johnnybravo-xyz/suchi v0.4.0

suchi v0.4.0

on GitHub

Added

• Two-factor sign-in for local-password accounts: authenticator codes with
  one-time recovery codes, which can be regenerated or turned off. Browser
  sign-in, API-token exchange and sign-in email changes ask for the second
  factor. Wrong codes back off from 30 seconds to an hour and lock after 100 in
  a row, six-digit codes submit on their own, and Security warns when recovery
  codes run low. Administrators can reset another user's factor after
  reauthenticating; host operators can run suchi auth reset-two-factor with
  the server stopped.
• Native archive serial numbers. Suchi can assign them from QR labels, split a
  feeder scan into one document per label, and keep the number across
  replacement versions, filesystem sidecars and manifest-v3 takeouts. Edit it on
  Document Detail and search it with asn:. Administrators set ASN mode, QR
  prefix and scan-analysis DPI live under Advanced > Scan processing;
  deployment-managed values are read-only. A rejected scan is explained on its
  Upload row with the page and number, naming the document that already holds
  the number when the uploader can open it. Demo corpus manifests can set
  archive_serial_number.
• Document dates you can act on. The Dashboard's Coming up card lists
  accepted due, expiry and renewal dates for the next 30 days. Document Detail
  lists a document's accepted dates with how far away they are and Add to
  calendar. Exported .ics events remind a day before a due date and a week
  before an expiry or renewal.
• Faster everyday work:
  • Inbox rows offer a pending filing suggestion as a one-click button beside
    File under…, applying the same decision as Approvals.
  • Filing, refiling and moving to Trash can be undone from a notice in the top
    bar, or with ⌘ Z / Ctrl Z. Notices replace the dark toast at the
    bottom of the screen and no longer cover the page.
  • The ⌘ K / Ctrl K menu finds documents and saved views as you type,
    lists recently opened documents, and adds New view, Pair a phone,
    Add a mailbox and Keyboard shortcuts commands. ? shows the
    shortcuts anywhere outside a text field.
  • Search offers two example rich queries before the first search, and the
    empty archive's getting-started card links to watched folders, mailboxes
    and phone pairing.
• Processing you can follow. A Processing N of M marker in the top bar shows
  how far the current run has got; selecting it lists those documents with the
  new is:processing query term, and the list refreshes as each one finishes.
  An open document that is still processing says so and refreshes when it
  finishes. Upload re-checks its rows only when that status reports finished
  work, replacing its own 2.5-second polling and "checks paused" state.
  Processing issues name their documents, offer Retry all, and open
  directly from the Dashboard's Failed jobs card.
• The MCP adapter can list custom fields and set or clear a document's values,
  so an agent can record an odometer reading or link a service invoice to its
  purchase invoice. Writes use the existing checks for type, permission, Trash,
  self-links and version history.
• API additions: /api/stats/ returns processing_reading and
  processing_classifying; document details report processing; job rows in
  /api/tasks/ carry doc_title; filing, correspondent and tag suggestions
  carry proposed_id; search hits carry jd_category_code; and
  sources[].client reports companion_app for Suchi Companion uploads.

Changed

• Breaking: filing addresses now identify categories with exactly two
  components. Introduced filing systems use SYS.AC (for example S01.21)
  instead of SYS.AC.documentID; the original single archive has no address
  and shows the category code (21). The resolver rejects former
  three-component values and returns jd_category_id; Search and the ⌘ K menu
  open the filtered Documents view, or search the text when no such category
  exists. jd_address and native-export values can repeat across documents,
  while numeric IDs and URLs remain exact identity and default filenames keep an
  independent __<documentID> suffix. API version 1, Companion v1, takeout
  manifest 3, sidecar format 1 and private suchi-taxonomy/v1 are unchanged.
  This clean cutover provides no parser alias, schema, cached-receipt or
  template rewrite, rendered-output sweep, fallback or maintenance command for
  prior multi-system projections.
• Filing chips: Dashboard, Documents, Search and Trash rows show the address (or
  category code) and ASN as aligned blue chips that deepen on row hover or
  keyboard focus. Document cards pair it with the category name, a
  single-category Documents view or the Inbox leaves it out, and Document Detail
  shows it beside the title instead of a read-only toolbar field with a copy
  button.
• Approvals use the shared workspace card, with tabs for All, Tags,
  Filing, Fields, Dates, Decisions and, for administrators, a
  right-aligned Processing issues. The open tab is kept in the address. Each
  document is one block with its suggestions under the title; added tags read
  + tag, and Approve all / Dismiss all appear only when a document
  has several suggestions. By suggestion opens a synchronized sidecar:
  hovering or focusing one side highlights the matching items on the other,
  decided items fade out of both, and each side shows at most 100 entries and
  reports the rest.
• Trash uses the shared workspace card, with the retention note and a counted
  Empty trash in its header. Like Documents rows, each row opens its
  document anywhere outside its controls, leads with the prior filing chip and
  ends its metadata with the prior category name. A day countdown turns into an
  amber pill in the final week; Restore comes first and permanent deletion
  is a plain action. An empty Trash shows only Trash is empty.
• Document Detail:
  • a human-owned title shows Title pinned with Unpin, replacing the
    lock icon, which now means only password status;
  • one Original row groups the file's name, plain format name (PDF, Word,
    Email; the exact type on hover), size and file date, with other names it
    arrived under folded beneath;
  • Added from shows one line per source, folding older mailbox folders, and
    labels Suchi Companion uploads Suchi Companion · name, recognised by
    the pairing token. Manually created tokens still read as API uploads.
• Email attachments keep their own file name, which consumption-automation
  filename filters match, and use the message's Date as their created date so
  filing paths sort by message date. The ingestion time stays the added date
  and is the fallback when Date is missing or invalid.
• Saved decryption passwords show their label, last-used date and most recently
  unlocked document in labeled columns; labels open for editing from the pencil
  action.
• Search is faster:
  • common-word searches return about a quarter faster with unchanged results,
    order and scores;
  • one- and two-character Chinese, Japanese, Korean and Thai terms check only
    the documents left by the selected system, filters and permissions;
  • text search counts its matches in the query that ranks them;
  • writing back an unchanged title and text no longer rewrites both search
    indexes, while revision counters still advance.

Fixed

• Versioned filesystem sidecars validate and restore document sensitivity,
  including sensitivity from native exports. Invalid sensitivity or a later
  metadata failure leaves no partial intake; unversioned sidecars still ignore
  fields outside their original flat shape.
• Files that previously got no text now do:
  • phone HEIC/HEIF photos are wrapped in JPEG-compressed PDF pages before OCR,
    so a 24-megapixel iPhone photo no longer exceeds the 32 MiB conversion cap;
  • PDFs whose header follows a short prefix within the first 1024 bytes, such
    as income-tax e-filing downloads and invoices beginning with a newline, are
    processed as PDFs;
  • select affected photos and PDFs stored earlier and choose Rescan to
    extract their text.
• Watched-folder files with a known document extension keep that format even
  when their first lines look like email headers. Bank .xls exports beginning
  Date : ... were stored as email and indexed nothing; extensionless Maildir
  handoff names are still detected as email.
• One format registry now drives MIME aliases, filename refinement, ingestion
  routing and rendered or downloaded extensions. BMP, DjVu, Outlook, EPUB and
  macro-enabled Office files keep the right extension, and DjVu reaches
  djvutxt. Rendered files use the linked file's own extension (.pdf for the
  searchable copy, otherwise the original's), so a plain-text upload no longer
  appears as name__1.pdf; folder-layout templates that include an extension
  are rejected.
• A second Suchi process against the same archive fails immediately with
  archive_in_use instead of running independent writers against one SQLite
  database.
• Document-link writes with a fractional, negative or zero document ID are
  rejected. A fractional ID previously rounded down to a different document, and
  zero removed the link.
• Deleting a folder layout that an automation still assigns is refused, naming
  the rules to change, instead of leaving rules that fail on every new match.
• suchi gc removes empty folders left in rendered/ after documents move. The
  dry run reports them; --apply removes only empty folders.
• suchi export sidecars carry custom-field values, so a reingested takeout
  keeps typed values such as amounts and dates. Document-link values and
  extraction-managed invoice_* fields are left out; the latter are read again
  from the original.
• Query examples filter by imported document type with tag:"type:invoice";
  bare type: is not a query filter.

Security

• Build with Go 1.27.3 to include the standard-library crypto/x509 fix that
  distrusts compromised intermediate certificates (GO-2026-6809), which mailbox
  TLS connections rely on.

Verification

The release tag is signed with the public key pinned in the source tree:

./hack/verify-release-tag.sh v0.4.0

Verify downloaded binaries and AnyDoc bundles:

sha256sum -c SHA256SUMS
cosign verify-blob \
  --bundle SHA256SUMS.cosign.bundle \
  --certificate-identity johnnybravo.xyz@protonmail.com \
  --certificate-oidc-issuer https://github.com/login/oauth \
  SHA256SUMS

Verify the immutable container images:

cosign verify \
  --certificate-identity johnnybravo.xyz@protonmail.com \
  --certificate-oidc-issuer https://github.com/login/oauth \
  ghcr.io/johnnybravo-xyz/suchi@sha256:64877e5304ba41512e849411d54a9cf77c120164f10fe9e5ef6e61646d4f90a3

cosign verify \
  --certificate-identity johnnybravo.xyz@protonmail.com \
  --certificate-oidc-issuer https://github.com/login/oauth \
  ghcr.io/johnnybravo-xyz/suchi@sha256:d6d895d417ee8e20009d66082331d0ac5e9cfdd1200689a0b64d18d72f8efabf