- Record url.path before routing so 404s and early responses retain their path.
- Keep matched route templates as span names to limit cardinality.
- Exclude query strings, full URLs, cookies and authorization headers.
- Test decoded paths on 404 responses and path attributes on matched routes.
- Document that paths may expose filenames, IDs or share tokens.
- Validate NanoShare with 294 passing tests.
- Add opt-in OTLP/HTTP export with bounded background batching.
- Propagate W3C context and correlate wide events with response trace IDs.
- Update my_helpers for Convex child spans and native request IDs.
- Respect parent sampling and shut down the exporter off the event loop.
- Keep raw URLs, payloads and exception text out of spans.
- Cover worker isolation, retries, sampling, privacy and exporter lifecycle.
- Document collector configuration and bump NanoShare to 1.27.5.
- Refresh locked dependencies, including pytest and watchdog.
- Validate the changes with 293 passing tests.
- Require Python 3.15 for the server and Python 3.14 for the CLI.
- Match the server requirement to quart_common's Python 3.15 features.
- Replace future annotations with native deferred evaluation.
- Defer CLI command dependencies and QR imports on Python 3.15.
- Enable argparse suggestions for mistyped CLI commands.
- Remove the obsolete tomllib import fallback.
- Update my_helpers and quart_common submodule references.
- Lock test dependencies and exclude them from Docker installations.
- Add regression coverage for lazy imports and deferred annotations.
- Document runtime requirements and standalone CLI validation.
- Validate 276 tests on Python 3.15 and 18 CLI tests on Python 3.14.
BREAKING CHANGE: The server now requires Python 3.15+ and the standalone CLI requires Python 3.14+.
File cache:
- Add my_modules/filecache with metadata, blob, validator and store layers
- Cache convex.get_file via AsyncCache, TTL clamped to the file expiry
- Skip caching for missing, incomplete or already expired records
- Add a process-local, size-bounded LRU for immutable storage blobs
- Build the cache stack from FILE_CACHE_* env vars in build_file_cache
- Attach the cache to the app in my_modules/app/setup.py
- Expose app-bound helpers in filecache/access.py for routes
Serving:
- Send strong ETag, Last-Modified and Cache-Control on served files
- Answer If-None-Match and If-Modified-Since with 304 from metadata only
- Avoid pulling the blob from Convex on a revalidation hit
- Add a short Cloudflare-CDN-Cache-Control edge window for deleted files
- Record cache_status in the wide event on a 304
- Invalidate cached metadata after file update and delete in both routes
Text viewer:
- Add my_modules/textview to render text/plain and text/markdown as HTML
- Linkify http(s) URLs and trim trailing sentence punctuation
- Resolve links pointing at this instance to the referenced file
- Inline image previews, mark missing and expired targets
- Cap resolution at MAX_LOOKUPS backend lookups per document
- Serve the viewer only for real browser navigations, never for curl or CLI
- Keep raw bytes for ?raw=1, downloads and Accept headers without text/html
- Add templates/side/views/webpage/files/text_view.htm with a raw link
Other:
- Add tests for cache layers, serving, text rendering and the route
- Bump multidict to 7.2.1 in uv.lock
- Update the my_helpers submodule pointer
- Switch local Python and the Docker base image to Python 3.15.
- Refresh locked dependencies with Python-version-specific resolution.
- Replace Pickle caching with native Redis strings, lists, and typed JSON.
- Validate cache TTLs and apply expiry atomically on Redis writes.
- Treat legacy binary cache values as misses and clear keys with SCAN.
- Ignore trailing prose after decoded spaces in share-link paths.
- Reject empty or slash-containing share IDs before database lookup.
- Add regression tests for plain and encoded spaces in share links.
- Update helper submodule for config lookup and tabular storage fixes.
- Update quart_common with JSON error response detection.
- Verify all 150 tests pass on CPython 3.15.0.
- Recover regular multipart fields when the file part is not exposed through request.files.
- Preserve expires and note values for browser uploads that need body-based file recovery.
- Add parser coverage for file parts without filenames and recovered expiry fields.
- Extend upload route tests to assert recovered uploads keep expiry metadata.
- Bump NanoShare to 1.27.3.
- Treat an existing multipart file field as upload content even when FileStorage has an empty filename.
- Keep upload telemetry aligned with file field presence instead of FileStorage truthiness.
- Add regression coverage for frontend-style uploads that provide a file field without a filename.
- Bump NanoShare to 1.27.2 and refresh the staged lockfile.
- Bump quart_common to 53b7599 with the httpx request-less crash fix
- The global exception handler no longer dies on RequestError without request
- Expect 503 for Convex connect failures, 504 is reserved for timeouts
- Add an API timeout case so the 504 branch stays covered
- Register a link_composer blueprint so error.htm can render its navigation
- Move the legacy logger assertion into a WIDE_EVENT_ENABLED=false test
- Assert user.session_age_seconds instead of the removed session.age_seconds
- Expect no legacy middleware logs while wide-event logging is active
The middleware moved into quart_common's register_security_middleware, so the
NanoShare copies of those assertions had been describing pre-refactor
behaviour. Suite is green again at 141 passed.
- Add structured URL codec with compact alphabets and dictionary support.
- Add public decode, redirect, and QR endpoints for composed links.
- Add authenticated encode API and link composer UI.
- Generate PNG QR codes via qrcode with Pillow support.
- Register the new blueprint and navigation entry.
- Cover public decode, auth gating, redirect URL parsing, and QR output.
- Bump NanoShare to 1.27.0 and lock new dependencies.
- Match directory ignore patterns against every path segment.
- Prevent nested .comments folders from uploading XML sidecar files.
- Bump the standalone CLI to 0.4.2 for the ignore fix.
- Add a private SSE endpoint that emits file change events for authenticated clients.
- Replace the watch sleep loop with watchdog local file events and remote SSE triggers.
- Debounce local event bursts and keep watch running after transient sync failures.
- Add watchdog as a standalone CLI dependency and cover watch behavior in tests.
- Bump NanoShare to 1.25.0 and the standalone CLI to 0.4.0.
- Skip .comments, virtualenvs, env files, VCS folders, and OS metadata in sync.
- Apply defaults before project .nanoshareignore and repeatable --ignore rules.
- Cover default ignores for local uploads and direct pattern matching.
- Leave sync and watch notes empty by default instead of writing placeholder text.
- Preserve existing remote notes when moving or adopting files without --note.
- Detect tracked local moves by SHA-256 and update remote metadata safely.
- Skip files that vanish during watch scans instead of aborting the sync cycle.
- Bump NanoShare to 1.24.0 and the standalone CLI to 0.3.0.
- Store synced folder locations in file_path instead of embedding them in file names.
- Add ignore rules from .nanoshareignore and repeatable sync --ignore flags.
- Adopt existing remote files only after SHA-256 verification.
- Move adopted remotes with metadata updates instead of uploading duplicates.
- Bump NanoShare to 1.23.0 and the standalone CLI to 0.2.0.
- Render remote files as an aligned table with JSON and TSV alternatives.
- Add Bash and Zsh completion for commands, options, paths, and remote files.
- Allow downloads by exact filename while rejecting ambiguous duplicate names.
- Cover table formatting, completion scripts, and selector resolution with tests.
- Add a separate installable NanoShare CLI package under cli/.
- Implement browser login with local callback and refresh-token config.
- Add upload, list, download, sync, and watch CLI commands.
- Add private owner-only file download endpoint for CLI downloads.
- Add CLI auth endpoints for browser login and token refresh.
- Return file_id from ServiceLink uploads for reliable sync state.
- Exclude the CLI package from NanoShare container builds.
- Include tests for private downloads and sync state updates.
- Replace the local /rpc Quart route with the shared ServiceLink blueprint helper.
- Move mesh scope enforcement into bearer_verifier via require_scope.
- Update ServiceLink tests to call the public handle_envelope and verify exports.
- Advance the servicelink submodule to include the shared CLI and RPC discovery work.
- Add the servicelink submodule and register POST /rpc for node-to-node file operations.
- Require bearer tokens with the mesh scope and apply rate/body-size limits to RPC calls.
- Map database connectivity failures to the existing 504 database error flow, with JSON responses for API routes.
- Cover the new RPC handlers and database error handling with focused pytest tests.
- Bump the NanoShare package version to 1.21.0.
- Bump the application version from 0.1.0 to 1.20.0 using the project version scheme.
- Trim pyproject dependencies to direct root packages only and let uv.lock keep the resolved transitive set.
- Update the quart_common submodule to include the latest wide-event session context handling.
- Adjust NanoShare wide-event middleware expectations for the new session payload shape.
- Register quart_common wide-event logging during app setup so every HTTP request emits one canonical structured event.
- Replace the inline security middleware with reusable quart_common security middleware wiring and move skip path configuration into app constants.
- Add NanoShare-specific wide-event context for health checks, auth/error handlers, file list/edit/delete/serve flows and upload outcomes.
- Rename runtime logging/project metadata from simple-picoshare to nanoshare where it is emitted in service context.
- Update my_helpers and quart_common submodules for Convex/wide-event integration and reusable security middleware support.
- Add NanoShare middleware tests covering safe user context, client IP enrichment, missing Convex handling and Convex security lookup failures.
daniel156161