v0.6.0 - Portable Backups and Two-Factor Security

Inkstone 0.6.0 adds restorable portable backups, TOTP two-factor authentication, a much more capable knowledge graph, tag-aware editing, and selectable background palettes. It also hardens synchronization, offline state, MCP authorization, attachments, imports, exports, sharing, and scheduled maintenance for larger and longer-running installations. Existing 0.5.0 databases are upgraded automatically through the next versioned schema migration; no manual database command or destructive rebuild is required, and existing notes, folders, tags, attachments, backup targets, sessions, shares, MCP grants, and browser data remain compatible. Keeping a current backup before deploying any self-hosted update is still recommended.

Added

1. TOTP two-factor authentication with recovery codes. Account settings can now enable authenticator-app verification through a QR code or manual secret, download one-time recovery codes, regenerate them, and disable the factor after confirming the current password and a valid code. Login challenges are bounded and replay-safe, sensitive TOTP material uses the credential vault, and enabling, regenerating, or disabling the factor revokes other sessions. Existing accounts remain signed in and two-factor authentication stays off until each user explicitly enables it. Commit: 53eb340.

2. Portable, verifiable backup archives and direct restore. Scheduled WebDAV and S3 backups now produce streamed ZIP archives containing readable Markdown, referenced attachments, a manifest, and a completion marker. Inkstone can restore a selected backup folder in bounded batches, choose the newest complete snapshot, verify file sizes and SHA-256 checksums, preserve active, archived, and trashed note states, and retain compatibility with the previous backup manifest layout. Only attachments referenced by backed-up notes are loaded and transferred. Commits: 5c1549b, 19785b4.

3. A filterable local and global knowledge graph. The graph can now focus on the current note or the whole notebook, control traversal depth, search nodes, filter by folder or tag, include or hide orphan and unresolved notes, group nodes, toggle labels and arrows, and tune layout forces and node scale. Preferences persist safely, superseded requests are cancelled, and graph queries are validated and bounded on the server. Commits: 9405e3c, 753d4ba, 3caca05, c41e393, 0e9abbf.

4. Tag-aware editing and discovery. Typing # in the editor now offers tag completion, while tag extraction and search recognize body occurrences more accurately without confusing Markdown structure or code for tags. Case-only renames, organizer filters, optimistic refreshes, and serialized color changes now remain consistent across the editor, sidebar, search, and API. Commits: 5233bd7, c2c6e1b, feab9f4, 2be4d35, 6f1f438.

5. Selectable background palettes. Appearance settings now include synchronized background choices that work with the existing light and dark themes, apply during the initial page paint, and follow the account across tabs and devices. Commit: bbff680.

Improved

1. Faster PWA startup and more consistent interface details. Startup now precaches the core application first and completes optional offline resources in the background, so first load is lighter without making unused features unavailable offline. Accent colors, loading states, generated tab containers, attachment actions, editor labels, and legacy Markdown rendering have also been refined. Commits: b61cace, b4cbe76, 54a3601.

2. More dependable backups across real S3 and WebDAV providers. Connectivity probes are rate-limited, cleanup failures no longer hide the primary result, scheduled failures retry, stale target edits and run-status races are rejected, large archives use bounded multipart transfers, and an ambiguous S3 HEAD 403 no longer prevents a credential with write access from attempting the real upload. Commits: 466a0ed, 91ca9e7, 7fb89bd, f897846, 9e3fbd3, 45a64fb, 7e61029.

3. Bounded work for large notebooks. Attachment management is paginated and cancels stale loads, downloads stream instead of buffering entire files, imports enforce attachment quotas, JSON exports cap memory, full synchronization supports large snapshots and pagination rollover, graph and attachment reference scans are bounded, and scheduled queues rotate fairly between users. Commits: dbb71a0, be3620d, f72ba77, a4d83b5, 3be0475, 334d750, c292f38, ff2f3ca.

4. Safer background cleanup and indexing. Expired operational records are purged in bounded batches, request paths defer nonessential cleanup, AI and FTS rebuilds are guarded and paginated, queue lookups use dedicated indexes, and note trash cleanup completes before changes are broadcast. Commits: 24b1912, 2664702, 5c4880e, 163d944, 6d3d601, 945529a.

Fixed

1. Attachment, import, export, and link integrity. Cleanup now counts references from trashed notes, avoids deleting attachments still pending in an import, scopes pending cleanup correctly, preserves omitted archive state, encodes download filenames, surfaces fallback download errors, re-resolves ambiguous title renames, skips trashed rename sources, and reindexes notes whose links were rewritten. Commits: f4ffd99, 265f671, bfaf786, d99b64a, f15c164, 9ed8877, 388a859, d949bae, 2d5ca9b, edddfbe.

2. Synchronization, logout, and offline recovery. Large or paginated snapshots no longer create phantom pages or move cursors incorrectly, reconnect loops continue after outages, logout waits for active settings and note writes and requires confirmed server completion, account switches isolate failed and legacy caches, and PWA updates stop rather than discard data when flushing fails. Commits: 71bb6fc, ebb4d7d, de5f0f4, 1b1ff0f, 1815d3e, 97ff151, 9220534, 51f681d.

3. MCP correctness, authorization, and client compatibility. Semantic-only mode and organizer filters are honored consistently, long-section reads and offset pagination no longer skip content, OAuth and API-key revocation is complete, key creation and AI indexing are guarded server-side, authorization bodies and cleanup work are bounded, metadata response headers are preserved, and setup instructions now use complete one-line commands for Codex, Claude Code, and other OAuth clients. Commits: 11a2fa4, 15bcca5, cb05628, 21e1648, b6ec5b5, 3a7dd40, d3aece2, 3c0eb92, 102e760.

4. Privacy, throttling, and dependency security. Protected shares no longer reveal note titles, Markdown images suppress referrers, CSP remains strict on HTTPS while retaining remote images on local HTTP deployments, passcode and login throttles keep stable bounded windows, password limits agree across client and server, and DOMPurify, Mermaid, OAuth, Nano ID, and the Cloudflare development runtime include their current security and compatibility patches. Commits: 943f875, 38bf87e, ac35f4b, d6c8117, 6c2e8c3, bcb1bb8, 222fd82, 8f05c6d, 223e3d1, fda3774.

5. Demo parity with production behavior. Demo mode now tracks attachment references, ZIP paths and backups correctly; enforces note, folder, title, attachment, import, backup-target, and credential limits; follows production share-expiry and passcode-clearing behavior; and preserves optimistic IDs and idempotent note, folder, and tag creation. Commits: e0da4bf, 426d40a, c3fa4f2, c15e45f, 6efec76, f01d618, 8274888.

v0.6.0 - 可恢复备份与双重验证

Inkstone 0.6.0 新增可直接恢复的便携备份、TOTP 双重验证、更完整的知识图谱、标签感知编辑，以及可选背景配色；同时针对大型和长期运行实例，强化同步、离线状态、MCP 授权、附件、导入导出、分享与定时维护。现有 0.5.0 数据库会通过下一条版本化迁移自动升级，无需手动执行数据库命令，也不会破坏性重建；已有笔记、文件夹、标签、附件、备份目标、登录会话、分享、MCP 授权和浏览器数据继续兼容。与所有自托管更新一样，部署前仍建议保留一份最新备份。

新增

1. 带恢复代码的 TOTP 双重验证。 账号设置现在可以通过二维码或手动密钥启用身份验证器，下载一次性恢复代码、重新生成恢复代码，并在验证当前密码和有效验证码后关闭双重验证。登录挑战有明确边界并防止验证码重放，敏感 TOTP 密钥由凭据保险库存储；启用、重新生成或关闭时会撤销其他会话。已有账号不会被强制开启，升级后会继续保持登录状态，直到用户自行启用。提交：53eb340。

2. 便携、可校验的备份归档与直接恢复。 WebDAV 和 S3 定时备份现在会流式生成 ZIP，其中包含可读 Markdown、笔记引用的附件、清单和完成标记。Inkstone 可以从选中的备份文件夹分批恢复，自动选择最新的完整快照，校验文件大小和 SHA-256，并保留正常、归档与回收站状态，同时兼容上一版备份清单布局。备份只会读取和传输实际被笔记引用的附件。提交：5c1549b、19785b4。

3. 可筛选的局部与全局知识图谱。 图谱现在可以聚焦当前笔记或整个笔记库，控制遍历深度、搜索节点、按文件夹或标签筛选、显示或隐藏孤立与未解析笔记、分组节点、切换标签和箭头，并调整布局作用力与节点大小。偏好会安全持久化，过期请求会被取消，服务端也会校验并限制所有图谱查询参数。提交：9405e3c、753d4ba、3caca05、c41e393、0e9abbf。

4. 标签感知编辑与发现。 在编辑器输入 # 时会提供标签补全；标签提取和搜索也能更准确地识别正文标签，不会把 Markdown 结构或代码误判为标签。仅大小写变化的重命名、整理器筛选、乐观刷新和串行颜色更新现在会在编辑器、侧边栏、搜索和 API 之间保持一致。提交：5233bd7、c2c6e1b、feab9f4、2be4d35、6f1f438。

5. 可选背景配色。 外观设置新增与现有浅色、深色主题配合使用的背景方案；它们会在页面首次绘制时生效，并通过账号在多个标签页和设备之间同步。提交：bbff680。

改进

1. 更快的 PWA 启动与更统一的界面细节。 启动时会先预缓存核心应用，再在后台补齐可选离线资源，从而减轻首次加载，同时保证未使用过的功能之后仍可离线使用。强调色、加载状态、生成式标签页容器、附件操作、编辑器标签和旧版 Markdown 渲染也得到统一。提交：b61cace、b4cbe76、54a3601。

2. 适配真实 S3 与 WebDAV 服务的可靠备份。 连接探测现在受限流保护，清理失败不会再遮盖主要结果，定时失败会重试，过期目标编辑和运行状态竞态会被拒绝，大型归档使用有界分片传输；模糊的 S3 HEAD 403 也不会再阻止拥有写权限的密钥尝试真正上传。提交：466a0ed、91ca9e7、7fb89bd、f897846、9e3fbd3、45a64fb、7e61029。

3. 为大型笔记库限制资源消耗。 附件管理器会分页并取消过期加载；下载改为流式传输；导入会执行附件配额；JSON 导出限制内存；全量同步支持大型快照和分页翻转恢复；图谱与附件引用扫描有明确上限；定时队列会在用户之间公平轮转。提交：dbb71a0、be3620d、f72ba77、a4d83b5、3be0475、334d750、c292f38、ff2f3ca。

4. 更安全的后台清理与索引。 过期运行记录会按有界批次清理，请求路径会延后非必要维护，AI 与 FTS 重建受到互斥保护并分批入队，队列查询使用专用索引，回收站清理也会在广播变更前真正完成。提交：24b1912、2664702、5c4880e、163d944、6d3d601、945529a。

修复

1. 附件、导入导出与链接完整性。 清理会统计回收站笔记引用，避免删除仍处于导入过程中的附件并正确限定待清理记录范围；导入会保留省略的归档状态；下载文件名会安全编码；回退下载错误会明确显示；歧义标题重命名会重新解析链接，跳过回收站来源，并重新索引被改写的源笔记。提交：f4ffd99、265f671、bfaf786、d99b64a、f15c164、9ed8877、388a859、d949bae、2d5ca9b、edddfbe。

2. 同步、退出登录与离线恢复。 大型或分页快照不会再产生幽灵页或错误移动游标，断网后会持续重连；退出登录会等待正在进行的设置与笔记写入，并要求服务端确认完成；账号切换会隔离失败和旧版缓存；写入队列提交失败时，PWA 更新会中止而不是丢弃数据。提交：71bb6fc、ebb4d7d、de5f0f4、1b1ff0f、1815d3e、97ff151、9220534、51f681d。

3. MCP 正确性、授权与客户端兼容性。 纯语义模式和整理器筛选会被一致遵守，长章节读取与偏移分页不再跳过内容，OAuth 与 API Key 可以完整撤销，Key 创建与 AI 索引受到服务端保护，授权请求体和清理工作有明确上限，元数据响应头得以保留；Codex、Claude Code 和其他 OAuth 客户端的示例也改为可直接执行的完整单行命令。提交：11a2fa4、15bcca5、cb05628、21e1648、b6ec5b5、3a7dd40、d3aece2、3c0eb92、102e760。

4. 隐私、限流与依赖安全。 受密码保护的分享不再泄露笔记标题；Markdown 图片禁止发送来源地址；HTTPS 下保持严格 CSP，同时兼容本地 HTTP 部署的远程图片；分享密码和登录限流使用稳定、有界的时间窗；客户端与服务端密码长度一致；DOMPurify、Mermaid、OAuth、Nano ID 和 Cloudflare 开发运行时已纳入当前安全与兼容补丁。提交：943f875、38bf87e、ac35f4b、d6c8117、6c2e8c3、bcb1bb8、222fd82、8f05c6d、223e3d1、fda3774。

5. Demo 行为与生产环境保持一致。 Demo 现在会正确追踪附件引用、ZIP 路径和备份，执行笔记、文件夹、标题、附件、导入、备份目标和凭据限制，遵守生产环境的分享过期与清除密码语义，并保留乐观 ID 以及笔记、文件夹和标签的幂等创建。提交：e0da4bf、426d40a、c3fa4f2、c15e45f、6efec76、f01d618、8274888。