ElyMail's window lists accounts and adds Gmail, Microsoft, iCloud
(app-specific password), IMAP and POP3 ones; a check logs in to both
servers and reports each. Accounts live in the store as JSON with a
case-insensitive unique address; secrets go to the keychain. Removal
names the cache it deletes, takes the secret first and puts it back
when local removal fails. Originals are set aside until commit and
restored after a crash. Requests are numbered so late results stay
with their own dialog. The account list is keyboard-navigable.
Gitea holds the downloads made before the move, so the worker sums
both hosts' asset download counts (update manifests excluded). Gitea is
read with the same five-minute cache and a five-second limit; when it
is down or answers oddly, the count is GitHub's alone. Downloads stay
on GitHub only.
Co-Authored-By: Claude <noreply@anthropic.com>
LICENSE is the MIT text, copyright Yang Zhang; the workspace crates,
the docs and the site say MIT. Bundled engines keep their licences:
LibreOffice (MPL-2.0), Git (GPL-2.0) and MuPDF (AGPL-3.0), which ElyPDF
links, so the Linux packages name both, e.g. "MIT AND AGPL-3.0-or-later".
Co-Authored-By: Claude <noreply@anthropic.com>
The update check reads the latest release from GitHub's API; its JSON
has the same tag_name and assets[].browser_download_url the reader
expects. Ely-GPUI-Components is fetched from ELY-Open-Source at the same
pinned commits.
Co-Authored-By: Claude <noreply@anthropic.com>
CONTRIBUTING opens pull requests from a GitHub fork; the Linux
packages' homepage is the GitHub repository; agents.md records the move.
Co-Authored-By: Claude <noreply@anthropic.com>
The worker reads the newest release and download counts from GitHub's
API, with an optional GITHUB_TOKEN secret for the rate limit. Download
links go to GitHub's latest release, and the source link wears the
GitHub mark. The "not notarized" notice goes: macOS builds are signed
and notarized now.
Co-Authored-By: Claude <noreply@anthropic.com>
The release workflow moves from .gitea to .github: macOS on the
macos-signing runner, Windows and Linux (WSL) on ely-windows. The
persistent clones fetch from GitHub. ci.sh creates or reuses the tag's
release through GitHub's API and replaces a rerun's assets of the same
name; the update manifests point at GitHub's download URLs.
Co-Authored-By: Claude <noreply@anthropic.com>
Passwords and refresh tokens go only to the system keychain; a refused
keychain keeps them in memory until exit and says why. Gmail and
Microsoft sign in by authorization code with S256 PKCE on a loopback
redirect; refresh tokens are kept, and revoked grants ask to sign in
again. Client IDs come from the build (env or oauth.env). ureq trace
records never reach the log.
Co-Authored-By: Claude <noreply@anthropic.com>
SQLite index, content-addressed originals, rebuildable FTS5 search,
schema versions with a backup before each upgrade and read-only on
failure, and size reporting. Three review rounds; the round 3 fixes
are checked by tests, not reviewed again.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The reader walks the MIME tree with its container context: alternative
picks versions, related finds its root by start, attached multiparts
stay whole, digest children are messages. Nesting deeper than 64
levels, counting enclosed messages, is refused, and over-deep parse
results are taken apart iteratively so dropping them cannot overflow
the stack. Composite parts with a Content-ID are cid targets.
The writer keeps attachment parameters and Content-IDs, writes
multipart and message attachments unencoded, and makes its own
Message-ID. SMTP adds BODY=8BITMIME for 8-bit bodies and SMTPUTF8
when any header block at any depth is 8-bit.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
TLS or STARTTLS with the system trust store; password and XOAUTH2
logins keep the server's words on refusal. IMAP and POP3 are written
in the engine (imap-proto parses IMAP replies): async-imap dropped
NO/BAD on LIST and FETCH and lost BYE text, async-pop kept dot
stuffing and logged passwords. SMTP runs its own transaction with
RFC 5321 mailbox checks, full dot transparency, SMTPUTF8 and RSET.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
async-imap, async-pop, mail-send, mail-parser and mail-builder replace
MailCore 2. The MailCore 2 and libetpan fetch, build and probe scripts
go. HTML bodies render as a sanitized block subset in GPUI; compose uses
the Markdown document component. OAuth client IDs come from oauth.env
(ignored) or CI secrets. The task list for C12 is rewritten in order.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Gitea #9. Patch 0049 moves inline pictures and OLE objects with
their run's w:position. Patches 0050 and 0051 turn EQ fields into
Math objects; unreadable fields show their code. Round 3 findings
(lowercase \s\do tail, split subscripts, \ai/\di, italics through
OMML) fixed and covered by word.rs; no fourth review.
Co-Authored-By: Claude <noreply@anthropic.com>
Pages, cells, slides and PDF pages paint as the file says in any
appearance; only the chrome around them follows dark mode. The
kernel keeps Ely's one light scheme, sent once a view, and MuPDF
no longer inverts. Reviews now run gpt-6.1-sol at xhigh.
Co-Authored-By: Claude <noreply@anthropic.com>
Each app installs a blank file and points ShellNew at it. Explorer
lists a type only through its default class, so a type no program
handles (no default, or one naming no class) gets the app's class;
an installed handler is never replaced. Uninstall removes only what
this install wrote.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Windows checks out symlinks as files, so only Linux (CI) and macOS
(release.sh) write source archives. ci.sh skips names already on
the release; the first platform's copy stays.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The walk over cargo metadata ignored an edge's target, so lopdf (Linux
only, a test dependency elsewhere) counted on Windows. Linux needs the
BSD-3-Clause text for alloc-stdlib, which ships no licence file.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Windows prints through the system dialog at the document's paper;
Linux through the desktop portal, the dialog's choices laid out by Ely.
Round 3 findings fixed without a further review, as the rules say.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The warning watch skips MuPDF's non-embedded font notice and its
repeat counts. Text and search reads are watched too: damage they meet
is kept on the document, told by the next draw or picture check, and
fails image and text exports until then.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The worker set the accessory policy after AppKit had already registered it
as a Dock app, so 11 of 15 launches showed Foreground for about 30 ms.
Now it sets LSUIElement in its main bundle's info before the kernel starts
AppKit, and fails to start unless the policy came up as accessory.
tests/scripts/dock-macos.sh samples each worker's type from its start until
the first tile; on the Mac mini 30 launches were all UIElement, and the
shipped worker fails it.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
R6.12: on macOS the worker sets LibreOffice's own NSApplication to the
accessory policy before the kit starts, so it never shows in the Dock.
R6.13: when the whole slide fits, the wheel and Up/Down (nothing
selected, no text editing) turn slides in the ElyShow editor.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Backups under .ely-old are numbered in list order, so paths near the
Windows limit still upgrade and uninstall. Uninstall checks the list
file first and puts everything back if it cannot delete it. Five
comments shortened. Round 3 was the last; ticked without review.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The list names each file and folder; upgrades and uninstall move only
listed files and remove a folder only when empty. Every file, nested
ones included, must be writable first. A new file whose place holds a
file this app did not install refuses the install. A copy failing
midway removes what it wrote and puts the old release back.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
