Feature chore bug 005 #19

2026-07-07T22:02:32-05:00

iamdoubz commented

2026-07-07 22:02:32 -05:00

MCP server
i18n translations
English and multi-language models
Audio device selection
Microphone
Briefs
Dropbox and Box integrations
MS Graph

- MCP server - i18n translations - English and multi-language models - Audio device selection - Microphone - Briefs - Dropbox and Box integrations - MS Graph

iamdoubz added 106 commits 2026-07-07 22:02:32 -05:00

feat(briefs): storage layer for feature_briefs (T10.6, M1.1) d14a6766e5

feat(llm): non-streaming complete() primitive for Ollama/OpenAI-compat (T10.6, M1.2) a7fda95843

feat(briefs): FeatureBriefBuilder distiller + golden-transcript tests (T10.6, M1.3/M1.6) 18f46ea6c3

chore(briefs): register briefs module (T10.6, M1.3) 7e1b7882eb

feat(mcp): add MCP settings fields to Settings (T10.4) c88c04233c

Adds mcp_enabled/mcp_transport/mcp_port/mcp_expose/mcp_expose_recordings
to Settings, all defaulting to off/none so an upgrading settings.json
gets a fully-local default (FR-MCP-1). The auth token itself never lives
here -- OS credential store only (see mcp::token, next commit).

feat(mcp): default_settings() covers the new MCP fields (T10.4) 999084ab3f

Keeps default_settings() exhaustive now that Settings grew mcp_* fields.

feat(mcp): Store methods for action items + access log (T10.4/10.5) e0668e48df

Adds list_action_items (backs the get_action_items MCP tool -- distinct
from list_pending_reminders, which is reminder-scoped across all
meetings) and record_mcp_access/list_mcp_access_log (FR-MCP-5 audit
trail) to the Store trait + SqliteStore, reusing the mcp_access_log
table from migrations/0003_ai_mcp.sql.

feat(mcp): trait/config plumbing for the real server (T10.4) c73245f293

ExposeScope/McpTransport gain as_str/parse (privacy-safe fallback: an
unparsed scope becomes None, not All/Selected) so commands.rs can read
them out of Settings' string fields. Declares the mcp submodules
(scope always compiled; handler/http_transport/server/stdio_transport/
token behind the `mcp` cargo feature) and removes the todo!() RmcpServer
stub -- its real implementation moves to mcp::server in the next commits.

feat(mcp): scope-control logic, unit tested (T10.7, FR-MCP-3) fc93f8e14f

Pure functions (no DB, no cargo feature gate) so scope control is
testable without a running server: meetings_visible/brief_visible/
recording_gate_ok/meeting_allowed. Documents the conservative choice for
`selected` scope on meetings/transcript/action-items -- there's no
per-meeting selection flag in the schema yet (only feature_briefs.exposed
does), so `selected` behaves like `none` there until a real "pick which
meetings" mechanism exists, rather than silently behaving like `all`.

feat(mcp): ServerHandler implementing the four MCP tools (T10.5) 14868d4e5c

WaMcpHandler wires list_recent_meetings/get_transcript/get_action_items/
get_feature_brief to Store, re-checking ExposeScope + the recordings
gate independently in every handler (FR-MCP-3) and logging every read
via record_mcp_access + an "mcp://access" event (FR-MCP-5) before scope
is even evaluated, so the audit trail is "what was asked for", not just
"what was returned". get_feature_brief calls through the existing
commands::get_feature_brief stub per the M1/M2 integration contract --
it always errors right now since M1's brief storage isn't implemented
in this worktree yet; the `selected`-scope exposed-flag check is left
as a marked TODO for when M1 lands.

build(mcp): pull in the HTTP/stdio transport features (T10.4) c48c67760d

rmcp gains transport-streamable-http-server + transport-io (the actual
serving code -- the base "server" feature only got tool routing) plus
client + transport-streamable-http-client-reqwest, used solely by this
crate's own in-process MCP-client tests (WA never opens an outbound MCP
connection at runtime, so this is not new egress, FR-MCP-7). hyper/
hyper-util/http-body-util/http/bytes/tower-service are the low-level glue
to run HTTP/1 over a loopback TcpListener in front of rmcp's
StreamableHttpService (a bare tower_service::Service, not an axum app).
All are already in Cargo.lock transitively via reqwest/tauri -- no new
crates, just promoted to direct deps under the existing `mcp` feature.

feat(mcp): loopback bind + bearer-token gate for Streamable HTTP (T10.4, FR-MCP-1/6) 9eed88e5bd

bind_loopback() refuses to bind anything that doesn't resolve to a
loopback address -- unit tested directly (non-loopback IP, unparseable
host, and a real 127.0.0.1:0 bind). serve() runs a hyper HTTP/1 accept
loop in front of rmcp's StreamableHttpService (a bare tower_service, not
an axum app); every request needs `Authorization: Bearer <token>`
(constant-time compared via mcp::token::verify) before it ever reaches
the MCP service -- an unauthenticated request never reaches rmcp at all.

feat(mcp): auth token in the OS credential store, not settings/DB (T10.4, FR-MCP-1) 851e89720d

Mirrors sync::credentials: mint_and_store() generates a fresh 32-byte
random token per set_mcp_enabled call and writes it via `keyring`
(Windows Credential Manager); the token is never persisted to
settings.json/wa.db/logs. verify() is a constant-time compare so token
checking doesn't leak timing information about a partial match
(NFR-SEC-5).

feat(mcp): stdio transport adapter (T10.4, FR-MCP-6) 5f690f4b74

serve_once() runs one MCP session over the current process's stdin/
stdout to completion -- the entry point main.rs's --mcp-stdio flag calls
into (next commit). No bearer-token check here: spawning this process
at all requires the same local-user privilege as any other command, so
process-spawn capability is the trust boundary for stdio, not a header.

feat(mcp): McpToolDescriptor is Copy (T10.4) 58d565907b

Needed so RmcpServer::tools() can hand back TOOL_DESCRIPTORS without a
manual field-by-field clone (next commit).

feat(mcp): RmcpServer wires token+transport+handler together (T10.4) bd9b5ba3cc

start() mints/stores a fresh token, then either binds the loopback HTTP
listener (bind_loopback + http_transport::serve) or, for stdio, just
records "enabled" and hands back the whishassist.exe --mcp-stdio command
line the agent's client config should spawn -- there is nothing to run
in-process for stdio (see mcp::stdio_transport). stop() tears down the
HTTP listener if any and deletes the stored token. instance() is a
process-wide singleton (OnceLock) so separate Tauri command invocations
(set_mcp_enabled/mcp_status/set_mcp_scope) share the same running state.

fix(mcp): WaMcpHandler's AppHandle is optional (T10.4) 49cc1e6cd3

The --mcp-stdio child process (main.rs, next commits) has no running
Tauri app/window to emit "mcp://access" events to -- only the GUI
instance's HTTP transport does. The mcp_access_log DB row is still
written unconditionally either way (FR-MCP-5); only the live event is
skipped when there's no AppHandle.

fix(mcp): pass the GUI's AppHandle as Some(..) to the handler (T10.4) eb2aa2a0d6

Follows the previous commit's WaMcpHandler::new signature change.

feat(mcp): --mcp-stdio launches the headless stdio adapter (T10.4, FR-MCP-6) 949bade137

Checked before whispassist_lib::run() builds the Tauri app -- the flag
routes straight to run_mcp_stdio() (next commit) and returns instead of
opening a window.

fix(mcp): add tokio-util for CancellationToken (T10.4) f85b78c9eb

http_transport.rs needs tokio_util::sync::CancellationToken directly;
rmcp pulls tokio-util transitively but that doesn't make it `use`-able
from our own crate without a direct Cargo.toml entry.

feat(mcp): run_mcp_stdio() serves one session over process stdio (T10.4, FR-MCP-6) f99845ef1b

Builds its own tokio runtime (there is no Tauri app in this mode) and
tracing goes to stderr, not stdout -- stdout is the MCP JSON-RPC channel.
Connects to the same wa.db as the GUI instance via SqliteStore::connect,
builds a WaMcpHandler with no AppHandle (None), and runs it to
completion via mcp::stdio_transport::serve_once. A build without the
`mcp` feature prints an error and exits(1) instead of silently opening
the GUI.

feat(mcp): wire mcp_status/set_mcp_enabled/set_mcp_scope/mcp_access_log (T10.4) 0ecc72f18f

Replaces the four not_implemented() stubs. mcp_status/set_mcp_enabled
reach the process-wide RmcpServer singleton (behind `#[cfg(feature =
"mcp")]`, with a not_implemented fallback for builds without it);
set_mcp_scope/mcp_access_log are plain settings/Store I/O and work in
every build regardless of the `mcp` cargo feature. The token is only
ever returned once, right when set_mcp_enabled mints it -- it is never
re-readable afterwards, same as any other freshly-issued secret.

fix(mcp): use HttpServerHandle.local_addr instead of a second lookup (T10.4) 45e34284e9

Fixes a dead_code warning (clippy -D warnings would fail on it) --
server.rs was calling listener.local_addr() itself before handing the
listener to http_transport::serve(), leaving the handle's own
local_addr field unread.

style(mcp): rustfmt e0112ec8c4

style(mcp): rustfmt 07072551c0

style(mcp): rustfmt 36a28dc096

style(mcp): rustfmt 386be75658

style(mcp): rustfmt 71c4c6ecf0

style(mcp): rustfmt run_mcp_stdio 8caeb818a7

style(mcp): rustfmt Store trait additions 59742e4fdf

style: rustfmt (incl. one pre-existing long line in serve_recording) bd97032550

style(storage): rustfmt fixup for list_feature_briefs (M1.1) 55b520d373

refactor(briefs): bundle distill() transcript args to satisfy clippy (M1.3) 4fc3df504a

feat(briefs): create/list/get_feature_brief + set_brief_exposed command bodies (T10.6, M1.4/M1.6) 63bfc293cb

build(mcp): Cargo.lock for the new mcp-feature dependencies (T10.4) cd6997265f

Regenerated by `cargo check --features mcp` after promoting hyper/
hyper-util/http/http-body-util/bytes/tower-service/tokio-util to direct
deps and widening rmcp's feature set (see the earlier Cargo.toml
commits).

fix(mcp): collapse nested if-let per clippy (T10.4) ec8b12f636

feat(mcp): frontend AppSettings/McpStatus types for the new fields (T10.4) ae0ef563e9

Adds mcp_transport/mcp_port/mcp_expose/mcp_expose_recordings to
AppSettings and a typed McpStatus for mcp_status()'s response; types
onMcpAccess's payload correctly (the live event is camelCase per
docs/04-api-contracts.md, unlike the snake_case McpAccessEntry rows
mcpAccessLog() returns).

feat(mcp): settings store gains MCP state/actions (T10.4/10.5) 70b4952366

loadMcpStatus/loadMcpAccessLog/setMcpEnabled/setMcpScope mirror the
existing sync-target patterns; a live "mcp://access" subscription tails
the FR-MCP-5 audit log into the store while the panel is open, on top
of the on-demand loadMcpAccessLog() refresh. mcpLastToken holds the
freshly-minted token from the most recent enable, for the one-time
reveal UI (next commit).

feat(briefs): Feature briefs UI in SummaryPanel (T10.6, M1.5) 02fb7de6a8

feat(mcp): MCP server settings section + privacy panel integration (T10.4/10.5, M2.5/M2.6) 1ade08a60e

New "MCP server" tab: persistent disclosure banner (agents may forward
served data to their own provider; WA itself adds no egress), enable
toggle, transport/port/scope controls, a reveal-once auth-token callout
(aria-live, never re-shown), and a live access-log list backed by the
settings store's mcp:// access subscription (FR-MCP-5).

Privacy tab gains a compact MCP status row + an explicit "adds nothing
to the egress list" confirmation line (FR-MCP-7, FR-SEC-2) next to the
existing sync/LLM egress rows.

Built with ui-ux-pro-max guidance (disclosure banner wording, reveal-
once secret pattern, aria-live for the token, badge semantics) mapped
onto this file's existing minimal/utilitarian style (banner/badge/row/
confirm classes already used by the Sync and Privacy sections) rather
than introducing a new visual language.

style(mcp): prettier e424ecd8d3

fix(mcp): make bind_loopback/serve/HttpServerHandle pub for the e2e test (T10.4) 71824d44cc

Widens visibility from pub(crate) to pub so tests/mcp_server_test.rs
(an external integration-test crate, per CLAUDE.md's "cross-service
tests in /tests") can drive the real HTTP transport end-to-end. This
does not weaken the loopback guarantee: bind_loopback still refuses
non-loopback regardless of caller -- only its visibility changed.

test(mcp): end-to-end client over real HTTP loopback (T10.4-10.9) 0839d9c0b8

A real rmcp client speaks Streamable HTTP to the real RmcpServer stack
(bind_loopback + serve + WaMcpHandler) over an OS-assigned loopback
port, using an in-memory SqliteStore -- not just isolated unit pieces.
Asserts: an unauthenticated POST is rejected (401) before it ever
reaches the MCP service; an authenticated client's list_tools/call_tool
round-trip is schema-valid; and the call appends an mcp_access_log row
even though default scope (`none`) denies it data (FR-MCP-5 logs the
ask, not just the answer). mint_and_store/delete touch the real OS
credential store, same pattern as sync::tests::webdav_round_trip.

fix(mcp): pin a second reqwest (0.13) for rmcp's client-http impl (T10.4) f5651c1133

rmcp's transport-streamable-http-client-reqwest is written against
reqwest 0.13.2+, a semver-incompatible major vs. the reqwest 0.12 the
rest of WA (llm/sync) depends on -- Cargo can't unify those, so
`reqwest::Client` from our own dependency isn't the same type rmcp's
`impl StreamableHttpClient for reqwest::Client` is written for. Adds
`reqwest013` (a Cargo package-rename of reqwest 0.13) purely so
tests/mcp_server_test.rs can construct the exact client type rmcp
expects, without touching reqwest 0.12 anywhere else in the crate.

fix(mcp): use reqwest013::Client for the rmcp client transport in the e2e test (T10.4) 42463d41f6

fix(mcp): reqwest 0.13's TLS feature is named rustls, not rustls-tls (T10.4) 23388f9305

fix(mcp): drop the TLS backend from the test-only reqwest013 dep (T10.4) 10edf053a9

The e2e test only ever talks plain http://127.0.0.1 (never https://), so
a TLS backend is unnecessary weight -- reqwest 0.13's `rustls` feature
pulls in aws-lc-rs, a large C codebase that was taking a very long time
to compile (and once contributed to a pagefile-exhaustion build failure
alongside concurrent cargo invocations). Building reqwest013 with
default-features=false and no TLS feature is enough for the plain-HTTP
client the test needs.

revert(mcp): drop the reqwest013 test-only dependency (T10.4) f76cd46660

Per instruction to stop iterating on builds: reqwest 0.13's client-http
feature (needed only for an in-process MCP-client e2e test) was pulling
a very slow/heavy native build (aws-lc-rs, even with the TLS backend
stripped down) and the last attempt was still in progress -- unverified.
Reverting Cargo.toml to the last state that was actually confirmed
green (cargo fmt/clippy -D warnings/test, both default and --features
mcp, all passing) rather than ship an unverified dependency change.
The HTTP transport itself (bind_loopback/token gate/serve loop) keeps
its own unit tests, which did pass under --features mcp.

revert(mcp): bind_loopback/serve back to pub(crate) (T10.4) 57e757f01f

No longer need to be pub now that the e2e test that required it is
reverted -- restores the tighter, originally-intended encapsulation.

revert(mcp): remove the unverified e2e MCP-client test (T10.4) ff3ced6874

Written to satisfy "an in-process MCP client can call the tools", but
its dependency (reqwest 0.13 via rmcp's client-http feature) pulled in
a very heavy native build (aws-lc-rs) that hadn't finished verifying
when told to stop building. Removing rather than leaving an unverified
test + dependency in the tree. The acceptance criterion it targeted is
still exercised at the unit level: http_transport::tests (loopback
bind/refusal) and mcp::scope::tests (tool-handler scope logic) both
pass under --features mcp; the full wire-protocol round trip is a
follow-up (see final report).

Merge branch 'worktree-agent-af937df502b61b006' into feature_chore_bug_005 2582d8947f

# Conflicts:
#	src-tauri/src/storage/mod.rs

feat(llm): AnthropicProvider real implementation (T10.1/M3.1) c3e8bae27f

Implements AnthropicProvider::status/summarize/suggest_tags against the
real Anthropic Messages API (POST /v1/messages, x-api-key + anthropic-
version headers, SSE streaming for summarize, non-streaming for the
short tag reply), replacing the stub that returned "isn't built yet".

- Adds llm::credentials (mirrors sync::credentials) so hosted API keys
  live in the OS credential store, never settings/DB/logs (ADR-0011).
- Fixes OpenAiCompatProvider::api_key() to actually read credential_ref
  from the store instead of the hardcoded None left by the T10a.2 stub.
- Splits build_messages/build_tag_messages into system/user halves
  (build_system_and_user/tag_system_and_user) since Anthropic's system
  prompt is a top-level field, not a messages[0] entry like OpenAI's shape.
- is_local() is unconditionally false for AnthropicProvider (no
  unauthenticated mode, unlike OpenAiCompatProvider).
- Adds a loopback raw-socket mock HTTP server (mirrors sync::oauth's
  LoopbackRedirect pattern — no HTTP-mock crate in the dependency tree)
  and tests proving request/response shape for both AnthropicProvider
  and OpenAiCompatProvider against mocked endpoints.

feat(llm): add hosted_ai_acknowledged settings field (T10.3/M3.3) e7925fc3ad

One-time "data leaves your device" acknowledgment flag for hosted
(non-local) AI providers, persisted like consent_acknowledged so the
banner doesn't nag on every use. serde(default) so it's false for any
settings.json written before this field existed.

feat(llm): set_llm_provider stores Anthropic key in credential store, extends egress allowlist (T10.2/M3.2) d73af49742

set_llm_provider now accepts provider "anthropic": the apiKey argument
is written straight to crate::llm::credentials (OS credential store)
and never assigned into Settings, so it structurally cannot reach
settings.json/wa.db (FR-SEC-1). apply_llm_provider_args pulls the
settings-mutation logic into a small pure function specifically so
that guarantee is unit-testable without touching a real keyring.

llm_provider_from_settings gets an "anthropic" arm; api.anthropic.com
joins the settings-derived egress allowlist through the exact same
generic is_local()-based path privacy_self_check_json already uses for
every other provider — no anthropic-specific allowlist code, and the
host only appears once the provider is actually selected (never
unconditionally).

Also fixes pre-existing cargo-fmt drift on one unrelated line this
file's formatter pass touched (CONTENT_RANGE header call).

feat(llm): add hosted_ai_acknowledged to AppSettings (T10.3/M3.3) 11b175dafa

Frontend counterpart of the new Settings field: the one-time "data
leaves your device" acknowledgment for hosted (non-local) AI providers.

feat(llm): wire apiKey through setLlmProvider, add acknowledgeHostedAi (T10.2/T10.3) 3cdb0abb2d

settings.svelte.ts's setLlmProvider now accepts an optional apiKey
(forwarded straight to the set_llm_provider command, which is the only
place it gets stored — the OS credential store) and DEFAULT_SETTINGS
gains hosted_ai_acknowledged. acknowledgeHostedAi() persists the
one-time hosted-AI banner acknowledgment the same way
acknowledgeConsent() does for recording consent.

feat(ui): HostedAiBanner one-time hosted-AI notice component (T10.3/M3.3) 754f0f0b6a

New component mirroring ConsentNotice.svelte's card/overlay pattern:
shown before first use of a hosted (non-local) provider, explains that
the transcript leaves the device to a third party, and offers
accept/cancel. Uses the existing design tokens (--accent, --warning,
--bg-elevated, --radius-lg/sm, --shadow-lg) so it matches the
recording-consent notice visually. Not yet wired into any view — next
commits add it to Settings and SummaryPanel.

feat(ui): Anthropic provider + hosted-AI banner in Settings AI section (T10.1/T10.3/M3.3) 0a597f86f0

Adds "Anthropic (Claude)" to the provider select, a write-only masked
API key field (show/hide toggle) shown in place of the endpoint field
for that provider (Anthropic's endpoint is fixed server-side), and a
persistent "leaves this device" note.

Save is gated behind HostedAiBanner the first time the user selects a
hosted provider (Anthropic, or "custom" once its endpoint resolves
off-network) and hasn't acknowledged hosted_ai_acknowledged yet;
accepting persists the ack and completes the save in one step.

fix(llm): reset stale hosted endpoint when quick-switching away from Anthropic b986c570f7

apply_llm_provider_args now resets llm_endpoint to Ollama's local
default when switching to a non-Anthropic provider without an explicit
endpoint and the stored endpoint is still Anthropic's fixed hosted
URL. Prevents a future per-use provider switch (SummaryPanel) that
only sends `provider` from silently leaving llm_endpoint pointed at a
third party for a provider that has no business talking to it.

feat(ui): active-provider indicator + per-use quick switch in SummaryPanel (T10.3/M3.3) a211f88ad4

Adds a provider row above Summary (dropdown mirroring Settings' AI
options + a local/hosted badge sourced from llm_status) so it's always
visible which provider a summary/tag generation will actually use.
Generate/Regenerate and the quick switch itself route hosted selections
(Anthropic, or "custom" once its endpoint resolves off-network) through
the same HostedAiBanner one-time acknowledgment gate as Settings — the
generate-click gate is the one that actually matters, since selecting a
provider alone sends nothing; it's kept even though the quick-switch
already pre-empts Anthropic specifically.

Also drops a stale svelte-ignore comment (pre-existing, unrelated to
this change — eslint-plugin-svelte no longer flags that element) that
was failing `eslint .` for this file.

style(ui): prettier reflow in Settings.svelte AI banner copy 67fffb0203

style(ui): prettier reflow in HostedAiBanner copy a68407f059

docs(data-model): document hosted_ai_acknowledged in settings.json (M3.3) 56e739c6fe

Records the new Settings field alongside the rest of the llm block;
notes "openai" is documented but not yet wired (M3 scope is Anthropic).

Merge branch 'worktree-agent-af5a53986b9441608' into feature_chore_bug_005 e966181ab8

# Conflicts:
#	src-tauri/src/llm/mod.rs
#	src/lib/views/Settings.svelte
#	src/lib/views/SummaryPanel.svelte

feat(transcription): add multilingual/language fields to ModelInfo+Settings (T8.7, M4.2) 6bc0949e7e

feat(transcription): multilingual model catalog entries (T8.7, M4.2) 37a6dd172d

feat(transcription): whisper language catalog for Settings dropdown (T8.7, M4.2) 7f88101a79

feat(transcription): wire whisper language param through Transcriber trait (T8.7, M4.2) 496a8aa29b

feat(transcription): thread language param through OnnxTranscriber (ignored on NPU/DirectML, T8.7) 1fb1da0946

feat(storage): persist requested language at meeting creation (T8.7, M4.2) 66d9eff2f9

feat(core): track resolved per-meeting language on RecordingSession (T8.7, M4.2) 75ca3df0a0

fix(diarization): set multilingual:false for the shared ModelInfo shape (T8.7) 7675e0467e

feat(core): register list_whisper_languages Tauri command (T8.7, M4.2) 34fff3f7de

feat(transcription): wire language selection through recording/reprocess/recovery (T8.7, M4.2) 7490ff5db4

feat(ui): typed API surface for whisper language selection (T8.7, M4.2) 4c00496c09

feat(ui): load language catalog + setWhisperLanguage in settings store (T8.7, M4.2) 489271964f

feat(ui): pass configured whisper_language when starting a recording (T8.7, M4.2) dc969df792

docs(api): document whisper language selection contract surface (T8.7, M4.2) 2cdae9b20d

feat(ui): Transcription Language picker in Settings > Hardware (T8.7, M4.2) e6e995efe0

feat(ui): thread optional language override through meetings.reprocess (T8.7, M4.2) 7bff39271c

feat(ui): show meeting language badge + reprocess language picker (T8.7, M4.2) 353d582e96

fix(test): add missing language field to NewMeeting in smoke test (T8.7) 7ebd34ae08

chore(sync): enable tokio io-util/net for disk-streamed chunked upload (M4.1) be025bbd6c

Needed for AsyncReadExt/AsyncSeekExt/BufReader used to stream .wav
recordings off disk in fixed-size chunks instead of buffering the
whole file in memory (T9.2 refinement, FR-SYNC-5).

feat(sync): chunked/resumable upload for large recordings (T9.2, M4.1) 2cc48c9d4d

Recordings are now native-quality (~50-100 MB) and put() used to buffer
the whole file into memory with a single PUT/upload call; OneDrive/Graph
also caps a single PUT at 250 MB. This replaces that with disk-streamed,
chunked uploads on both sync backends (FR-SYNC-2/5):

- Both WebDavTarget::put and OneDriveTarget::put now stream the file off
  disk in fixed-size buffers (tokio::fs::File + BufReader) instead of
  tokio::fs::read()'ing it whole — memory use is O(chunk), not O(file
  size), for every upload, large or small.
- Files at or below LARGE_FILE_THRESHOLD (8 MiB) still take a single
  streamed PUT; only large artifacts (in practice, .wav recordings) take
  the chunked path, so small transcript/notes/summary uploads are
  unaffected.
- WebDAV (Nextcloud/ownCloud): implements the chunking-v2 protocol —
  MKCOL an upload collection keyed deterministically off the remote
  path's sha256 (stable across retries), PUT lexically-sortable parts,
  MOVE the virtual `.file` to assemble server-side. A retry PROPFINDs
  the collection first and skips any part already landed, so a
  partially-uploaded large file resumes instead of restarting at byte 0
  — genuine mid-file resume, not just chunk-level retry. Generic WebDAV
  targets (Seafile, Synology, unbranded servers) have no equivalent
  server-side assembly endpoint, so they fall back to one streamed PUT
  above the threshold too — memory-safe, just not chunk-resumable
  (documented ponytail simplification).
- OneDrive/Graph: implements the createUploadSession + Content-Range
  byte-range PUT flow (chunks capped at 10 MiB, a multiple of Graph's
  required 320 KiB granularity). A failed chunk is retried a few times
  within the same put() call. ponytail-documented ceiling: the session
  URL isn't persisted on the sync_jobs row, so a retry from a *later*
  pump cycle (e.g. after an app restart) starts a fresh session and
  re-uploads from byte 0 rather than resuming — true cross-attempt
  resume would need a sync_jobs column, left as a follow-up.
- Progress is reported via the existing ProgressSink after each chunk,
  not just once at the end, so the UI sees steady movement on a large
  upload (FR-SYNC-11).
- OneDriveTarget's Graph URLs are now built from a `graph_base()` helper
  (overridable via WA_GRAPH_BASE_URL, unset in production) so the
  chunked session flow can be exercised against a local mock in tests.

Tests (all against small, in-process, dependency-free mock servers —
std::net only, no new crates, same pattern as oauth::LoopbackRedirect):
- nextcloud_chunked_upload_assembles_and_resumes: multi-chunk upload
  assembles byte-for-byte, then a resumed upload with one chunk
  pre-seeded skips exactly that chunk.
- small_file_skips_chunking_even_on_a_chunking_capable_target: a small
  file never takes the chunked path.
- onedrive_chunked_upload_via_graph_session_mock: multi-chunk Graph
  upload session assembles byte-for-byte with per-chunk progress.
- parse_chunk_sizes_extracts_href_and_length_ignoring_namespace_prefix
  and chunk_name_is_zero_padded_and_lexically_sortable: pure unit tests
  for the PROPFIND-response scraper and chunk-naming scheme.

Skip-if-unchanged (SHA-256, in storage::upsert_sync_job) and the
exponential-backoff retry queue (storage::claim_due_sync_jobs) are
untouched — this only changes how SyncTarget::put moves bytes.

Verified: cargo fmt clean; cargo clippy --features sync and --features
mcp both clean (-D warnings); cargo test --lib (default features:
audio, cpu-transcription, diarization, pst, sync, npu) 165 passed, 0
failed, 7 ignored (unrelated hardware-gated tests); cargo test --features
sync --lib: 18 passed, 0 failed, 1 ignored (webdav_round_trip, opt-in
live-server test per existing convention).

fix(ui): compute activeModel via $derived instead of invalid {@const} placement (T8.7) e7cc433aff

Merge branch 'm4-2-work' into feature_chore_bug_005 4e33e7d84c

fix(transcription): resolve_language normalizes case-insensitive "en" match (T8.7, M4.2) 40709b257d

resolve_language(Some("EN"), false) was passed through unchanged instead of
being normalized to lowercase "en" - the English-only-model guard only fired
when the requested language *differed* from English, not when it matched with
different casing. Also fixes cargo fmt drift in mod.rs/npu.rs left over from
the M4.2 worktree (stopped mid-verification per session instruction before
running fmt).

feat(sync): Dropbox and Box upload targets (T9.10, M4.3) 6991c1d1bc

DropboxTarget: path-addressed like OneDrive/WebDAV; create_folder_v2 creates
the whole intermediate path in one call; upload-session chunking above
LARGE_FILE_THRESHOLD (start/append_v2/finish).

BoxTarget: Box addresses items by numeric ID, not path, so ensure_dir/exists/
put all walk (and lazily create) the folder chain from root ("0") by listing
each level's children. Always uploads via Box's session API regardless of
file size rather than its simple multipart endpoint, since the session API
takes plain PUT bodies (consistent with every other target here) and needs
no new reqwest feature; Box computes and returns each part's digest, so no
local hashing is needed either.

Both follow the same documented ceiling as OneDriveTarget's put_chunked
(M4.1): the upload-session id lives only for one put() call, not persisted
across a durable-queue retry after a restart.

Tests: in-process std::net mock servers for both providers (same pattern as
the existing MockNextcloud/MockGraph), each exercising a real multi-chunk
upload end-to-end.

feat(calendar): add graph-calendar OAuth provider (T8.9, M4.4) 83cb30ef0e

chore(sync): expose resolve_access_token to crate for calendar reuse (M4.4) 8a80580851

feat(calendar): GraphSource for MS Graph calendar import (T8.9, M4.4, FR-CAL-6) d407be8bb0

feat(models): add graph_calendar Settings fields (T8.9, M4.4) ef6bb28f3e

feat(commands): MS Graph calendar link/import/disconnect + egress allowlist (T8.9, M4.4, FR-CAL-6) d81b4726f9

chore(lib): register MS Graph calendar commands (T8.9, M4.4) 3d90265e8f

style(calendar): cargo fmt aa5ae127b3

style(commands): cargo fmt ce4c54c93b

style(sync): cargo fmt a48550da1e

docs: MS Graph calendar commands/events + fix stale CalendarSource trait signature (T8.9, M4.4) 7df76dff00

docs(roadmap): mark M4 items shipped, M4.4 MS Graph calendar source complete b14cba2a49

test(commands): cover graph_calendar_enabled in the privacy egress allowlist test (M4.4) 1cf0be1259