- npm run test:e2e builds the app, runs it on port 3101 with an empty throwaway
database and drives Chrome (the installed one; no browser download) through
notes and the paste check, the daily five minutes and weekly recall,
translation compare (Bible text faked), and two-screen presenting.
- Vitest skips e2e/; ESLint knows the e2e folder and playwright.config.js.
- .gitignore: the local demo video, Playwright output and sign-in file.
- README and TODO describe the browser tests and what CI still needs.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Admin: sign-up Open / Invite only / Closed with single-use invite links
- Present mode for scripts (auto-scroll) and outlines (step through, pace vs planned minutes)
- Series: group studies on the dashboard, filter by series, calendar file for a study's sessions
- Lesson handout: printable page per session (passage, outline, questions, writing lines)
- Save a chunk's notes as your own study template (synced)
- Voice dictation for notes and scripts (browser speech recognition)
- Reading progress: map of the 66 books and a calendar of days read, synced and merged across devices
- Export highlights and bookmarks as Markdown or Word, grouped by named colour
- Verse of the day push to the ntfy topic (needs IQBIBLE_API_KEY)
- Sharing: co-teacher editing via single-use invite links; read-only links can expire and take a passcode
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
setup.sh starts the production server without SESSION_SECRET, so the new
"refuse to start" check stopped the app after an update. When the variable
is unset in production the server now makes a random secret once and keeps
it in DATA_DIR/.session-secret (mode 600, git-ignored).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Sync and data safety
- Autosave flushes on leaving a study or the tab; storage-full errors are reported
- Unsynced studies, deletes and ink are queued and retried when back online
- Deletes propagate across devices (with a "Keep it" undo) and no longer resurrect
- Server assigns study versions (no client-clock conflicts); "Combine both"
merges a conflicted study chunk by chunk
- Reading-plan progress made offline is merged, not overwritten; plans, ink and
marks are cleared from the device on sign-out
Security
- Block SSRF through the ntfy reminder URL; failure-only rate limiting per IP and
account; constant-time login; TOTP replay protection; input validation;
SESSION_SECRET required in production; admin user delete fixed
- Forgot password: one-time code sent to the account's ntfy topic
Features
- IQ Bible proxy (route allow-list, text-only caching per its terms): more
commentaries, lexicons, study aids, daily verse and devotional, plan calendar
export, narrations, podcast background
- Study templates, reading-plan catch-up, account export, daily database snapshots
Tests and tooling
- ESLint config; App tests split into src/test; tests for sync queues, library
hook, merge, templates, IQ Bible UI and reset form
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Performance:
- Lazy-load pages, docx, and mammoth (initial JS 1,298 KB -> ~290 KB)
- Gzip responses and cache hashed assets for a year
- Memoize DrawCanvas strokes so ink isn't redrawn on every render
- Precompute whole-Bible search index and defer the query while typing
- Reload once if a lazy chunk is missing after a deploy
Deployment:
- setup.sh builds and runs one production server on APP_PORT (default
5173); --dev keeps the old Vite dev setup
- Session cookie uses secure: 'auto' so login works behind any proxy
Chunk editor:
- Remove the Draw layout, Ink Notes panel, and ink in HTML export
(existing inkStrokes data is left in saved projects)
Refactor:
- Move module-level helpers out of App.jsx into src/utils/*
- Extract Bible reader state and logic into hooks/useBibleReader
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
nmemmertandClaude Sonnet 5.5
nmemmertandClaude Sonnet 4.6