chore(main): release 2.0.0

[github-actions]

🤖 I have created a release beep boop

2.0.0 (2026-03-16)

⚠ BREAKING CHANGES

• first public stable release

Features

• add automated release workflow triggered by version tags (b3eac0a)
• add dark theme support (05b190f)
• add dark theme support with persistent toggle (9cf2d67)
• automate releases with release-please (03623b6)
• constitution alignment — type safety, quota enforcement, code hygiene (4a14873)
• default dark theme to OS preference (4ea07f9)
• default dark theme to OS preference when no saved setting (07c19e3)
• enable dynamic client registration for MCP OAuth (861de24)
• enable dynamic client registration for MCP OAuth (e6ffdf3)
• expose OAuth sessions in Keys UI with disconnect support (d5bcaa1)
• expose OAuth sessions in Keys UI with disconnect support (f3caabc)
• improve system status modal layout and add pagination (b7242cf)
• improve system status modal layout and add pagination (ac1d96c)
• initial public release at v1.0.0 (54d6703)
• proper GitHub releases with release-please and versioned Docker tags (c75f32e)
• replace browser alerts with toast notifications (2761926)
• us1: complete type safety — zero mypy errors across all modules (31fb70b)
• us2,us3: security gaps closed + code hygiene complete (228a9bb)

Bug Fixes

• add 'none' to token_endpoint_auth_methods_supported for public clients (b734e2a)
• add 'none' to token_endpoint_auth_methods_supported for public clients (e7965c4)
• bump version to 1.0.1 (f99f864)
• cli: add from future import annotations to fix Python 3.13 compat (acc11ba)
• compute folder size in query_file_list used by web UI (0164dca)
• correct release-please manifest to bootstrap at v1.0.0 (6afd7ac)
• correct URL state when closing note viewer (043ce26)
• encode navigation path in URL hash (4757059)
• encode navigation path in URL hash instead of sessionStorage (0455486)
• file sync duplicates, folder sizes, and system folder naming (0c88506)
• handle socket.io requests explicitly to avoid ASGI crash (177a4bb)
• handle socket.io requests explicitly to avoid ASGI crash (94649f8)
• handle socket.io requests to prevent ASGI crash (29d200f)
• implement Engine.IO v3 WebSocket stub to resolve sync failures (5f2a56c)
• implement Engine.IO v3 WebSocket stub to resolve sync failures (de5022e)
• improve toast notifications for file operations (523e30b)
• improve toast notifications for file operations (5ad2a35)
• invalidate summary task when note pages change (951fab6)
• invalidate summary task when note pages change (f8f1b35)
• match device firmware folder names to prevent duplicate sync folders (e41007a)
• mount auth routes on MCP server for same-host OAuth discovery (a59ef21)
• mount auth routes on MCP server for same-host OAuth discovery (243ea50)
• mount auth routes on MCP server for same-host OAuth discovery (f500ffd)
• preserve original folder name casing from device (e9f2969)
• preserve original folder name casing from device (a665ecf)
• preserve original name for user folders sharing a system directory name (7f6fe44)
• preserve original name for user folders sharing a system directory name (2f1ebf3)
• prevent duplicate insights on note re-upload (02a57bb)
• prevent duplicate synced files and show correct folder sizes (88f86ff)
• prevent duplicate synced files and show correct folder sizes (a6a37c7)
• prevent duplicate synced files and show correct folder sizes (fc979a2)
• prevent theme icon flash on page load (dfc36d0)
• resolve merge conflict in ApiKeysPanel, add dark mode to sessions section (c822a9a)
• resolve SPA fallback routing conflict with MCP OAuth ASGI resource (9647225)
• restore navigation state on page refresh (e427758)
• restore navigation state on page refresh (025ba2f)
• restore navigation state on refresh (714282b)
• restore open note viewer on page refresh (9268e0c)
• restore open note viewer state on page refresh (df1c4e8)
• revoke access tokens immediately on OAuth session disconnect (589038a)
• revoke access tokens immediately on OAuth session disconnect (1acd5e4)
• serve JS/CSS with Cache-Control: no-store to prevent stale ES modules (1deb44f)
• show system folders (EXPORT, INBOX, SCREENSHOT) with their actual names (b7be03a)
• show system folders with their actual names (EXPORT, INBOX, SCREENSHOT) (893f12d)
• tests: distinguish is_file() vs direct stat() call to avoid Python 3.13 breakage (aaef83b)
• tests: make cleanup patch tests compatible with Python 3.13 (97ad2bb)
• tests: scope stat patch to .part. files to avoid breaking exists() on Python 3.13 (405beb4)
• trigger docker and pypi builds on tag push instead of release event (b0e2972)
• trigger docker and pypi builds on tag push, not release event (093e0f0)
• update test to expect original folder name casing (dc962ab)
• update tests to use file_id for summary UUID assertions (b595c19)
• use clean name-based URL paths for navigation state (8ba2b08)
• use device-compatible schedule API routes and WebSocket token auth (a9738a9)
• use device-compatible schedule routes and support token query param auth (ac2238a)
• use display names for web API immutability checks (ffc6c0b)
• use display names for web API immutability checks (0e184c6)
• use issuer_url to build login-bridge return_to URL (50d1c65)
• use issuer_url to build login-bridge return_to URL (fb4ad60)
• use real URL paths instead of hash for navigation state (e0745da)
• use stable file_id for summary UUID to prevent duplicates (baea270)

Documentation

• update MCP and security docs to cover API key auth (d059344)
• update spec files to reflect release-please implementation (981f77f)

---

This PR was generated with Release Please. See documentation.

[ddulic]

Closing — this is caused by the bootstrap feat!: commit already consumed in v1.0.0. Will resolve once PR #49 merges and the manifest is correctly anchored at 1.0.1.