@dsh-plugin/echo-notes

LIMITATIONS

已知限制

- **Metadata remains plaintext.** Titles, mood, tags, timestamps, word counts and pin state are stored unencrypted for indexing and filtering. The plaintext body preview is removed when encryption is enabled. Anyone who can read the storage backend can still infer patterns from metadata. - **Authenticated encryption does not prevent rollback or deletion.** AES-GCM detects ciphertext tampering and moving ciphertext between note/revision ids. Anyone with write access to the storage backend can still delete notes or restore an older valid database snapshot. Back up the storage backend safely. - **A forgotten passphrase is unrecoverable.** That is what the encryption is for. There is no recovery key and no escrow. - **Auto-lock is coarse.** It is checked on the tick loop, so the lock lands within one `tickSeconds` of the deadline, not exactly on it. - **Reminders need a live Harness.** They are Host timers, not OS-level notifications; a closed app fires nothing, and the missed occurrence is skipped. - **Search requires an unlocked vault.** Matching happens against decrypted bodies in memory, so a locked vault can list metadata but cannot search text. - **Browser-verified panel.** `scripts/browser-smoke.mjs` (`pnpm test:browser`, needs a running `dsh web` and Playwright) drives the real Web UI: the sidebar entry opens the panel, the first-run passphrase card renders, and the `--dsw-alias-*` tokens resolve to different palettes under light and dark schemes. Verified against DeepSeek Harness 0.2.1-alpha.4.