collect();
+        let new_fm = self.apply_to_lines(&lines).join(block.line_ending);
+        Ok(format!(
+            "---{}{}{}---{}",
+            block.line_ending, new_fm, block.line_ending, block.rest
+        ))
     }
 }
 
@@ -162,3 +198,70 @@ pub fn update_frontmatter_content(
     }
     .apply_to_content(DocumentText(&updated))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn bool_value(value: bool) -> FrontmatterValue {
+        FrontmatterValue::Bool(value)
+    }
+
+    fn string_value(value: &str) -> FrontmatterValue {
+        FrontmatterValue::String(value.to_string())
+    }
+
+    fn frontmatter_delimiter_lines(content: &str) -> usize {
+        content.lines().filter(|line| *line == "---").count()
+    }
+
+    #[test]
+    fn updates_existing_crlf_frontmatter_without_creating_a_second_block() {
+        let content = concat!(
+            "---\r\n",
+            "type: Note\r\n",
+            "related_to:\r\n",
+            "  - \"[[tolaria]]\"\r\n",
+            "---\r\n",
+            "# Properties Panel\r\n",
+        );
+
+        let updated = update_frontmatter_content(content, "_organized", Some(bool_value(true)))
+            .expect("frontmatter update should succeed");
+
+        assert_eq!(frontmatter_delimiter_lines(&updated), 2);
+        assert_eq!(
+            updated,
+            concat!(
+                "---\r\n",
+                "type: Note\r\n",
+                "related_to:\r\n",
+                "  - \"[[tolaria]]\"\r\n",
+                "_organized: true\r\n",
+                "---\r\n",
+                "# Properties Panel\r\n",
+            )
+        );
+    }
+
+    #[test]
+    fn repeated_crlf_updates_stay_in_the_original_frontmatter_block() {
+        let content = concat!(
+            "---\r\n",
+            "type: Note\r\n",
+            "related_to: \"[[tolaria]]\"\r\n",
+            "---\r\n",
+            "# Properties Panel\r\n",
+        );
+
+        let widened = update_frontmatter_content(content, "_width", Some(string_value("wide")))
+            .expect("width update should succeed");
+        let organized = update_frontmatter_content(&widened, "_organized", Some(bool_value(true)))
+            .expect("organized update should succeed");
+
+        assert_eq!(frontmatter_delimiter_lines(&organized), 2);
+        assert!(organized.contains("type: Note\r\n"));
+        assert!(organized.contains("_width: wide\r\n"));
+        assert!(organized.contains("_organized: true\r\n"));
+    }
+}

src-tauri/src/git/clone.rs

@@ -244,6 +244,8 @@ mod tests {
         assert_eq!(
             args,
             vec![
+                "-c".to_string(),
+                "core.quotePath=false".to_string(),
                 "clone".to_string(),
                 "--quiet".to_string(),
                 "https://example.com/repo.git".to_string(),

src-tauri/src/git/history.rs

@@ -1,4 +1,5 @@
 use super::git_command;
+use crate::vault::path_identity::vault_relative_path_string;
 use std::path::Path;
 
 use super::GitCommit;
@@ -7,14 +8,7 @@ use super::GitCommit;
 pub fn get_file_history(vault_path: &str, file_path: &str) -> Result<Vec<GitCommit>, String> {
     let vault = Path::new(vault_path);
     let file = Path::new(file_path);
-
-    let relative = file
-        .strip_prefix(vault)
-        .map_err(|_| format!("File {} is not inside vault {}", file_path, vault_path))?;
-
-    let relative_str = relative
-        .to_str()
-        .ok_or_else(|| "Invalid UTF-8 in path".to_string())?;
+    let relative_str = vault_relative_path_string(vault, file)?;
 
     let output = git_command()
         .args([
@@ -23,7 +17,7 @@ pub fn get_file_history(vault_path: &str, file_path: &str) -> Result<Vec<GitComm
             "-n",
             "20",
             "--",
-            relative_str,
+            &relative_str,
         ])
         .current_dir(vault)
         .output()
@@ -70,18 +64,11 @@ pub fn get_file_history(vault_path: &str, file_path: &str) -> Result<Vec<GitComm
 pub fn get_file_diff(vault_path: &str, file_path: &str) -> Result<String, String> {
     let vault = Path::new(vault_path);
     let file = Path::new(file_path);
-
-    let relative = file
-        .strip_prefix(vault)
-        .map_err(|_| format!("File {} is not inside vault {}", file_path, vault_path))?;
-
-    let relative_str = relative
-        .to_str()
-        .ok_or_else(|| "Invalid UTF-8 in path".to_string())?;
+    let relative_str = vault_relative_path_string(vault, file)?;
 
     // First try tracked file diff
     let output = git_command()
-        .args(["diff", "--", relative_str])
+        .args(["diff", "--", &relative_str])
         .current_dir(vault)
         .output()
         .map_err(|e| format!("Failed to run git diff: {}", e))?;
@@ -91,7 +78,7 @@ pub fn get_file_diff(vault_path: &str, file_path: &str) -> Result<String, String
     // If no diff (maybe staged or untracked), try diff --cached
     if stdout.is_empty() {
         let cached = git_command()
-            .args(["diff", "--cached", "--", relative_str])
+            .args(["diff", "--cached", "--", &relative_str])
             .current_dir(vault)
             .output()
             .map_err(|e| format!("Failed to run git diff --cached: {}", e))?;
@@ -103,7 +90,7 @@ pub fn get_file_diff(vault_path: &str, file_path: &str) -> Result<String, String
 
         // Try showing untracked file as all-new
         let status = git_command()
-            .args(["status", "--porcelain", "--", relative_str])
+            .args(["status", "--porcelain", "--", &relative_str])
             .current_dir(vault)
             .output()
             .map_err(|e| format!("Failed to run git status: {}", e))?;
@@ -134,14 +121,7 @@ pub fn get_file_diff_at_commit(
 ) -> Result<String, String> {
     let vault = Path::new(vault_path);
     let file = Path::new(file_path);
-
-    let relative = file
-        .strip_prefix(vault)
-        .map_err(|_| format!("File {} is not inside vault {}", file_path, vault_path))?;
-
-    let relative_str = relative
-        .to_str()
-        .ok_or_else(|| "Invalid UTF-8 in path".to_string())?;
+    let relative_str = vault_relative_path_string(vault, file)?;
 
     // Show diff between commit^ and commit for this file
     let output = git_command()
@@ -150,7 +130,7 @@ pub fn get_file_diff_at_commit(
             &format!("{}^", commit_hash),
             commit_hash,
             "--",
-            relative_str,
+            &relative_str,
         ])
         .current_dir(vault)
         .output()
@@ -187,37 +167,53 @@ mod tests {
     use super::git_command;
     use super::*;
     use crate::git::tests::setup_git_repo;
-    use std::fs;
+    use std::{fs, path::PathBuf};
+
+    fn force_quoted_git_paths(vault: &Path) {
+        git_command()
+            .args(["config", "core.quotePath", "true"])
+            .current_dir(vault)
+            .output()
+            .unwrap();
+    }
+
+    fn write_and_commit_file(
+        vault: &Path,
+        relative_path: &str,
+        content: &str,
+        message: &str,
+    ) -> PathBuf {
+        let file = vault.join(relative_path);
+        fs::write(&file, content).unwrap();
+        git_command()
+            .args(["add", relative_path])
+            .current_dir(vault)
+            .output()
+            .unwrap();
+        git_command()
+            .args(["commit", "-m", message])
+            .current_dir(vault)
+            .output()
+            .unwrap();
+        file
+    }
+
+    fn head_hash(vault: &Path) -> String {
+        let log = git_command()
+            .args(["log", "--format=%H", "-1"])
+            .current_dir(vault)
+            .output()
+            .unwrap();
+        String::from_utf8_lossy(&log.stdout).trim().to_string()
+    }
 
     #[test]
     fn test_get_file_history_with_commits() {
         let dir = setup_git_repo();
         let vault = dir.path();
-        let file = vault.join("test.md");
 
-        fs::write(&file, "# Initial\n").unwrap();
-        git_command()
-            .args(["add", "test.md"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-        git_command()
-            .args(["commit", "-m", "Initial commit"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-
-        fs::write(&file, "# Updated\n\nNew content.").unwrap();
-        git_command()
-            .args(["add", "test.md"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-        git_command()
-            .args(["commit", "-m", "Update test"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
+        let file = write_and_commit_file(vault, "test.md", "# Initial\n", "Initial commit");
+        write_and_commit_file(vault, "test.md", "# Updated\n\nNew content.", "Update test");
 
         let history = get_file_history(vault.to_str().unwrap(), file.to_str().unwrap()).unwrap();
 
@@ -245,19 +241,13 @@ mod tests {
     fn test_get_file_diff() {
         let dir = setup_git_repo();
         let vault = dir.path();
-        let file = vault.join("diff-test.md");
 
-        fs::write(&file, "# Test\n\nOriginal content.").unwrap();
-        git_command()
-            .args(["add", "diff-test.md"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-        git_command()
-            .args(["commit", "-m", "Add diff-test"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
+        let file = write_and_commit_file(
+            vault,
+            "diff-test.md",
+            "# Test\n\nOriginal content.",
+            "Add diff-test",
+        );
 
         fs::write(&file, "# Test\n\nModified content.").unwrap();
 
@@ -272,39 +262,21 @@ mod tests {
     fn test_get_file_diff_at_commit() {
         let dir = setup_git_repo();
         let vault = dir.path();
-        let file = vault.join("diff-at-commit.md");
 
-        fs::write(&file, "# First\n\nOriginal content.").unwrap();
-        git_command()
-            .args(["add", "diff-at-commit.md"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-        git_command()
-            .args(["commit", "-m", "First commit"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
+        let file = write_and_commit_file(
+            vault,
+            "diff-at-commit.md",
+            "# First\n\nOriginal content.",
+            "First commit",
+        );
+        write_and_commit_file(
+            vault,
+            "diff-at-commit.md",
+            "# First\n\nModified content.",
+            "Second commit",
+        );
 
-        fs::write(&file, "# First\n\nModified content.").unwrap();
-        git_command()
-            .args(["add", "diff-at-commit.md"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-        git_command()
-            .args(["commit", "-m", "Second commit"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-
-        // Get hash of second commit
-        let log = git_command()
-            .args(["log", "--format=%H", "-1"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-        let hash = String::from_utf8_lossy(&log.stdout).trim().to_string();
+        let hash = head_hash(vault);
 
         let diff = get_file_diff_at_commit(vault.to_str().unwrap(), file.to_str().unwrap(), &hash)
             .unwrap();
@@ -318,26 +290,15 @@ mod tests {
     fn test_get_file_diff_at_initial_commit() {
         let dir = setup_git_repo();
         let vault = dir.path();
-        let file = vault.join("initial.md");
 
-        fs::write(&file, "# Initial\n\nHello world.").unwrap();
-        git_command()
-            .args(["add", "initial.md"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-        git_command()
-            .args(["commit", "-m", "Initial commit"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
+        let file = write_and_commit_file(
+            vault,
+            "initial.md",
+            "# Initial\n\nHello world.",
+            "Initial commit",
+        );
 
-        let log = git_command()
-            .args(["log", "--format=%H", "-1"])
-            .current_dir(vault)
-            .output()
-            .unwrap();
-        let hash = String::from_utf8_lossy(&log.stdout).trim().to_string();
+        let hash = head_hash(vault);
 
         let diff = get_file_diff_at_commit(vault.to_str().unwrap(), file.to_str().unwrap(), &hash)
             .unwrap();
@@ -346,4 +307,35 @@ mod tests {
         assert!(diff.contains("+# Initial"));
         assert!(diff.contains("+Hello world."));
     }
+
+    #[test]
+    fn test_get_file_diff_at_commit_preserves_chinese_filename_and_content() {
+        let dir = setup_git_repo();
+        let vault = dir.path();
+        let relative_path = "中文笔记.md";
+        let file = vault.join(relative_path);
+
+        force_quoted_git_paths(vault);
+        write_and_commit_file(
+            vault,
+            relative_path,
+            "# 初始\n\n第一行\n",
+            "Add Chinese note",
+        );
+        write_and_commit_file(
+            vault,
+            relative_path,
+            "# 初始\n\n第二行\n",
+            "Update Chinese note",
+        );
+        let hash = head_hash(vault);
+
+        let diff = get_file_diff_at_commit(vault.to_str().unwrap(), file.to_str().unwrap(), &hash)
+            .unwrap();
+
+        assert!(diff.contains("diff --git a/中文笔记.md b/中文笔记.md"));
+        assert!(diff.contains("-第一行"));
+        assert!(diff.contains("+第二行"));
+        assert!(!diff.contains("\\344"));
+    }
 }

src-tauri/src/git/mod.rs

@@ -56,9 +56,10 @@ const DEFAULT_GITIGNORE: &str = "# Tolaria app files (machine-specific, never co
 *.swp\n\
 *.swo\n";
 
-fn git_command() -> Command {
+pub(crate) fn git_command() -> Command {
     let mut command = crate::hidden_command("git");
     sanitize_linux_appimage_git_env(&mut command);
+    command.args(["-c", "core.quotePath=false"]);
     command
 }
 

src-tauri/src/git/status.rs

@@ -300,6 +300,14 @@ mod tests {
         git_commit(vp, "initial").unwrap();
     }
 
+    fn force_quoted_git_paths(vault: &Path) {
+        git_command()
+            .args(["config", "core.quotePath", "true"])
+            .current_dir(vault)
+            .output()
+            .unwrap();
+    }
+
     #[test]
     fn test_get_modified_files() {
         let dir = setup_git_repo();
@@ -380,6 +388,28 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_get_modified_files_preserves_chinese_markdown_path() {
+        let dir = setup_git_repo();
+        let vault = dir.path();
+        let vp = vault.to_str().unwrap();
+        let relative_path = "中文笔记.md";
+
+        force_quoted_git_paths(vault);
+        write_and_commit_markdown(vault, vp, relative_path, "# 初始\n");
+        fs::write(vault.join(relative_path), "# 初始\n\n更新\n").unwrap();
+
+        let modified = get_modified_files(vp).unwrap();
+        let file = modified
+            .iter()
+            .find(|file| file.relative_path == relative_path)
+            .expect("Chinese markdown path should be reported as modified");
+
+        assert_eq!(file.status, "modified");
+        assert!(file.path.ends_with(relative_path));
+        assert_eq!(file.added_lines, Some(2));
+    }
+
     #[test]
     fn test_commit_flow_modified_files_then_commit_clears() {
         let dir = setup_git_repo();

src-tauri/src/lib.rs

@@ -1,4 +1,5 @@
 pub mod ai_agents;
+pub mod ai_models;
 pub mod app_updater;
 pub mod claude_cli;
 mod cli_agent_runtime;
@@ -413,6 +414,10 @@ macro_rules! app_invoke_handler {
             commands::restore_vault_ai_guidance,
             commands::stream_claude_chat,
             commands::stream_ai_agent,
+            commands::stream_ai_model,
+            commands::save_ai_model_provider_api_key,
+            commands::delete_ai_model_provider_api_key,
+            commands::test_ai_model_provider,
             commands::reload_vault,
             commands::reload_vault_entry,
             commands::sync_vault_asset_scope_for_window,

src-tauri/src/linux_appimage.rs

@@ -15,6 +15,20 @@ const LINUX_APPIMAGE_WEBKIT_OVERRIDES: [StartupEnvOverride; 2] = [
     },
 ];
 
+const FCITX_GTK_IM_MODULE_OVERRIDE: StartupEnvOverride = StartupEnvOverride {
+    key: "GTK_IM_MODULE",
+    value: "fcitx",
+};
+const FCITX_ENV_HINT_KEYS: [&str; 4] = [
+    "XMODIFIERS",
+    "INPUT_METHOD",
+    "QT_IM_MODULE",
+    "SDL_IM_MODULE",
+];
+const COLRV1_EMOJI_FONT_FILE: &str = "Noto-COLRv1.ttf";
+#[cfg(all(desktop, target_os = "linux"))]
+const TOLARIA_COLRV1_FONTCONFIG_FILE: &str = "tolaria-appimage-no-colrv1-emoji.conf";
+
 const WAYLAND_CLIENT_PRELOAD_CANDIDATES: [&str; 7] = [
     "/usr/lib64/libwayland-client.so.0",
     "/usr/lib64/libwayland-client.so",
@@ -40,11 +54,78 @@ where
         .any(|key| get_var(key).is_some_and(|value| !value.trim().is_empty()))
 }
 
+fn has_non_empty_env<F>(get_var: &mut F, key: &str) -> bool
+where
+    F: FnMut(&str) -> Option<String>,
+{
+    get_var(key).is_some_and(|value| !value.trim().is_empty())
+}
+
+fn has_env<F>(get_var: &mut F, key: &str) -> bool
+where
+    F: FnMut(&str) -> Option<String>,
+{
+    get_var(key).is_some()
+}
+
+fn has_explicit_fontconfig_env<F>(get_var: &mut F) -> bool
+where
+    F: FnMut(&str) -> Option<String>,
+{
+    ["FONTCONFIG_FILE", "FONTCONFIG_PATH"]
+        .into_iter()
+        .any(|key| has_non_empty_env(get_var, key))
+}
+
+fn can_apply_colrv1_font_guard<F>(get_var: &mut F) -> bool
+where
+    F: FnMut(&str) -> Option<String>,
+{
+    if !is_linux_appimage_launch(&mut *get_var) {
+        return false;
+    }
+
+    !has_explicit_fontconfig_env(get_var)
+}
+
+fn env_mentions_fcitx(value: &str) -> bool {
+    value.to_ascii_lowercase().contains("fcitx")
+}
+
+fn has_fcitx_env_hint<F>(get_var: &mut F) -> bool
+where
+    F: FnMut(&str) -> Option<String>,
+{
+    FCITX_ENV_HINT_KEYS
+        .into_iter()
+        .any(|key| get_var(key).is_some_and(|value| env_mentions_fcitx(&value)))
+}
+
+fn fcitx_gtk_im_module_override_with<F>(get_var: &mut F) -> Option<StartupEnvOverride>
+where
+    F: FnMut(&str) -> Option<String>,
+{
+    if !is_linux_appimage_launch(&mut *get_var) {
+        return None;
+    }
+    if !is_wayland_session(&mut *get_var) {
+        return None;
+    }
+    if has_env(get_var, "GTK_IM_MODULE") {
+        return None;
+    }
+    if !has_fcitx_env_hint(get_var) {
+        return None;
+    }
+
+    Some(FCITX_GTK_IM_MODULE_OVERRIDE)
+}
+
 fn is_wayland_session<F>(mut get_var: F) -> bool
 where
     F: FnMut(&str) -> Option<String>,
 {
-    get_var("WAYLAND_DISPLAY").is_some_and(|value| !value.trim().is_empty())
+    has_non_empty_env(&mut get_var, "WAYLAND_DISPLAY")
         || get_var("XDG_SESSION_TYPE")
             .is_some_and(|value| value.trim().eq_ignore_ascii_case("wayland"))
 }
@@ -81,7 +162,7 @@ where
         return None;
     }
 
-    if get_var("LD_PRELOAD").is_some_and(|value| !value.trim().is_empty())
+    if has_non_empty_env(&mut get_var, "LD_PRELOAD")
         || get_var("TOLARIA_APPIMAGE_WAYLAND_PRELOAD_ATTEMPTED").is_some_and(|value| value == "1")
     {
         return None;
@@ -92,6 +173,54 @@ where
         .find(|path| candidate_matches(path))
 }
 
+fn colrv1_emoji_font_path_with<F, M>(mut get_var: F, mut match_emoji_font: M) -> Option<String>
+where
+    F: FnMut(&str) -> Option<String>,
+    M: FnMut() -> Option<String>,
+{
+    if !can_apply_colrv1_font_guard(&mut get_var) {
+        return None;
+    }
+
+    let font_path = match_emoji_font()?;
+
+    std::path::Path::new(font_path.trim())
+        .file_name()
+        .and_then(|name| name.to_str())
+        .is_some_and(|name| name.eq_ignore_ascii_case(COLRV1_EMOJI_FONT_FILE))
+        .then(|| font_path.trim().to_string())
+}
+
+fn escape_xml_text(value: &str) -> String {
+    value
+        .replace('&', "&amp;")
+        .replace('<', "&lt;")
+        .replace('>', "&gt;")
+        .replace('"', "&quot;")
+        .replace('\'', "&apos;")
+}
+
+fn colrv1_emoji_fontconfig_contents(rejected_font_path: &str) -> String {
+    format!(
+        r#"<?xml version="1.0"?>
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+<fontconfig>
+  <include ignore_missing="yes">/etc/fonts/fonts.conf</include>
+  <selectfont>
+    <rejectfont>
+      <pattern>
+        <patelt name="file">
+          <string>{}</string>
+        </patelt>
+      </pattern>
+    </rejectfont>
+  </selectfont>
+</fontconfig>
+"#,
+        escape_xml_text(rejected_font_path)
+    )
+}
+
 fn startup_env_overrides_with<F>(mut get_var: F) -> Vec<StartupEnvOverride>
 where
     F: FnMut(&str) -> Option<String>,
@@ -100,23 +229,86 @@ where
         return Vec::new();
     }
 
-    LINUX_APPIMAGE_WEBKIT_OVERRIDES
+    let mut overrides: Vec<_> = LINUX_APPIMAGE_WEBKIT_OVERRIDES
         .into_iter()
-        .filter(|env_override| {
-            !get_var(env_override.key).is_some_and(|value| !value.trim().is_empty())
-        })
-        .collect()
+        .filter(|env_override| !has_non_empty_env(&mut get_var, env_override.key))
+        .collect();
+
+    if let Some(env_override) = fcitx_gtk_im_module_override_with(&mut get_var) {
+        overrides.push(env_override);
+    }
+
+    overrides
 }
 
 #[cfg(all(desktop, target_os = "linux"))]
 pub(crate) fn apply_startup_env_overrides() {
     apply_wayland_client_preload();
+    apply_colrv1_emoji_font_guard();
 
     for env_override in startup_env_overrides_with(|key| std::env::var(key).ok()) {
         std::env::set_var(env_override.key, env_override.value);
     }
 }
 
+#[cfg(all(desktop, target_os = "linux"))]
+fn apply_colrv1_emoji_font_guard() {
+    let Some(font_path) =
+        colrv1_emoji_font_path_with(|key| std::env::var(key).ok(), match_emoji_font_path)
+    else {
+        return;
+    };
+    let Some(config_path) = colrv1_fontconfig_file_path() else {
+        eprintln!("Tolaria AppImage COLRv1 font guard skipped: failed to resolve cache directory");
+        return;
+    };
+    let Some(parent) = config_path.parent() else {
+        return;
+    };
+
+    if let Err(error) = std::fs::create_dir_all(parent) {
+        eprintln!("Tolaria AppImage COLRv1 font guard skipped: failed to prepare cache ({error})");
+        return;
+    }
+
+    if let Err(error) = std::fs::write(&config_path, colrv1_emoji_fontconfig_contents(&font_path)) {
+        eprintln!("Tolaria AppImage COLRv1 font guard skipped: failed to write config ({error})");
+        return;
+    }
+
+    std::env::set_var("FONTCONFIG_FILE", config_path.as_os_str());
+}
+
+#[cfg(all(desktop, target_os = "linux"))]
+fn match_emoji_font_path() -> Option<String> {
+    let output = std::process::Command::new("fc-match")
+        .args(["-f", "%{file}\n", "emoji"])
+        .output()
+        .ok()?;
+
+    if !output.status.success() {
+        return None;
+    }
+
+    String::from_utf8_lossy(&output.stdout)
+        .lines()
+        .map(str::trim)
+        .find(|line| !line.is_empty())
+        .map(ToOwned::to_owned)
+}
+
+#[cfg(all(desktop, target_os = "linux"))]
+fn colrv1_fontconfig_file_path() -> Option<std::path::PathBuf> {
+    let cache_dir =
+        dirs::cache_dir().or_else(|| dirs::home_dir().map(|home| home.join(".cache")))?;
+
+    Some(
+        cache_dir
+            .join("tolaria")
+            .join(TOLARIA_COLRV1_FONTCONFIG_FILE),
+    )
+}
+
 #[cfg(all(desktop, target_os = "linux"))]
 fn apply_wayland_client_preload() {
     use std::os::unix::process::CommandExt;
@@ -149,10 +341,42 @@ fn apply_wayland_client_preload() {
 #[cfg(test)]
 mod tests {
     use super::{
-        elf_library_matches_process, startup_env_overrides_with, wayland_client_preload_path_with,
-        StartupEnvOverride,
+        colrv1_emoji_font_path_with, colrv1_emoji_fontconfig_contents, elf_library_matches_process,
+        startup_env_overrides_with, wayland_client_preload_path_with, StartupEnvOverride,
     };
 
+    fn default_webkit_overrides() -> Vec<StartupEnvOverride> {
+        vec![
+            StartupEnvOverride {
+                key: "WEBKIT_DISABLE_DMABUF_RENDERER",
+                value: "1",
+            },
+            StartupEnvOverride {
+                key: "WEBKIT_DISABLE_COMPOSITING_MODE",
+                value: "1",
+            },
+        ]
+    }
+
+    fn default_webkit_and_fcitx_overrides() -> Vec<StartupEnvOverride> {
+        let mut overrides = default_webkit_overrides();
+        overrides.push(StartupEnvOverride {
+            key: "GTK_IM_MODULE",
+            value: "fcitx",
+        });
+        overrides
+    }
+
+    fn appimage_wayland_fcitx_env(key: &str, gtk_im_module: Option<&str>) -> Option<String> {
+        match key {
+            "APPIMAGE" => Some("/tmp/Tolaria.AppImage".to_string()),
+            "WAYLAND_DISPLAY" => Some("wayland-1".to_string()),
+            "XMODIFIERS" => Some("@im=fcitx".to_string()),
+            "GTK_IM_MODULE" => gtk_im_module.map(ToOwned::to_owned),
+            _ => None,
+        }
+    }
+
     #[test]
     fn startup_env_overrides_are_empty_outside_appimage_launches() {
         let overrides = startup_env_overrides_with(|_| None);
@@ -167,19 +391,7 @@ mod tests {
             _ => None,
         });
 
-        assert_eq!(
-            overrides,
-            vec![
-                StartupEnvOverride {
-                    key: "WEBKIT_DISABLE_DMABUF_RENDERER",
-                    value: "1",
-                },
-                StartupEnvOverride {
-                    key: "WEBKIT_DISABLE_COMPOSITING_MODE",
-                    value: "1",
-                }
-            ]
-        );
+        assert_eq!(overrides, default_webkit_overrides());
     }
 
     #[test]
@@ -199,6 +411,86 @@ mod tests {
         );
     }
 
+    #[test]
+    fn startup_env_overrides_enable_fcitx_gtk_module_for_wayland_appimage() {
+        let overrides = startup_env_overrides_with(|key| appimage_wayland_fcitx_env(key, None));
+
+        assert_eq!(overrides, default_webkit_and_fcitx_overrides());
+    }
+
+    #[test]
+    fn startup_env_overrides_preserve_explicit_gtk_im_module() {
+        let overrides =
+            startup_env_overrides_with(|key| appimage_wayland_fcitx_env(key, Some("wayland")));
+
+        assert_eq!(overrides, default_webkit_overrides());
+    }
+
+    #[test]
+    fn startup_env_overrides_leave_non_fcitx_wayland_appimage_input_unchanged() {
+        let overrides = startup_env_overrides_with(|key| match key {
+            "APPIMAGE" => Some("/tmp/Tolaria.AppImage".to_string()),
+            "WAYLAND_DISPLAY" => Some("wayland-1".to_string()),
+            _ => None,
+        });
+
+        assert_eq!(overrides, default_webkit_overrides());
+    }
+
+    #[test]
+    fn colrv1_font_guard_targets_reported_appimage_emoji_font() {
+        let font_path = colrv1_emoji_font_path_with(
+            |key| match key {
+                "APPIMAGE" => Some("/tmp/Tolaria.AppImage".to_string()),
+                _ => None,
+            },
+            || Some("/usr/share/fonts/google-noto-color-emoji-fonts/Noto-COLRv1.ttf".to_string()),
+        );
+
+        assert_eq!(
+            font_path.as_deref(),
+            Some("/usr/share/fonts/google-noto-color-emoji-fonts/Noto-COLRv1.ttf")
+        );
+    }
+
+    #[test]
+    fn colrv1_font_guard_preserves_explicit_fontconfig_settings() {
+        let font_path = colrv1_emoji_font_path_with(
+            |key| match key {
+                "APPDIR" => Some("/tmp/.mount_Tolaria".to_string()),
+                "FONTCONFIG_FILE" => Some("/tmp/custom-fontconfig.conf".to_string()),
+                _ => None,
+            },
+            || Some("/usr/share/fonts/google-noto-color-emoji-fonts/Noto-COLRv1.ttf".to_string()),
+        );
+
+        assert_eq!(font_path, None);
+    }
+
+    #[test]
+    fn colrv1_font_guard_ignores_other_emoji_fonts() {
+        let font_path = colrv1_emoji_font_path_with(
+            |key| match key {
+                "APPIMAGE" => Some("/tmp/Tolaria.AppImage".to_string()),
+                _ => None,
+            },
+            || Some("/usr/share/fonts/noto/NotoColorEmoji.ttf".to_string()),
+        );
+
+        assert_eq!(font_path, None);
+    }
+
+    #[test]
+    fn colrv1_fontconfig_includes_system_fonts_and_rejects_matched_file() {
+        let contents = colrv1_emoji_fontconfig_contents("/tmp/fonts/A&B/Noto-COLRv1.ttf");
+
+        assert!(
+            contents.contains("<include ignore_missing=\"yes\">/etc/fonts/fonts.conf</include>")
+        );
+        assert!(contents.contains("<patelt name=\"file\">"));
+        assert!(contents.contains("<string>/tmp/fonts/A&amp;B/Noto-COLRv1.ttf</string>"));
+    }
+
     #[test]
     fn wayland_preload_uses_first_available_system_library() {
         let preload_path = wayland_client_preload_path_with(

src-tauri/src/mcp.rs

@@ -284,6 +284,10 @@ fn linux_package_mcp_server_dirs(root: &Path) -> Vec<PathBuf> {
         root.join("Tolaria").join("mcp-server"),
         root.join("Tolaria").join("resources").join("mcp-server"),
         root.join("lib").join("tolaria").join("mcp-server"),
+        root.join("lib")
+            .join("tolaria")
+            .join("resources")
+            .join("mcp-server"),
     ]
 }
 
@@ -759,12 +763,26 @@ mod tests {
             PathBuf::from("/usr/local/Tolaria/mcp-server"),
             PathBuf::from("/usr/local/Tolaria/resources/mcp-server"),
             PathBuf::from("/usr/local/lib/tolaria/mcp-server"),
+            PathBuf::from("/usr/local/lib/tolaria/resources/mcp-server"),
             PathBuf::from("/usr/lib/tolaria/mcp-server"),
+            PathBuf::from("/usr/lib/tolaria/resources/mcp-server"),
         ];
 
         assert!(expected.iter().all(|path| candidates.contains(path)));
     }
 
+    #[test]
+    fn mcp_server_dir_candidates_include_linux_appimage_resource_root() {
+        let dev_path = Path::new("/repo/mcp-server");
+        let exe_path = Path::new("/tmp/.mount_tolaria/usr/bin/tolaria");
+        let appdir = Path::new("/tmp/.mount_tolaria");
+        let candidates = mcp_server_dir_candidates(dev_path, exe_path, Some(appdir));
+
+        assert!(candidates.contains(&PathBuf::from(
+            "/tmp/.mount_tolaria/usr/lib/tolaria/resources/mcp-server"
+        )));
+    }
+
     #[test]
     fn upsert_creates_new_config() {
         let tmp = tempfile::tempdir().unwrap();

src-tauri/src/menu.rs

@@ -1,9 +1,13 @@
+#[cfg(not(target_os = "macos"))]
+use crate::window_state::MAIN_WINDOW_LABEL;
 use serde::{Deserialize, Deserializer};
 use std::{
     collections::{BTreeMap, HashSet},
     error::Error,
     sync::OnceLock,
 };
+#[cfg(not(target_os = "macos"))]
+use tauri::{menu::MenuEvent, Manager};
 use tauri::{
     menu::{MenuBuilder, MenuItem, MenuItemBuilder, MenuItemKind, Submenu, SubmenuBuilder},
     App, AppHandle, Emitter,
@@ -234,6 +238,10 @@ fn app_menu_includes_services(target_os: &str) -> bool {
     target_os == "macos"
 }
 
+fn window_menu_event_handler_required(target_os: &str) -> bool {
+    target_os != "macos"
+}
+
 fn build_manifest_menu_item(
     app: &App,
     item: &ManifestMenuItem,
@@ -383,6 +391,28 @@ pub fn setup_menu(app: &App) -> Result<(), Box<dyn Error>> {
         let _ = emit_custom_menu_event(app_handle, id);
     });
 
+    register_window_menu_event_handler(app)?;
+
+    Ok(())
+}
+
+#[cfg(not(target_os = "macos"))]
+fn register_window_menu_event_handler(app: &App) -> Result<(), Box<dyn Error>> {
+    debug_assert!(window_menu_event_handler_required(std::env::consts::OS));
+    let window = app.get_webview_window(MAIN_WINDOW_LABEL).ok_or_else(|| {
+        format!("setup_menu: window '{MAIN_WINDOW_LABEL}' not found; menu events will not fire")
+    })?;
+    let app_handle = app.handle().clone();
+    window.on_menu_event(move |_window, event: MenuEvent| {
+        let id = event.id().0.as_str();
+        let _ = emit_custom_menu_event(&app_handle, id);
+    });
+    Ok(())
+}
+
+#[cfg(target_os = "macos")]
+fn register_window_menu_event_handler(_app: &App) -> Result<(), Box<dyn Error>> {
+    debug_assert!(!window_menu_event_handler_required(std::env::consts::OS));
     Ok(())
 }
 
@@ -564,4 +594,11 @@ mod tests {
         assert!(!app_menu_includes_services("windows"));
         assert!(!app_menu_includes_services("linux"));
     }
+
+    #[test]
+    fn window_menu_event_handler_is_required_off_macos() {
+        assert!(!window_menu_event_handler_required("macos"));
+        assert!(window_menu_event_handler_required("windows"));
+        assert!(window_menu_event_handler_required("linux"));
+    }
 }

src-tauri/src/settings.rs

@@ -2,6 +2,8 @@ use serde::{Deserialize, Serialize};
 use std::fs;
 use std::path::PathBuf;
 
+use crate::ai_models::{normalize_ai_model_providers, AiModelProvider};
+
 const APP_CONFIG_DIR: &str = "com.tolaria.app";
 const LEGACY_APP_CONFIG_DIR: &str = "com.laputa.app";
 const SUPPORTED_DEFAULT_AI_AGENTS: &[&str] = &["claude_code", "codex", "opencode", "pi", "gemini"];
@@ -76,8 +78,11 @@ pub struct Settings {
     pub theme_mode: Option<String>,
     pub ui_language: Option<String>,
     pub note_width_mode: Option<String>,
+    pub sidebar_type_pluralization_enabled: Option<bool>,
     pub initial_h1_auto_rename_enabled: Option<bool>,
     pub default_ai_agent: Option<String>,
+    pub default_ai_target: Option<String>,
+    pub ai_model_providers: Option<Vec<AiModelProvider>>,
     pub hide_gitignored_files: Option<bool>,
     pub all_notes_show_pdfs: Option<bool>,
     pub all_notes_show_images: Option<bool>,
@@ -118,7 +123,7 @@ pub fn normalize_default_ai_agent(value: Option<&str>) -> Option<String> {
 
 pub fn normalize_theme_mode(value: Option<&str>) -> Option<String> {
     match value.map(|candidate| candidate.trim().to_ascii_lowercase()) {
-        Some(mode) if mode == "light" || mode == "dark" => Some(mode),
+        Some(mode) if mode == "light" || mode == "dark" || mode == "system" => Some(mode),
         _ => None,
     }
 }
@@ -177,8 +182,11 @@ fn normalize_settings(settings: Settings) -> Settings {
         theme_mode: normalize_theme_mode(settings.theme_mode.as_deref()),
         ui_language: normalize_ui_language(settings.ui_language.as_deref()),
         note_width_mode: normalize_note_width_mode(settings.note_width_mode.as_deref()),
+        sidebar_type_pluralization_enabled: settings.sidebar_type_pluralization_enabled,
         initial_h1_auto_rename_enabled: settings.initial_h1_auto_rename_enabled,
         default_ai_agent: normalize_default_ai_agent(settings.default_ai_agent.as_deref()),
+        default_ai_target: normalize_optional_string(settings.default_ai_target),
+        ai_model_providers: normalize_ai_model_providers(settings.ai_model_providers),
         hide_gitignored_files: settings.hide_gitignored_files,
         all_notes_show_pdfs: settings.all_notes_show_pdfs,
         all_notes_show_images: settings.all_notes_show_images,
@@ -324,8 +332,11 @@ mod tests {
             theme_mode: Some("dark".to_string()),
             ui_language: Some("zh-Hans".to_string()),
             note_width_mode: Some("wide".to_string()),
+            sidebar_type_pluralization_enabled: Some(false),
             initial_h1_auto_rename_enabled: Some(false),
             default_ai_agent: Some("codex".to_string()),
+            default_ai_target: Some("agent:codex".to_string()),
+            ai_model_providers: None,
             hide_gitignored_files: Some(false),
             all_notes_show_pdfs: Some(true),
             all_notes_show_images: Some(true),
@@ -356,6 +367,7 @@ mod tests {
             theme_mode: Some("dark".to_string()),
             ui_language: Some("zh-Hans".to_string()),
             note_width_mode: Some("wide".to_string()),
+            sidebar_type_pluralization_enabled: Some(false),
             initial_h1_auto_rename_enabled: Some(false),
             default_ai_agent: Some("codex".to_string()),
             hide_gitignored_files: Some(false),
@@ -373,6 +385,7 @@ mod tests {
         assert_eq!(loaded.theme_mode.as_deref(), Some("dark"));
         assert_eq!(loaded.ui_language.as_deref(), Some("zh-CN"));
         assert_eq!(loaded.note_width_mode.as_deref(), Some("wide"));
+        assert_eq!(loaded.sidebar_type_pluralization_enabled, Some(false));
         assert_eq!(loaded.initial_h1_auto_rename_enabled, Some(false));
         assert_eq!(loaded.default_ai_agent.as_deref(), Some("codex"));
         assert_eq!(loaded.hide_gitignored_files, Some(false));
@@ -479,11 +492,20 @@ mod tests {
     }
 
     #[test]
-    fn test_invalid_theme_mode_is_filtered() {
+    fn test_system_theme_mode_is_preserved() {
         let loaded = save_and_reload(Settings {
             theme_mode: Some("system".to_string()),
             ..Default::default()
         });
+        assert_eq!(loaded.theme_mode.as_deref(), Some("system"));
+    }
+
+    #[test]
+    fn test_invalid_theme_mode_is_filtered() {
+        let loaded = save_and_reload(Settings {
+            theme_mode: Some("sepia".to_string()),
+            ..Default::default()
+        });
         assert!(loaded.theme_mode.is_none());
     }
 

src-tauri/src/vault/cache.rs

@@ -9,6 +9,10 @@ use uuid::Uuid;
 use crate::git::{get_all_file_dates, GitDates};
 use std::collections::HashMap;
 
+use super::path_identity::{
+    normalize_path_for_identity, push_unique_relative_path, relative_path_key,
+    vault_relative_path_string,
+};
 use super::{is_md_file, parse_md_file, parse_non_md_file, scan_vault, VaultEntry};
 
 // --- Vault Cache ---
@@ -83,7 +87,7 @@ fn default_cache_version() -> u32 {
 /// Compute a deterministic hex hash of the vault path for use as cache filename.
 fn vault_path_hash(vault: &Path) -> String {
     let mut hasher = std::collections::hash_map::DefaultHasher::new();
-    vault.to_string_lossy().as_ref().hash(&mut hasher);
+    normalize_path_for_identity(&vault.to_string_lossy()).hash(&mut hasher);
     format!("{:016x}", hasher.finish())
 }
 
@@ -125,7 +129,7 @@ fn git_head_hash(vault: &Path) -> Option<String> {
 
 /// Run a git command in the given directory and return stdout if successful.
 fn run_git(vault: &Path, args: &[&str]) -> Option<String> {
-    let output = crate::hidden_command("git")
+    let output = crate::git::git_command()
         .args(args)
         .current_dir(vault)
         .output()
@@ -148,28 +152,22 @@ fn parse_porcelain_line(line: &str) -> Option<(&str, String)> {
 /// Includes all non-hidden files (not just .md) so the cache picks up
 /// view files (.yml), binary assets, etc.
 fn collect_paths_from_diff(stdout: &str) -> Vec<String> {
-    stdout
-        .lines()
-        .filter(|line| !line.is_empty() && !has_hidden_segment(line))
-        .map(|line| line.to_string())
-        .collect()
+    let mut paths = Vec::new();
+    for line in stdout.lines() {
+        push_unique_relative_path(&mut paths, line);
+    }
+    paths
 }
 
 /// Extract file paths from git status --porcelain output.
 /// Includes all non-hidden files so incremental cache updates cover
 /// every file type the vault scanner recognises.
 fn collect_paths_from_porcelain(stdout: &str) -> Vec<String> {
-    stdout
-        .lines()
-        .filter_map(parse_porcelain_line)
-        .filter(|(_, path)| !has_hidden_segment(path))
-        .map(|(_, path)| path)
-        .collect()
-}
-
-/// Return true if any path segment starts with `.` (hidden file/directory).
-fn has_hidden_segment(path: &str) -> bool {
-    path.split('/').any(|seg| seg.starts_with('.'))
+    let mut paths = Vec::new();
+    for (_, path) in stdout.lines().filter_map(parse_porcelain_line) {
+        push_unique_relative_path(&mut paths, path);
+    }
+    paths
 }
 
 fn git_changed_files(vault: &Path, from_hash: &str, to_hash: &str) -> Vec<String> {
@@ -182,9 +180,7 @@ fn git_changed_files(vault: &Path, from_hash: &str, to_hash: &str) -> Vec<String
     let uncommitted = git_uncommitted_files(vault);
 
     for path in uncommitted.into_iter() {
-        if !files.contains(&path) {
-            files.push(path);
-        }
+        push_unique_relative_path(&mut files, path);
     }
 
     files
@@ -201,17 +197,16 @@ fn git_uncommitted_files(vault: &Path) -> Vec<String> {
     // files inside — ls-files resolves them so the cache picks up all new files.
     let untracked = run_git(vault, &["ls-files", "--others", "--exclude-standard"])
         .map(|s| {
-            s.lines()
-                .filter(|l| !l.is_empty() && !has_hidden_segment(l))
-                .map(|l| l.to_string())
-                .collect::<Vec<_>>()
+            let mut paths = Vec::new();
+            for line in s.lines() {
+                push_unique_relative_path(&mut paths, line);
+            }
+            paths
         })
         .unwrap_or_default();
 
     for path in untracked {
-        if !files.contains(&path) {
-            files.push(path);
-        }
+        push_unique_relative_path(&mut files, path);
     }
 
     files
@@ -447,13 +442,12 @@ fn write_cache(
 
 /// Normalize an absolute path to a relative path for comparison with git output.
 fn to_relative_path(abs_path: &str, vault: &Path) -> String {
-    let vault_str = vault.to_string_lossy();
-    let with_slash = format!("{}/", vault_str);
-    abs_path
-        .strip_prefix(&with_slash)
-        .or_else(|| abs_path.strip_prefix(vault_str.as_ref()))
-        .unwrap_or(abs_path)
-        .to_string()
+    vault_relative_path_string(vault, Path::new(abs_path))
+        .unwrap_or_else(|_| normalize_path_for_identity(abs_path))
+}
+
+fn to_relative_path_key(abs_path: &str, vault: &Path) -> String {
+    relative_path_key(&to_relative_path(abs_path, vault))
 }
 
 /// Parse files from a list of relative paths, skipping any that don't exist.
@@ -535,7 +529,7 @@ fn prune_stale_entries(vault: &Path, entries: &mut Vec<VaultEntry>) -> bool {
     // Deduplicate by case-folded relative path
     let mut seen = std::collections::HashSet::new();
     entries.retain(|e| {
-        let rel = to_relative_path(&e.path, vault).to_lowercase();
+        let rel = to_relative_path_key(&e.path, vault);
         seen.insert(rel)
     });
     entries.len() != before
@@ -587,8 +581,9 @@ fn update_same_commit(
     let changed = git_uncommitted_files(vault);
     let mut entries = cache.entries;
     if !changed.is_empty() {
-        let changed_set: std::collections::HashSet<String> = changed.iter().cloned().collect();
-        entries.retain(|e| !changed_set.contains(&to_relative_path(&e.path, vault)));
+        let changed_set: std::collections::HashSet<String> =
+            changed.iter().map(|path| relative_path_key(path)).collect();
+        entries.retain(|e| !changed_set.contains(&to_relative_path_key(&e.path, vault)));
         entries.extend(parse_files_at(vault, &changed, git_dates));
     }
     // Always finalize: prune_stale_entries inside finalize_and_cache removes
@@ -605,12 +600,15 @@ fn update_different_commit(
 ) -> Vec<VaultEntry> {
     let LoadedCache { cache, fingerprint } = loaded_cache;
     let changed_files = git_changed_files(vault, &cache.commit_hash, &current_hash);
-    let changed_set: std::collections::HashSet<String> = changed_files.iter().cloned().collect();
+    let changed_set: std::collections::HashSet<String> = changed_files
+        .iter()
+        .map(|path| relative_path_key(path))
+        .collect();
 
     let mut entries: Vec<VaultEntry> = cache
         .entries
         .into_iter()
-        .filter(|e| !changed_set.contains(&to_relative_path(&e.path, vault)))
+        .filter(|e| !changed_set.contains(&to_relative_path_key(&e.path, vault)))
         .collect();
     entries.extend(parse_files_at(vault, &changed_files, git_dates));
 
@@ -618,9 +616,10 @@ fn update_different_commit(
 }
 
 fn cache_requires_full_rescan(cache: &VaultCache, vault_path: &Path) -> bool {
-    let current_vault_str = vault_path.to_string_lossy();
+    let current_vault_str = normalize_path_for_identity(&vault_path.to_string_lossy());
     cache.version != CACHE_VERSION
-        || (!cache.vault_path.is_empty() && cache.vault_path != current_vault_str.as_ref())
+        || (!cache.vault_path.is_empty()
+            && normalize_path_for_identity(&cache.vault_path) != current_vault_str)
 }
 
 fn scan_and_cache_full(
@@ -768,6 +767,14 @@ mod tests {
             .unwrap();
     }
 
+    fn force_quoted_git_paths(vault: &Path) {
+        crate::hidden_command("git")
+            .args(["config", "core.quotePath", "true"])
+            .current_dir(vault)
+            .output()
+            .unwrap();
+    }
+
     #[test]
     fn test_cache_path_is_outside_vault() {
         let _lock = ENV_LOCK.lock().unwrap();
@@ -800,6 +807,17 @@ mod tests {
         assert_eq!(hash1, hash2);
     }
 
+    #[test]
+    fn test_to_relative_path_normalizes_aliases_and_separators() {
+        assert_eq!(
+            to_relative_path(
+                "/tmp/tolaria-vault/projects\\active.md",
+                Path::new("/private/tmp/tolaria-vault")
+            ),
+            "projects/active.md"
+        );
+    }
+
     #[test]
     fn test_different_vaults_get_different_hashes() {
         let hash1 = vault_path_hash(Path::new("/Users/test/Vault1"));
@@ -1007,6 +1025,22 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_git_uncommitted_files_preserves_chinese_markdown_path() {
+        let (_lock, _cache_tmp, dir) = setup_git_vault();
+        let vault = dir.path();
+        let relative_path = "中文笔记.md";
+
+        force_quoted_git_paths(vault);
+        create_test_file(vault, relative_path, "# 初始\n");
+        git_add_commit(vault, "init");
+        create_test_file(vault, relative_path, "# 初始\n\n更新\n");
+
+        let changed = git_uncommitted_files(vault);
+
+        assert_eq!(changed, vec![relative_path.to_string()]);
+    }
+
     #[test]
     fn test_update_same_commit_new_file_still_added() {
         let (_lock, _cache_tmp, dir) = setup_git_vault();

src-tauri/src/vault/file.rs

@@ -2,7 +2,10 @@ use std::borrow::Cow;
 use std::fs;
 use std::io::{Error, ErrorKind, Write};
 use std::path::Path;
-use std::time::UNIX_EPOCH;
+use std::thread;
+use std::time::{Duration, UNIX_EPOCH};
+
+const SAVE_RETRY_DELAYS_MS: [u64; 4] = [25, 50, 100, 200];
 
 /// Read file metadata (modified_at timestamp, created_at timestamp, file size).
 /// Creation time is sourced from filesystem metadata (birthtime on macOS).
@@ -30,6 +33,25 @@ fn is_invalid_platform_path_error(error: &Error) -> bool {
     error.kind() == ErrorKind::InvalidInput || error.raw_os_error() == Some(123)
 }
 
+fn is_retryable_save_error(error: &Error) -> bool {
+    error.kind() == ErrorKind::PermissionDenied
+        || (cfg!(windows) && error.raw_os_error() == Some(5))
+}
+
+fn write_with_retry(
+    mut write_once: impl FnMut() -> Result<(), Error>,
+    mut wait_before_retry: impl FnMut(u64),
+) -> Result<(), Error> {
+    for delay in SAVE_RETRY_DELAYS_MS {
+        match write_once() {
+            Ok(()) => return Ok(()),
+            Err(error) if is_retryable_save_error(&error) => wait_before_retry(delay),
+            Err(error) => return Err(error),
+        }
+    }
+    write_once()
+}
+
 fn read_existing_note_bytes(path: &Path) -> Result<Vec<u8>, String> {
     if !path.exists() {
         return Err(format!("File does not exist: {}", path.display()));
@@ -141,8 +163,11 @@ pub fn save_note_content(path: &str, content: &str) -> Result<(), String> {
         }
     }
     validate_save_path(file_path, path)?;
-    fs::write(file_path, content)
-        .map_err(|e| note_io_error(NoteIoOperation::Save, NotePathDisplay::new(path), &e))
+    write_with_retry(
+        || fs::write(file_path, content),
+        |delay| thread::sleep(Duration::from_millis(delay)),
+    )
+    .map_err(|e| note_io_error(NoteIoOperation::Save, NotePathDisplay::new(path), &e))
 }
 
 /// Create a new note file without overwriting any existing file.
@@ -197,6 +222,28 @@ mod tests {
         );
     }
 
+    #[test]
+    fn retries_transient_access_denied_save_errors() {
+        let mut attempts = 0;
+        let mut delays = Vec::new();
+
+        write_with_retry(
+            || {
+                attempts += 1;
+                if attempts == 1 {
+                    Err(Error::new(ErrorKind::PermissionDenied, "Access is denied"))
+                } else {
+                    Ok(())
+                }
+            },
+            |delay| delays.push(delay),
+        )
+        .unwrap();
+
+        assert_eq!(attempts, 2);
+        assert_eq!(delays, vec![25]);
+    }
+
     #[test]
     fn note_content_matches_detects_external_edits() {
         let dir = tempfile::TempDir::new().unwrap();

src-tauri/src/vault/frontmatter.rs

@@ -242,28 +242,53 @@ pub(crate) fn extract_relationships(
             continue;
         }
 
-        match value {
-            serde_json::Value::String(s) if contains_wikilink(s) => {
-                relationships.insert(key.clone(), vec![s.clone()]);
-            }
-            serde_json::Value::Array(arr) => {
-                let wikilinks: Vec<String> = arr
-                    .iter()
-                    .filter_map(|v| v.as_str())
-                    .filter(|s| contains_wikilink(s))
-                    .map(|s| s.to_string())
-                    .collect();
-                if !wikilinks.is_empty() {
-                    relationships.insert(key.clone(), wikilinks);
-                }
-            }
-            _ => {}
+        let wikilinks = relationship_wikilinks(value);
+        if !wikilinks.is_empty() {
+            relationships.insert(key.clone(), wikilinks);
         }
     }
 
     relationships
 }
 
+fn relationship_wikilinks(value: &serde_json::Value) -> Vec<String> {
+    let mut wikilinks = Vec::new();
+    collect_relationship_wikilinks(value, 0, &mut wikilinks);
+    wikilinks
+}
+
+fn collect_relationship_wikilinks(
+    value: &serde_json::Value,
+    depth: usize,
+    wikilinks: &mut Vec<String>,
+) {
+    match value {
+        serde_json::Value::String(s) if contains_wikilink(s) => wikilinks.push(s.clone()),
+        serde_json::Value::Array(arr) => {
+            if let Some(link) = nested_flow_wikilink(arr, depth) {
+                wikilinks.push(link);
+                return;
+            }
+            for item in arr {
+                collect_relationship_wikilinks(item, depth + 1, wikilinks);
+            }
+        }
+        _ => {}
+    }
+}
+
+fn nested_flow_wikilink(arr: &[serde_json::Value], depth: usize) -> Option<String> {
+    if depth == 0 {
+        return None;
+    }
+    match arr {
+        [serde_json::Value::String(target)] if !contains_wikilink(target) => {
+            Some(format!("[[{target}]]"))
+        }
+        _ => None,
+    }
+}
+
 /// Extract custom scalar properties from raw YAML frontmatter.
 pub(crate) fn extract_properties(
     data: &HashMap<String, serde_json::Value>,
@@ -276,6 +301,9 @@ pub(crate) fn extract_properties(
         }
 
         match value {
+            serde_json::Value::Null => {
+                properties.insert(key.clone(), value.clone());
+            }
             serde_json::Value::String(s) if !contains_wikilink(s) => {
                 properties.insert(key.clone(), value.clone());
             }

src-tauri/src/vault/frontmatter_regression_tests.rs

@@ -114,6 +114,40 @@ fn test_single_element_array_properties_unwrap_to_scalars() {
     }
 }
 
+#[test]
+fn test_blank_scalar_properties_are_preserved() {
+    let dir = TempDir::new().unwrap();
+    let entry = parse_test_entry(
+        &dir,
+        "book.md",
+        "---\ntype: Book\nstart date:\nrating: \n---\n# Book\n",
+    );
+
+    assert!(entry
+        .properties
+        .get("start date")
+        .is_some_and(|value| value.is_null()));
+    assert!(entry
+        .properties
+        .get("rating")
+        .is_some_and(|value| value.is_null()));
+}
+
+#[test]
+fn test_unquoted_wikilink_relationships_are_preserved() {
+    let dir = TempDir::new().unwrap();
+    let entry = parse_test_entry(
+        &dir,
+        "book.md",
+        "---\ntype: Type\nMentor: [[person/alice]]\n---\n# Book\n",
+    );
+
+    assert_eq!(
+        entry.relationships.get("Mentor"),
+        Some(&vec!["[[person/alice]]".to_string()])
+    );
+}
+
 #[test]
 fn test_alias_parser_recovers_special_alias_items() {
     let cases = [

src-tauri/src/vault/mod.rs

@@ -10,6 +10,7 @@ mod ignored;
 mod image;
 mod migration;
 mod parsing;
+pub(crate) mod path_identity;
 mod rename;
 mod rename_transaction;
 mod title_sync;
@@ -349,11 +350,7 @@ fn lookup_git_dates(
     vault_path: &Path,
     git_dates: &HashMap<String, GitDates>,
 ) -> Option<(u64, u64)> {
-    let rel = path
-        .strip_prefix(vault_path)
-        .ok()?
-        .to_string_lossy()
-        .to_string();
+    let rel = path_identity::vault_relative_path_string(vault_path, path).ok()?;
     git_dates.get(&rel).map(|d| (d.modified_at, d.created_at))
 }
 
@@ -462,11 +459,10 @@ pub fn scan_vault_folders(vault_path: &Path) -> Result<Vec<FolderNode>, String>
             if is_folder_tree_hidden_dir(&name) {
                 continue;
             }
-            let rel_path = path
-                .strip_prefix(vault_root)
-                .unwrap_or(&path)
-                .to_string_lossy()
-                .replace('\\', "/");
+            let rel_path = path_identity::vault_relative_path_string(vault_root, &path)
+                .unwrap_or_else(|_| {
+                    path_identity::normalize_path_for_identity(&path.to_string_lossy())
+                });
             let children = build_tree(&path, vault_root);
             nodes.push(FolderNode {
                 name,

src-tauri/src/vault/path_identity.rs

@@ -0,0 +1,117 @@
+use std::path::Path;
+
+type PathText = str;
+type RelativePathText = str;
+
+fn normalize_tmp_alias(path: &PathText) -> String {
+    if path == "/private/tmp" {
+        return "/tmp".to_string();
+    }
+    if let Some(rest) = path.strip_prefix("/private/tmp/") {
+        return format!("/tmp/{rest}");
+    }
+    path.to_string()
+}
+
+fn trim_trailing_slashes(path: String) -> String {
+    let trimmed = path.trim_end_matches('/');
+    if trimmed.is_empty() && path.starts_with('/') {
+        "/".to_string()
+    } else {
+        trimmed.to_string()
+    }
+}
+
+pub(crate) fn normalize_path_for_identity(path: &PathText) -> String {
+    trim_trailing_slashes(normalize_tmp_alias(&path.replace('\\', "/")))
+}
+
+pub(crate) fn normalize_relative_path(path: &RelativePathText) -> String {
+    path.replace('\\', "/").trim_matches('/').to_string()
+}
+
+pub(crate) fn relative_path_key(path: &RelativePathText) -> String {
+    normalize_relative_path(path).to_lowercase()
+}
+
+pub(crate) fn has_hidden_segment(path: &RelativePathText) -> bool {
+    normalize_relative_path(path)
+        .split('/')
+        .any(|segment| segment.starts_with('.'))
+}
+
+pub(crate) fn push_unique_relative_path(
+    paths: &mut Vec<String>,
+    path: impl AsRef<RelativePathText>,
+) {
+    let normalized = normalize_relative_path(path.as_ref());
+    if normalized.is_empty() || has_hidden_segment(&normalized) {
+        return;
+    }
+    let key = relative_path_key(&normalized);
+    if !paths
+        .iter()
+        .any(|existing| relative_path_key(existing) == key)
+    {
+        paths.push(normalized);
+    }
+}
+
+pub(crate) fn vault_relative_path_string(vault: &Path, file: &Path) -> Result<String, String> {
+    let vault_path = normalize_path_for_identity(&vault.to_string_lossy());
+    let file_path = normalize_path_for_identity(&file.to_string_lossy());
+    if file_path == vault_path {
+        return Ok(String::new());
+    }
+
+    let prefix = format!("{vault_path}/");
+    file_path
+        .strip_prefix(&prefix)
+        .map(normalize_relative_path)
+        .ok_or_else(|| {
+            format!(
+                "File {} is not inside vault {}",
+                file.display(),
+                vault.display()
+            )
+        })
+}
+
+pub(crate) fn vault_relative_markdown_stem(path: &Path, vault: &Path) -> String {
+    let relative = vault_relative_path_string(vault, path)
+        .unwrap_or_else(|_| normalize_path_for_identity(&path.to_string_lossy()));
+    relative
+        .strip_suffix(".md")
+        .unwrap_or(&relative)
+        .to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_vault_relative_path_string_normalizes_tmp_alias_and_backslashes() {
+        assert_eq!(
+            vault_relative_path_string(
+                Path::new("/private/tmp/tolaria-vault"),
+                Path::new("/tmp/tolaria-vault/projects\\active.md"),
+            )
+            .unwrap(),
+            "projects/active.md"
+        );
+    }
+
+    #[test]
+    fn test_relative_path_key_is_case_insensitive_without_changing_output_path() {
+        let mut paths = vec![];
+        push_unique_relative_path(&mut paths, "Projects\\Active.md");
+        push_unique_relative_path(&mut paths, "projects/active.md");
+
+        assert_eq!(paths, vec!["Projects/Active.md"]);
+        assert_eq!(
+            relative_path_key("Projects\\Active.md"),
+            "projects/active.md"
+        );
+    }
+}

src-tauri/src/vault/rename.rs

@@ -7,6 +7,7 @@ use tempfile::NamedTempFile;
 use walkdir::WalkDir;
 
 use super::filename_rules::validate_filename_stem;
+use super::path_identity::vault_relative_markdown_stem;
 use super::rename_transaction::RenameWorkspace;
 use crate::frontmatter::{update_frontmatter_content, FrontmatterValue};
 
@@ -211,12 +212,7 @@ fn update_note_title_in_content(content: &str, new_title: &str) -> String {
 
 /// Strip vault prefix and .md suffix to get the relative path stem (e.g., "project/weekly-review").
 fn to_path_stem(path: &Path, vault_root: &Path) -> String {
-    let relative = path.strip_prefix(vault_root).unwrap_or(path);
-    let normalized = relative.to_string_lossy().replace('\\', "/");
-    normalized
-        .strip_suffix(".md")
-        .unwrap_or(&normalized)
-        .to_string()
+    vault_relative_markdown_stem(path, vault_root)
 }
 
 pub(crate) fn recover_pending_rename_transactions(vault: &Path) -> Result<(), String> {
@@ -501,7 +497,7 @@ pub struct DetectedRename {
 
 /// Detect renamed files by comparing working tree against HEAD using git diff.
 pub fn detect_renames(vault: &Path) -> Result<Vec<DetectedRename>, String> {
-    let output = crate::hidden_command("git")
+    let output = crate::git::git_command()
         .args(["diff", "HEAD", "--name-status", "--diff-filter=R", "-M"])
         .current_dir(vault)
         .output()
@@ -601,6 +597,27 @@ mod tests {
         vault.join(relative_path)
     }
 
+    fn run_git(vault: &Path, args: &[&str]) {
+        let output = crate::hidden_command("git")
+            .args(args)
+            .current_dir(vault)
+            .output()
+            .unwrap();
+        assert!(
+            output.status.success(),
+            "git {:?} failed: {}",
+            args,
+            String::from_utf8_lossy(&output.stderr)
+        );
+    }
+
+    fn init_git_repo_with_quoted_paths(vault: &Path) {
+        run_git(vault, &["init"]);
+        run_git(vault, &["config", "user.email", "test@test.com"]);
+        run_git(vault, &["config", "user.name", "Test"]);
+        run_git(vault, &["config", "core.quotePath", "true"]);
+    }
+
     fn assert_rename_note_filename_error<P>(
         new_filename_stem: impl AsRef<str>,
         existing_destination: Option<P>,
@@ -710,6 +727,36 @@ mod tests {
         assert_unicode_rename_frontmatter(&result);
     }
 
+    #[test]
+    fn test_detect_renames_preserves_chinese_markdown_paths() {
+        let dir = TempDir::new().unwrap();
+        let vault = dir.path();
+
+        init_git_repo_with_quoted_paths(vault);
+        create_test_file(vault, "旧名.md", "# 旧名\n");
+        run_git(vault, &["add", "旧名.md"]);
+        run_git(vault, &["commit", "-m", "add chinese note"]);
+        fs::rename(vault.join("旧名.md"), vault.join("新名.md")).unwrap();
+        run_git(vault, &["add", "-A"]);
+
+        let renames = detect_renames(vault).unwrap();
+
+        assert_eq!(renames.len(), 1);
+        assert_eq!(renames[0].old_path, "旧名.md");
+        assert_eq!(renames[0].new_path, "新名.md");
+    }
+
+    #[test]
+    fn test_path_stem_normalizes_tmp_aliases_and_separators() {
+        assert_eq!(
+            to_path_stem(
+                Path::new("/tmp/tolaria-vault/projects\\weekly-review.md"),
+                Path::new("/private/tmp/tolaria-vault")
+            ),
+            "projects/weekly-review"
+        );
+    }
+
     #[test]
     fn test_rename_note_basic() {
         let dir = TempDir::new().unwrap();

src-tauri/src/window_state.rs

@@ -7,7 +7,7 @@ use tauri::{
     WindowEvent,
 };
 
-const MAIN_WINDOW_LABEL: &str = "main";
+pub(crate) const MAIN_WINDOW_LABEL: &str = "main";
 const WINDOW_STATE_FILE: &str = "window-state.json";
 const MIN_WINDOW_WIDTH: u32 = 480;
 const MIN_WINDOW_HEIGHT: u32 = 400;

src-tauri/tauri.conf.json

@@ -34,13 +34,13 @@
       "csp": {
         "default-src": "'self' ipc: http://ipc.localhost",
         "script-src": "'self' https://us.i.posthog.com https://eu.i.posthog.com https://us-assets.i.posthog.com https://eu-assets.i.posthog.com",
-        "connect-src": "'self' ipc: http://ipc.localhost ws://localhost:9710 ws://127.0.0.1:9710 ws://localhost:9711 ws://127.0.0.1:9711 https:",
+        "connect-src": "'self' ipc: http://ipc.localhost data: ws://localhost:9710 ws://127.0.0.1:9710 ws://localhost:9711 ws://127.0.0.1:9711 https:",
         "img-src": "'self' asset: http://asset.localhost data: blob: https:",
         "style-src": "'self' 'unsafe-inline' https://fonts.googleapis.com",
         "style-src-elem": "'self' 'nonce-tolaria-runtime-style' https://fonts.googleapis.com",
         "style-src-attr": "'unsafe-inline'",
         "font-src": "'self' data: https://fonts.gstatic.com",
-        "media-src": "'self' data: blob: https:",
+        "media-src": "'self' asset: http://asset.localhost data: blob: https:",
         "object-src": "'self' asset: http://asset.localhost"
       },
       "assetProtocol": {

src/App.test.tsx

@@ -311,7 +311,7 @@ function resetMockCommandResults() {
 }
 
 function resolveMockCommandResult(cmd: string, args?: unknown) {
-  const result = mockCommandResults[cmd]
+  const result = Reflect.get(mockCommandResults, cmd) as unknown
   return typeof result === 'function'
     ? (result as (input?: unknown) => unknown)(args)
     : result ?? null
@@ -654,6 +654,39 @@ describe('App', () => {
     })
   })
 
+  it('shows immediate feedback while a menu-driven update check is pending', async () => {
+    let resolveUpdate: ((result: { kind: 'up-to-date' }) => void) | null = null
+    const checkForUpdates = vi.fn(() => new Promise<{ kind: 'up-to-date' }>((resolve) => {
+      resolveUpdate = resolve
+    }))
+    vi.mocked(useUpdater).mockReturnValue(createMockUpdaterResult(checkForUpdates))
+
+    render(<App />)
+
+    await waitFor(() => {
+      expect(screen.getByText('All Notes')).toBeInTheDocument()
+      expect(typeof window.__laputaTest?.dispatchBrowserMenuCommand).toBe('function')
+    })
+
+    act(() => {
+      window.__laputaTest?.dispatchBrowserMenuCommand?.('app-check-for-updates')
+    })
+
+    await waitFor(() => {
+      expect(screen.getByText('Checking for updates...')).toBeInTheDocument()
+    })
+    expect(checkForUpdates).toHaveBeenCalledOnce()
+
+    await act(async () => {
+      resolveUpdate?.({ kind: 'up-to-date' })
+      await Promise.resolve()
+    })
+
+    await waitFor(() => {
+      expect(screen.getByText('No newer stable update is available right now')).toBeInTheDocument()
+    })
+  })
+
   it('shows the external AI setup dialog from the menu when AI onboarding is active', async () => {
     localStorage.removeItem(AI_AGENTS_ONBOARDING_DISMISSED_KEY)
     localStorage.removeItem(CLAUDE_CODE_ONBOARDING_DISMISSED_KEY)
@@ -669,7 +702,7 @@ describe('App', () => {
     render(<App />)
 
     await waitFor(() => {
-      expect(screen.getByText('AI agents ready')).toBeInTheDocument()
+      expect(screen.getByText('AI is ready')).toBeInTheDocument()
     }, { timeout: SLOW_APP_READY_TIMEOUT_MS })
 
     await waitFor(() => {
@@ -684,7 +717,7 @@ describe('App', () => {
       expect(screen.getByText('Manage External AI Tools')).toBeInTheDocument()
     })
     expect(screen.getByTestId('mcp-setup-dialog')).toBeInTheDocument()
-    expect(screen.queryByText('AI agents ready')).not.toBeInTheDocument()
+    expect(screen.queryByText('AI is ready')).not.toBeInTheDocument()
   })
 
   it('routes right-panel AI chat messages to the selected default agent', async () => {
@@ -746,8 +779,6 @@ describe('App', () => {
     fireEvent.keyDown(window, { key: 'l', code: 'KeyL', metaKey: true, shiftKey: true })
 
     const input = await screen.findByTestId('agent-input')
-    input.textContent = 'Summarize the active vault'
-    fireEvent.input(input)
     fireEvent.click(screen.getByTestId('agent-send'))
 
     await act(async () => {
@@ -772,6 +803,8 @@ describe('App', () => {
       expect(input).toHaveAttribute('aria-placeholder', 'Ask Codex')
     })
 
+    input.textContent = 'Summarize the active vault'
+    fireEvent.input(input)
     fireEvent.click(screen.getByTestId('agent-send'))
 
     await waitFor(() => {
@@ -1348,4 +1381,34 @@ describe('App', () => {
       })
     })
   })
+
+  it('does not ask Windows to grow the native window when toggling Properties', async () => {
+    const { invoke } = await import('@tauri-apps/api/core') as { invoke: ReturnType<typeof vi.fn> }
+    const originalUserAgent = navigator.userAgent
+    Object.defineProperty(window.navigator, 'userAgent', {
+      configurable: true,
+      value: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)',
+    })
+
+    try {
+      render(<App />)
+      await waitFor(() => {
+        expect(screen.getByText('All Notes')).toBeInTheDocument()
+      })
+
+      invoke.mockClear()
+
+      fireEvent.keyDown(window, { key: 'I', metaKey: true, shiftKey: true })
+      await waitFor(() => {
+        expect(invoke).toHaveBeenCalledWith('update_current_window_min_size', expect.objectContaining({
+          growToFit: false,
+        }))
+      })
+    } finally {
+      Object.defineProperty(window.navigator, 'userAgent', {
+        configurable: true,
+        value: originalUserAgent,
+      })
+    }
+  })
 })

src/App.tsx

@@ -88,6 +88,7 @@ import { initializeNoteProperties } from './utils/initializeNoteProperties'
 import { filterEntries, filterInboxEntries, type NoteListFilter } from './utils/noteListHelpers'
 import { resolveAllNotesFileVisibility } from './utils/allNotesFileVisibility'
 import { openNoteInNewWindow } from './utils/openNoteWindow'
+import { isWindows } from './utils/platform'
 import { refreshPulledVaultState } from './utils/pulledVaultRefresh'
 import { isNoteWindow, getNoteWindowParams, getNoteWindowPathCandidates, type NoteWindowParams } from './utils/windowMode'
 import { GitSetupDialog } from './components/GitRequiredModal'
@@ -101,6 +102,7 @@ import {
   getBrowserLanguagePreferences,
   resolveEffectiveLocale,
   serializeUiLanguagePreference,
+  translate,
   type UiLanguagePreference,
 } from './lib/i18n'
 import { normalizeReleaseChannel } from './lib/releaseChannel'
@@ -108,6 +110,7 @@ import {
   buildVaultAiGuidanceRefreshKey,
 } from './lib/vaultAiGuidance'
 import { extractDeletedContentFromDiff } from './components/note-list/noteListUtils'
+import { isActiveVaultUnavailableError } from './utils/vaultErrors'
 import { hasNoteIconValue } from './utils/noteIcon'
 import { filenameStemToTitle } from './utils/noteTitle'
 import {
@@ -127,6 +130,14 @@ import {
 import { requestPlainTextPaste } from './utils/plainTextPaste'
 import './App.css'
 
+const ACTIVE_EDITOR_SURFACE_SELECTOR = '.editor__blocknote-container, .raw-editor-codemirror'
+
+function isActiveElementInsideEditorSurface(): boolean {
+  const activeElement = document.activeElement
+  if (!(activeElement instanceof HTMLElement)) return false
+  return Boolean(activeElement.closest(ACTIVE_EDITOR_SURFACE_SELECTOR))
+}
+
 // Type declarations for mock content storage and test overrides
 declare global {
   interface Window {
@@ -375,6 +386,7 @@ function App() {
   }, [resolvedPath, setToastMessage])
 
   const vault = useVaultLoader(noteWindowParams ? '' : resolvedPath)
+  const runtimeMissingVaultPath = !noteWindowParams ? vault.unavailableVaultPath : null
   const {
     markInternalWrite: markRecentVaultWrite,
     filterExternalPaths: filterExternalVaultPaths,
@@ -578,6 +590,9 @@ function App() {
     markRecentVaultWrite(path)
     vault.loadModifiedFiles()
   }, [markRecentVaultWrite, vault])
+  const handleMissingActiveVault = useCallback(() => {
+    if (!noteWindowParams && resolvedPath) vault.markVaultUnavailable(resolvedPath)
+  }, [noteWindowParams, resolvedPath, vault])
 
   const notes = useNoteActions({
     addEntry: vault.addEntry,
@@ -596,6 +611,7 @@ function App() {
     unsavedPaths: vault.unsavedPaths,
     markContentPending: (path, content) => appSave.contentChangeRef.current(path, content),
     onNewNotePersisted: handleCreatedVaultEntryPersisted,
+    onMissingActiveVault: handleMissingActiveVault,
     onTypeStateChanged: async () => { await vault.reloadVault() },
     replaceEntry: vault.replaceEntry,
     onFrontmatterPersisted: vault.loadModifiedFiles,
@@ -611,12 +627,18 @@ function App() {
   useEffect(() => {
     noteWindowActionsRef.current = { handleSelectNote, openTabWithContent }
   }, [handleSelectNote, openTabWithContent])
-  const handlePulledVaultUpdate = useCallback(async (updatedFiles: string[]) => {
+  const handleVaultUpdate = useCallback(async (
+    updatedFiles: string[],
+    options: { preserveFocusedEditor?: boolean } = {},
+  ) => {
     await refreshPulledVaultState({
       activeTabPath: notes.activeTabPath,
       closeAllTabs,
       getActiveTabPath: () => notes.activeTabPathRef.current,
       hasUnsavedChanges: (path) => vault.unsavedPaths.has(path),
+      shouldKeepActiveEditorMounted: options.preserveFocusedEditor
+        ? isActiveElementInsideEditorSurface
+        : undefined,
       reloadFolders: vault.reloadFolders,
       reloadVault: vault.reloadVault,
       reloadViews: vault.reloadViews,
@@ -635,9 +657,17 @@ function App() {
       vault.reloadViews,
       vault.unsavedPaths,
     ])
+  const handlePulledVaultUpdate = useCallback(
+    (updatedFiles: string[]) => handleVaultUpdate(updatedFiles),
+    [handleVaultUpdate],
+  )
+  const handleFocusedVaultUpdate = useCallback(
+    (updatedFiles: string[]) => handleVaultUpdate(updatedFiles, { preserveFocusedEditor: true }),
+    [handleVaultUpdate],
+  )
   useVaultWatcher({
     vaultPath: noteWindowParams ? '' : resolvedPath,
-    onVaultChanged: handlePulledVaultUpdate,
+    onVaultChanged: handleFocusedVaultUpdate,
     filterChangedPaths: filterExternalVaultPaths,
   })
   const autoSync = useAutoSync({
@@ -766,6 +796,7 @@ function App() {
     closeAllTabs,
     replaceActiveTab: handleReplaceActiveTab,
     hasUnsavedChanges: (path) => vault.unsavedPaths.has(path),
+    shouldKeepActiveEditorMounted: isActiveElementInsideEditorSurface,
     onSelectNote: notes.handleSelectNote,
     activeTabPath: notes.activeTabPath,
     getActiveTabPath: () => notes.activeTabPathRef.current,
@@ -1169,7 +1200,15 @@ function App() {
 
   const handleDeleteView = useCallback(async (filename: string) => {
     const target = isTauri() ? invoke : mockInvoke
-    await target('delete_view_cmd', { vaultPath: resolvedPath, filename })
+    try {
+      await target('delete_view_cmd', { vaultPath: resolvedPath, filename })
+    } catch (err) {
+      if (isActiveVaultUnavailableError(err)) {
+        vault.markVaultUnavailable(resolvedPath)
+        return
+      }
+      throw err
+    }
     await vault.reloadViews()
     await vault.reloadVault()
     vault.reloadFolders()
@@ -1222,7 +1261,7 @@ function App() {
       inspectorWidth: layout.inspectorWidth,
     })
 
-    void applyMainWindowSizeConstraints(minWidth).catch((err) => console.warn('[window] Size constraints failed:', err))
+    void applyMainWindowSizeConstraints(minWidth, { growToFit: !isWindows() }).catch((err) => console.warn('[window] Size constraints failed:', err))
   }, [layout.inspectorCollapsed, layout.inspectorWidth, layout.noteListWidth, layout.sidebarWidth, noteWindowParams])
 
   const handleSetViewMode = useCallback((mode: ViewMode) => {
@@ -1266,6 +1305,7 @@ function App() {
       await restartApp()
       return
     }
+    setToastMessage(translate(appLocale, 'update.checking'))
     const result = await updateActions.checkForUpdates()
     if (result.kind === 'up-to-date') {
       const checkedChannel = normalizeReleaseChannel(settings.release_channel)
@@ -1275,7 +1315,7 @@ function App() {
     } else {
       setToastMessage(result.message)
     }
-  }, [settings.release_channel, updateActions, updateStatus.state, setToastMessage])
+  }, [appLocale, settings.release_channel, updateActions, updateStatus.state, setToastMessage])
 
   const handleRepairVault = useCallback(async () => {
     if (!resolvedPath) return
@@ -1636,8 +1676,17 @@ function App() {
   }
 
   // Show welcome/onboarding screen when vault doesn't exist (skip for note windows — vault path is known)
-  if (!noteWindowParams && (onboarding.state.status === 'welcome' || onboarding.state.status === 'vault-missing' || shouldResumeFreshStartOnboarding)) {
-    const welcomeOnboarding = shouldResumeFreshStartOnboarding
+  if (!noteWindowParams && (runtimeMissingVaultPath || onboarding.state.status === 'welcome' || onboarding.state.status === 'vault-missing' || shouldResumeFreshStartOnboarding)) {
+    const welcomeOnboarding = runtimeMissingVaultPath
+      ? {
+          ...onboarding,
+          state: {
+            status: 'vault-missing' as const,
+            vaultPath: runtimeMissingVaultPath,
+            defaultPath: vaultSwitcher.defaultPath || runtimeMissingVaultPath,
+          },
+        }
+      : shouldResumeFreshStartOnboarding
       ? { ...onboarding, state: { status: 'welcome' as const, defaultPath: vaultSwitcher.vaultPath } }
       : onboarding
     return <WelcomeView onboarding={welcomeOnboarding} isOffline={networkStatus.isOffline} />
@@ -1668,7 +1717,7 @@ function App() {
           {sidebarVisible && (
             <>
               <div className="app__sidebar" style={{ width: layout.sidebarWidth }}>
-                <Sidebar entries={vault.entries} folders={vault.folders} views={vault.views} selection={effectiveSelection} onSelect={handleSetSelection} onSelectNote={notes.handleSelectNote} onSelectFavorite={handleOpenFavorite} onReorderFavorites={entryActions.handleReorderFavorites} onCreateType={notes.handleCreateNoteImmediate} onCreateNewType={dialogs.openCreateType} onCustomizeType={entryActions.handleCustomizeType} onUpdateTypeTemplate={entryActions.handleUpdateTypeTemplate} onReorderSections={entryActions.handleReorderSections} onRenameSection={entryActions.handleRenameSection} onDeleteType={handleDeleteType} onToggleTypeVisibility={entryActions.handleToggleTypeVisibility} onCreateFolder={handleCreateFolder} onRenameFolder={folderActions.renameFolder} onDeleteFolder={folderActions.requestDeleteFolder} folderFileActions={fileActions.folderActions} renamingFolderPath={folderActions.renamingFolderPath} onStartRenameFolder={folderActions.startFolderRename} onCancelRenameFolder={folderActions.cancelFolderRename} onCreateView={dialogs.openCreateView} onEditView={handleEditView} onDeleteView={handleDeleteView} onUpdateViewDefinition={handleSidebarUpdateViewDefinition} onReorderViews={viewOrdering.onReorderViews} showInbox={explicitOrganizationEnabled} inboxCount={inboxCount} allNotesFileVisibility={allNotesFileVisibility} onCollapse={handleCollapseSidebar} onGoBack={handleGoBack} onGoForward={handleGoForward} canGoBack={canGoBack} canGoForward={canGoForward} locale={appLocale} loading={isVaultContentLoading} vaultRootPath={resolvedPath} />
+                <Sidebar entries={vault.entries} folders={vault.folders} views={vault.views} selection={effectiveSelection} onSelect={handleSetSelection} onSelectNote={notes.handleSelectNote} onSelectFavorite={handleOpenFavorite} onReorderFavorites={entryActions.handleReorderFavorites} onCreateType={notes.handleCreateNoteImmediate} onCreateNewType={dialogs.openCreateType} onCustomizeType={entryActions.handleCustomizeType} onUpdateTypeTemplate={entryActions.handleUpdateTypeTemplate} onReorderSections={entryActions.handleReorderSections} onRenameSection={entryActions.handleRenameSection} onDeleteType={handleDeleteType} onToggleTypeVisibility={entryActions.handleToggleTypeVisibility} onCreateFolder={handleCreateFolder} onRenameFolder={folderActions.renameFolder} onDeleteFolder={folderActions.requestDeleteFolder} folderFileActions={fileActions.folderActions} renamingFolderPath={folderActions.renamingFolderPath} onStartRenameFolder={folderActions.startFolderRename} onCancelRenameFolder={folderActions.cancelFolderRename} onCreateView={dialogs.openCreateView} onEditView={handleEditView} onDeleteView={handleDeleteView} onUpdateViewDefinition={handleSidebarUpdateViewDefinition} onReorderViews={viewOrdering.onReorderViews} showInbox={explicitOrganizationEnabled} inboxCount={inboxCount} allNotesFileVisibility={allNotesFileVisibility} pluralizeTypeLabels={settings.sidebar_type_pluralization_enabled ?? true} onCollapse={handleCollapseSidebar} onGoBack={handleGoBack} onGoForward={handleGoForward} canGoBack={canGoBack} canGoForward={canGoForward} locale={appLocale} loading={isVaultContentLoading} vaultRootPath={resolvedPath} />
               </div>
               <ResizeHandle onResize={layout.handleSidebarResize} />
             </>
@@ -1702,6 +1751,7 @@ function App() {
               onToggleInspector={handleToggleInspector}
               inspectorWidth={layout.inspectorWidth}
               defaultAiAgent={aiAgentPreferences.defaultAiAgent}
+              defaultAiTarget={aiAgentPreferences.defaultAiTarget}
               defaultAiAgentReadiness={aiAgentPreferences.defaultAiAgentReadiness}
               defaultAiAgentReady={aiAgentPreferences.defaultAiAgentReady}
               onUnsupportedAiPaste={setToastMessage}
@@ -1755,7 +1805,7 @@ function App() {
         </div>
         <UpdateBanner status={updateStatus} actions={updateActions} locale={appLocale} />
         <RenameDetectedBanner renames={detectedRenames} onUpdate={handleUpdateWikilinks} onDismiss={handleDismissRenames} />
-        <StatusBar noteCount={vault.entries.length} modifiedCount={vault.modifiedFiles.length} vaultPath={resolvedPath} vaults={vaultSwitcher.allVaults} onSwitchVault={vaultSwitcher.switchVault} onOpenSettings={dialogs.openSettings} onOpenFeedback={openFeedback} onOpenLocalFolder={vaultSwitcher.handleOpenLocalFolder} onCreateEmptyVault={vaultSwitcher.handleCreateEmptyVault} onCloneVault={dialogs.openCloneVault} onCloneGettingStarted={cloneGettingStartedVault} onClickPending={() => handleSetSelection({ kind: 'filter', filter: 'changes' })} onClickPulse={() => handleSetSelection({ kind: 'filter', filter: 'pulse' })} onCommitPush={handleCommitPush} onInitializeGit={openGitSetupDialog} isOffline={networkStatus.isOffline} isGitVault={isGitVault} isVaultReloading={vault.isReloading || isVaultContentLoading} syncStatus={autoSync.syncStatus} lastSyncTime={autoSync.lastSyncTime} conflictCount={autoSync.conflictFiles.length} remoteStatus={autoSync.remoteStatus} onTriggerSync={autoSync.triggerSync} onPullAndPush={autoSync.pullAndPush} onOpenConflictResolver={conflictFlow.handleOpenConflictResolver} zoomLevel={zoom.zoomLevel} themeMode={documentThemeMode} onZoomReset={zoom.zoomReset} onToggleThemeMode={settingsLoaded ? handleToggleThemeMode : undefined} buildNumber={buildNumber} onCheckForUpdates={handleCheckForUpdates} onRemoveVault={vaultSwitcher.removeVault} mcpStatus={mcpStatus} onInstallMcp={openMcpSetupDialog} aiAgentsStatus={aiAgentsStatus} vaultAiGuidanceStatus={vaultAiGuidanceStatus} defaultAiAgent={aiAgentPreferences.defaultAiAgent} onSetDefaultAiAgent={aiAgentPreferences.setDefaultAiAgent} onRestoreVaultAiGuidance={() => { void restoreVaultAiGuidance() }} locale={appLocale} />
+        <StatusBar noteCount={vault.entries.length} modifiedCount={vault.modifiedFiles.length} vaultPath={resolvedPath} vaults={vaultSwitcher.allVaults} onSwitchVault={vaultSwitcher.switchVault} onOpenSettings={dialogs.openSettings} onOpenFeedback={openFeedback} onOpenLocalFolder={vaultSwitcher.handleOpenLocalFolder} onCreateEmptyVault={vaultSwitcher.handleCreateEmptyVault} onCloneVault={dialogs.openCloneVault} onCloneGettingStarted={cloneGettingStartedVault} onClickPending={() => handleSetSelection({ kind: 'filter', filter: 'changes' })} onClickPulse={() => handleSetSelection({ kind: 'filter', filter: 'pulse' })} onCommitPush={handleCommitPush} onInitializeGit={openGitSetupDialog} isOffline={networkStatus.isOffline} isGitVault={isGitVault} isVaultReloading={vault.isReloading || isVaultContentLoading} syncStatus={autoSync.syncStatus} lastSyncTime={autoSync.lastSyncTime} conflictCount={autoSync.conflictFiles.length} remoteStatus={autoSync.remoteStatus} onTriggerSync={autoSync.triggerSync} onPullAndPush={autoSync.pullAndPush} onOpenConflictResolver={conflictFlow.handleOpenConflictResolver} zoomLevel={zoom.zoomLevel} themeMode={documentThemeMode} onZoomReset={zoom.zoomReset} onToggleThemeMode={settingsLoaded ? handleToggleThemeMode : undefined} buildNumber={buildNumber} onCheckForUpdates={handleCheckForUpdates} onRemoveVault={vaultSwitcher.removeVault} mcpStatus={mcpStatus} onInstallMcp={openMcpSetupDialog} aiAgentsStatus={aiAgentsStatus} vaultAiGuidanceStatus={vaultAiGuidanceStatus} defaultAiAgent={aiAgentPreferences.defaultAiAgent} defaultAiTarget={settings.default_ai_target ?? undefined} aiModelProviders={settings.ai_model_providers ?? []} onSetDefaultAiAgent={aiAgentPreferences.setDefaultAiAgent} onSetDefaultAiTarget={aiAgentPreferences.setDefaultAiTarget} onRestoreVaultAiGuidance={() => { void restoreVaultAiGuidance() }} locale={appLocale} />
         <GitSetupDialog open={shouldShowGitSetupDialog} onInitGit={handleInitGitRepo} onDismiss={dismissGitSetupDialog} />
         <DeleteProgressNotice count={deleteActions.pendingDeleteCount} />
         <Toast message={toastMessage} onDismiss={() => setToastMessage(null)} />

src/components/AiAgentsOnboardingPrompt.test.tsx

@@ -58,7 +58,7 @@ describe('AiAgentsOnboardingPrompt', () => {
       claude_code: { status: 'installed', version: '1.0.20' },
     })
 
-    expect(screen.getByText('AI agents ready')).toBeInTheDocument()
+    expect(screen.getByText('AI is ready')).toBeInTheDocument()
     expectMissingAgentInstallLinks()
     expect(screen.getByTestId('ai-agents-onboarding-continue')).toHaveTextContent('Continue')
   })
@@ -66,12 +66,12 @@ describe('AiAgentsOnboardingPrompt', () => {
   it('shows the missing state when no agents are installed', () => {
     renderPrompt()
 
-    expect(screen.getByText('No AI agents detected')).toBeInTheDocument()
+    expect(screen.getByText('Choose how Tolaria should use AI')).toBeInTheDocument()
     expect(screen.getByTestId('claude-onboarding-screen')).toBeInTheDocument()
     expect(screen.getByText('Claude Code not detected')).toBeInTheDocument()
     expect(screen.getByTestId('ai-agents-onboarding-install-claude_code')).toBeInTheDocument()
     expectMissingAgentInstallLinks()
-    expect(screen.getByTestId('ai-agents-onboarding-continue')).toHaveTextContent('Continue without it')
+    expect(screen.getByTestId('ai-agents-onboarding-continue')).toHaveTextContent('Set up later')
   })
 
   it('opens the agent install links', () => {

src/components/AiAgentsOnboardingPrompt.tsx

@@ -1,4 +1,4 @@
-import { ArrowUpRight, Bot, CheckCircle2, Loader2 } from 'lucide-react'
+import { ArrowUpRight, Bot, CheckCircle2, Cloud, HardDrive, Loader2, Terminal } from 'lucide-react'
 import {
   AI_AGENT_DEFINITIONS,
   getAiAgentDefinition,
@@ -20,7 +20,7 @@ function getPromptCopy(statuses: AiAgentsStatus) {
   if (isAiAgentsStatusChecking(statuses)) {
     return {
       accentClassName: 'bg-muted text-muted-foreground',
-      description: 'Checking which AI agents are available on this machine.',
+      description: 'Checking coding agents. You can also use a local model or API provider.',
       icon: <Loader2 className="size-7 animate-spin" />,
       title: 'Checking AI agents',
     }
@@ -29,20 +29,54 @@ function getPromptCopy(statuses: AiAgentsStatus) {
   if (!hasAnyInstalledAiAgent(statuses)) {
     return {
       accentClassName: 'bg-[var(--feedback-warning-bg)] text-[var(--feedback-warning-text)]',
-      description: 'Tolaria works best with a local CLI AI agent installed.',
+      description: 'Connect a local model, an API provider, or a desktop coding agent.',
       icon: <Bot className="size-7" />,
-      title: 'No AI agents detected',
+      title: 'Choose how Tolaria should use AI',
     }
   }
 
   return {
     accentClassName: 'bg-[var(--feedback-success-bg)] text-[var(--feedback-success-text)]',
-    description: 'Your AI agents are ready to use in Tolaria.',
+    description: 'You can use the detected coding agents, or add local/API models in Settings.',
     icon: <CheckCircle2 className="size-7" />,
-    title: 'AI agents ready',
+    title: 'AI is ready',
   }
 }
 
+function AiModeChoices() {
+  const choices = [
+    {
+      icon: <HardDrive className="size-4" />,
+      title: 'Local model',
+      description: 'Use Ollama, LM Studio, or another local OpenAI-compatible endpoint. API keys are usually not needed.',
+    },
+    {
+      icon: <Cloud className="size-4" />,
+      title: 'API provider',
+      description: 'Use OpenAI, Anthropic, OpenRouter, or a gateway. API keys are read from environment variables, not saved in settings.',
+    },
+    {
+      icon: <Terminal className="size-4" />,
+      title: 'Coding agent',
+      description: 'Use Claude Code, Codex, OpenCode, Gemini CLI, or Pi for tool-capable vault editing on desktop.',
+    },
+  ]
+
+  return (
+    <div className="grid gap-3 md:grid-cols-3">
+      {choices.map((choice) => (
+        <div key={choice.title} className="rounded-lg border border-border bg-muted/20 p-3 text-left">
+          <div className="mb-2 flex items-center gap-2 text-sm font-medium text-foreground">
+            {choice.icon}
+            {choice.title}
+          </div>
+          <div className="text-xs leading-5 text-muted-foreground">{choice.description}</div>
+        </div>
+      ))}
+    </div>
+  )
+}
+
 function AgentStatusList({ statuses }: { statuses: AiAgentsStatus }) {
   return (
     <div className="space-y-3">
@@ -104,6 +138,7 @@ export function AiAgentsOnboardingPrompt({
         </CardHeader>
 
         <CardContent className="space-y-4">
+          <AiModeChoices />
           {showLegacyClaudeCompatibility ? (
             <div
               className="rounded-lg border border-[var(--feedback-warning-border)] bg-[var(--feedback-warning-bg)] px-4 py-3 text-left"
@@ -138,7 +173,7 @@ export function AiAgentsOnboardingPrompt({
               disabled={isAiAgentsStatusChecking(statuses)}
               data-testid={showLegacyClaudeCompatibility ? 'claude-onboarding-continue' : undefined}
             >
-              {hasAnyInstalledAiAgent(statuses) ? 'Continue' : 'Continue without it'}
+              {hasAnyInstalledAiAgent(statuses) ? 'Continue' : 'Set up later'}
             </Button>
           </div>
         </CardFooter>

src/components/AiPanel.test.tsx

@@ -197,6 +197,18 @@ describe('AiPanel', () => {
     expect(screen.getByTestId('ai-panel')).toBeTruthy()
   })
 
+  it('caps long AI agent drafts inside a scrollable composer while keeping send visible', () => {
+    render(<AiPanel onClose={vi.fn()} vaultPath="/tmp/vault" />)
+
+    const editor = screen.getByTestId('agent-input')
+    editor.textContent = Array.from({ length: 40 }, (_, index) => `Line ${index + 1}`).join('\n')
+    fireEvent.input(editor)
+
+    expect(editor).toHaveClass('max-h-[160px]', 'overflow-y-auto', 'overscroll-contain')
+    expect(editor).toHaveStyle({ maxHeight: '160px', overflowY: 'auto' })
+    expect(screen.getByTestId('agent-send')).toBeVisible()
+  })
+
   it('calls onClose when close button is clicked', () => {
     const onClose = vi.fn()
     render(<AiPanel onClose={onClose} vaultPath="/tmp/vault" />)

src/components/AiPanel.tsx

@@ -11,6 +11,7 @@ import {
   type AiAgentId,
   type AiAgentReadiness,
 } from '../lib/aiAgents'
+import type { AiTarget } from '../lib/aiTargets'
 import type { AppLocale } from '../lib/i18n'
 import { type NoteListItem } from '../utils/ai-context'
 import type { VaultEntry } from '../types'
@@ -25,6 +26,7 @@ interface AiPanelProps {
   onOpenNote?: (path: string) => void
   onUnsupportedAiPaste?: (message: string) => void
   defaultAiAgent?: AiAgentId
+  defaultAiTarget?: AiTarget
   defaultAiAgentReadiness?: AiAgentReadiness
   defaultAiAgentReady?: boolean
   locale?: AppLocale
@@ -47,6 +49,7 @@ interface AiPanelViewProps {
   onOpenNote?: (path: string) => void
   onUnsupportedAiPaste?: (message: string) => void
   defaultAiAgent?: AiAgentId
+  defaultAiTarget?: AiTarget
   defaultAiAgentReadiness?: AiAgentReadiness
   defaultAiAgentReady?: boolean
   locale?: AppLocale
@@ -64,6 +67,7 @@ export function AiPanelView({
   onOpenNote,
   onUnsupportedAiPaste,
   defaultAiAgent: providedDefaultAiAgent,
+  defaultAiTarget,
   defaultAiAgentReadiness: providedDefaultAiAgentReadiness,
   defaultAiAgentReady: providedDefaultAiAgentReady,
   locale = 'en',
@@ -75,7 +79,9 @@ export function AiPanelView({
     ?? readinessFromReadyFlag(providedDefaultAiAgentReady)
   const inputRef = useRef<HTMLDivElement>(null)
   const panelRef = useRef<HTMLElement>(null)
-  const agentLabel = getAiAgentDefinition(defaultAiAgent).label
+  const activeTarget = defaultAiTarget
+  const agentLabel = activeTarget?.label ?? getAiAgentDefinition(defaultAiAgent).label
+  const targetKind = activeTarget?.kind ?? 'agent'
   const {
     agent,
     input,
@@ -118,6 +124,7 @@ export function AiPanelView({
       <AiPanelHeader
         agentLabel={agentLabel}
         agentReadiness={defaultAiAgentReadiness}
+        targetKind={targetKind}
         locale={locale}
         permissionMode={permissionMode}
         permissionModeDisabled={isActive}
@@ -159,6 +166,7 @@ export function AiPanel({
   onOpenNote,
   onUnsupportedAiPaste,
   defaultAiAgent: providedDefaultAiAgent,
+  defaultAiTarget,
   defaultAiAgentReadiness: providedDefaultAiAgentReadiness,
   defaultAiAgentReady: providedDefaultAiAgentReady,
   locale = 'en',
@@ -178,6 +186,7 @@ export function AiPanel({
   const controller = useAiPanelController({
     vaultPath,
     defaultAiAgent: providedDefaultAiAgent ?? DEFAULT_AI_AGENT,
+    defaultAiTarget,
     defaultAiAgentReady: providedDefaultAiAgentReady ?? true,
     defaultAiAgentReadiness,
     activeEntry,
@@ -200,6 +209,7 @@ export function AiPanel({
       onOpenNote={onOpenNote}
       onUnsupportedAiPaste={onUnsupportedAiPaste}
       defaultAiAgent={providedDefaultAiAgent}
+      defaultAiTarget={defaultAiTarget}
       defaultAiAgentReadiness={defaultAiAgentReadiness}
       defaultAiAgentReady={providedDefaultAiAgentReady}
       locale={locale}

src/components/AiPanelChrome.performance.test.tsx

@@ -0,0 +1,55 @@
+import { useState } from 'react'
+import { describe, expect, it, vi } from 'vitest'
+import { fireEvent, render, screen } from '@testing-library/react'
+import { AiPanelMessageHistory } from './AiPanelChrome'
+
+const aiMessageRender = vi.hoisted(() => vi.fn())
+
+vi.mock('./AiMessage', () => ({
+  AiMessage: (props: { id?: string; response: string }) => {
+    aiMessageRender(props.id)
+    return <div data-testid="ai-message">{props.response}</div>
+  },
+}))
+
+const noop = () => {}
+
+function HistoryRerenderHarness() {
+  const [draft, setDraft] = useState('')
+  const [messages] = useState([{
+    userMessage: 'Explain the note',
+    actions: [],
+    response: 'Here is a long answer with [[Test Note]].',
+    id: 'msg-stable',
+  }])
+
+  return (
+    <>
+      <button type="button" onClick={() => setDraft('typing')}>type</button>
+      <span data-testid="draft">{draft}</span>
+      <AiPanelMessageHistory
+        agentLabel="Claude Code"
+        agentReadiness="ready"
+        messages={messages}
+        isActive={false}
+        onOpenNote={noop}
+        onNavigateWikilink={noop}
+        hasContext
+      />
+    </>
+  )
+}
+
+describe('AiPanelChrome performance', () => {
+  it('keeps stable message history from re-rendering while composer state changes', () => {
+    render(<HistoryRerenderHarness />)
+    expect(screen.getByTestId('ai-message')).toHaveTextContent('Here is a long answer')
+    expect(aiMessageRender).toHaveBeenCalledTimes(1)
+    aiMessageRender.mockClear()
+
+    fireEvent.click(screen.getByRole('button', { name: 'type' }))
+
+    expect(screen.getByTestId('draft')).toHaveTextContent('typing')
+    expect(aiMessageRender).not.toHaveBeenCalled()
+  })
+})

src/components/AiPanelChrome.tsx

@@ -1,4 +1,4 @@
-import { useEffect, useRef } from 'react'
+import { memo, useEffect, useRef } from 'react'
 import { Robot, X, PaperPlaneRight, Plus, Link } from '@phosphor-icons/react'
 import { AiMessage } from './AiMessage'
 import { Button } from '@/components/ui/button'
@@ -19,6 +19,7 @@ import type { VaultEntry } from '../types'
 interface AiPanelHeaderProps {
   agentLabel: string
   agentReadiness: AiAgentReadiness
+  targetKind?: 'agent' | 'api_model'
   locale?: AppLocale
   permissionMode: AiAgentPermissionMode
   permissionModeDisabled: boolean
@@ -164,9 +165,10 @@ function AiPanelEmptyState({
   )
 }
 
-export function AiPanelHeader({
+export const AiPanelHeader = memo(function AiPanelHeader({
   agentLabel,
   agentReadiness,
+  targetKind = 'agent',
   locale = 'en',
   permissionMode,
   permissionModeDisabled,
@@ -175,7 +177,9 @@ export function AiPanelHeader({
   onNewChat,
 }: AiPanelHeaderProps) {
   const t = createTranslator(locale)
-  const modeLabel = aiAgentPermissionModeLabels(permissionMode, locale).short
+  const modeLabel = targetKind === 'api_model'
+    ? t('ai.panel.mode.chat')
+    : aiAgentPermissionModeLabels(permissionMode, locale).short
 
   return (
     <div
@@ -196,6 +200,7 @@ export function AiPanelHeader({
           type="button"
           variant="ghost"
           size="icon-xs"
+          className="h-6 w-6 p-0 [&_svg:not([class*=size-])]:size-4"
           onClick={onNewChat}
           aria-label={t('ai.panel.newChat')}
           title={t('ai.panel.newChat')}
@@ -206,6 +211,7 @@ export function AiPanelHeader({
           type="button"
           variant="ghost"
           size="icon-xs"
+          className="h-6 w-6 p-0 [&_svg:not([class*=size-])]:size-4"
           onClick={onClose}
           aria-label={t('ai.panel.close')}
           title={t('ai.panel.close')}
@@ -213,15 +219,21 @@ export function AiPanelHeader({
           <X size={16} />
         </Button>
       </div>
-      <AiPermissionModeToggle
-        value={permissionMode}
-        locale={locale}
-        disabled={permissionModeDisabled}
-        onChange={onPermissionModeChange}
-      />
+      {targetKind === 'agent' ? (
+        <AiPermissionModeToggle
+          value={permissionMode}
+          locale={locale}
+          disabled={permissionModeDisabled}
+          onChange={onPermissionModeChange}
+        />
+      ) : (
+        <div className="rounded-md border border-border bg-muted px-3 py-2 text-[11px] leading-5 text-muted-foreground">
+          {t('ai.panel.mode.chatDescription')}
+        </div>
+      )}
     </div>
   )
-}
+})
 
 function AiPermissionModeToggle({
   value,
@@ -277,7 +289,11 @@ function AiPermissionModeToggle({
   )
 }
 
-export function AiPanelContextBar({ activeEntry, linkedCount, locale = 'en' }: AiPanelContextBarProps) {
+export const AiPanelContextBar = memo(function AiPanelContextBar({
+  activeEntry,
+  linkedCount,
+  locale = 'en',
+}: AiPanelContextBarProps) {
   const t = createTranslator(locale)
 
   return (
@@ -293,9 +309,9 @@ export function AiPanelContextBar({ activeEntry, linkedCount, locale = 'en' }: A
       )}
     </div>
   )
-}
+})
 
-export function AiPanelMessageHistory({
+export const AiPanelMessageHistory = memo(function AiPanelMessageHistory({
   agentLabel,
   agentReadiness,
   locale = 'en',
@@ -332,7 +348,7 @@ export function AiPanelMessageHistory({
       <div ref={endRef} />
     </div>
   )
-}
+})
 
 export function AiPanelComposer({
   entries,
@@ -365,7 +381,7 @@ export function AiPanelComposer({
       style={{ padding: '8px 12px' }}
     >
       <div className="flex items-end gap-2">
-        <div className="flex-1">
+        <div className="min-w-0 flex-1">
           <WikilinkChatInput
             entries={entries}
             value={input}
@@ -375,6 +391,8 @@ export function AiPanelComposer({
             disabled={composerDisabled}
             placeholder={placeholder}
             inputRef={inputRef}
+            editorClassName="max-h-[160px] overflow-y-auto overscroll-contain"
+            editorStyle={{ maxHeight: 160, overflowY: 'auto', overscrollBehavior: 'contain' }}
           />
         </div>
         <Button

src/components/AiProviderSettings.tsx

@@ -0,0 +1,350 @@
+import { useState } from 'react'
+import {
+  DEFAULT_MODEL_CAPABILITIES,
+  aiModelProviderCatalog,
+  aiModelProviderCatalogEntry,
+  configuredModelTargets,
+  isLocalAiProvider,
+  normalizeAiModelProviders,
+  type AiModelApiKeyStorage,
+  type AiModelProvider,
+  type AiModelProviderKind,
+} from '../lib/aiTargets'
+import type { createTranslator } from '../lib/i18n'
+import { deleteAiModelProviderApiKey, saveAiModelProviderApiKey, testAiModelProvider } from '../utils/aiProviderSecrets'
+import { Button } from './ui/button'
+import { Input } from './ui/input'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from './ui/select'
+
+type Translate = ReturnType<typeof createTranslator>
+type ProviderMode = 'local' | 'api'
+type TestState = 'idle' | 'testing' | 'success'
+
+interface AiProviderSettingsProps {
+  t: Translate
+  mode: ProviderMode
+  providers: AiModelProvider[]
+  onChange: (providers: AiModelProvider[]) => void
+}
+
+interface ProviderDraft {
+  kind: AiModelProviderKind
+  name: string
+  baseUrl: string
+  modelId: string
+  apiKeyStorage: AiModelApiKeyStorage
+  apiKey: string
+  apiKeyEnvVar: string
+}
+
+function providerKindsForMode(mode: ProviderMode): AiModelProviderKind[] {
+  return aiModelProviderCatalog()
+    .filter((entry) => entry.local === (mode === 'local'))
+    .map((entry) => entry.kind)
+}
+
+function initialDraft(mode: ProviderMode): ProviderDraft {
+  const [kind] = providerKindsForMode(mode)
+  if (!kind) throw new Error(`No AI model providers are configured for ${mode} mode`)
+  return draftFromProviderKind(kind)
+}
+
+function draftFromProviderKind(kind: AiModelProviderKind): ProviderDraft {
+  const defaults = aiModelProviderCatalogEntry(kind)
+  return {
+    kind,
+    name: defaults.name,
+    baseUrl: defaults.base_url,
+    modelId: '',
+    apiKeyStorage: defaults.api_key_storage,
+    apiKey: '',
+    apiKeyEnvVar: defaults.api_key_env_var ?? '',
+  }
+}
+
+function providerKindOptions(mode: ProviderMode, t: Translate): Array<{ value: AiModelProviderKind; label: string }> {
+  return providerKindsForMode(mode).map((kind) => {
+    const defaults = aiModelProviderCatalogEntry(kind)
+    return { value: kind, label: t(defaults.label_key) }
+  })
+}
+
+function providerPresetPatch(kind: AiModelProviderKind): Pick<ProviderDraft, 'kind' | 'name' | 'baseUrl' | 'apiKeyStorage' | 'apiKeyEnvVar'> {
+  const defaults = draftFromProviderKind(kind)
+  return {
+    kind,
+    name: defaults.name,
+    baseUrl: defaults.baseUrl,
+    apiKeyStorage: defaults.apiKeyStorage,
+    apiKeyEnvVar: defaults.apiKeyEnvVar,
+  }
+}
+
+function buildProvider(draft: ProviderDraft, providerId: string): AiModelProvider {
+  return {
+    id: providerId,
+    name: draft.name,
+    kind: draft.kind,
+    base_url: draft.baseUrl || null,
+    api_key_storage: draft.apiKeyStorage,
+    api_key_env_var: draft.apiKeyStorage === 'env' ? draft.apiKeyEnvVar || null : null,
+    headers: null,
+    models: [{
+      id: draft.modelId,
+      display_name: null,
+      context_window: null,
+      max_output_tokens: null,
+      capabilities: DEFAULT_MODEL_CAPABILITIES,
+    }],
+  }
+}
+
+function providerModeTitle(mode: ProviderMode, t: Translate): string {
+  return mode === 'local' ? t('settings.aiProviders.localTitle') : t('settings.aiProviders.apiTitle')
+}
+
+function providerModeDescription(mode: ProviderMode, t: Translate): string {
+  return mode === 'local' ? t('settings.aiProviders.localDescription') : t('settings.aiProviders.apiDescription')
+}
+
+function providerStorageLabel(provider: AiModelProvider, t: Translate): string {
+  if (provider.api_key_storage === 'local_file') return t('settings.aiProviders.keyLocalSaved')
+  if (provider.api_key_storage === 'env' && provider.api_key_env_var) {
+    return t('settings.aiProviders.keyEnvSaved', { env: provider.api_key_env_var })
+  }
+  return t('settings.aiProviders.noKey')
+}
+
+function visibleProviders(providers: AiModelProvider[], mode: ProviderMode): AiModelProvider[] {
+  return providers.filter((provider) => mode === 'local' ? isLocalAiProvider(provider) : !isLocalAiProvider(provider))
+}
+
+function editableInputClassName(): string {
+  return 'border-border bg-background text-foreground placeholder:text-muted-foreground/65 shadow-xs'
+}
+
+function LabeledInput({
+  label,
+  value,
+  onChange,
+  placeholder,
+  type = 'text',
+}: {
+  label: string
+  value: string
+  onChange: (value: string) => void
+  placeholder?: string
+  type?: 'text' | 'password'
+}) {
+  return (
+    <label className="space-y-1.5 text-xs font-medium text-foreground">
+      <span>{label}</span>
+      <Input
+        type={type}
+        value={value}
+        placeholder={placeholder}
+        onChange={(event) => onChange(event.target.value)}
+        className={editableInputClassName()}
+      />
+    </label>
+  )
+}
+
+function ProviderKindSelect({
+  mode,
+  t,
+  value,
+  onChange,
+}: {
+  mode: ProviderMode
+  t: Translate
+  value: AiModelProviderKind
+  onChange: (value: AiModelProviderKind) => void
+}) {
+  return (
+    <label className="space-y-1.5 text-xs font-medium text-foreground">
+      <span>{t('settings.aiProviders.kind')}</span>
+      <Select value={value} onValueChange={(next) => onChange(next as AiModelProviderKind)}>
+        <SelectTrigger className={`h-9 ${editableInputClassName()}`}>
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent>
+          {providerKindOptions(mode, t).map((option) => (
+            <SelectItem key={option.value} value={option.value}>{option.label}</SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    </label>
+  )
+}
+
+function ApiKeyStorageFields({
+  t,
+  draft,
+  updateDraft,
+}: {
+  t: Translate
+  draft: ProviderDraft
+  updateDraft: (patch: Partial<ProviderDraft>) => void
+}) {
+  return (
+    <>
+      <label className="space-y-1.5 text-xs font-medium text-foreground">
+        <span>{t('settings.aiProviders.keyStorage')}</span>
+        <Select value={draft.apiKeyStorage} onValueChange={(next) => updateDraft({ apiKeyStorage: next as AiModelApiKeyStorage })}>
+          <SelectTrigger className={`h-9 ${editableInputClassName()}`}>
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="local_file">{t('settings.aiProviders.keyStorage.local')}</SelectItem>
+            <SelectItem value="env">{t('settings.aiProviders.keyStorage.env')}</SelectItem>
+            <SelectItem value="none">{t('settings.aiProviders.keyStorage.none')}</SelectItem>
+          </SelectContent>
+        </Select>
+      </label>
+      {draft.apiKeyStorage === 'local_file' ? (
+        <LabeledInput
+          label={t('settings.aiProviders.key')}
+          value={draft.apiKey}
+          onChange={(apiKey) => updateDraft({ apiKey })}
+          placeholder={t('settings.aiProviders.keyPlaceholder')}
+          type="password"
+        />
+      ) : null}
+      {draft.apiKeyStorage === 'env' ? (
+        <LabeledInput
+          label={t('settings.aiProviders.keyEnv')}
+          value={draft.apiKeyEnvVar}
+          onChange={(apiKeyEnvVar) => updateDraft({ apiKeyEnvVar })}
+          placeholder={aiModelProviderCatalogEntry(draft.kind).api_key_env_var ?? ''}
+        />
+      ) : null}
+    </>
+  )
+}
+
+function ProviderList({
+  t,
+  mode,
+  providers,
+  onRemove,
+}: {
+  t: Translate
+  mode: ProviderMode
+  providers: AiModelProvider[]
+  onRemove: (providerId: string) => void
+}) {
+  const visible = visibleProviders(providers, mode)
+  if (visible.length === 0) {
+    return <div className="rounded-md border border-dashed border-border bg-background px-3 py-2 text-xs text-muted-foreground">{t('settings.aiProviders.empty')}</div>
+  }
+
+  return (
+    <div className="space-y-2">
+      {configuredModelTargets(visible).map((target) => (
+        <div key={target.id} className="flex items-center justify-between gap-3 rounded-md border border-border bg-background px-3 py-2 text-sm">
+          <div className="min-w-0">
+            <div className="truncate font-medium text-foreground">{target.label}</div>
+            <div className="truncate text-xs text-muted-foreground">
+              {target.provider.base_url || t('settings.aiProviders.defaultEndpoint')} · {providerStorageLabel(target.provider, t)}
+            </div>
+          </div>
+          <Button type="button" variant="ghost" size="sm" onClick={() => onRemove(target.provider.id)}>
+            {t('common.remove')}
+          </Button>
+        </div>
+      ))}
+    </div>
+  )
+}
+
+export function AiProviderSettings({ t, mode, providers, onChange }: AiProviderSettingsProps) {
+  const [draft, setDraft] = useState<ProviderDraft>(() => initialDraft(mode))
+  const [error, setError] = useState<string | null>(null)
+  const [testState, setTestState] = useState<TestState>('idle')
+  const updateDraft = (patch: Partial<ProviderDraft>) => setDraft((current) => ({ ...current, ...patch }))
+  const resetTest = () => {
+    setTestState('idle')
+    setError(null)
+  }
+  const updateForm = (patch: Partial<ProviderDraft>) => {
+    resetTest()
+    updateDraft(patch)
+  }
+  const updateKind = (kind: AiModelProviderKind) => updateForm(providerPresetPatch(kind))
+  const canSave = draft.name.trim() && draft.modelId.trim() && (draft.apiKeyStorage !== 'local_file' || draft.apiKey.trim())
+  const apiKeyOverride = draft.apiKeyStorage === 'local_file' ? draft.apiKey : null
+
+  const addProvider = async () => {
+    const providerId = `${draft.kind}-${Date.now().toString(36)}`
+    setError(null)
+    try {
+      if (draft.apiKeyStorage === 'local_file') {
+        await saveAiModelProviderApiKey(providerId, draft.apiKey)
+      }
+      onChange(normalizeAiModelProviders([...providers, buildProvider(draft, providerId)]))
+      setDraft((current) => ({ ...draftFromProviderKind(current.kind), name: current.name, baseUrl: current.baseUrl }))
+      setTestState('idle')
+    } catch (error) {
+      setError(error instanceof Error ? error.message : String(error))
+    }
+  }
+  const testProvider = async () => {
+    setError(null)
+    setTestState('testing')
+    try {
+      await testAiModelProvider(buildProvider(draft, 'draft-provider-test'), draft.modelId, apiKeyOverride)
+      setTestState('success')
+    } catch (error) {
+      setTestState('idle')
+      setError(error instanceof Error ? error.message : String(error))
+    }
+  }
+  const removeProvider = (providerId: string) => {
+    void deleteAiModelProviderApiKey(providerId)
+    onChange(providers.filter((provider) => provider.id !== providerId))
+  }
+
+  return (
+    <div className="rounded-md border border-border bg-card p-3" style={{ display: 'flex', flexDirection: 'column', gap: 12 }}>
+      <div>
+        <div className="text-sm font-medium text-foreground">{providerModeTitle(mode, t)}</div>
+        <div className="mt-1 text-xs leading-5 text-muted-foreground">{providerModeDescription(mode, t)}</div>
+      </div>
+      <ProviderList t={t} mode={mode} providers={providers} onRemove={removeProvider} />
+      <div className="grid grid-cols-2 gap-3">
+        <ProviderKindSelect mode={mode} t={t} value={draft.kind} onChange={updateKind} />
+        <LabeledInput label={t('settings.aiProviders.name')} value={draft.name} onChange={(name) => updateForm({ name })} />
+        <LabeledInput label={t('settings.aiProviders.baseUrl')} value={draft.baseUrl} onChange={(baseUrl) => updateForm({ baseUrl })} />
+        <LabeledInput label={t('settings.aiProviders.model')} value={draft.modelId} onChange={(modelId) => updateForm({ modelId })} placeholder={aiModelProviderCatalogEntry(draft.kind).default_model_id} />
+        {mode === 'api' ? <ApiKeyStorageFields t={t} draft={draft} updateDraft={updateForm} /> : null}
+      </div>
+      <div className="text-xs leading-5 text-muted-foreground">
+        {mode === 'api' ? t('settings.aiProviders.keySafetyLocal') : t('settings.aiProviders.localSafety')}
+      </div>
+      {testState === 'success' ? <div className="text-xs text-emerald-700">{t('settings.aiProviders.testSuccess')}</div> : null}
+      {error ? <div className="text-xs text-destructive">{error}</div> : null}
+      <div className="flex items-center gap-3">
+        <Button type="button" size="sm" onClick={() => void addProvider()} disabled={!canSave}>
+          {mode === 'local' ? t('settings.aiProviders.addLocal') : t('settings.aiProviders.addApi')}
+        </Button>
+        <Button
+          type="button"
+          variant="link"
+          size="sm"
+          className="h-auto px-0 text-muted-foreground hover:text-foreground"
+          onClick={() => void testProvider()}
+          disabled={!canSave || testState === 'testing'}
+        >
+          {testState === 'testing' ? t('settings.aiProviders.testing') : t('settings.aiProviders.test')}
+        </Button>
+      </div>
+    </div>
+  )
+}

src/components/BreadcrumbBar.test.tsx

@@ -307,6 +307,24 @@ describe('BreadcrumbBar — action buttons always right-aligned', () => {
     expect(widthActionGroup).toHaveClass('gap-2')
   })
 
+  it('end-aligns toolbar action tooltips so zoomed windows keep them inside the right edge', async () => {
+    render(
+      <BreadcrumbBar
+        entry={baseEntry}
+        {...defaultProps}
+        onToggleFavorite={vi.fn()}
+      />,
+    )
+
+    act(() => {
+      fireEvent.focus(screen.getByRole('button', { name: 'Add to favorites' }))
+    })
+
+    const tooltip = await screen.findByRole('tooltip')
+    expect(document.querySelector('[data-slot="tooltip-content"]')).toHaveAttribute('data-align', 'end')
+    expect(tooltip).toHaveTextContent('Add to favorites')
+  })
+
   it('lets the title use the free space before the fixed drag gap', () => {
     const { container } = render(<BreadcrumbBar entry={baseEntry} {...defaultProps} />)
 
@@ -407,3 +425,54 @@ describe('BreadcrumbBar — note width toggle', () => {
     expect(onToggleNoteWidth).toHaveBeenCalledOnce()
   })
 })
+
+describe('BreadcrumbBar — table of contents toggle', () => {
+  it('shows the table of contents action and calls the toggle handler', () => {
+    const onToggleTableOfContents = vi.fn()
+    render(
+      <BreadcrumbBar
+        entry={baseEntry}
+        {...defaultProps}
+        onToggleTableOfContents={onToggleTableOfContents}
+      />,
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Open table of contents' }))
+
+    expect(onToggleTableOfContents).toHaveBeenCalledOnce()
+  })
+
+  it('uses the close label while the table of contents panel is active', () => {
+    render(
+      <BreadcrumbBar
+        entry={baseEntry}
+        {...defaultProps}
+        showTableOfContents
+        onToggleTableOfContents={vi.fn()}
+      />,
+    )
+
+    expect(screen.getByRole('button', { name: 'Close table of contents' })).toBeInTheDocument()
+  })
+
+  it('offers the table of contents action from the overflow menu', async () => {
+    const onToggleTableOfContents = vi.fn()
+    render(
+      <BreadcrumbBar
+        entry={baseEntry}
+        {...defaultProps}
+        onToggleTableOfContents={onToggleTableOfContents}
+      />,
+    )
+
+    fireEvent.pointerDown(screen.getByRole('button', { name: 'More note actions' }), {
+      button: 0,
+      ctrlKey: false,
+    })
+
+    const menu = await screen.findByRole('menu')
+    fireEvent.click(within(menu).getByRole('menuitem', { name: 'Open table of contents' }))
+
+    expect(onToggleTableOfContents).toHaveBeenCalledOnce()
+  })
+})

src/components/BreadcrumbBar.tsx

@@ -17,6 +17,7 @@ import {
   GitBranch,
   Code,
   Sparkle,
+  ListBullets,
   SidebarSimple,
   Trash,
   Archive,
@@ -46,6 +47,8 @@ interface BreadcrumbBarProps {
   forceRawMode?: boolean
   showAIChat?: boolean
   onToggleAIChat?: () => void
+  showTableOfContents?: boolean
+  onToggleTableOfContents?: () => void
   inspectorCollapsed?: boolean
   onToggleInspector?: () => void
   onToggleFavorite?: () => void
@@ -120,7 +123,7 @@ function IconActionButton({
   style,
   children,
   testId,
-  tooltipAlign,
+  tooltipAlign = 'end',
 }: {
   copy: ActionTooltipCopy
   onClick?: () => void
@@ -351,6 +354,24 @@ function AIChatAction({ showAIChat, locale = 'en', onToggleAIChat }: Pick<Breadc
   )
 }
 
+function TableOfContentsAction({
+  showTableOfContents,
+  locale = 'en',
+  onToggleTableOfContents,
+}: Pick<BreadcrumbBarProps, 'showTableOfContents' | 'locale' | 'onToggleTableOfContents'>) {
+  if (!onToggleTableOfContents) return null
+
+  return (
+    <IconActionButton
+      copy={{ label: translate(locale, showTableOfContents ? 'editor.toolbar.closeTableOfContents' : 'editor.toolbar.openTableOfContents') }}
+      onClick={onToggleTableOfContents}
+      className={cn(showTableOfContents ? 'text-foreground' : 'hover:text-foreground')}
+    >
+      <ListBullets size={16} weight={showTableOfContents ? 'bold' : 'regular'} className={BREADCRUMB_ICON_CLASS} />
+    </IconActionButton>
+  )
+}
+
 function ArchiveAction({
   archived,
   locale = 'en',
@@ -796,6 +817,8 @@ function BreadcrumbActions({
   onToggleNoteWidth,
   showAIChat,
   onToggleAIChat,
+  showTableOfContents,
+  onToggleTableOfContents,
   inspectorCollapsed,
   onToggleInspector,
   onToggleFavorite,
@@ -835,6 +858,13 @@ function BreadcrumbActions({
         <NoteWidthAction noteWidth={noteWidth} locale={locale} onToggleNoteWidth={onToggleNoteWidth} />
       </OverflowToolbarAction>
       <AIChatAction showAIChat={showAIChat} locale={locale} onToggleAIChat={onToggleAIChat} />
+      <OverflowToolbarAction>
+        <TableOfContentsAction
+          showTableOfContents={showTableOfContents}
+          locale={locale}
+          onToggleTableOfContents={onToggleTableOfContents}
+        />
+      </OverflowToolbarAction>
       <OverflowToolbarAction>
         <FilePathActions entry={entry} locale={locale} onRevealFile={onRevealFile} onCopyFilePath={onCopyFilePath} />
       </OverflowToolbarAction>
@@ -852,6 +882,8 @@ function BreadcrumbActions({
         onToggleDiff={onToggleDiff}
         noteWidth={noteWidth}
         onToggleNoteWidth={onToggleNoteWidth}
+        showTableOfContents={showTableOfContents}
+        onToggleTableOfContents={onToggleTableOfContents}
         onRevealFile={onRevealFile}
         onCopyFilePath={onCopyFilePath}
         onArchive={onArchive}
@@ -872,6 +904,8 @@ function BreadcrumbOverflowMenu({
   onToggleDiff,
   noteWidth,
   onToggleNoteWidth,
+  showTableOfContents,
+  onToggleTableOfContents,
   onRevealFile,
   onCopyFilePath,
   onArchive,
@@ -887,6 +921,8 @@ function BreadcrumbOverflowMenu({
   | 'onToggleDiff'
   | 'noteWidth'
   | 'onToggleNoteWidth'
+  | 'showTableOfContents'
+  | 'onToggleTableOfContents'
   | 'onRevealFile'
   | 'onCopyFilePath'
   | 'onArchive'
@@ -901,6 +937,7 @@ function BreadcrumbOverflowMenu({
   const diffLabel = translate(locale, diffMenuLabelKey({ showDiffToggle, diffMode, diffLoading }))
   const noteWidthLabel = translate(locale, noteWidthLabelKey(noteWidth))
   const archiveLabel = translate(locale, archiveLabelKey(entry.archived))
+  const tableOfContentsLabel = translate(locale, showTableOfContents ? 'editor.toolbar.closeTableOfContents' : 'editor.toolbar.openTableOfContents')
 
   return (
     <DropdownMenu>
@@ -927,6 +964,10 @@ function BreadcrumbOverflowMenu({
           <NoteWidthMenuIcon noteWidth={noteWidth} />
           {noteWidthLabel}
         </DropdownMenuItem>
+        <DropdownMenuItem disabled={!onToggleTableOfContents} onSelect={onToggleTableOfContents}>
+          <ListBullets size={16} />
+          {tableOfContentsLabel}
+        </DropdownMenuItem>
         <DropdownMenuItem disabled={!runRevealAction} onSelect={runRevealAction}>
           <FolderOpen size={16} />
           {translate(locale, 'editor.toolbar.revealFile')}

src/components/CommandPalette.test.tsx

@@ -114,7 +114,7 @@ function updateAiInput(text: string) {
   editor.textContent = text
   setSelection(editor, text.length)
   fireEvent.input(editor)
-  return editor
+  return screen.queryByTestId('command-palette-ai-input') ?? editor
 }
 
 function resetNativeDropState() {

src/components/DynamicPropertiesPanel.test.tsx

@@ -176,6 +176,44 @@ describe('DynamicPropertiesPanel', () => {
     expect(screen.getByText('\u2014').parentElement).toHaveClass('justify-start', 'text-left')
   })
 
+  it('keeps present empty properties visible and editable', () => {
+    renderPanel({ frontmatter: { 'start date': '' }, onUpdateProperty })
+
+    expect(screen.getByText('Start date')).toBeInTheDocument()
+    fireEvent.click(screen.getByText('\u2014'))
+    const input = screen.getByDisplayValue('')
+    fireEvent.change(input, { target: { value: '2026-05-03' } })
+    fireEvent.blur(input)
+
+    expect(onUpdateProperty).toHaveBeenCalledWith('start date', '2026-05-03')
+  })
+
+  it('shows missing type-defined properties as gray editable placeholders', () => {
+    const typeEntry = makeEntry({
+      title: 'Book',
+      isA: 'Type',
+      properties: {
+        'start date': null,
+      },
+    })
+
+    renderPanel({
+      entry: makeEntry({ title: 'Dune', isA: 'Book' }),
+      entries: [typeEntry],
+      frontmatter: {},
+      onUpdateProperty,
+    })
+
+    const placeholder = screen.getByTestId('type-derived-property')
+    expect(within(placeholder).getByText('Start date')).toHaveClass('text-muted-foreground/40')
+    fireEvent.click(placeholder)
+    const input = screen.getByDisplayValue('')
+    fireEvent.change(input, { target: { value: '2026-05-04' } })
+    fireEvent.blur(input)
+
+    expect(onUpdateProperty).toHaveBeenCalledWith('start date', '2026-05-04')
+  })
+
   it('hides Owner with wikilink value from Properties panel', () => {
     renderPanel({ frontmatter: { Owner: '[[person/luca]]' } })
     // Owner with wikilink goes to RelationshipsPanel, not Properties

src/components/DynamicPropertiesPanel.tsx

@@ -153,6 +153,83 @@ function SuggestedPropertySlot({ label, displayMode, onAdd }: {
   )
 }
 
+function TypeDerivedPropertySlot({
+  propKey,
+  editingKey,
+  displayMode,
+  autoMode,
+  vaultStatuses,
+  vaultTags,
+  onStartEdit,
+  onSave,
+  onSaveList,
+  onUpdate,
+  onDisplayModeChange,
+  locale,
+}: {
+  propKey: string
+  editingKey: string | null
+  displayMode: PropertyDisplayMode
+  autoMode: PropertyDisplayMode
+  vaultStatuses: string[]
+  vaultTags: string[]
+  onStartEdit: (key: string | null) => void
+  onSave: (key: string, value: string) => void
+  onSaveList: (key: string, items: string[]) => void
+  onUpdate?: (key: string, value: FrontmatterValue) => void
+  onDisplayModeChange: (key: string, mode: PropertyDisplayMode | null) => void
+  locale: AppLocale
+}) {
+  if (editingKey === propKey) {
+    return (
+      <PropertyRow
+        propKey={propKey}
+        value=""
+        editingKey={editingKey}
+        displayMode={displayMode}
+        autoMode={autoMode}
+        vaultStatuses={vaultStatuses}
+        vaultTags={vaultTags}
+        onStartEdit={onStartEdit}
+        onSave={onSave}
+        onSaveList={onSaveList}
+        onUpdate={onUpdate}
+        onDisplayModeChange={onDisplayModeChange}
+        locale={locale}
+      />
+    )
+  }
+
+  const PlaceholderIcon = DISPLAY_MODE_ICONS[displayMode]
+
+  return (
+    <Button
+      type="button"
+      variant="ghost"
+      size="sm"
+      className={PROPERTY_PANEL_INTERACTIVE_ROW_CLASS_NAME}
+      style={PROPERTY_PANEL_ROW_STYLE}
+      onClick={() => onStartEdit(propKey)}
+      disabled={!onUpdate}
+      data-testid="type-derived-property"
+    >
+      <span className={PROPERTY_PANEL_PLACEHOLDER_LABEL_CLASS_NAME}>
+        <span
+          className={PROPERTY_PANEL_LABEL_ICON_SLOT_CLASS_NAME}
+          data-testid="type-derived-property-icon-slot"
+        >
+          <PlaceholderIcon
+            className="size-3.5 shrink-0 text-muted-foreground/40"
+            data-testid={`type-derived-property-icon-${displayMode}`}
+          />
+        </span>
+        <span className="min-w-0 truncate text-muted-foreground/40">{humanizePropertyKey(propKey)}</span>
+      </span>
+      <span className={PROPERTY_PANEL_PLACEHOLDER_VALUE_CLASS_NAME}>{'\u2014'}</span>
+    </Button>
+  )
+}
+
 function getExistingPropertyKeys(propertyEntries: [string, FrontmatterValue][], frontmatter: ParsedFrontmatter): Set<string> {
   const keys = new Set(propertyEntries.map(([key]) => key.toLowerCase()))
   for (const key of Object.keys(frontmatter)) keys.add(key.toLowerCase())
@@ -229,6 +306,139 @@ function useSuggestedPropertyActions({
   }
 }
 
+function PropertyEntryRows({
+  source,
+  entries,
+  editingKey,
+  displayOverrides,
+  vaultStatuses,
+  vaultTagsByKey,
+  locale,
+  onStartEdit,
+  onSave,
+  onSaveList,
+  onUpdate,
+  onDelete,
+  onDisplayModeChange,
+}: {
+  source: 'frontmatter' | 'type-derived'
+  entries: [string, FrontmatterValue][]
+  editingKey: string | null
+  displayOverrides: Record<string, PropertyDisplayMode>
+  vaultStatuses: string[]
+  vaultTagsByKey: Record<string, string[]>
+  locale: AppLocale
+  onStartEdit: (key: string | null) => void
+  onSave: (key: string, value: string) => void
+  onSaveList: (key: string, items: string[]) => void
+  onUpdate?: (key: string, value: FrontmatterValue) => void
+  onDelete?: (key: string) => void
+  onDisplayModeChange: (key: string, mode: PropertyDisplayMode | null) => void
+}) {
+  return (
+    <>
+      {entries.map(([key, value]) => (
+        source === 'type-derived' ? (
+          <TypeDerivedPropertySlot
+            key={`type-derived:${key}`}
+            propKey={key}
+            editingKey={editingKey}
+            displayMode={getEffectiveDisplayMode(key, value, displayOverrides)}
+            autoMode={detectPropertyType(key, value)}
+            vaultStatuses={vaultStatuses}
+            vaultTags={vaultTagsByKey[key] ?? []}
+            onStartEdit={onStartEdit}
+            onSave={onSave}
+            onSaveList={onSaveList}
+            onUpdate={onUpdate}
+            onDisplayModeChange={onDisplayModeChange}
+            locale={locale}
+          />
+        ) : (
+          <PropertyRow
+            key={key} propKey={key} value={value}
+            editingKey={editingKey} displayMode={getEffectiveDisplayMode(key, value, displayOverrides)} autoMode={detectPropertyType(key, value)}
+            vaultStatuses={vaultStatuses}
+            vaultTags={vaultTagsByKey[key] ?? []}
+            onStartEdit={onStartEdit} onSave={onSave}
+            onSaveList={onSaveList} onUpdate={onUpdate}
+            onDelete={onDelete}
+            onDisplayModeChange={onDisplayModeChange}
+            locale={locale}
+          />
+        )
+      ))}
+    </>
+  )
+}
+
+function PendingSuggestedPropertyRow({
+  pendingSuggestedKey,
+  editingKey,
+  vaultStatuses,
+  vaultTagsByKey,
+  locale,
+  onStartEdit,
+  onSave,
+  onSaveList,
+  onDisplayModeChange,
+}: {
+  pendingSuggestedKey: string | null
+  editingKey: string | null
+  vaultStatuses: string[]
+  vaultTagsByKey: Record<string, string[]>
+  locale: AppLocale
+  onStartEdit: (key: string | null) => void
+  onSave: (key: string, value: string) => void
+  onSaveList: (key: string, items: string[]) => void
+  onDisplayModeChange: (key: string, mode: PropertyDisplayMode | null) => void
+}) {
+  if (!pendingSuggestedKey || editingKey !== pendingSuggestedKey) {
+    return null
+  }
+
+  return (
+    <PropertyRow
+      key={`pending:${pendingSuggestedKey}`}
+      propKey={pendingSuggestedKey}
+      value=""
+      editingKey={editingKey}
+      displayMode={getSuggestedDisplayMode(pendingSuggestedKey)}
+      autoMode={getSuggestedDisplayMode(pendingSuggestedKey)}
+      vaultStatuses={vaultStatuses}
+      vaultTags={vaultTagsByKey[pendingSuggestedKey] ?? []}
+      onStartEdit={onStartEdit}
+      onSave={onSave}
+      onSaveList={onSaveList}
+      onUpdate={undefined}
+      onDelete={undefined}
+      onDisplayModeChange={onDisplayModeChange}
+      locale={locale}
+    />
+  )
+}
+
+function SuggestedPropertyRows({
+  properties,
+  onAdd,
+}: {
+  properties: Array<{ key: string; label: string }>
+  onAdd: (key: string) => void
+}) {
+  return (
+    <>
+      {properties.map(({ key, label }) => (
+        <SuggestedPropertySlot
+          key={key}
+          label={label}
+          displayMode={getSuggestedDisplayMode(key)}
+          onAdd={() => onAdd(key)}
+        />
+      ))}
+    </>
+  )
+}
+
 export function DynamicPropertiesPanel({
   entry, frontmatter, entries,
   onUpdateProperty, onDeleteProperty, onAddProperty, onNavigate, onCreateMissingType,
@@ -248,12 +458,15 @@ export function DynamicPropertiesPanel({
   const {
     editingKey, setEditingKey, showAddDialog, setShowAddDialog, displayOverrides,
     availableTypes, customColorKey, typeColorKeys, typeIconKeys, vaultStatuses, vaultTagsByKey, propertyEntries,
-    handleSaveValue, handleSaveList, handleAdd, handleDisplayModeChange,
+    typeDerivedPropertyEntries, handleSaveValue, handleSaveTypeDerivedValue, handleSaveList, handleAdd, handleDisplayModeChange,
   } = usePropertyPanelState({ entries, entryIsA: entry.isA, frontmatter, onUpdateProperty, onDeleteProperty, onAddProperty })
   const [pendingSuggestedKey, setPendingSuggestedKey] = useState<string | null>(null)
   const missingTypeName = useMemo(() => resolveMissingTypeName(entry.isA, availableTypes), [entry.isA, availableTypes])
 
-  const existingKeys = useMemo(() => getExistingPropertyKeys(propertyEntries, frontmatter), [propertyEntries, frontmatter])
+  const existingKeys = useMemo(
+    () => getExistingPropertyKeys([...propertyEntries, ...typeDerivedPropertyEntries], frontmatter),
+    [propertyEntries, typeDerivedPropertyEntries, frontmatter],
+  )
   const missingSuggested = useMemo(
     () => getMissingSuggestedProperties(Boolean(onAddProperty), existingKeys, pendingSuggestedKey),
     [existingKeys, onAddProperty, pendingSuggestedKey],
@@ -285,46 +498,47 @@ export function DynamicPropertiesPanel({
           onCreateMissingType={onCreateMissingType}
           locale={locale}
         />
-        {propertyEntries.map(([key, value]) => (
-          <PropertyRow
-            key={key} propKey={key} value={value}
-            editingKey={editingKey} displayMode={getEffectiveDisplayMode(key, value, displayOverrides)} autoMode={detectPropertyType(key, value)}
-            vaultStatuses={vaultStatuses}
-            vaultTags={vaultTagsByKey[key] ?? []}
-            onStartEdit={setEditingKey} onSave={handleSaveValue}
-            onSaveList={handleSaveList} onUpdate={onUpdateProperty}
-            onDelete={onDeleteProperty}
-            onDisplayModeChange={handleDisplayModeChange}
-            locale={locale}
-          />
-        ))}
-        {pendingSuggestedKey && editingKey === pendingSuggestedKey && (
-          <PropertyRow
-            key={`pending:${pendingSuggestedKey}`}
-            propKey={pendingSuggestedKey}
-            value=""
-            editingKey={editingKey}
-            displayMode={getSuggestedDisplayMode(pendingSuggestedKey)}
-            autoMode={getSuggestedDisplayMode(pendingSuggestedKey)}
-            vaultStatuses={vaultStatuses}
-            vaultTags={vaultTagsByKey[pendingSuggestedKey] ?? []}
-            onStartEdit={handlePendingSuggestedEdit}
-            onSave={handleSaveSuggestedValue}
-            onSaveList={handleSaveList}
-            onUpdate={undefined}
-            onDelete={undefined}
-            onDisplayModeChange={handleDisplayModeChange}
-            locale={locale}
-          />
-        )}
-        {missingSuggested.map(({ key, label }) => (
-          <SuggestedPropertySlot
-            key={key}
-            label={label}
-            displayMode={getSuggestedDisplayMode(key)}
-            onAdd={() => handleSuggestedAdd(key)}
-          />
-        ))}
+        <PropertyEntryRows
+          source="frontmatter"
+          entries={propertyEntries}
+          editingKey={editingKey}
+          displayOverrides={displayOverrides}
+          vaultStatuses={vaultStatuses}
+          vaultTagsByKey={vaultTagsByKey}
+          locale={locale}
+          onStartEdit={setEditingKey}
+          onSave={handleSaveValue}
+          onSaveList={handleSaveList}
+          onUpdate={onUpdateProperty}
+          onDelete={onDeleteProperty}
+          onDisplayModeChange={handleDisplayModeChange}
+        />
+        <PropertyEntryRows
+          source="type-derived"
+          entries={typeDerivedPropertyEntries}
+          editingKey={editingKey}
+          displayOverrides={displayOverrides}
+          vaultStatuses={vaultStatuses}
+          vaultTagsByKey={vaultTagsByKey}
+          locale={locale}
+          onStartEdit={setEditingKey}
+          onSave={handleSaveTypeDerivedValue}
+          onSaveList={handleSaveList}
+          onUpdate={onUpdateProperty}
+          onDisplayModeChange={handleDisplayModeChange}
+        />
+        <PendingSuggestedPropertyRow
+          pendingSuggestedKey={pendingSuggestedKey}
+          editingKey={editingKey}
+          vaultStatuses={vaultStatuses}
+          vaultTagsByKey={vaultTagsByKey}
+          locale={locale}
+          onStartEdit={handlePendingSuggestedEdit}
+          onSave={handleSaveSuggestedValue}
+          onSaveList={handleSaveList}
+          onDisplayModeChange={handleDisplayModeChange}
+        />
+        <SuggestedPropertyRows properties={missingSuggested} onAdd={handleSuggestedAdd} />
         {!showAddDialog && (
           <AddPropertyButton
             locale={locale}

src/components/Editor.test.tsx

@@ -236,6 +236,7 @@ describe('Editor', () => {
   beforeEach(() => {
     blockNoteCreation.options = []
     blockNoteViewState.onChange = null
+    mockEditor.document = [{ id: '1', type: 'paragraph', content: [], props: {}, children: [] }]
     clearParsedNoteBlockCache()
   })
 
@@ -537,6 +538,27 @@ describe('Editor', () => {
     expect(screen.getAllByText('Properties').length).toBeGreaterThan(0)
   })
 
+  it('renders the table of contents panel from the active note content', async () => {
+    mockEditor.document = [
+      { id: 'toc-heading', type: 'heading', content: [{ type: 'text', text: 'Table Heading' }], props: { level: 2 }, children: [] },
+    ]
+
+    render(
+      <Editor
+        {...defaultProps}
+        tabs={[mockTab]}
+        activeTabPath={mockEntry.path}
+        inspectorEntry={mockEntry}
+        inspectorContent={`${mockContent}\n\n## Table Heading`}
+      />
+    )
+
+    fireEvent.click(screen.getByRole('button', { name: 'Open table of contents' }))
+
+    expect(screen.getByTestId('table-of-contents-panel')).toBeInTheDocument()
+    expect(await screen.findByRole('button', { name: 'Table Heading' })).toBeInTheDocument()
+  })
+
   // Regression: editor content did not appear on first load because BlockNote's
   // replaceBlocks/insertBlocks internally calls flushSync, which fails silently
   // when invoked from within React's useEffect. Fix: defer via queueMicrotask.

src/components/Editor.tsx

@@ -3,8 +3,9 @@ import { useEditorTabSwap } from '../hooks/useEditorTabSwap'
 import { useCreateBlockNote } from '@blocknote/react'
 import '@blocknote/mantine/style.css'
 import 'katex/dist/katex.min.css'
-import { uploadImageFile } from '../hooks/useImageDrop'
+import { clipboardImageFiles, uploadImageFile } from '../hooks/useImageDrop'
 import { DEFAULT_AI_AGENT, type AiAgentId, type AiAgentReadiness } from '../lib/aiAgents'
+import type { AiTarget } from '../lib/aiTargets'
 import { translate, type AppLocale } from '../lib/i18n'
 import { RUNTIME_STYLE_NONCE } from '../lib/runtimeStyleNonce'
 import type { VaultEntry, GitCommit, NoteWidthMode, NoteStatus } from '../types'
@@ -20,6 +21,7 @@ import { EditorContent } from './EditorContent'
 import { EditorMemoryProbe } from './EditorMemoryProbe'
 import { FilePreview } from './FilePreview'
 import { schema } from './editorSchema'
+import { useRightPanelExclusion } from './useRightPanelExclusion'
 import type { RawEditorFindRequest } from './RawEditorFindBar'
 import {
   applyPendingRawExitContent,
@@ -29,6 +31,7 @@ import {
 import { useRegisterEditorContentFlushes } from './editorContentFlushRegistration'
 import { useRawModeWithFlush } from './useRawModeWithFlush'
 import { createArrowLigaturesExtension } from './arrowLigaturesExtension'
+import { createImeCompositionKeyGuardExtension } from './imeCompositionKeyGuardExtension'
 import { createMathInputExtension } from './mathInputExtension'
 import { useFilenameAutolinkGuard } from './useFilenameAutolinkGuard'
 import './Editor.css'
@@ -56,6 +59,7 @@ interface EditorProps {
   onToggleInspector: () => void
   inspectorWidth: number
   defaultAiAgent?: AiAgentId
+  defaultAiTarget?: AiTarget
   defaultAiAgentReadiness?: AiAgentReadiness
   defaultAiAgentReady?: boolean
   onInspectorResize: (delta: number) => void
@@ -183,6 +187,40 @@ interface EditorSetupParams {
   diffToggleRef?: React.MutableRefObject<() => void>
 }
 
+function queueClipboardImagePasteUploads(
+  editor: ReturnType<typeof useCreateBlockNote>,
+  files: File[],
+  vaultPath?: string,
+) {
+  const referenceBlock = editor.getTextCursorPosition().block
+
+  for (const file of files) {
+    const insertedBlock = editor.insertBlocks([
+      { type: 'image' as const, props: { name: file.name } },
+    ], referenceBlock, 'after')[0]
+
+    void uploadImageFile(file, vaultPath)
+      .then((url) => {
+        editor.updateBlock(insertedBlock.id, { props: { name: file.name, url } })
+      })
+      .catch((error) => {
+        console.warn('[editor] Failed to paste clipboard image:', error)
+      })
+  }
+}
+
+function handleClipboardImagePaste(
+  event: ClipboardEvent,
+  editor: ReturnType<typeof useCreateBlockNote>,
+  vaultPath?: string,
+): boolean {
+  const files = clipboardImageFiles(event.clipboardData)
+  if (files.length === 0) return false
+
+  queueClipboardImagePasteUploads(editor, files, vaultPath)
+  return true
+}
+
 function useEditorSetup({
   tabs, activeTabPath, vaultPath, onContentChange,
   onLoadDiff, onLoadDiffAtCommit, pendingCommitDiffRequest, onPendingCommitDiffHandled, getNoteStatus,
@@ -195,8 +233,17 @@ function useEditorSetup({
   const editor = useCreateBlockNote({
     schema,
     uploadFile: (file: File) => uploadImageFile(file, vaultPathRef.current),
+    pasteHandler: ({ event, editor, defaultPasteHandler }) => {
+      if (handleClipboardImagePaste(event, editor, vaultPathRef.current)) return true
+
+      return defaultPasteHandler()
+    },
     _tiptapOptions: { injectNonce: RUNTIME_STYLE_NONCE },
-    extensions: [createArrowLigaturesExtension(), createMathInputExtension()],
+    extensions: [
+      createImeCompositionKeyGuardExtension(),
+      createArrowLigaturesExtension(),
+      createMathInputExtension(),
+    ],
   })
   useFilenameAutolinkGuard(editor)
   const activeTab = tabs.find((t) => t.entry.path === activeTabPath) ?? null
@@ -321,6 +368,8 @@ function EditorLayout({
   showDiffToggle,
   showAIChat,
   onToggleAIChat,
+  showTableOfContents,
+  onToggleTableOfContents,
   inspectorCollapsed,
   onToggleInspector,
   onNavigateWikilink,
@@ -346,6 +395,7 @@ function EditorLayout({
   onInspectorResize,
   inspectorWidth,
   defaultAiAgent,
+  defaultAiTarget,
   defaultAiAgentReadiness,
   defaultAiAgentReady,
   inspectorEntry,
@@ -385,6 +435,8 @@ function EditorLayout({
   showDiffToggle: boolean
   showAIChat?: boolean
   onToggleAIChat?: () => void
+  showTableOfContents?: boolean
+  onToggleTableOfContents?: () => void
   inspectorCollapsed: boolean
   onToggleInspector: () => void
   onNavigateWikilink: (target: string) => void
@@ -410,6 +462,7 @@ function EditorLayout({
   onInspectorResize: (delta: number) => void
   inspectorWidth: number
   defaultAiAgent: AiAgentId
+  defaultAiTarget?: AiTarget
   defaultAiAgentReadiness?: AiAgentReadiness
   defaultAiAgentReady: boolean
   inspectorEntry: VaultEntry | null
@@ -466,6 +519,8 @@ function EditorLayout({
               showDiffToggle={showDiffToggle}
               showAIChat={showAIChat}
               onToggleAIChat={onToggleAIChat}
+              showTableOfContents={showTableOfContents}
+              onToggleTableOfContents={onToggleTableOfContents}
               inspectorCollapsed={inspectorCollapsed}
               onToggleInspector={onToggleInspector}
               onNavigateWikilink={onNavigateWikilink}
@@ -490,12 +545,15 @@ function EditorLayout({
               locale={locale}
             />
         }
-        {(showAIChat || !inspectorCollapsed) && <ResizeHandle onResize={onInspectorResize} />}
+        {(showAIChat || showTableOfContents || !inspectorCollapsed) && <ResizeHandle onResize={onInspectorResize} />}
         <EditorRightPanel
           showAIChat={showAIChat}
+          showTableOfContents={showTableOfContents}
           inspectorCollapsed={inspectorCollapsed}
           inspectorWidth={inspectorWidth}
+          editor={editor}
           defaultAiAgent={defaultAiAgent}
+          defaultAiTarget={defaultAiTarget}
           defaultAiAgentReadiness={defaultAiAgentReadiness}
           defaultAiAgentReady={defaultAiAgentReady}
           onUnsupportedAiPaste={onUnsupportedAiPaste}
@@ -508,6 +566,7 @@ function EditorLayout({
           noteListFilter={noteListFilter}
           onToggleInspector={onToggleInspector}
           onToggleAIChat={onToggleAIChat}
+          onToggleTableOfContents={onToggleTableOfContents}
           onNavigateWikilink={onNavigateWikilink}
           onViewCommitDiff={handleViewCommitDiff}
           onUpdateFrontmatter={onUpdateFrontmatter}
@@ -529,122 +588,63 @@ function EditorLayout({
   )
 }
 
+type EditorRuntime = ReturnType<typeof useEditorSetup>
+type EditorLayoutProps = Parameters<typeof EditorLayout>[0]
+
+function buildEditorLayoutProps(
+  props: EditorProps,
+  runtime: EditorRuntime,
+  findRequest: RawEditorFindRequest | null,
+): EditorLayoutProps {
+  return {
+    ...props,
+    ...runtime,
+    activeTabPath: props.activeTabPath,
+    defaultAiAgent: props.defaultAiAgent ?? DEFAULT_AI_AGENT,
+    defaultAiAgentReady: props.defaultAiAgentReady ?? true,
+    findRequest,
+  }
+}
+
 export const Editor = memo(function Editor(props: EditorProps) {
-  const {
-    tabs, activeTabPath, entries, onNavigateWikilink,
-    isVaultLoading,
-    getNoteStatus,
-    inspectorCollapsed, onToggleInspector, inspectorWidth,
-    defaultAiAgent = DEFAULT_AI_AGENT, defaultAiAgentReadiness, defaultAiAgentReady = true,
-    onUnsupportedAiPaste,
-    onInspectorResize,
-    inspectorEntry, inspectorContent, gitHistory,
-    onUpdateFrontmatter, onDeleteProperty, onAddProperty, onCreateMissingType, onCreateAndOpenNote, onInitializeProperties,
-    showAIChat, onToggleAIChat,
-    vaultPath, noteList, noteListFilter,
-    onToggleFavorite, onToggleOrganized, onRevealFile, onCopyFilePath, onOpenExternalFile,
-    onDeleteNote, onArchiveNote, onUnarchiveNote,
-    onContentChange, onSave, onRenameFilename,
-    noteWidth, onToggleNoteWidth,
-    onFileCreated, onFileModified, onVaultChanged,
-    isConflicted, onKeepMine, onKeepTheirs,
-    flushPendingEditorContentRef, flushPendingRawContentRef, findInNoteRef, locale,
-  } = props
-  const {
-    editor, activeTab, rawLatestContentRef, rawModeContent,
-    rawMode, diffMode, diffContent, diffLoading,
-    handleToggleDiffExclusive, handleToggleRawExclusive,
-    handleEditorChange, flushPendingEditorChange, handleViewCommitDiff,
-    isLoadingNewTab, activeStatus, showDiffToggle,
-  } = useEditorSetup({
-    tabs, activeTabPath, vaultPath, onContentChange,
+  const runtime = useEditorSetup({
+    tabs: props.tabs,
+    activeTabPath: props.activeTabPath,
+    vaultPath: props.vaultPath,
+    onContentChange: props.onContentChange,
     onLoadDiff: props.onLoadDiff,
     onLoadDiffAtCommit: props.onLoadDiffAtCommit,
     pendingCommitDiffRequest: props.pendingCommitDiffRequest,
     onPendingCommitDiffHandled: props.onPendingCommitDiffHandled,
-    getNoteStatus,
-    rawToggleRef: props.rawToggleRef, diffToggleRef: props.diffToggleRef,
+    getNoteStatus: props.getNoteStatus,
+    rawToggleRef: props.rawToggleRef,
+    diffToggleRef: props.diffToggleRef,
   })
   const findRequest = useEditorFindCommand({
-    activeTab,
-    findInNoteRef,
-    handleToggleRawExclusive,
-    rawMode,
+    activeTab: runtime.activeTab,
+    findInNoteRef: props.findInNoteRef,
+    handleToggleRawExclusive: runtime.handleToggleRawExclusive,
+    rawMode: runtime.rawMode,
   })
   useRegisterEditorContentFlushes({
-    activeTab,
-    flushPendingEditorChange,
-    flushPendingEditorContentRef,
-    rawLatestContentRef,
-    rawMode,
-    onContentChange,
-    flushPendingRawContentRef,
+    activeTab: runtime.activeTab,
+    flushPendingEditorChange: runtime.flushPendingEditorChange,
+    flushPendingEditorContentRef: props.flushPendingEditorContentRef,
+    rawLatestContentRef: runtime.rawLatestContentRef,
+    rawMode: runtime.rawMode,
+    onContentChange: props.onContentChange,
+    flushPendingRawContentRef: props.flushPendingRawContentRef,
   })
+  const rightPanel = useRightPanelExclusion(props)
+
   return (
     <EditorLayout
-      tabs={tabs}
-      activeTabPath={props.activeTabPath}
-      activeTab={activeTab}
-      isLoadingNewTab={isLoadingNewTab}
-      isVaultLoading={isVaultLoading}
-      entries={entries}
-      editor={editor}
-      diffMode={diffMode}
-      diffContent={diffContent}
-      diffLoading={diffLoading}
-      handleToggleDiffExclusive={handleToggleDiffExclusive}
-      rawMode={rawMode}
-      handleToggleRawExclusive={handleToggleRawExclusive}
-      onContentChange={onContentChange}
-      onSave={onSave}
-      activeStatus={activeStatus}
-      showDiffToggle={showDiffToggle}
-      showAIChat={showAIChat}
-      onToggleAIChat={onToggleAIChat}
-      inspectorCollapsed={inspectorCollapsed}
-      onToggleInspector={onToggleInspector}
-      onNavigateWikilink={onNavigateWikilink}
-      handleEditorChange={handleEditorChange}
-      onToggleFavorite={onToggleFavorite}
-      onToggleOrganized={onToggleOrganized}
-      onRevealFile={onRevealFile}
-      onCopyFilePath={onCopyFilePath}
-      onOpenExternalFile={onOpenExternalFile}
-      onDeleteNote={onDeleteNote}
-      onArchiveNote={onArchiveNote}
-      onUnarchiveNote={onUnarchiveNote}
-      vaultPath={vaultPath}
-      rawModeContent={rawModeContent}
-      findRequest={findRequest}
-      rawLatestContentRef={rawLatestContentRef}
-      onRenameFilename={onRenameFilename}
-      noteWidth={noteWidth}
-      onToggleNoteWidth={onToggleNoteWidth}
-      isConflicted={isConflicted}
-      onKeepMine={onKeepMine}
-      onKeepTheirs={onKeepTheirs}
-      onInspectorResize={onInspectorResize}
-      inspectorWidth={inspectorWidth}
-      defaultAiAgent={defaultAiAgent}
-      defaultAiAgentReadiness={defaultAiAgentReadiness}
-      defaultAiAgentReady={defaultAiAgentReady}
-      onUnsupportedAiPaste={onUnsupportedAiPaste}
-      inspectorEntry={inspectorEntry}
-      inspectorContent={inspectorContent}
-      gitHistory={gitHistory}
-      noteList={noteList}
-      noteListFilter={noteListFilter}
-      handleViewCommitDiff={handleViewCommitDiff}
-      onUpdateFrontmatter={onUpdateFrontmatter}
-      onDeleteProperty={onDeleteProperty}
-      onAddProperty={onAddProperty}
-      onCreateMissingType={onCreateMissingType}
-      onCreateAndOpenNote={onCreateAndOpenNote}
-      onInitializeProperties={onInitializeProperties}
-      onFileCreated={onFileCreated}
-      onFileModified={onFileModified}
-      onVaultChanged={onVaultChanged}
-      locale={locale}
+      {...buildEditorLayoutProps(props, runtime, findRequest)}
+      onToggleInspector={rightPanel.handleToggleInspectorPanel}
+      showAIChat={props.showAIChat}
+      onToggleAIChat={rightPanel.handleToggleAIChatPanel}
+      showTableOfContents={rightPanel.showTableOfContents}
+      onToggleTableOfContents={rightPanel.handleToggleTableOfContents}
     />
   )
 })

src/components/EditorRightPanel.tsx

@@ -1,5 +1,7 @@
 import { useEffect } from 'react'
+import type { useCreateBlockNote } from '@blocknote/react'
 import { DEFAULT_AI_AGENT, type AiAgentId, type AiAgentReadiness } from '../lib/aiAgents'
+import type { AiTarget } from '../lib/aiTargets'
 import type { AppLocale } from '../lib/i18n'
 import type { VaultEntry, GitCommit } from '../types'
 import type { NoteListItem } from '../utils/ai-context'
@@ -7,12 +9,16 @@ import { Inspector, type FrontmatterValue } from './Inspector'
 import { AiPanelView } from './AiPanel'
 import { useAiPanelController } from './useAiPanelController'
 import { NEW_AI_CHAT_EVENT } from '../utils/aiPromptBridge'
+import { TableOfContentsPanel } from './TableOfContentsPanel'
 
 interface EditorRightPanelProps {
   showAIChat?: boolean
+  showTableOfContents?: boolean
   inspectorCollapsed: boolean
   inspectorWidth: number
+  editor: ReturnType<typeof useCreateBlockNote>
   defaultAiAgent?: AiAgentId
+  defaultAiTarget?: AiTarget
   defaultAiAgentReadiness?: AiAgentReadiness
   defaultAiAgentReady?: boolean
   onUnsupportedAiPaste?: (message: string) => void
@@ -25,6 +31,7 @@ interface EditorRightPanelProps {
   noteListFilter?: { type: string | null; query: string }
   onToggleInspector: () => void
   onToggleAIChat?: () => void
+  onToggleTableOfContents?: () => void
   onNavigateWikilink: (target: string) => void
   onViewCommitDiff: (commitHash: string) => Promise<void>
   onUpdateFrontmatter?: (path: string, key: string, value: FrontmatterValue) => Promise<void>
@@ -42,12 +49,13 @@ interface EditorRightPanelProps {
 }
 
 export function EditorRightPanel({
-  showAIChat, inspectorCollapsed, inspectorWidth,
-  defaultAiAgent = DEFAULT_AI_AGENT, defaultAiAgentReadiness, defaultAiAgentReady = true,
+  showAIChat, showTableOfContents, inspectorCollapsed, inspectorWidth,
+  editor,
+  defaultAiAgent = DEFAULT_AI_AGENT, defaultAiTarget, defaultAiAgentReadiness, defaultAiAgentReady = true,
   onUnsupportedAiPaste,
   inspectorEntry, inspectorContent, entries, gitHistory, vaultPath,
   noteList, noteListFilter,
-  onToggleInspector, onToggleAIChat, onNavigateWikilink, onViewCommitDiff,
+  onToggleInspector, onToggleAIChat, onToggleTableOfContents, onNavigateWikilink, onViewCommitDiff,
   onUpdateFrontmatter, onDeleteProperty, onAddProperty, onCreateMissingType, onCreateAndOpenNote, onInitializeProperties, onToggleRawEditor, onOpenNote,
   onFileCreated, onFileModified, onVaultChanged,
   locale,
@@ -55,6 +63,7 @@ export function EditorRightPanel({
   const aiPanelController = useAiPanelController({
     vaultPath,
     defaultAiAgent,
+    defaultAiTarget,
     defaultAiAgentReady,
     defaultAiAgentReadiness,
     activeEntry: inspectorEntry,
@@ -79,6 +88,52 @@ export function EditorRightPanel({
     return () => window.removeEventListener(NEW_AI_CHAT_EVENT, handleRequestedNewChat)
   }, [handleNewChat])
 
+  if (!inspectorCollapsed) {
+    return (
+      <div
+        className="shrink-0 flex flex-col min-h-0"
+        style={{ width: inspectorWidth, height: '100%' }}
+      >
+        <Inspector
+          collapsed={inspectorCollapsed}
+          onToggle={onToggleInspector}
+          entry={inspectorEntry}
+          content={inspectorContent}
+          entries={entries}
+          gitHistory={gitHistory}
+          vaultPath={vaultPath}
+          onNavigate={onNavigateWikilink}
+          onViewCommitDiff={onViewCommitDiff}
+          onUpdateFrontmatter={onUpdateFrontmatter}
+          onDeleteProperty={onDeleteProperty}
+          onAddProperty={onAddProperty}
+          onCreateMissingType={onCreateMissingType}
+          onCreateAndOpenNote={onCreateAndOpenNote}
+          onInitializeProperties={onInitializeProperties}
+          onToggleRawEditor={onToggleRawEditor}
+          locale={locale}
+        />
+      </div>
+    )
+  }
+
+  if (showTableOfContents) {
+    return (
+      <div
+        className="shrink-0 flex flex-col min-h-0"
+        style={{ width: inspectorWidth, minWidth: 240, height: '100%' }}
+      >
+        <TableOfContentsPanel
+          editor={editor}
+          entry={inspectorEntry}
+          locale={locale}
+          onClose={() => onToggleTableOfContents?.()}
+          sourceContent={inspectorContent}
+        />
+      </div>
+    )
+  }
+
   if (showAIChat) {
     return (
       <div
@@ -91,6 +146,7 @@ export function EditorRightPanel({
           onOpenNote={onOpenNote}
           onUnsupportedAiPaste={onUnsupportedAiPaste}
           defaultAiAgent={defaultAiAgent}
+          defaultAiTarget={defaultAiTarget}
           defaultAiAgentReadiness={defaultAiAgentReadiness}
           defaultAiAgentReady={defaultAiAgentReady}
           locale={locale}
@@ -101,32 +157,5 @@ export function EditorRightPanel({
     )
   }
 
-  if (inspectorCollapsed) return null
-
-  return (
-    <div
-      className="shrink-0 flex flex-col min-h-0"
-      style={{ width: inspectorWidth, height: '100%' }}
-    >
-      <Inspector
-        collapsed={inspectorCollapsed}
-        onToggle={onToggleInspector}
-        entry={inspectorEntry}
-        content={inspectorContent}
-        entries={entries}
-        gitHistory={gitHistory}
-        vaultPath={vaultPath}
-        onNavigate={onNavigateWikilink}
-        onViewCommitDiff={onViewCommitDiff}
-        onUpdateFrontmatter={onUpdateFrontmatter}
-        onDeleteProperty={onDeleteProperty}
-        onAddProperty={onAddProperty}
-        onCreateMissingType={onCreateMissingType}
-        onCreateAndOpenNote={onCreateAndOpenNote}
-        onInitializeProperties={onInitializeProperties}
-        onToggleRawEditor={onToggleRawEditor}
-        locale={locale}
-      />
-    </div>
-  )
+  return null
 }

src/components/EditorTheme.css

@@ -4,6 +4,10 @@
    ============================================== */
 
 /* --- Editor root --- */
+.editor__blocknote-container {
+  position: relative;
+}
+
 .editor__blocknote-container .bn-editor {
   font-family: var(--editor-font-family);
   font-size: var(--editor-font-size);
@@ -23,6 +27,12 @@
   padding-right: 0;
 }
 
+/* Let each rich-text block resolve its own base direction for mixed LTR/RTL notes. */
+.editor__blocknote-container .bn-inline-content {
+  unicode-bidi: plaintext;
+  text-align: start;
+}
+
 /* Override BlockNote's default line-height on block-outer so our theme controls it */
 .editor__blocknote-container .bn-block-outer {
   line-height: var(--editor-line-height) !important;
@@ -392,6 +402,81 @@
   font-size: 0.85rem;
 }
 
+.editor__blocknote-container .tldraw-whiteboard {
+  position: relative;
+  width: min(var(--tldraw-whiteboard-width, 100%), 100%);
+  max-width: 100%;
+  height: var(--tldraw-whiteboard-height, 520px);
+  overflow: hidden;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  background: var(--card);
+  user-select: none;
+}
+
+.editor__blocknote-container .tldraw-whiteboard .tl-container {
+  --color-background: var(--card);
+  --tl-layer-menu-click-capture: 25;
+  --tl-layer-panels: 30;
+  --tl-layer-menus: 40;
+  --tl-layer-toasts: 50;
+  --tl-layer-cursor: 60;
+  --tl-layer-header-footer: 70;
+  --tl-layer-following-indicator: 80;
+}
+
+.editor__blocknote-container .tldraw-whiteboard [data-radix-popper-content-wrapper] {
+  position: absolute !important;
+}
+
+.editor__blocknote-container .mantine-Popover-dropdown,
+.editor__blocknote-container .bn-menu,
+.editor__blocknote-container .bn-suggestion-menu {
+  z-index: 1000 !important;
+}
+
+.editor__blocknote-container .tldraw-whiteboard__resize-handle {
+  position: absolute;
+  z-index: 2;
+  background: transparent;
+  touch-action: none;
+}
+
+.editor__blocknote-container .tldraw-whiteboard__resize-handle--width {
+  top: 0;
+  right: 0;
+  width: 12px;
+  height: 100%;
+  cursor: ew-resize;
+}
+
+.editor__blocknote-container .tldraw-whiteboard__resize-handle--height {
+  bottom: 0;
+  left: 0;
+  width: 100%;
+  height: 12px;
+  cursor: ns-resize;
+}
+
+.editor__blocknote-container .tldraw-whiteboard__resize-handle--corner {
+  right: 0;
+  bottom: 0;
+  width: 18px;
+  height: 18px;
+  cursor: nwse-resize;
+}
+
+.editor__blocknote-container .tldraw-whiteboard__resize-handle--corner::after {
+  position: absolute;
+  right: 4px;
+  bottom: 4px;
+  width: 8px;
+  height: 8px;
+  border-right: 2px solid color-mix(in srgb, var(--foreground) 42%, transparent);
+  border-bottom: 2px solid color-mix(in srgb, var(--foreground) 42%, transparent);
+  content: '';
+}
+
 .editor__blocknote-container[data-follow-links] .bn-editor a,
 .editor__blocknote-container[data-follow-links] .wikilink {
   cursor: pointer;
@@ -402,6 +487,26 @@
   background-color: var(--editor-code-block-background) !important;
   border: 1px solid var(--editor-code-block-border);
   color: var(--editor-code-block-text) !important;
+  position: relative;
+}
+
+.editor__code-block-copy {
+  position: absolute;
+  z-index: 4;
+}
+
+.editor__code-block-copy [data-editor-code-copy-button] {
+  background: transparent !important;
+  border-color: transparent !important;
+  box-shadow: none !important;
+  color: var(--editor-code-block-language);
+  padding: 0;
+}
+
+.editor__code-block-copy [data-editor-code-copy-button]:hover,
+.editor__code-block-copy [data-editor-code-copy-button]:focus-visible {
+  background: transparent !important;
+  color: var(--editor-code-block-text);
 }
 
 .editor__blocknote-container .bn-block-content[data-content-type="codeBlock"] > pre {
@@ -428,11 +533,6 @@
   background-color: transparent !important;
 }
 
-:root:not(.dark) .editor__blocknote-container .bn-block-content[data-content-type="codeBlock"] pre code .shiki,
-[data-theme="light"] .editor__blocknote-container .bn-block-content[data-content-type="codeBlock"] pre code .shiki {
-  color: var(--editor-code-block-text) !important;
-}
-
 /* --- Blockquote --- */
 .editor__blocknote-container [data-content-type="blockquote"],
 .editor__blocknote-container blockquote {

src/components/FilePreview.test.tsx

@@ -54,6 +54,18 @@ const pdfEntry: VaultEntry = {
   filename: 'report.pdf',
   title: 'report.pdf',
 }
+const audioEntry: VaultEntry = {
+  ...imageEntry,
+  path: '/vault/Attachments/meeting.mp3',
+  filename: 'meeting.mp3',
+  title: 'meeting.mp3',
+}
+const videoEntry: VaultEntry = {
+  ...imageEntry,
+  path: '/vault/Attachments/demo.mp4',
+  filename: 'demo.mp4',
+  title: 'demo.mp4',
+}
 
 describe('FilePreview', () => {
   beforeEach(() => {
@@ -110,6 +122,22 @@ describe('FilePreview', () => {
     expect(screen.getByTestId('pdf-file-preview')).toHaveAttribute('data', 'asset:///vault/Attachments/report.pdf')
   })
 
+  it('renders supported audio files through the media asset path', () => {
+    render(<FilePreview entry={audioEntry} />)
+
+    expect(screen.getByTestId('audio-file-preview')).toHaveAttribute('src', 'asset:///vault/Attachments/meeting.mp3')
+    expect(screen.getByText('MP3 file')).toBeInTheDocument()
+    expect(trackEventMock).toHaveBeenCalledWith('file_preview_opened', { preview_kind: 'audio' })
+  })
+
+  it('renders supported video files through the media asset path', () => {
+    render(<FilePreview entry={videoEntry} />)
+
+    expect(screen.getByTestId('video-file-preview')).toHaveAttribute('src', 'asset:///vault/Attachments/demo.mp4')
+    expect(screen.getByTestId('video-file-preview')).toHaveAttribute('title', 'demo.mp4')
+    expect(trackEventMock).toHaveBeenCalledWith('file_preview_opened', { preview_kind: 'video' })
+  })
+
   it('provides a graceful fallback when a PDF preview cannot render', () => {
     render(<FilePreview entry={pdfEntry} />)
 
@@ -128,4 +156,16 @@ describe('FilePreview', () => {
       expect.objectContaining({ path: expect.any(String) }),
     )
   })
+
+  it('tracks media preview failures without leaking the file path', () => {
+    render(<FilePreview entry={audioEntry} />)
+
+    fireEvent.error(screen.getByTestId('audio-file-preview'))
+
+    expect(trackEventMock).toHaveBeenCalledWith('file_preview_failed', { preview_kind: 'audio' })
+    expect(trackEventMock).not.toHaveBeenCalledWith(
+      expect.any(String),
+      expect.objectContaining({ path: expect.any(String) }),
+    )
+  })
 })

src/components/FilePreview.tsx

@@ -1,6 +1,6 @@
-import { useCallback, useEffect, useMemo, useState, type KeyboardEvent } from 'react'
+import { useCallback, useEffect, useMemo, useState, type KeyboardEvent, type ReactNode } from 'react'
 import { convertFileSrc } from '@tauri-apps/api/core'
-import { ArrowSquareOut, ClipboardText, FileDashed, FilePdf, FolderOpen, ImageSquare, WarningCircle } from '@phosphor-icons/react'
+import { ArrowSquareOut, ClipboardText, FileDashed, FilePdf, FolderOpen, ImageSquare, SpeakerHigh, Video, WarningCircle } from '@phosphor-icons/react'
 import type { VaultEntry } from '../types'
 import { trackFilePreviewAction, trackFilePreviewFailed, trackFilePreviewOpened } from '../lib/productAnalytics'
 import { filePreviewKind, previewFileTypeLabel, type FilePreviewKind } from '../utils/filePreview'
@@ -55,6 +55,14 @@ function FilePreviewHeaderIcon({ previewKind }: { previewKind: FilePreviewKind |
     return <FilePdf size={17} className="shrink-0 text-muted-foreground" aria-hidden="true" />
   }
 
+  if (previewKind === 'audio') {
+    return <SpeakerHigh size={17} className="shrink-0 text-muted-foreground" aria-hidden="true" />
+  }
+
+  if (previewKind === 'video') {
+    return <Video size={17} className="shrink-0 text-muted-foreground" aria-hidden="true" />
+  }
+
   return <FileDashed size={17} className="shrink-0 text-muted-foreground" aria-hidden="true" />
 }
 
@@ -179,6 +187,61 @@ function FilePreviewImage({
   )
 }
 
+function FilePreviewMediaFrame({
+  children,
+  video = false,
+}: {
+  children: ReactNode
+  video?: boolean
+}) {
+  return (
+    <div className={`flex h-full items-center justify-center ${video ? 'min-h-[320px] bg-black p-4' : 'min-h-[260px] p-6'}`}>
+      {children}
+    </div>
+  )
+}
+
+function FilePreviewMedia({
+  entry,
+  mediaKind,
+  mediaSrc,
+  onMediaError,
+}: {
+  entry: VaultEntry
+  mediaKind: 'audio' | 'video'
+  mediaSrc: string
+  onMediaError: () => void
+}) {
+  if (mediaKind === 'audio') {
+    return (
+      <FilePreviewMediaFrame>
+        <audio
+          controls
+          preload="metadata"
+          src={mediaSrc}
+          className="w-full max-w-2xl"
+          data-testid="audio-file-preview"
+          onError={onMediaError}
+        />
+      </FilePreviewMediaFrame>
+    )
+  }
+
+  return (
+    <FilePreviewMediaFrame video>
+      <video
+        controls
+        preload="metadata"
+        src={mediaSrc}
+        title={entry.title}
+        className="max-h-full max-w-full"
+        data-testid="video-file-preview"
+        onError={onMediaError}
+      />
+    </FilePreviewMediaFrame>
+  )
+}
+
 function shouldRenderImagePreview(isImage: boolean, imageSrc: string | null, imageFailed: boolean): imageSrc is string {
   return isImage && imageSrc !== null && !imageFailed
 }
@@ -189,6 +252,8 @@ function FilePreviewBody({
   assetSrc,
   imageFailed,
   onImageError,
+  onAudioError,
+  onVideoError,
   onOpenExternal,
 }: {
   entry: VaultEntry
@@ -196,6 +261,8 @@ function FilePreviewBody({
   assetSrc: string | null
   imageFailed: boolean
   onImageError: () => void
+  onAudioError: () => void
+  onVideoError: () => void
   onOpenExternal: () => void
 }) {
   if (shouldRenderImagePreview(previewKind === 'image', assetSrc, imageFailed)) {
@@ -206,6 +273,14 @@ function FilePreviewBody({
     return <FilePreviewPdf entry={entry} pdfSrc={assetSrc} onOpenExternal={onOpenExternal} />
   }
 
+  if (previewKind === 'audio' && assetSrc !== null) {
+    return <FilePreviewMedia entry={entry} mediaKind="audio" mediaSrc={assetSrc} onMediaError={onAudioError} />
+  }
+
+  if (previewKind === 'video' && assetSrc !== null) {
+    return <FilePreviewMedia entry={entry} mediaKind="video" mediaSrc={assetSrc} onMediaError={onVideoError} />
+  }
+
   const fallback = fallbackContentForPreviewKind(previewKind)
 
   return (
@@ -218,48 +293,96 @@ function FilePreviewBody({
   )
 }
 
+function useFilePreviewFailureState(entryPath: string) {
+  const [failedImagePath, setFailedImagePath] = useState<string | null>(null)
+  const [failedMediaPath, setFailedMediaPath] = useState<string | null>(null)
+
+  const handleImageError = useCallback(() => {
+    setFailedImagePath(entryPath)
+    trackFilePreviewFailed('image')
+  }, [entryPath])
+  const handleAudioError = useCallback(() => {
+    setFailedMediaPath(entryPath)
+    trackFilePreviewFailed('audio')
+  }, [entryPath])
+  const handleVideoError = useCallback(() => {
+    setFailedMediaPath(entryPath)
+    trackFilePreviewFailed('video')
+  }, [entryPath])
+
+  return {
+    imageFailed: failedImagePath === entryPath,
+    mediaFailed: failedMediaPath === entryPath,
+    handleImageError,
+    handleAudioError,
+    handleVideoError,
+  }
+}
+
+function useFilePreviewActions({
+  entryPath,
+  onCopyFilePath,
+  onOpenExternalFile,
+  onRevealFile,
+  previewKind,
+}: {
+  entryPath: string
+  onCopyFilePath?: (path: string) => void
+  onOpenExternalFile?: (path: string) => void
+  onRevealFile?: (path: string) => void
+  previewKind: FilePreviewKind | null
+}) {
+  const handleOpenExternal = useCallback(() => {
+    trackFilePreviewAction('open_external', previewKind)
+    if (onOpenExternalFile) {
+      onOpenExternalFile(entryPath)
+      return
+    }
+
+    void openLocalFile(entryPath).catch((error) => {
+      console.warn('Failed to open file with default app:', error)
+    })
+  }, [entryPath, onOpenExternalFile, previewKind])
+
+  const handleRevealFile = useCallback(() => {
+    trackFilePreviewAction('reveal', previewKind)
+    onRevealFile?.(entryPath)
+  }, [entryPath, onRevealFile, previewKind])
+
+  const handleCopyFilePath = useCallback(() => {
+    trackFilePreviewAction('copy_path', previewKind)
+    onCopyFilePath?.(entryPath)
+  }, [entryPath, onCopyFilePath, previewKind])
+
+  return { handleOpenExternal, handleRevealFile, handleCopyFilePath }
+}
+
+function previewKindForBody(previewKind: FilePreviewKind | null, mediaFailed: boolean): FilePreviewKind | null {
+  return mediaFailed ? null : previewKind
+}
+
 export function FilePreview({
   entry,
   onCopyFilePath,
   onOpenExternalFile,
   onRevealFile,
 }: FilePreviewProps) {
-  const [failedImagePath, setFailedImagePath] = useState<string | null>(null)
   const previewKind = filePreviewKind(entry)
   const assetSrc = useMemo(() => (previewKind ? convertFileSrc(entry.path) : null), [entry.path, previewKind])
   const fileTypeLabel = previewFileTypeLabel(entry)
-  const imageFailed = failedImagePath === entry.path
-  const handleImageError = useCallback(() => {
-    setFailedImagePath(entry.path)
-    trackFilePreviewFailed('image')
-  }, [entry.path])
+  const failures = useFilePreviewFailureState(entry.path)
+  const actions = useFilePreviewActions({
+    entryPath: entry.path,
+    onCopyFilePath,
+    onOpenExternalFile,
+    onRevealFile,
+    previewKind,
+  })
 
   useEffect(() => {
     trackFilePreviewOpened(previewKind)
   }, [entry.path, previewKind])
 
-  const handleOpenExternal = useCallback(() => {
-    trackFilePreviewAction('open_external', previewKind)
-    if (onOpenExternalFile) {
-      onOpenExternalFile(entry.path)
-      return
-    }
-
-    void openLocalFile(entry.path).catch((error) => {
-      console.warn('Failed to open file with default app:', error)
-    })
-  }, [entry.path, onOpenExternalFile, previewKind])
-
-  const handleRevealFile = useCallback(() => {
-    trackFilePreviewAction('reveal', previewKind)
-    onRevealFile?.(entry.path)
-  }, [entry.path, onRevealFile, previewKind])
-
-  const handleCopyFilePath = useCallback(() => {
-    trackFilePreviewAction('copy_path', previewKind)
-    onCopyFilePath?.(entry.path)
-  }, [entry.path, onCopyFilePath, previewKind])
-
   const handleKeyDown = useCallback((event: KeyboardEvent<HTMLDivElement>) => {
     if (event.key !== 'Escape') return
     event.preventDefault()
@@ -279,18 +402,20 @@ export function FilePreview({
         entry={entry}
         previewKind={previewKind}
         fileTypeLabel={fileTypeLabel}
-        onOpenExternal={handleOpenExternal}
-        onRevealFile={onRevealFile ? handleRevealFile : undefined}
-        onCopyFilePath={onCopyFilePath ? handleCopyFilePath : undefined}
+        onOpenExternal={actions.handleOpenExternal}
+        onRevealFile={onRevealFile ? actions.handleRevealFile : undefined}
+        onCopyFilePath={onCopyFilePath ? actions.handleCopyFilePath : undefined}
       />
       <div className="min-h-0 flex-1 overflow-auto bg-background">
         <FilePreviewBody
           entry={entry}
-          previewKind={previewKind}
+          previewKind={previewKindForBody(previewKind, failures.mediaFailed)}
           assetSrc={assetSrc}
-          imageFailed={imageFailed}
-          onImageError={handleImageError}
-          onOpenExternal={handleOpenExternal}
+          imageFailed={failures.imageFailed}
+          onImageError={failures.handleImageError}
+          onAudioError={failures.handleAudioError}
+          onVideoError={failures.handleVideoError}
+          onOpenExternal={actions.handleOpenExternal}
         />
       </div>
     </section>

src/components/FilterBuilder.tsx

@@ -4,6 +4,7 @@ import { Input } from '@/components/ui/input'
 import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'
 import { cn } from '@/lib/utils'
 import type { FilterCondition, FilterOp, FilterGroup, FilterNode } from '../types'
+import { compileSafeUserRegex } from '../utils/safeRegex'
 import { FilterFieldCombobox } from './FilterFieldCombobox'
 import { DateValueInput } from './filter-builder/DateValueInput'
 
@@ -32,12 +33,7 @@ function normalizeRegexFlag(op: FilterOp, enabled: boolean): boolean | undefined
 
 function hasInvalidRegex(value: string, regexEnabled: boolean): boolean {
   if (!regexEnabled) return false
-  try {
-    new RegExp(value, 'i')
-    return false
-  } catch {
-    return true
-  }
+  return !compileSafeUserRegex(value, 'i').ok
 }
 
 function isFilterGroup(node: FilterNode): node is FilterGroup {

src/components/InlineWikilinkInput.tsx

@@ -4,6 +4,7 @@ import {
   useMemo,
   useRef,
   useState,
+  type CSSProperties,
   type ReactNode,
 } from 'react'
 import type { VaultEntry } from '../types'
@@ -57,6 +58,7 @@ interface InlineWikilinkInputProps {
   inputRef?: React.RefObject<HTMLDivElement | null>
   dataTestId?: string
   editorClassName?: string
+  editorStyle?: CSSProperties
   suggestionListVariant?: 'floating' | 'palette'
   suggestionEmptyLabel?: string
   paletteHeader?: ReactNode
@@ -168,6 +170,7 @@ export function InlineWikilinkInput({
   inputRef,
   dataTestId = 'agent-input',
   editorClassName,
+  editorStyle,
   suggestionListVariant = 'floating',
   suggestionEmptyLabel = 'No matching notes',
   paletteHeader,
@@ -188,7 +191,6 @@ export function InlineWikilinkInput({
     setSelectionRange,
     setCombinedRef,
     syncSelectionRange,
-    commitValueFromEditor,
     focusSelectionRange,
   } = useInlineWikilinkSelection({
     value,
@@ -393,7 +395,20 @@ export function InlineWikilinkInput({
       }
     }
 
-    commitValueFromEditor()
+    if (!editor) return
+
+    const nextValue = normalizeInlineWikilinkValue(serializeInlineNode(editor))
+    const nextSelection = readSelectionRange(editor)
+    const clampedSelection: InlineSelectionRange = {
+      start: Math.min(nextSelection.start, nextValue.length),
+      end: Math.min(nextSelection.end, nextValue.length),
+    }
+
+    const shouldRestoreFocus = document.activeElement === editor
+    pendingFocusAfterRemountRef.current = shouldRestoreFocus ? clampedSelection : null
+    onChange(nextValue)
+    setSelectionRange(clampedSelection)
+    forceRender((current) => current + 1)
   }
   const flushPendingCompositionInput = () => {
     if (isComposingRef.current || !pendingCompositionInputRef.current) return
@@ -428,6 +443,8 @@ export function InlineWikilinkInput({
     queueMicrotask(flushPendingCompositionInput)
   }
   const handleInput = () => {
+    if (disabled) return
+
     if (isComposingRef.current) {
       pendingCompositionInputRef.current = true
       return
@@ -472,6 +489,7 @@ export function InlineWikilinkInput({
       inputRef={setCombinedRef}
       dataTestId={dataTestId}
       editorClassName={editorClassName}
+      editorStyle={editorStyle}
       onCompositionEnd={handleCompositionEnd}
       onCompositionStart={handleCompositionStart}
       onInput={handleInput}

src/components/InlineWikilinkParts.tsx

@@ -1,4 +1,5 @@
 import { Fragment, createElement } from 'react'
+import type { CSSProperties } from 'react'
 import type { VaultEntry } from '../types'
 import { getTypeColor, getTypeLightColor } from '../utils/typeColors'
 import { NoteTitleIcon } from './NoteTitleIcon'
@@ -158,6 +159,7 @@ export function InlineWikilinkEditorField({
   inputRef,
   dataTestId,
   editorClassName,
+  editorStyle,
   onCompositionEnd,
   onCompositionStart,
   onInput,
@@ -175,6 +177,7 @@ export function InlineWikilinkEditorField({
   inputRef: React.Ref<HTMLDivElement>
   dataTestId: string
   editorClassName?: string
+  editorStyle?: CSSProperties
   onCompositionEnd: () => void
   onCompositionStart: () => void
   onInput: () => void
@@ -222,7 +225,7 @@ export function InlineWikilinkEditorField({
         onClick={onSelectionChange}
         onKeyUp={onSelectionChange}
         onMouseUp={onSelectionChange}
-        style={{ whiteSpace: 'pre-wrap', wordBreak: 'break-word' }}
+        style={{ ...editorStyle, whiteSpace: 'pre-wrap', wordBreak: 'break-word' }}
       >
         {segments.map((segment, index) => (
           segment.kind === 'text'

src/components/Inspector.tsx

@@ -96,6 +96,7 @@ function ValidFrontmatterPanels({
       />
       <Separator data-testid="inspector-properties-relationships-separator" />
       <DynamicRelationshipsPanel
+        entry={entry}
         frontmatter={frontmatter}
         entries={entries}
         typeEntryMap={typeEntryMap}

src/components/InspectorPanels.test.tsx

@@ -1,6 +1,6 @@
 import type { ComponentProps } from 'react'
 import { describe, it, expect, vi, beforeEach } from 'vitest'
-import { render as rtlRender, screen, fireEvent, act } from '@testing-library/react'
+import { render as rtlRender, screen, fireEvent, act, within } from '@testing-library/react'
 import { DynamicRelationshipsPanel, BacklinksPanel, ReferencedByPanel, GitHistoryPanel, InstancesPanel } from './InspectorPanels'
 import { TooltipProvider } from './ui/tooltip'
 import type { ReferencedByItem } from './InspectorPanels'
@@ -125,6 +125,35 @@ describe('DynamicRelationshipsPanel', () => {
     expect(screen.getByText('Related to')).toBeInTheDocument()
   })
 
+  it('shows missing type-defined relationships as editable placeholders', () => {
+    const bookType = makeEntry({
+      path: '/vault/book.md',
+      filename: 'book.md',
+      title: 'Book',
+      isA: 'Type',
+      relationships: {
+        Mentor: ['[[person/alice]]'],
+      },
+    })
+
+    renderRelationshipsPanel({
+      entry: makeEntry({ title: 'Dune', isA: 'Book' }),
+      entries: [...entries, bookType],
+      frontmatter: {},
+      onAddProperty,
+    })
+
+    const placeholder = screen.getByTestId('type-derived-relationship')
+    expect(within(placeholder).getByText('Mentor')).toHaveClass('text-muted-foreground/40')
+    fireEvent.click(within(placeholder).getByTestId('add-relation-ref'))
+    fireEvent.change(within(placeholder).getByTestId('add-relation-ref-input'), {
+      target: { value: 'My Project' },
+    })
+    fireEvent.keyDown(within(placeholder).getByTestId('add-relation-ref-input'), { key: 'Enter' })
+
+    expect(onAddProperty).toHaveBeenCalledWith('Mentor', '[[project/my-project]]')
+  })
+
   it('navigates when clicking a relationship link', () => {
     render(
       <DynamicRelationshipsPanel

src/components/MermaidDiagram.test.tsx

@@ -71,6 +71,34 @@ describe('MermaidDiagram', () => {
     expect(style?.getAttribute('nonce')).toBe(RUNTIME_STYLE_NONCE)
   })
 
+  it('keeps Mermaid foreignObject labels visible after sanitizing the SVG', async () => {
+    mermaidMock.render.mockResolvedValueOnce({
+      svg: [
+        '<svg aria-label="Rendered Mermaid">',
+        '<g class="node">',
+        '<foreignObject width="200" height="40">',
+        '<div xmlns="http://www.w3.org/1999/xhtml">',
+        '<span class="nodeLabel" onclick="alert(1)">Employee<br>clocks in</span>',
+        '</div>',
+        '</foreignObject>',
+        '</g>',
+        '</svg>',
+      ].join(''),
+    })
+
+    render(
+      <MermaidDiagram
+        diagram={'flowchart LR\nA(["Employee clocks in"]) --> B'}
+        source={'```mermaid\nflowchart LR\nA(["Employee clocks in"]) --> B\n```'}
+      />,
+    )
+
+    await waitFor(() => {
+      expect(screen.getByTestId('mermaid-diagram-viewport')).toHaveTextContent('Employeeclocks in')
+    })
+    expect(screen.getByText('Employeeclocks in')).not.toHaveAttribute('onclick')
+  })
+
   it('falls back to the original source when Mermaid cannot render', async () => {
     mermaidMock.render.mockRejectedValueOnce(new Error('parse error'))
 

src/components/MermaidDiagram.tsx

@@ -8,7 +8,7 @@ import {
   DialogTitle,
   DialogTrigger,
 } from '@/components/ui/dialog'
-import { RUNTIME_STYLE_NONCE } from '@/lib/runtimeStyleNonce'
+import { SafeSvgDiv } from './SafeMarkup'
 
 type MermaidApi = typeof import('mermaid')['default']
 
@@ -52,18 +52,6 @@ function initializeMermaid(mermaid: MermaidApi) {
   initialized = true
 }
 
-function withRuntimeStyleNonce(svg: string): string {
-  if (!svg.includes('<style')) return svg
-  if (typeof document === 'undefined') return svg
-
-  const container = document.createElement('div')
-  container.innerHTML = svg
-  container.querySelectorAll('style').forEach((style) => {
-    style.setAttribute('nonce', RUNTIME_STYLE_NONCE)
-  })
-  return container.innerHTML
-}
-
 async function renderMermaidDiagram({
   diagram,
   renderId,
@@ -75,7 +63,7 @@ async function renderMermaidDiagram({
     const mermaid = (await import('mermaid')).default
     initializeMermaid(mermaid)
     const result = await mermaid.render(renderId, diagram)
-    return withRuntimeStyleNonce(result.svg)
+    return result.svg
   }
   const nextRender = renderQueue.then(render, render)
   renderQueue = nextRender.then(() => undefined, () => undefined)
@@ -84,13 +72,13 @@ async function renderMermaidDiagram({
 
 function MermaidSvgViewport({ ariaLabel, className, svg, testId }: MermaidSvgViewportProps) {
   return (
-    <div
+    <SafeSvgDiv
       aria-label={ariaLabel}
       className={className}
       data-testid={testId}
       role="img"
+      svg={svg}
       tabIndex={0}
-      dangerouslySetInnerHTML={{ __html: svg }}
     />
   )
 }

src/components/NoteItem.test.tsx

@@ -78,6 +78,37 @@ describe('NoteItem', () => {
     expect(screen.getByTestId('type-icon')).toHaveAttribute('data-file-preview-kind', 'pdf')
   })
 
+  it('renders audio and video files as clickable media preview rows', () => {
+    const audioEntry = makeEntry({
+      path: '/vault/attachments/interview.mp3',
+      filename: 'interview.mp3',
+      title: 'interview.mp3',
+      fileKind: 'binary',
+    })
+    const videoEntry = makeEntry({
+      path: '/vault/attachments/demo.mp4',
+      filename: 'demo.mp4',
+      title: 'demo.mp4',
+      fileKind: 'binary',
+    })
+    const onClickNote = vi.fn()
+
+    render(
+      <>
+        <NoteItem entry={audioEntry} isSelected={false} typeEntryMap={{}} onClickNote={onClickNote} />
+        <NoteItem entry={videoEntry} isSelected={false} typeEntryMap={{}} onClickNote={onClickNote} />
+      </>,
+    )
+
+    expect(screen.getByTestId('audio-file-item')).toHaveAttribute('title', 'Open audio preview')
+    expect(screen.getByTestId('video-file-item')).toHaveAttribute('title', 'Open video preview')
+
+    fireEvent.click(screen.getByTestId('audio-file-item'))
+    fireEvent.click(screen.getByTestId('video-file-item'))
+    expect(onClickNote).toHaveBeenCalledWith(audioEntry, expect.any(Object))
+    expect(onClickNote).toHaveBeenCalledWith(videoEntry, expect.any(Object))
+  })
+
   it('renders text files as clickable rows', () => {
     const textEntry = makeEntry({
       path: '/vault/config.yml',

src/components/NoteItem.tsx

@@ -4,7 +4,7 @@ import { cn } from '@/lib/utils'
 import {
   Wrench, Flask, Target, ArrowsClockwise,
   Users, CalendarBlank, Tag, FileText, StackSimple,
-  File, FileDashed, FilePdf, ImageSquare,
+  File, FileDashed, FilePdf, ImageSquare, SpeakerHigh, Video,
 } from '@phosphor-icons/react'
 import { getTypeColor, getTypeLightColor } from '../utils/typeColors'
 import { resolveIcon } from '../utils/iconRegistry'
@@ -205,6 +205,8 @@ function resolveNoteTypeIcon(entry: VaultEntry, customIcon?: string | null): Com
   const previewKind = filePreviewKind(entry)
   if (previewKind === 'image') return ImageSquare
   if (previewKind === 'pdf') return FilePdf
+  if (previewKind === 'audio') return SpeakerHigh
+  if (previewKind === 'video') return Video
   if (entry.fileKind && entry.fileKind !== 'markdown') return getFileKindIcon(entry.fileKind)
   return getTypeIcon(entry.isA, customIcon)
 }
@@ -380,6 +382,8 @@ function resolveNoteItemTitle({
 }) {
   if (previewKind === 'image') return 'Open image preview'
   if (previewKind === 'pdf') return 'Open PDF preview'
+  if (previewKind === 'audio') return 'Open audio preview'
+  if (previewKind === 'video') return 'Open video preview'
   return isUnavailableBinary ? 'Cannot open this file type' : undefined
 }
 

src/components/PrivacySettingsSection.tsx

@@ -0,0 +1,73 @@
+import type { createTranslator } from '../lib/i18n'
+import { SectionHeading, SettingsGroup, SettingsGroupItem } from './SettingsControls'
+import { Checkbox } from './ui/checkbox'
+
+type Translate = ReturnType<typeof createTranslator>
+
+interface PrivacySettingsSectionProps {
+  t: Translate
+  crashReporting: boolean
+  setCrashReporting: (value: boolean) => void
+  analytics: boolean
+  setAnalytics: (value: boolean) => void
+}
+
+function isChecked(checked: boolean | 'indeterminate'): boolean {
+  return checked === true
+}
+
+function TelemetryToggle({
+  label,
+  description,
+  checked,
+  onChange,
+  testId,
+}: {
+  label: string
+  description: string
+  checked: boolean
+  onChange: (value: boolean) => void
+  testId: string
+}) {
+  return (
+    <SettingsGroupItem testId={testId}>
+      <label className="flex cursor-pointer items-start gap-3">
+        <Checkbox checked={checked} onCheckedChange={(value) => onChange(isChecked(value))} className="mt-0.5" />
+        <span className="space-y-1">
+          <span className="block text-sm font-medium text-foreground">{label}</span>
+          <span className="block text-xs leading-5 text-muted-foreground">{description}</span>
+        </span>
+      </label>
+    </SettingsGroupItem>
+  )
+}
+
+export function PrivacySettingsSection({
+  t,
+  crashReporting,
+  setCrashReporting,
+  analytics,
+  setAnalytics,
+}: PrivacySettingsSectionProps) {
+  return (
+    <>
+      <SectionHeading title={t('settings.privacy.title')} />
+      <SettingsGroup>
+        <TelemetryToggle
+          label={t('settings.privacy.crashReporting')}
+          description={t('settings.privacy.crashReportingDescription')}
+          checked={crashReporting}
+          onChange={setCrashReporting}
+          testId="settings-crash-reporting"
+        />
+        <TelemetryToggle
+          label={t('settings.privacy.analytics')}
+          description={t('settings.privacy.analyticsDescription')}
+          checked={analytics}
+          onChange={setAnalytics}
+          testId="settings-analytics"
+        />
+      </SettingsGroup>
+    </>
+  )
+}

src/components/PropertyValueCells.tsx

@@ -428,33 +428,49 @@ type ScalarRendererProps = SmartCellProps & {
   editProps: ScalarEditProps
 }
 
-const SCALAR_DISPLAY_RENDERERS: Partial<Record<PropertyDisplayMode, (props: ScalarRendererProps) => ReactNode>> = {
-  status: ({ propKey, value, isEditing, vaultStatuses, onSave, onStartEdit }) => (
-    <StatusValue propKey={propKey} value={value ?? ''} isEditing={isEditing} vaultStatuses={vaultStatuses} onSave={onSave} onStartEdit={onStartEdit} />
-  ),
-  tags: ({ propKey, value, isEditing, vaultTags, onSaveList, onStartEdit }) => (
-    <TagsValue propKey={propKey} value={value ? [String(value)] : []} isEditing={isEditing} vaultTags={vaultTags} onSave={onSaveList} onStartEdit={onStartEdit} />
-  ),
-  date: ({ propKey, value, isEditing, onSave, onStartEdit }) => (
-    <DateValue
-      key={`${propKey}:${isEditing ? 'editing' : 'view'}`}
-      value={String(value ?? '')}
-      onSave={(nextValue) => onSave(propKey, nextValue)}
-      autoOpen={isEditing}
-      onCancel={() => onStartEdit(null)}
+type ScalarDisplayRenderer = (props: ScalarRendererProps & { resolvedMode: PropertyDisplayMode }) => ReactNode
+
+const SCALAR_DISPLAY_RENDERERS: readonly [PropertyDisplayMode, ScalarDisplayRenderer][] = [
+  ['status', (props) => (
+    <StatusValue
+      propKey={props.propKey}
+      value={props.value ?? ''}
+      isEditing={props.isEditing}
+      vaultStatuses={props.vaultStatuses}
+      onSave={props.onSave}
+      onStartEdit={props.onStartEdit}
     />
-  ),
-  number: ({ editProps }) => <NumberValue {...editProps} />,
-  boolean: ({ propKey, value, onUpdate }) => {
-    const boolVal = toBooleanValue(value)
-    return <BooleanToggle value={boolVal} onToggle={() => onUpdate?.(propKey, !boolVal)} />
-  },
-  url: ({ editProps }) => <UrlValue {...editProps} />,
-  color: ({ editProps }) => <ColorEditableValue {...editProps} />,
-}
+  )],
+  ['tags', (props) => (
+    <TagsValue
+      propKey={props.propKey}
+      value={props.value ? [String(props.value)] : []}
+      isEditing={props.isEditing}
+      vaultTags={props.vaultTags}
+      onSave={props.onSaveList}
+      onStartEdit={props.onStartEdit}
+    />
+  )],
+  ['date', (props) => (
+    <DateValue
+      key={`${props.propKey}:${props.isEditing ? 'editing' : 'view'}`}
+      value={String(props.value ?? '')}
+      onSave={(nextValue) => props.onSave(props.propKey, nextValue)}
+      autoOpen={props.isEditing}
+      onCancel={() => props.onStartEdit(null)}
+    />
+  )],
+  ['number', (props) => <NumberValue {...props.editProps} />],
+  ['boolean', (props) => {
+    const boolVal = toBooleanValue(props.value)
+    return <BooleanToggle value={boolVal} onToggle={() => props.onUpdate?.(props.propKey, !boolVal)} />
+  }],
+  ['url', (props) => <UrlValue {...props.editProps} />],
+  ['color', (props) => <ColorEditableValue {...props.editProps} />],
+]
 
 function renderScalarDisplayMode(props: ScalarRendererProps & { resolvedMode: PropertyDisplayMode }) {
-  const renderer = SCALAR_DISPLAY_RENDERERS[props.resolvedMode]
+  const renderer = SCALAR_DISPLAY_RENDERERS.find(([mode]) => mode === props.resolvedMode)?.[1]
   return renderer ? renderer(props) : <EditableValue {...props.editProps} />
 }
 

src/components/ResizeHandle.test.tsx

@@ -28,6 +28,12 @@ describe('ResizeHandle', () => {
     expect(handle.style.cursor || handle.className).toBeTruthy()
   })
 
+  it('stacks above z-indexed panel surfaces', () => {
+    const { container } = render(<ResizeHandle onResize={vi.fn()} />)
+    const handle = container.firstChild as HTMLElement
+    expect(handle.className).toContain('z-30')
+  })
+
   it('calls onResize with delta during drag', () => {
     const onResize = vi.fn()
     const { container } = render(<ResizeHandle onResize={onResize} />)

src/components/ResizeHandle.tsx

@@ -67,7 +67,7 @@ export function ResizeHandle({ onResize }: ResizeHandleProps) {
 
   return (
     <div
-      className="relative z-10 -ml-1 w-1 shrink-0 self-stretch cursor-col-resize bg-transparent transition-colors hover:bg-[var(--border)]"
+      className="relative z-30 -ml-1 w-1 shrink-0 self-stretch cursor-col-resize bg-transparent transition-colors hover:bg-[var(--border)]"
       onMouseDown={handleMouseDown}
     />
   )

src/components/SafeMarkup.tsx

@@ -0,0 +1,60 @@
+import DOMPurify from 'dompurify'
+import { useLayoutEffect, useRef, type HTMLAttributes } from 'react'
+import { RUNTIME_STYLE_NONCE } from '@/lib/runtimeStyleNonce'
+
+interface SafeHtmlSpanProps extends HTMLAttributes<HTMLSpanElement> {
+  html: string
+}
+
+interface SafeSvgDivProps extends HTMLAttributes<HTMLDivElement> {
+  svg: string
+}
+
+const MERMAID_SVG_SANITIZE_CONFIG = {
+  USE_PROFILES: { svg: true, svgFilters: true, html: true },
+  ADD_TAGS: ['foreignObject'],
+  ADD_ATTR: ['xmlns'],
+  HTML_INTEGRATION_POINTS: { foreignobject: true },
+}
+
+function importSanitizedHtmlNodes(html: string): Node[] {
+  const sanitized = DOMPurify.sanitize(html, {
+    USE_PROFILES: { html: true, mathMl: true },
+  })
+  const parsed = new DOMParser().parseFromString(sanitized, 'text/html')
+  return Array.from(parsed.body.childNodes, (node) => document.importNode(node, true))
+}
+
+function importSanitizedSvgNode(svg: string): Node | null {
+  const sanitized = DOMPurify.sanitize(svg, MERMAID_SVG_SANITIZE_CONFIG)
+  const parsed = new DOMParser().parseFromString(sanitized, 'text/html')
+  const parsedSvg = parsed.body.querySelector('svg')
+  if (!parsedSvg) return null
+
+  const svgNode = document.importNode(parsedSvg, true)
+  svgNode.querySelectorAll('style').forEach((style) => {
+    style.setAttribute('nonce', RUNTIME_STYLE_NONCE)
+  })
+  return svgNode
+}
+
+export function SafeHtmlSpan({ html, ...props }: SafeHtmlSpanProps) {
+  const ref = useRef<HTMLSpanElement>(null)
+
+  useLayoutEffect(() => {
+    ref.current?.replaceChildren(...importSanitizedHtmlNodes(html))
+  }, [html])
+
+  return <span {...props} ref={ref} />
+}
+
+export function SafeSvgDiv({ svg, ...props }: SafeSvgDivProps) {
+  const ref = useRef<HTMLDivElement>(null)
+
+  useLayoutEffect(() => {
+    const node = importSanitizedSvgNode(svg)
+    ref.current?.replaceChildren(...(node ? [node] : []))
+  }, [svg])
+
+  return <div {...props} ref={ref} />
+}

src/components/SettingsControls.tsx

@@ -0,0 +1,273 @@
+import type { ReactNode } from 'react'
+import { Input } from './ui/input'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from './ui/select'
+import { Switch } from './ui/switch'
+
+type SelectOption = { value: string; label: string }
+type ControlWidth = 'auto' | 'compact' | 'default' | 'wide'
+
+const SETTINGS_GROUP_ITEM_CLASS = 'border-b border-border px-4 py-3 last:border-b-0'
+
+function sanitizePositiveInteger(value: number | null | undefined, fallback: number): number {
+  if (value === null || value === undefined || !Number.isFinite(value) || value < 1) return fallback
+  return Math.round(value)
+}
+
+export function SettingsSection({
+  children,
+  id,
+}: {
+  children: ReactNode
+  id?: string
+  showDivider?: boolean
+}) {
+  return (
+    <div id={id} className="scroll-mt-4" style={{ display: 'flex', flexDirection: 'column', gap: 14, padding: '18px 0' }}>
+      {children}
+    </div>
+  )
+}
+
+export function SectionHeading({
+  title,
+}: {
+  title: string
+  description?: string
+}) {
+  return (
+    <div>
+      <div
+        style={{
+          fontSize: 14,
+          fontWeight: 600,
+          color: 'var(--foreground)',
+        }}
+      >
+        {title}
+      </div>
+    </div>
+  )
+}
+
+export function SettingsGroup({ children }: { children: ReactNode }) {
+  return <div className="overflow-hidden rounded-md border border-border bg-card">{children}</div>
+}
+
+export function SettingsGroupItem({
+  children,
+  testId,
+}: {
+  children: ReactNode
+  testId?: string
+}) {
+  return <div className={SETTINGS_GROUP_ITEM_CLASS} data-testid={testId}>{children}</div>
+}
+
+function controlWidthClass(width: ControlWidth): string {
+  if (width === 'auto') return 'lg:w-auto'
+  if (width === 'compact') return 'lg:w-56'
+  if (width === 'wide') return 'lg:w-[420px]'
+  return 'lg:w-80'
+}
+
+export function SettingsRow({
+  label,
+  description,
+  children,
+  controlWidth = 'default',
+  testId,
+}: {
+  label: string
+  description?: string
+  children: ReactNode
+  controlWidth?: ControlWidth
+  testId?: string
+}) {
+  return (
+    <div
+      className={`${SETTINGS_GROUP_ITEM_CLASS} flex flex-col gap-3 lg:flex-row lg:items-center`}
+      data-testid={testId}
+    >
+      <div className="min-w-0 flex-1 space-y-1">
+        <div className="text-sm font-medium text-foreground">{label}</div>
+        {description ? <div className="text-xs leading-5 text-muted-foreground">{description}</div> : null}
+      </div>
+      <div className={`w-full min-w-0 lg:shrink-0 ${controlWidthClass(controlWidth)}`}>{children}</div>
+    </div>
+  )
+}
+
+export function SelectControl({
+  value,
+  onValueChange,
+  options,
+  testId,
+  ariaLabel,
+  autoFocus = false,
+}: {
+  value: string
+  onValueChange: (value: string) => void
+  options: SelectOption[]
+  testId: string
+  ariaLabel: string
+  autoFocus?: boolean
+}) {
+  return (
+    <Select value={value} onValueChange={onValueChange}>
+      <SelectTrigger
+        className="w-full bg-transparent"
+        aria-label={ariaLabel}
+        data-testid={testId}
+        data-value={value}
+        data-settings-autofocus={autoFocus ? 'true' : undefined}
+      >
+        <SelectValue />
+      </SelectTrigger>
+      <SelectContent position="popper" data-anchor-strategy="popper">
+        {options.map((option) => (
+          <SelectItem key={option.value} value={option.value}>
+            {option.label}
+          </SelectItem>
+        ))}
+      </SelectContent>
+    </Select>
+  )
+}
+
+export function NumberInputControl({
+  value,
+  onValueChange,
+  testId,
+  ariaLabel,
+  disabled = false,
+}: {
+  value: number
+  onValueChange: (value: number) => void
+  testId: string
+  ariaLabel: string
+  disabled?: boolean
+}) {
+  return (
+    <Input
+      id={testId}
+      type="number"
+      min={1}
+      step={1}
+      value={value}
+      disabled={disabled}
+      aria-label={ariaLabel}
+      onChange={(event) => onValueChange(sanitizePositiveInteger(Number(event.target.value), value))}
+      data-testid={testId}
+      className="w-full bg-transparent"
+    />
+  )
+}
+
+export function SettingsSwitchControl({
+  label,
+  checked,
+  onChange,
+  disabled = false,
+}: {
+  label: string
+  checked: boolean
+  onChange: (value: boolean) => void
+  disabled?: boolean
+}) {
+  return <Switch checked={checked} onCheckedChange={onChange} aria-label={label} disabled={disabled} />
+}
+
+export function LabeledSelect({
+  label,
+  value,
+  onValueChange,
+  options,
+  testId,
+  autoFocus = false,
+}: {
+  label: string
+  value: string
+  onValueChange: (value: string) => void
+  options: Array<{ value: string; label: string }>
+  testId: string
+  autoFocus?: boolean
+}) {
+  return (
+    <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+      <label style={{ fontSize: 12, fontWeight: 500, color: 'var(--foreground)' }}>{label}</label>
+      <SelectControl
+        value={value}
+        onValueChange={onValueChange}
+        options={options}
+        testId={testId}
+        ariaLabel={label}
+        autoFocus={autoFocus}
+      />
+    </div>
+  )
+}
+
+export function LabeledNumberInput({
+  label,
+  value,
+  onValueChange,
+  testId,
+  disabled = false,
+}: {
+  label: string
+  value: number
+  onValueChange: (value: number) => void
+  testId: string
+  disabled?: boolean
+}) {
+  return (
+    <div style={{ display: 'flex', flexDirection: 'column', gap: 6 }}>
+      <label style={{ fontSize: 12, fontWeight: 500, color: 'var(--foreground)' }} htmlFor={testId}>{label}</label>
+      <NumberInputControl
+        value={value}
+        onValueChange={onValueChange}
+        testId={testId}
+        ariaLabel={label}
+        disabled={disabled}
+      />
+    </div>
+  )
+}
+
+export function SettingsSwitchRow({
+  label,
+  description,
+  checked,
+  onChange,
+  disabled = false,
+  testId,
+}: {
+  label: string
+  description: string
+  checked: boolean
+  onChange: (value: boolean) => void
+  disabled?: boolean
+  testId?: string
+}) {
+  return (
+    <label
+      className={`${SETTINGS_GROUP_ITEM_CLASS} flex flex-col gap-3 lg:flex-row lg:items-center`}
+      style={{ cursor: disabled ? 'not-allowed' : 'pointer', opacity: disabled ? 0.6 : 1 }}
+      data-testid={testId}
+    >
+      <div className="min-w-0 flex-1 space-y-1">
+        <div className="text-sm font-medium text-foreground">{label}</div>
+        <div className="text-xs leading-5 text-muted-foreground">{description}</div>
+      </div>
+      <div className="flex justify-start lg:shrink-0 lg:justify-end">
+        <SettingsSwitchControl label={label} checked={checked} onChange={onChange} disabled={disabled} />
+      </div>
+    </label>
+  )
+}

src/components/SettingsFooter.tsx

@@ -0,0 +1,31 @@
+import type { createTranslator } from '../lib/i18n'
+import { Button } from './ui/button'
+
+type Translate = ReturnType<typeof createTranslator>
+
+export function SettingsFooter({
+  onClose,
+  onSave,
+  t,
+}: {
+  onClose: () => void
+  onSave: () => void
+  t: Translate
+}) {
+  return (
+    <div
+      className="flex items-center justify-between shrink-0"
+      style={{ height: 56, padding: '0 24px', borderTop: '1px solid var(--border)' }}
+    >
+      <span style={{ fontSize: 11, color: 'var(--muted-foreground)' }}>{t('settings.footerShortcut')}</span>
+      <div className="flex gap-2">
+        <Button variant="outline" size="sm" onClick={onClose}>
+          {t('settings.cancel')}
+        </Button>
+        <Button size="sm" onClick={onSave} data-testid="settings-save">
+          {t('settings.save')}
+        </Button>
+      </div>
+    </div>
+  )
+}

src/components/SettingsPanel.test.tsx

@@ -3,6 +3,7 @@ import { fireEvent, render, screen, within } from '@testing-library/react'
 import { SettingsPanel } from './SettingsPanel'
 import type { Settings } from '../types'
 import { THEME_MODE_STORAGE_KEY } from '../lib/themeMode'
+import type { AiAgentsStatus } from '../lib/aiAgents'
 
 const { trackEventMock } = vi.hoisted(() => ({
   trackEventMock: vi.fn(),
@@ -56,15 +57,50 @@ function createStorageMock(): Storage {
   }
 }
 
+function installMatchMedia(matches = false) {
+  Object.defineProperty(window, 'matchMedia', {
+    configurable: true,
+    value: vi.fn((query: string) => ({
+      matches,
+      media: query,
+      onchange: null,
+      addEventListener: vi.fn(),
+      removeEventListener: vi.fn(),
+      addListener: vi.fn(),
+      removeListener: vi.fn(),
+      dispatchEvent: vi.fn(() => true),
+    })),
+  })
+}
+
 describe('SettingsPanel', () => {
   const onSave = vi.fn()
   const onClose = vi.fn()
   const localStorageMock = createStorageMock()
 
+  function renderOpenSettings(settings: Settings = emptySettings) {
+    return render(
+      <SettingsPanel open={true} settings={settings} onSave={onSave} onClose={onClose} />
+    )
+  }
+
+  function saveSettingsPanel() {
+    fireEvent.click(screen.getByTestId('settings-save'))
+  }
+
+  function expectSettingsSaved(partial: Partial<Settings>) {
+    expect(onSave).toHaveBeenCalledWith(expect.objectContaining(partial))
+  }
+
+  function selectThemeMode(label: string) {
+    fireEvent.click(screen.getByRole('radio', { name: label }))
+  }
+
   beforeEach(() => {
     vi.clearAllMocks()
     trackEventMock.mockClear()
     Object.defineProperty(window, 'localStorage', { value: localStorageMock, configurable: true })
+    installMatchMedia(false)
     window.localStorage.clear()
     document.documentElement.removeAttribute('data-theme')
     document.documentElement.classList.remove('dark')
@@ -83,7 +119,48 @@ describe('SettingsPanel', () => {
       <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
     )
     expect(screen.getByText('Settings')).toBeInTheDocument()
-    expect(screen.getByText('Sync & Updates')).toBeInTheDocument()
+    expect(screen.getAllByText('Sync & Updates').length).toBeGreaterThan(0)
+  })
+
+  it('separates coding agents, local models, and API models in AI settings', async () => {
+    const aiAgentsStatus: AiAgentsStatus = {
+      claude_code: { status: 'installed', version: '2.1.18' },
+      codex: { status: 'missing', version: null },
+      opencode: { status: 'missing', version: null },
+      pi: { status: 'missing', version: null },
+      gemini: { status: 'missing', version: null },
+    }
+    render(
+      <SettingsPanel
+        open={true}
+        settings={emptySettings}
+        aiAgentsStatus={aiAgentsStatus}
+        onSave={onSave}
+        onClose={onClose}
+      />
+    )
+
+    expect(screen.getByText('Recognized coding agents')).toBeInTheDocument()
+    expect(screen.getByText('Claude Code')).toBeInTheDocument()
+    expect(screen.getByText('2.1.18')).toBeInTheDocument()
+    expect(screen.getByRole('tab', { name: 'Local model' })).toBeInTheDocument()
+    expect(screen.getByRole('tab', { name: 'API model' })).toBeInTheDocument()
+
+    fireEvent.mouseDown(screen.getByRole('tab', { name: 'Local model' }), { button: 0, ctrlKey: false })
+    fireEvent.change(screen.getByLabelText('Model ID'), { target: { value: 'llama3.2' } })
+    fireEvent.click(screen.getByRole('button', { name: 'Test model' }))
+    expect(await screen.findByText('Connection works. The model replied successfully.')).toBeInTheDocument()
+    expect(screen.getByRole('button', { name: 'Add local model' })).toBeInTheDocument()
+    expect(screen.queryByText('Recognized coding agents')).not.toBeInTheDocument()
+
+    fireEvent.mouseDown(screen.getByRole('tab', { name: 'API model' }), { button: 0, ctrlKey: false })
+    expect(screen.getByRole('button', { name: 'Add API model' })).toBeInTheDocument()
+    expect(screen.queryByRole('button', { name: 'Add local model' })).not.toBeInTheDocument()
+    fireEvent.pointerDown(screen.getByText('OpenAI').closest('button')!, { button: 0, pointerType: 'mouse' })
+    fireEvent.click(screen.getByRole('option', { name: 'Gemini' }))
+    expect(screen.getByDisplayValue('Gemini')).toBeInTheDocument()
+    expect(screen.getByDisplayValue('https://generativelanguage.googleapis.com/v1beta/openai')).toBeInTheDocument()
+    expect(screen.getByPlaceholderText('gemini-2.5-flash')).toBeInTheDocument()
   })
 
   it('updates the draft language when stored settings finish loading', () => {
@@ -118,6 +195,8 @@ describe('SettingsPanel', () => {
       autogit_inactive_threshold_seconds: 30,
       release_channel: null,
       theme_mode: 'light',
+      note_width_mode: 'normal',
+      sidebar_type_pluralization_enabled: true,
       hide_gitignored_files: true,
       all_notes_show_pdfs: false,
       all_notes_show_images: false,
@@ -140,18 +219,18 @@ describe('SettingsPanel', () => {
     expect(onClose).toHaveBeenCalled()
   })
 
-  it('renders All Notes file visibility checkboxes off by default', () => {
+  it('renders All Notes file visibility switches off by default', () => {
     render(
       <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
     )
 
-    expect(screen.getByText('All Notes visibility')).toBeInTheDocument()
-    expect(within(screen.getByTestId('settings-all-notes-show-pdfs')).getByRole('checkbox')).toHaveAttribute('aria-checked', 'false')
-    expect(within(screen.getByTestId('settings-all-notes-show-images')).getByRole('checkbox')).toHaveAttribute('aria-checked', 'false')
-    expect(within(screen.getByTestId('settings-all-notes-show-unsupported')).getByRole('checkbox')).toHaveAttribute('aria-checked', 'false')
+    expect(screen.getByText('Show PDFs')).toBeInTheDocument()
+    expect(within(screen.getByTestId('settings-all-notes-show-pdfs')).getByRole('switch')).toHaveAttribute('aria-checked', 'false')
+    expect(within(screen.getByTestId('settings-all-notes-show-images')).getByRole('switch')).toHaveAttribute('aria-checked', 'false')
+    expect(within(screen.getByTestId('settings-all-notes-show-unsupported')).getByRole('switch')).toHaveAttribute('aria-checked', 'false')
   })
 
-  it('preserves saved All Notes file visibility checkboxes', () => {
+  it('preserves saved All Notes file visibility switches', () => {
     render(
       <SettingsPanel
         open={true}
@@ -166,20 +245,18 @@ describe('SettingsPanel', () => {
       />
     )
 
-    expect(within(screen.getByTestId('settings-all-notes-show-pdfs')).getByRole('checkbox')).toHaveAttribute('aria-checked', 'true')
-    expect(within(screen.getByTestId('settings-all-notes-show-images')).getByRole('checkbox')).toHaveAttribute('aria-checked', 'true')
-    expect(within(screen.getByTestId('settings-all-notes-show-unsupported')).getByRole('checkbox')).toHaveAttribute('aria-checked', 'false')
+    expect(within(screen.getByTestId('settings-all-notes-show-pdfs')).getByRole('switch')).toHaveAttribute('aria-checked', 'true')
+    expect(within(screen.getByTestId('settings-all-notes-show-images')).getByRole('switch')).toHaveAttribute('aria-checked', 'true')
+    expect(within(screen.getByTestId('settings-all-notes-show-unsupported')).getByRole('switch')).toHaveAttribute('aria-checked', 'false')
   })
 
-  it('saves All Notes file visibility from keyboard toggles before Escape close', () => {
+  it('saves All Notes file visibility immediately before Escape close', () => {
     render(
       <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
     )
 
-    const pdfCheckbox = within(screen.getByTestId('settings-all-notes-show-pdfs')).getByRole('checkbox')
-    pdfCheckbox.focus()
-    fireEvent.keyDown(pdfCheckbox, { key: ' ', code: 'Space' })
-    fireEvent.keyUp(pdfCheckbox, { key: ' ', code: 'Space' })
+    const pdfSwitch = within(screen.getByTestId('settings-all-notes-show-pdfs')).getByRole('switch')
+    fireEvent.click(pdfSwitch)
     fireEvent.keyDown(screen.getByTestId('settings-panel'), { key: 'Escape' })
 
     expect(onSave).toHaveBeenCalledWith(expect.objectContaining({
@@ -195,7 +272,7 @@ describe('SettingsPanel', () => {
       <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
     )
 
-    fireEvent.click(within(screen.getByTestId('settings-all-notes-show-images')).getByRole('checkbox'))
+    fireEvent.click(within(screen.getByTestId('settings-all-notes-show-images')).getByRole('switch'))
 
     expect(trackEventMock).toHaveBeenCalledWith('all_notes_visibility_changed', {
       category: 'images',
@@ -215,6 +292,7 @@ describe('SettingsPanel', () => {
     expect(screen.getByTestId('settings-theme-mode')).toBeInTheDocument()
     expect(screen.getByRole('radio', { name: 'Light' })).toHaveAttribute('aria-checked', 'true')
     expect(screen.getByRole('radio', { name: 'Dark' })).toHaveAttribute('aria-checked', 'false')
+    expect(screen.getByRole('radio', { name: 'System' })).toHaveAttribute('aria-checked', 'false')
   })
 
   it('defaults the language selector to system language', () => {
@@ -233,6 +311,53 @@ describe('SettingsPanel', () => {
     expect(screen.getByText('系统（简体中文）')).toBeInTheDocument()
   })
 
+  it('defaults note width to normal and sidebar type pluralization to enabled', () => {
+    render(
+      <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
+    )
+
+    expect(screen.getByTestId('settings-default-note-width')).toHaveAttribute('data-value', 'normal')
+    expect(
+      within(screen.getByTestId('settings-sidebar-type-pluralization')).getByRole('switch')
+    ).toHaveAttribute('aria-checked', 'true')
+  })
+
+  it('preserves saved default note width and sidebar type pluralization preferences', () => {
+    render(
+      <SettingsPanel
+        open={true}
+        settings={{
+          ...emptySettings,
+          note_width_mode: 'wide',
+          sidebar_type_pluralization_enabled: false,
+        }}
+        onSave={onSave}
+        onClose={onClose}
+      />
+    )
+
+    expect(screen.getByTestId('settings-default-note-width')).toHaveAttribute('data-value', 'wide')
+    expect(
+      within(screen.getByTestId('settings-sidebar-type-pluralization')).getByRole('switch')
+    ).toHaveAttribute('aria-checked', 'false')
+  })
+
+  it('saves default note width and sidebar type pluralization preferences', () => {
+    render(
+      <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
+    )
+
+    fireEvent.pointerDown(screen.getByTestId('settings-default-note-width'), { button: 0, pointerType: 'mouse' })
+    fireEvent.click(screen.getByRole('option', { name: 'Wide' }))
+    fireEvent.click(within(screen.getByTestId('settings-sidebar-type-pluralization')).getByRole('switch'))
+    fireEvent.click(screen.getByTestId('settings-save'))
+
+    expect(onSave).toHaveBeenCalledWith(expect.objectContaining({
+      note_width_mode: 'wide',
+      sidebar_type_pluralization_enabled: false,
+    }))
+  })
+
   it('keeps the language selector keyboard accessible', () => {
     render(
       <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
@@ -273,31 +398,42 @@ describe('SettingsPanel', () => {
   })
 
   it('saves the selected dark color mode', () => {
-    render(
-      <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
-    )
+    renderOpenSettings()
 
-    fireEvent.click(screen.getByRole('radio', { name: 'Dark' }))
-    fireEvent.click(screen.getByTestId('settings-save'))
+    selectThemeMode('Dark')
+    saveSettingsPanel()
 
-    expect(onSave).toHaveBeenCalledWith(expect.objectContaining({
+    expectSettingsSaved({
       theme_mode: 'dark',
-    }))
+    })
   })
 
   it('applies the selected dark color mode immediately while settings stays open', () => {
-    render(
-      <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
-    )
+    renderOpenSettings()
 
-    fireEvent.click(screen.getByRole('radio', { name: 'Dark' }))
+    selectThemeMode('Dark')
 
     expect(document.documentElement).toHaveAttribute('data-theme', 'dark')
     expect(document.documentElement).toHaveClass('dark')
     expect(window.localStorage.getItem(THEME_MODE_STORAGE_KEY)).toBe('dark')
-    expect(onSave).toHaveBeenCalledWith(expect.objectContaining({
+    expectSettingsSaved({
       theme_mode: 'dark',
-    }))
+    })
+  })
+
+  it('saves system color mode while applying the current OS appearance immediately', () => {
+    installMatchMedia(true)
+    renderOpenSettings()
+
+    selectThemeMode('System')
+    saveSettingsPanel()
+
+    expect(document.documentElement).toHaveAttribute('data-theme', 'dark')
+    expect(document.documentElement).toHaveClass('dark')
+    expect(window.localStorage.getItem(THEME_MODE_STORAGE_KEY)).toBe('system')
+    expectSettingsSaved({
+      theme_mode: 'system',
+    })
   })
 
   it('preserves a saved dark color mode until changed', () => {
@@ -540,6 +676,29 @@ describe('SettingsPanel', () => {
     expect(screen.getByText(/to open settings/)).toBeInTheDocument()
   })
 
+  it('keeps Tab focus inside the settings panel', () => {
+    render(
+      <>
+        <button type="button" data-testid="background-action">Background</button>
+        <SettingsPanel open={true} settings={emptySettings} onSave={onSave} onClose={onClose} />
+      </>
+    )
+
+    const backgroundAction = screen.getByTestId('background-action')
+    const closeButton = screen.getByTitle('Close settings')
+    const saveButton = screen.getByTestId('settings-save')
+
+    backgroundAction.focus()
+    fireEvent.keyDown(document, { key: 'Tab' })
+    expect(closeButton).toHaveFocus()
+
+    fireEvent.keyDown(document, { key: 'Tab', shiftKey: true })
+    expect(saveButton).toHaveFocus()
+
+    fireEvent.keyDown(document, { key: 'Tab' })
+    expect(closeButton).toHaveFocus()
+  })
+
   it('copies the MCP config from the AI Agents section', () => {
     const onCopyMcpConfig = vi.fn()
     render(

src/components/Sidebar.test.ts

@@ -41,6 +41,11 @@ describe('buildSectionGroup', () => {
     expect(group.Icon).toBe(FileText)
   })
 
+  it('uses exact type names when automatic pluralization is disabled', () => {
+    const group = buildSectionGroup('Widget', {}, false)
+    expect(group.label).toBe('Widget')
+  })
+
   it('overrides built-in type icon/color when type entry has custom values', () => {
     const typeEntryMap: Record<string, VaultEntry> = {
       Project: { ...baseEntry, title: 'Project', isA: 'Type', icon: 'rocket', color: 'green', sidebarLabel: 'My Projects' },

src/components/Sidebar.test.tsx

@@ -515,6 +515,22 @@ describe('Sidebar', () => {
       // Recipe has no sidebarLabel → should auto-pluralize to "Recipes"
       expect(screen.getByText('Recipes')).toBeInTheDocument()
     })
+
+    it('uses exact type names when automatic sidebar pluralization is disabled', () => {
+      render(
+        <Sidebar
+          entries={entriesWithCustomTypes}
+          selection={defaultSelection}
+          onSelect={() => {}}
+          pluralizeTypeLabels={false}
+        />
+      )
+
+      expect(screen.getByText('Recipe')).toBeInTheDocument()
+      expect(screen.getByText('Project')).toBeInTheDocument()
+      expect(screen.queryByText('Recipes')).not.toBeInTheDocument()
+      expect(screen.queryByText('Projects')).not.toBeInTheDocument()
+    })
   })
 
   describe('type visibility via visible property', () => {