최근 완료된 8시간 회차 사이 GitHub 스타 증가량 순
DeepSeek Harness Remote: DeepSeek Harness 실행 PC와 모바일·PC를 안전하게 연결해 어디서나 작업 이어받기
필요 없는 메뉴바 아이콘을 화살표 뒤에 숨기고, 요청 시 즉시 복원합니다. macOS 전용, 기본 제공, 무료
당신이 펜을 잡으면 AI가 잉크를 이어줍니다
인간과 에이전트를 위한 자체 호스팅·공유 가능한 칸반. 4.5 MB 바이너리와 RAM, 응답당 10~60 토큰, 2 ms 기동, 설정 필요 없음
Claude 브라우저 플러그인 대체 오픈소스 AI 브라우저 확장으로 웹 페이지를 읽고 이해·자동화하며 다중 LLM·다국어 UI를 지원합니다
A fast, local-first desktop editor for notes, snippets, and Markdown.
저장소 README에서 가져옴
README 전체를 불러오는 중입니다.
README 전문 보기 ↗Scratchpad is a lightweight, open-source, local-first desktop editor for notes, snippets, and Markdown. It runs on macOS, Windows, and Linux with no account, cloud service, or telemetry.
Visit the Scratchpad website for an OS-aware download and SHA-256 checksums.
Use the download panel to choose your operating system and processor type: x64 for 64-bit Intel/AMD, ARM64 for 64-bit ARM, or Universal for Apple Silicon/Intel Macs. If the browser cannot identify a supported processor, choose it explicitly. Only packages in the displayed published release are offered; see download selection for details.
On this page: Install · First steps · Features · Storage and privacy · Agent access (MCP) · Delete and recover notes · Keyboard shortcuts · Markdown editing · Themes · Development · Releases · Architecture · Contributing and security · License
Download the latest published release from the Scratchpad website or GitHub Releases. Stable releases are the default once available; draft candidates are never advertised:
.dmg and drag the app to Applications..msi or .exe installer..deb, or make the .AppImage executable and run it.macOS packages from v0.8.2 are signed with a Developer ID certificate and notarized by Apple. Windows packages from v0.8.2 are Authenticode-signed and timestamped, though SmartScreen may still warn about new downloads. Only install artifacts downloaded from this repository. Linux packages are GPG-signed; see Verifying Linux downloads. Back up important collections before upgrading.
See release notes for highlights and limitations. Existing beta users should follow Upgrading from beta to 1.0, including the renamed macOS app and Windows installer transition.
The documentation index links the user, contributor, architecture, and release guides.
Optional local MCP agent access with five read tools, eight individually enabled write tools, and a live listening indicator
Optional update checks with in-app release notes, one release track, and automatic checks off by default
Multiple scratchpads with automatic saving, titles derived from the first line, and quick creation by double-clicking empty sidebar space
Edit, synchronized edit/preview, and full Markdown preview layouts
Optional format-aware editor coloring for Markdown, JSON, XML, YAML, CSV, and Splunk SPL, plus language-aware fenced-code highlighting in previews
Optional, theme-aware source line numbers in either editor pane
Collapsible Markdown, JSON, XML, and YAML sections in either editor pane, with Find revealing hidden matches
Markdown-aware continuation for lists, task lists, blockquotes, code fences, and tables
Pair completion, selection wrapping, and smart URL or spreadsheet paste
Right-click Markdown starter templates for tables, task lists, code blocks, and links
Two-note side-by-side editing with drag-to-split and live source comparison
Top-level pinned notes, collapsible sidebar folders with drag-and-drop organization, search, configurable note previews, manual ordering, word counts, and distraction-free Focus Mode
Find and replace with case-sensitive, exact-match, and regular-expression modes, live highlighting, and results across one or every scratchpad
Sidebar format badges for detected TXT, MD, JSON, XML, YAML, CSV, and SPL content, refreshed after edits
Native text-file import and Markdown/standalone HTML export
Formatted, note-only printing through the system print dialog (Cmd/Ctrl+P)
Copy as Markdown or sanitized rendered HTML
Optional portable workspace files that reopen automatically
Recoverable note deletion with persistent trash, Restore actions, and user-confirmed Empty Trash
Built-in and importable color themes with contrast-aware sidebar and active-note tones
Persistent editor zoom and adjustable editor line spacing
A sectioned Scratchpad menu, About panel, keyboard shortcut reference, and Markdown cheatsheet
By default, notes, folders, and trash stay in the desktop webview's local storage. Scratchpad also supports optional portable workspace files for a durable collection of notes, folders, trash, pinned state, and sidebar order. Workspace files use SQLite internally and may have a .db or .sqlite extension. Notes without a folder remain at the top level of the sidebar; deleting a folder from the sidebar returns its notes there rather than deleting them. Agent folder deletion requires an empty folder.
Local notes and workspace notes are two separate collections, each with its own trash. While a workspace is connected, changes are written to that workspace and the local collection is left exactly as it was, so disconnecting returns the notes and trash you had before. An uninitialized workspace can receive a one-time copy of readable notes and folders; unreadable local data and local trash are not copied. At startup, if no readable local notes are available, it receives a fresh welcome note instead. Local folders are copied only when the local collection is not in recovery mode. Opening one from the menu without available notes leaves it empty. A workspace with existing notes, folders, or trash opens its own collection, and an initialized empty workspace stays empty.
A collection is your notes, folders, and trash; a workspace file is a portable storage location for a collection. The menu section is labeled Collection for local notes, or Workspace for a workspace file. Both modes use the same status label: Current — Local notes or Current — filename. Hover over actions for descriptions and their storage scope; the same information is available to screen readers. Choose Open or create workspace… to switch to a workspace file, or Return to local notes to switch back. These actions do not merge collections. Backup and restore remain available in both modes. Clear Local Collection… is hidden while a workspace is open and always targets local storage, never a workspace file.
Pending changes are flushed before switching collections, closing the desktop window, or quitting on macOS. Both editor panes and collection mutations are locked during the operation; cancellation or failure restores editing. A pending valid folder name is committed first; an invalid name cancels the operation with instructions to correct it or press Escape. Save failure cancels the switch/close/quit and reports the error, then a native prompt offers Keep Editing or Discard Changes so a save that keeps failing (for example, a disconnected drive or read-only file) cannot trap you. Edits are discarded only if you choose Discard Changes. If a workspace cannot be opened at start-up, Scratchpad reports it and falls back to your local notes, leaving the workspace file untouched.
If macOS Quit receives no reply from the editor for 30 seconds, a native prompt offers Keep Open, Quit Without Saving, or Cancel. Unsaved edits are discarded only if you explicitly choose Quit Without Saving; a timeout alone does not discard them. This protection does not cover force-quitting, power loss, or another process overwriting the same files. Use one editor instance per collection/workspace, keep backups, and resolve Save failed before leaving the app.
Workspace access is limited to files chosen through the native workspace dialog or restored from native preferences. A missing remembered workspace is not recreated automatically. When upgrading from an older version that stored its workspace choice in browser storage, Scratchpad asks once before reopening that file; declining returns to local notes, and you can open the workspace later from the menu.
On macOS and Linux, newly created workspace files are readable and writable only by their owner (0600); SQLite creates new journal/WAL files with the database's permissions. Existing workspace permissions are preserved, including intentional sharing. Native preferences are saved through a verified, synced replacement file with owner-only permissions, then renamed into place. Windows files inherit their folder's normal access controls. These permissions do not encrypt notes or securely erase deleted content. If a workspace symlink's target is missing, select the intended target file directly.
Disconnecting revokes native access to the workspace; connecting another revokes the previous workspace once the switch completes. Exports cannot overwrite any workspace opened during the current app session, including one you have disconnected. An invalid or missing legacy workspace choice is reported once and cleared after native preferences are saved; reconnect it from the menu when available. Missing workspaces already recorded in native preferences remain remembered for a later launch, so a temporarily disconnected drive can reconnect.
Scratchpad has no analytics, advertising, accounts, or sync service. Markdown is parsed on-device, preview HTML is sanitized, and remote images are blocked so merely previewing a note does not contact an image host. Links in the preview open in your default browser rather than inside the app; following one is an explicit network action and may contact that destination.
Open Scratchpad menu → About Scratchpad, then choose Check for Updates… to check for a newer release. Scratchpad follows one release track: the website and current desktop clients prefer the latest published stable release, with the latest beta as a fallback until the first stable release exists. Stable installations are never offered a prerelease or a version downgrade. About shows the installed version, last check time, and any available update; its menu item indicates when an update is available. Choose Read release notes to review the changes inside the app before deciding; Download Update opens that version’s GitHub release page in your browser. Later closes the panel, and Skip This Version suppresses background notices for that version. Manual checks still reveal skipped releases. Scratchpad never installs updates automatically.
The 1.0 transition keeps the existing application identifier so local data and preferences can stay in place. Existing beta clients will also discover the stable release after publication. See Upgrading from beta to 1.0 for the candidate upgrade procedure, platform-specific installer steps, and remaining verification.
Automatically check for updates, in About, is off by default. Manual checks and enabled automatic checks request the public release manifest at https://crims0n.github.io/scratchpad/release.json. GitHub receives normal connection information such as your IP address, but no notes, workspace data, account identifiers, or telemetry. Automatic checks run after a short launch delay and at most once every 24 hours, including failed attempts; background failures do not interrupt editing. The preference, last attempt time, and skipped version are saved locally. Turning the preference off cancels future checks; a request already sent may finish.
The optional MCP agent access uses a stdio mode built into the desktop executable and is off by default. While enabled, it can read the collection open in Scratchpad, including edits that have not been saved yet. Individually enabled write functions can create notes and folders, append text, rename notes and folders, move notes between folders, move notes to recoverable trash, and delete empty folders. Agents can list trash metadata; restoring and permanently emptying trash are available only in the UI. Existing-item edits require revision checks and support safe retries. A connected agent may send returned note contents to its model provider.
In the desktop app, choose Back Up Collection… from the menu to save the currently open local-only or workspace collection. Pending edits are saved first; a failed save or backup is reported without claiming success. The JSON file is staged, synced, and verified before replacing any existing backup file.
Choose Restore Collection…, select a backup, and review the destination and counts before confirming Replace collection. Restore replaces all active notes, folders, and trash in the current collection; it does not merge or affect other collections. Invalid, truncated, and unsupported backups are rejected before replacement. Editing, collection switching, MCP writes, and app closing are blocked while the dialog is open. Close any other Scratchpad instances using the same collection before backing up or restoring; the dialog does not lock other processes.
The version 1 format uses kind: "scratchpad-collection-backup", schemaVersion: 1, an ISO createdAt, and a collection containing ordered notes, ordered folders, and trash. It preserves IDs, titles, bodies, timestamps, title locks, pins, folder assignments, empty folders, and deleted-note metadata. Preferences, themes, collapsed sections, workspace paths, MCP tokens/permissions, and earlier recovery archives are not included. A backup can be restored into either a local-only or workspace collection, including an empty or trash-only collection. Restoring a workspace keeps the same workspace file and connection.
Empty collections remain empty after reopening. With no note selected, the title and editor are read-only and a prompt explains how to create or select a note; creating/selecting one enables editing. No placeholder note is inserted automatically.
Before replacement, Scratchpad saves and verifies an independent, restorable safety backup in the app data directory's collection-backups folder and shows its path. Keep that file until you have checked your restored data; you can restore it through the same action to undo a replacement. Workspace replacement uses one SQLite transaction. Local replacement uses a durable native checkpoint: a failed or interrupted write rolls back to the prior local values, including on the next launch. If recovery cannot complete, local data remains read-only; Retry reading retries checkpoint recovery. Do not delete app data while recovery is pending. The safety copies are retained and have no automatic expiry.
Backups and safety copies are unencrypted and contain active and trashed note content; store them privately and copy important backups somewhere outside the app data directory. Clearing app data also deletes local notes and automatic safety copies. Collection backups are distinct from Markdown/HTML exports (one note) and preserved-data recovery exports (raw damaged data for manual recovery).
Choose Scratchpad menu → Note → Export HTML file to save the selected note as a standalone .html document. In Dual-Note Split View, it exports the active editor pane. The export includes your latest edits, Markdown formatting, the current preview colours, and code highlighting when enabled; it does not change your note or collection. Styles are embedded, with system font fallbacks, so the file opens offline without Scratchpad or external assets. Search highlights and app controls are excluded.
HTML export uses the same sanitization as Preview: scripts and unsafe links are removed, internet/local-file images are blocked, and supported embedded raster images are retained. Safe external links remain clickable and go online only when opened. The HTML file contains readable, unencrypted note content; store and share it accordingly. HTML exports are for reading/sharing, not collection backups or a round-trip import format. PDF export is not included.
Native HTML, Markdown, recovery, and collection-backup exports stage and verify a new file in the destination folder before replacing the destination. The folder must be writable. Overwriting replaces the file itself, including a symlink, rather than changing its target or other hard links; extended attributes, ownership, and ACLs are not copied. On Unix, new HTML/Markdown files follow the normal umask and overwrites retain an existing regular file’s permission bits. Recovery and backup files remain owner-only (0600).
Choose Scratchpad menu → Note → Print Note…, or press Cmd+P on macOS / Ctrl+P on Windows and Linux. The desktop app opens a separate, note-only preview and its system print dialog, using a fresh snapshot of the selected note, including current edits; in Dual-Note Split View it uses the active pane. Only formatted note content is printed, not the sidebar, editor controls, other notes, search highlights, or preview toolbar. Printing uses a light, paper-friendly palette regardless of the app theme, with wrapped code blocks, table headers, and page-break guidance. The same Preview/HTML sanitization and image restrictions apply.
Use the system dialog for printers, paper, margins, page ranges, and any available print-to-PDF destination. Cancel leaves your notes unchanged. The desktop preview stays open so an asynchronous print operation retains its document; use Print… to retry, then Close when finished, before preparing another note. Closing the main editor saves pending edits and exits the app, including any print preview; a failed save cancels closing. Its snapshot is kept only in memory and released when that window closes, with no temporary note file. Browser-only use prints an offscreen note document and removes it after the dialog closes. Scratchpad does not report printing as a successful save and cannot tell whether paper was actually printed. Printing/sharing can expose note content to your chosen printer or destination. A dedicated PDF export remains separate from this feature.
In the desktop app, while Local notes is active, choose Clear Local Collection…. Review the note, folder, and trash counts, then type the exact word DELETE to enable Clear local collection. Cancel or Escape leaves the collection unchanged; confirmation is discarded when the dialog closes. Return to local notes first if a workspace is connected. Recover unreadable local data or an interrupted collection change before clearing.
Clearing removes only the local notes, folders, and trash; it does not move notes to trash, reset preferences/themes, modify workspace files, or delete existing backup/recovery copies. Pending edits are saved and a verified, restorable safety backup is retained before clearing. A save or safety-backup failure stops the operation. Clearing uses the same durable checkpoint and rollback/startup recovery as local restore. Empty collections stay empty across restart; create or select a note before editing.
The result shows the safety backup path. Use Restore Collection… to restore it into local notes if needed. Safety copies are unencrypted, include trashed content, and have no automatic expiry. This action is not secure erasure and is not a full app-data reset. Close other instances using the local collection first; it does not lock other processes. Copy important backups outside the app data directory.
Open Scratchpad menu → Agent access and turn access On. Choose MCP Configuration to copy the executable path, --mcp-stdio argument, or generic JSON example into a client that supports local stdio MCP servers. Configuration stays available while access is off. Scratchpad must remain open; the accent-colored MCP listening indicator appears beside the save status while access is enabled.
Each time access starts, all five read permissions are on and all eight write permissions are off. Use the Read and Write checkboxes to choose individual functions or select all in a section. Changes apply to connected clients immediately and reset when access is restarted.
| Permission group | Functions |
|---|---|
| Read | List folders, list notes, search notes, read note content, list trash metadata |
| Write | Create note, create folder, append to note, rename note, move note, rename folder, delete note to trash, delete empty folder |
Writes to existing items check the current revision before changing anything. Request IDs make retries safe after a timeout or failed save. Agents cannot replace an entire note, read trashed note bodies, restore notes, or empty trash. Access applies to all connected local clients and to the collection currently open in Scratchpad, including unsaved edits.
See the MCP reference for client setup, tool arguments, limits, retry behavior, and the privacy boundary.
Use a note's sidebar delete button or right-click it and choose Delete Note to move it to trash. Click the trash icon at the bottom right to see deleted notes and choose Restore. Restoring preserves the note's content, title, and pin state, returning it to its original folder or the top level if that folder no longer exists.
Right-click the trash icon and choose Empty Trash…, then confirm to permanently remove the listed recovery copies. Keyboard users can focus the icon and press Shift+F10 to open its menu. Trash survives restarts and has no automatic expiry. Only the user can restore notes or empty trash; MCP agents can list its metadata. See storage and recovery details for save-failure behavior.
If saved local notes or folder metadata cannot be read, a Local data recovery banner keeps that collection read-only. Startup, autosave, MCP writes, switching collections, and closing the app do not replace the unreadable values. Readable notes can still be viewed and copied, and healthy workspace files remain usable.
Choose Export preserved data… to save a recovery JSON bundle containing the current unreadable raw strings, including malformed JSON, and all preserved recovery files. Each preserved file is included as its original JSON string; previous copies are not nested inside new snapshots. This is for manual recovery, not a collection backup or a file the Markdown importer can restore. The bundle can include active and trashed note content; keep it private. Retry reading reloads the original local values without changing them.
In the desktop app, Replace unreadable data… requires confirmation and first saves and verifies an independent recovery file in the app data directory's local-recovery folder, outside the webview's localStorage quota. Only then does it replace unreadable notes or folder metadata with empty values. Readable data and trash are retained. A failed archive write prevents replacement; if a later replacement write fails, the original file remains available. Earlier localStorage recovery copies are preserved in that file before being removed from localStorage. Export for safekeeping before proceeding: deleting the app data directory also deletes these recovery files. The banner keeps all finalized copies available to export after replacement and future launches. Browser-only sessions can export but cannot automatically replace unreadable data. Missing folder metadata may need manual reconstruction; this action does not repair damaged JSON automatically.
The app displays Cmd on macOS and Ctrl on Windows or Linux.
| Shortcut | Action |
|---|---|
Cmd/Ctrl + N | Create a scratchpad |
Cmd/Ctrl + Z | Undo in the active editor |
Cmd + Shift + Z (macOS) / Ctrl + Y (Windows/Linux) | Redo in the active editor |
Ctrl + Shift + Z (Linux) | Alternative Redo shortcut |
Cmd/Ctrl + B | Toggle the sidebar |
Cmd/Ctrl + \ | Toggle two-note side-by-side editing |
Alt + ↑ / Alt + ↓ | Move a list branch, or the active sidebar note outside a list |
Cmd/Ctrl + F | Open or close Find |
Cmd/Ctrl + H | Open Find and Replace |
Alt + C | Toggle case-sensitive matching while Find is open |
Alt + W | Toggle exact whole-word matching while Find is open |
Alt + R | Toggle regular-expression mode while Find is open |
Enter / Shift + Enter | Select the next or previous match |
Enter | Continue a list or blockquote, close a new code fence, or extend a table |
Tab / Shift + Tab | Nest or outdent a list, navigate table cells, or insert plain indentation |
Home | Move to list-item content first, then the beginning of the line |
Cmd/Ctrl + + / Cmd/Ctrl + - | Zoom the editor in or out |
Cmd/Ctrl + 0 | Reset editor zoom to 100% |
Cmd/Ctrl + Shift + F | Toggle Focus Mode |
Cmd/Ctrl + / or F1 | Open or close Help and Reference |
Tab / Shift + Tab | Switch topics while Help is open |
Escape | Close the active modal or Find bar, or leave Focus Mode |
Scratchpad provides Markdown assistance in both editor panes. Structured formats such as JSON and SPL preserve literal punctuation instead of applying Markdown shortcuts:
Enter preserves the marker and spacing of bullet lists, advances ordered-list numbering, and creates unchecked task items. An empty item outdents or exits its list.Tab at the start of a list item nests the complete item and its children; Shift+Tab outdents them. Elsewhere, Tab inserts indentation. Fenced code always receives literal indentation.*, _, </code>, or ~` wraps the selection.Enter in the final cell or Tab past it adds a row; Enter or Backspace on an empty generated row exits the table.Format detection favors ordinary text when YAML or CSV evidence is ambiguous. YAML needs typed values, nested structure, or an explicit document marker; CSV needs consistent records plus compact column headers, quoted cells, or numeric values. A Markdown heading followed only by flat mappings stays Markdown, even when that text is also valid YAML; nested structures, scalar blocks, or an explicit YAML document marker take precedence over heading-like comments. Plain string mappings or prose with commas may therefore stay TXT.
SPL is recognized from how a search starts: a leading generating command such as | tstats or | makeresults, or a search that begins with index=, sourcetype=, source=, host=, or eventtype= followed by a piped command or a second field=value term. Other notes need at least two piped SPL commands and no Markdown structure. Prose that mentions a command, Markdown tables, and Markdown notes with SPL in inline code or fences keep their usual format; label a fence ```spl to highlight it in Preview.
Syntax highlighting is enabled by default. Open Scratchpad menu → Appearance → Syntax highlighting to toggle coloring in both editor panes and language-aware Preview highlighting. Editor colors follow the detected format, shown in the sidebar and in the status bar beside the cursor position for the active pane (with highlighting off noted when coloring is disabled): Markdown syntax, JSON keys and values, XML tags and attributes, YAML keys and values, repeating CSV column colors, and SPL commands, fields, functions, macros, and comments. TXT stays plain; incomplete or unrecognized documents stay plain until a format is detected. Preview code highlighting requires a supported language after the opening fence, such as ```javascript; unknown and unlabeled fences remain plain code.
Source line numbers are off by default. Open Scratchpad menu → Appearance → Line numbers to show a subtle, theme-aware gutter in both editor panes; the preference is remembered between launches.
Collapse sections with the gutter chevrons: Markdown headings and fenced code, JSON objects and arrays, XML elements, and YAML nested mappings, sequences, and scalar blocks. Click the hidden-line placeholder to expand a section. CSV and TXT stay unfolded. To keep typing responsive, folding is available for notes up to 100,000 characters and 10,000 lines; larger notes remain fully editable, and growing past either limit expands existing folds. Folding works independently of syntax colors and line numbers; each pane remembers folds for each note and collection until the app closes. Find searches the complete source and expands selected hidden matches. Entering Compare expands both notes. Saving, exporting, and copying the complete document include hidden text, and folding does not add text undo steps. Edits recheck fold boundaries; changed or invalid boundaries expand automatically.
With the editor focused, use Cmd+Alt+[ / Cmd+Alt+] on macOS or Ctrl+Shift+[ / Ctrl+Shift+] elsewhere to collapse or expand the current section. Ctrl+Alt+[ / Ctrl+Alt+] collapses or expands all sections. Hidden-line placeholders also support keyboard activation.
Open two notes side by side, then choose Compare in the toolbar to highlight source differences without changing either note. Removed text is marked on the left, added text on the right, and related words receive contiguous substring detail. The toolbar reports the total number of changed lines across both notes. Comparison refreshes after a brief pause in typing, showing Updating comparison… while pending, and turns off when split view closes.
Scratchpad includes Default Dark and Light, Dracula, Catppuccin Mocha, Nord, Tokyo Night, Monokai Pro, One Dark Pro, Solarized Dark and Light, Amber CRT, Green CRT, Pastel Daydream, Macintosh System 6, Mac OS 9 Platinum, Windows Classic, and GitHub Dark.
A custom JSON theme requires background and foreground. Other colors receive defaults when omitted:
{
"name": "Amber CRT",
"background": "#120f08",
"foreground": "#f6c453",
"sidebar": "#1b160b",
"accent": "#ffb000",
"border": "#4a3814",
"selection": "#5c4315"
}
Simple TOML/key-value theme files using the same names are also accepted. Themes can use hex and supported fixed named colors, plus literal RGB/RGBA, HSL/HSLA, HWB, Lab/LCH, Oklab/OkLCh, and color(…) values. CSS variables, system colors, calculations, relative colors, conditional/mixing functions, and inherited values are not applied; invalid optional colors receive defaults. Imports trim all colors and use the first supported value when a color has alternative keys such as background and editor.background. A missing, blank, or non-string imported theme name uses the file name.
Previously saved themes keep their original data. If a saved theme has unsupported background or foreground colors, the picker marks it as needing updating and offers Export original so you can edit and reimport it. An unavailable active theme falls back to Default Dark. Importing or deleting another theme preserves these originals; reimporting a corrected theme with the same name replaces that theme explicitly.
Opaque hex, RGB, HSL, named, and color(srgb …) values are measured against the theme's own surfaces so secondary text remains readable; translucent or wider-gamut values are preserved without being flattened into guessed colors.
rust-toolchain.toml)gpg and gpgv) for the release-verification tests in npm run check. The isolated key-import regression also needs gpgconf and gpg-preset-passphrase; it generates and removes its own disposable test key. It skips locally when those import tools are unavailable; CI requires them. The POSIX combined-signing regression also needs sha256sum (GNU coreutils on macOS), skips locally if its tools are missing, and requires them in CI. Production signing credentials are never used by the tests.git clone https://github.com/crims0n/scratchpad.git
cd scratchpad
npm ci
npm run tauri -- dev
The frontend is served directly from src/; there is no framework-specific development server.
Plain tauri dev and local builds use Scratchpad Development, with a separate application identifier (io.github.crims0n.scratchpad.dev), executable name, local storage, native settings, and MCP discovery files. Release packaging explicitly applies src-tauri/tauri.release.conf.json to retain the published installation identity. Use copied workspace files for development: separate app profiles do not coordinate writes to a workspace file you deliberately open in both apps.
npm run check
cargo fmt --manifest-path src-tauri/Cargo.toml --check
cargo clippy --locked --manifest-path src-tauri/Cargo.toml --all-targets -- -D warnings
cargo test --locked --manifest-path src-tauri/Cargo.toml
npm run tauri -- build
Development bundles and installers are written beneath src-tauri/target/release/bundle/. They use the development profile even with release compiler optimizations; the production identity is selected by the release workflow's explicit configuration override.
The CI workflow validates every push to main and every pull request. Development uses main and short-lived PR branches. The manually triggered Stable Release workflow builds signed macOS, Windows, and Linux packages from main and attaches them to a draft, non-prerelease vX.Y.Z. There is one release stream; beta packaging has been retired. The internal published identifier and old-client manifest alias are retained for compatibility.
Before triggering a release, update the version in package.json, src-tauri/Cargo.toml, src-tauri/tauri.conf.json, both lockfiles, and the About panel in src/index.html. Update RELEASE_NOTES.md, the README, MCP reference, welcome note, and in-app Help for the final feature set. The workflow requires a stable version of 1.0.0 or later. A main-only preparation job with push permission refuses existing tags or releases, including drafts, and creates the candidate once; failed GitHub queries stop preparation. Platform builds have read-only repository permission and save verified files plus independent signing records. A separate write-authorized job validates those records, uploads to the prepared release ID, and downloads the final assets by ID. Read-only verification checks that snapshot against the signing records and previews website-manifest recognition. A final dependency-free job checks that the live draft still matches the verified snapshot. No job with repository write permission installs npm dependencies. Review and install the draft packages before publishing. The website's download manifest is generated from published GitHub releases; do not point it at unbuilt packages.
Follow the release checklist to build a draft, check signing on all three platforms, and record installed-package acceptance results before publishing. The ARM64 stable pipeline documents the expanded candidate matrix and the acceptance still required before ARM64 publication. Publishing is a separate manual step after candidate review; the workflow never publishes automatically.
Linux artifacts are signed during the release using secrets in the protected release-signing environment. The release fails if signing or verification fails. The draft includes SHA256SUMS and SHA256SUMS.asc; see Linux release signing for key setup, rotation, and revocation. Windows executables and both installers are Authenticode-signed and timestamped with Azure Artifact Signing, and the release fails if any signature does not verify; see Windows release signing. The macOS app and DMG are signed with a Developer ID certificate, notarized, and stapled, and the release fails if signing, notarization, or Gatekeeper verification fails; see macOS release signing.
See Architecture and data flow for runtime, persistence, MCP, quit-handling, and release-pipeline diagrams, plus the source map and security boundaries.
| Area | Implementation |
|---|---|
| Desktop runtime | Tauri v2 and Rust |
| Frontend | Vanilla HTML, CSS, and JavaScript |
| Editor | Offline-bundled CodeMirror 6 behind a note-editor adapter; selection, undo, wrapping, and gutters in both panes |
| Markdown | Bundled Marked parser with an allowlist sanitizer |
| Syntax highlighting | Bundled Highlight.js for JSON/XML/YAML editors and labeled preview fences; local Markdown and CSV tokenizers and SPL grammar |
| Note comparison | Bundled jsdiff with line and word-level source comparison |
| External links | tauri-plugin-opener, scoped to http, https, and mailto |
| Local persistence | Desktop webview local storage |
| Workspace persistence | Bundled SQLite through rusqlite |
| Agent integration | Toggleable stdio MCP access in the desktop binary through the official Rust MCP SDK |
| Native preferences | JSON in the platform app configuration directory |
| Themes | CSS custom properties with JSON and TOML/key-value import |
See CONTRIBUTING.md for the development workflow. Please report suspected vulnerabilities privately using the process in SECURITY.md.
Scratchpad is free software licensed under GPL-3.0-or-later, with an additional permission for distribution through app stores. The bundled CodeMirror editor and Marked parser are provided under the MIT License; Highlight.js and jsdiff are provided under the BSD 3-Clause License. See THIRD_PARTY_NOTICES.md.