About MoodHaven Journal

Milestones

1. Idea Born

   Mar 2025

   Ken conceives MoodHaven after searching for a safe journaling space.

2. Alpha Launch

   Aug 2025

   First alpha builds — a quiet build-in-public project rather than a launch.

3. Feature Refinement

   Oct 2025

   Implemented privacy-first encryption, custom prompts, and mood tracking.

4. v0.1.0

   Initial release

5. v0.2.0

   Calendar heatmap — monthly view colour-coded by average daily mood

6. v0.2.1

   Journal save freeze — create_entry and update_entry were calling get_entry internally, causing a non-reentrant std::sync::Mutex deadlock; fixed by querying directly on the existing connection

7. v0.2.2

   Settings page tab structure: General, AI, Appearance, Privacy, Health

8. v0.3.0

   First-run setup wizard — Welcome, password creation, storage backend selection, optional import

9. v0.3.1

   Encrypted export — .moodbloom files use AES-256-GCM envelope (moodbloom-encrypted-v1 format)

10. v0.3.2

    7 journal templates — Gratitude, Happiness, Rest & Recovery, Grounding, Daily Reflection, Goals & Dreams, Free Write

11. v0.4.0

    Multiple journals (Books) — named, colour-coded journals with emoji; books SQLite table; book_id column on entries

12. v0.5.0

    Hashtag auto-extraction — tags parsed from entry content on save and stored in entry_tags table; surfaced in timeline

13. v0.6.0

    Local peer sync foundation

14. v0.6.1

    QR code / PIN pairing — devices exchange a 6-digit PIN (or scan a QR) to establish trust; no manual IP entry

15. v0.7.0

    Mar 2026

    Encrypted peer sync engine — TCP manifest-diff sync between trusted LAN devices with AES-256-GCM transport and last-write-wins conflict resolution

16. v0.7.1

    Mar 2026

    STT transcript formatting — 3-layer privacy ladder. Voice recordings now produce clean, formatted journal prose instead of raw whisper output. Layer 1 (always on) removes filler words, collapses false starts/repetitions, and adds paragraph breaks using whisper timestamp data. Layer 2 (optional, Ollama) applies local LLM formatting with no data leaving the device. Layer 3 (optional, OpenAI BYOK) provides cloud-quality polish with explicit separate consent.

17. v0.7.2

    Mar 2026

    Microphone permission modals. MicrophonePermissionModal (pre-OS-prompt consent) and MicrophoneBlockedModal (platform-specific unblock instructions for macOS, Windows, Linux) handle Tauri WebView permission quirks where navigator.permissions may return 'denied' before the user has ever been prompted.

18. v0.7.3

    Mar 2026

    SetupScreen component extraction. The first-run wizard is now composed of 10 focused step components (WelcomeStep, PasswordStep, RecoveryStep, SecurityStep, StorageStep, DevicesStep, SyncFromPeerStep, ImportStep, SourceStep, CompleteStep) replacing the previous 1200-line monolith. SetupScreen is now an orchestrator holding shared wizard state.

19. v0.7.4

    Mar 2026

    Reading time estimate. Word count bar shows · N min read next to word count once an entry reaches 200 words (1 min per 200 words, ceiling).

20. v0.7.5

    Mar 2026

    Time Capsule feature. Seal any journal entry until a future date — choose a Letter to yourself or Vault type, pick the reveal date, and the entry disappears from the timeline. On the next app unlock after the date passes, a reveal modal surfaces the entry with its decrypted content and a mood delta chip comparing your mood then vs. now.

21. v0.7.6

    Mar 2026

    "Buy Me a Coffee" support link. A permanent link in the sidebar footer and the Settings → About section lets users support the project. The link opens buymeacoffee.com/moodbloom in the default browser.

22. v0.7.7

    Mar 2026

    Full rebrand: MoodBloom → MoodHaven Journal. The product is now named MoodHaven Journal (by Moodbloom). All user-facing strings, metadata, and technical identifiers updated across the entire codebase.

23. v0.7.9

    Mar 2026

    Structured logger with log level filtering. New src/lib/logger.ts wraps @tauri-apps/plugin-log with a unified logger.{debug,info,warn,error}(msg, ctx?) API. Optional structured context is serialized as key=value pairs appended to the message. Messages longer than 2000 characters are truncated. The module default level is warn.

24. v0.7.10

    Mar 2026

    SQLite WAL mode + cache pragmas. PRAGMA journal_mode = WAL, cache_size = -8000 (8 MB), and synchronous = NORMAL applied at startup. WAL mode enables concurrent reads during writes; 8 MB page cache reduces repeated I/O on analytics queries.

25. v0.7.11

    Mar 2026

    Bar-grow animation on Mood Distribution chart. Bars animate from scaleX(0) to scaleX(1) on mount via a new animate-bar-grow Tailwind utility (custom barGrow keyframe, compositor-only, no layout shift). origin-left ensures bars grow left-to-right.

26. v0.7.12

    Mar 2026

    Restructured src/lib/ from a flat ~40-file directory into services/ (IPC wrappers, crypto, sync, peer, storage) and utils/ (pure utilities: dateUtils, chartUtils, markdownUtils, metadataExtractor, transcriptFormatter, writingUtils, journalTemplates). No behavior changes — imports only.

27. v0.7.13

    Mar 2026

    Selective export. The Export section in Settings now lets you filter by tags, mood range, and date range before exporting. Exports with no filters applied are identical to the previous full export (WebDAV-safe). The Rust export_data command accepts an optional ExportFilter; the SelectiveExportPanel component handles the filter UI with live entry count preview.

28. v0.7.14

    Apr 2026

    Rust tests for time capsule commands. Six #[cfg(test)] unit tests added to src-tauri/src/commands/time_capsule.rs using an in-memory SQLite database: seal sets columns correctly, seal rejects past dates, seal double-seal guard (can't seal an already-sealed entry), unseal clears sealed_until and defaults capsule_type to 'anniversary', get_due_capsules returns past-due entries, get_due_capsules excludes entries whose month/day matches today.

29. v0.7.15

    Apr 2026

    Wear OS companion: polish pass. Addresses correctness and reliability issues across the Android phone bridge and Wear OS watch app. Key changes: AudioFrameParser extracted as a single parsing source of truth used by both WearListenerService (background) and WearPlugin (foreground); wire protocol constants consolidated into WearProtocol; BreatheSessionActivity busy-wait replaced with AtomicBoolean + Channel(CONFLATED) for correct pause/resume; OfflineQueue eviction changed from O(n) to O(1) ArrayDeque; SignalSender now retries with 250/500/1000 ms exponential backoff; MoodComplicationService adds 30-second SharedPrefs cache; HistoryAdapter extracted into MoodHistoryAdapter for reuse across HistoryActivity and HistoryFragment; MoodAdapter reuses existing GradientDrawable instead of allocating per bind.

30. v0.8.0

    Apr 2026

    Browser (web) port. MoodHaven Journal now runs in any modern browser. Open it from a corporate laptop, a borrowed machine, or any device without installing anything. Your journal stays encrypted end-to-end: the zero-knowledge model is unchanged — your password never leaves the browser tab.

31. vwebsite-0.2.0

    Apr 2026

    /download page. OS-aware CTA detects Windows/macOS/Linux and surfaces the right installer. Falls back to a GitHub releases link when no build is available for the detected platform. Full platform grid below the fold covers all six supported targets.

32. v0.8.1

    Apr 2026

    Android wear tile service. MoodTileService now uses BuildConfig.APPLICATION_ID instead of a hardcoded string, so a future applicationId rename will produce a compile error instead of a silent breakage.

33. v0.8.2

    Apr 2026

    Crypto key cache no longer stores plaintext password. The session key cache now uses a djb2 hash of the password as the Map key instead of the raw password string, preventing the user's password from persisting in the JS heap beyond the unlock operation.

34. v0.8.3

    Apr 2026

    ErrorBoundary component wraps each view and the root layout. Rendering crashes are caught, logged, and present a "Reload" button instead of a blank screen.

35. vUnreleased

    Automated pentest harness (scripts/pentest.sh). Six-phase local security scan: static analysis (cargo-audit, npm audit, semgrep), DAST (OWASP ZAP + ffuf with dynamic Vite port detection), IPC fuzzer (119 Tauri commands, 1 558 cases via Playwright browser-invoke shim), AES-256-GCM crypto oracle prober, peer sync TCP fuzzer, and finding aggregator. Results written to pentest-results/YYYYMMDD_HHMMSS/ as JSON + Markdown. Each tool is skipped gracefully with install hint when not present. Sync fuzzer uses concurrent port scanning (100 workers) across the full 44 000–44 999 range and validates that a port speaks the MoodHaven protocol before fuzzing it.

36. v0.8.4

    Apr 2026

    @vitejs/plugin-react bumped from 4.3.1 → 6.0.1 to match vite 8 peer requirements.

37. v0.8.5

    Apr 2026

    Peer sync engine module split: peer_sync_engine.rs (2 554 lines) decomposed into a proper Rust module directory. Sub-modules: protocol.rs (wire types + port formula), crypto.rs (ECDH key derivation + AES-GCM helpers), connection.rs (TCP frame I/O), conflict.rs (DB helpers + LWW upsert logic). mod.rs retains the orchestration layer, Tauri commands, and unit tests. Wire format, transport key derivation, and session protocol sequence are bit-for-bit identical to 0.8.4 — no user-visible behaviour change.

38. v0.8.5.1

    Apr 2026

    Android Wear companion — tile tap regression: MoodTileService was using BuildConfig.APPLICATION_ID (resolves to com.moodhaven.app) as the class path for TileActionActivity. The activity lives in package com.moodbloom.wear, so the correct fully-qualified name is com.moodbloom.wear.TileActionActivity. Tile mood taps work correctly again.

39. v0.9.0

    Apr 2026

    Speech to Text settings tab: A dedicated "Speech to Text" tab is now the 9th settings tab. Currently shows a placeholder; model download UI ships in v0.9.1.

40. v0.9.1

    Apr 2026

    Unlock blocked on first launch (v0.9.0 regression): verify_password, unlock_app, and lock_app were registered in invoke_handler! but missing from app-commands.toml. Tauri's ACL blocked them before the Rust code ran, producing "An error occurred. Please try again." every time a user tried to unlock. Ten other commands were also missing from the ACL and are now added.

41. v0.9.2

    Apr 2026

    STT recording strip: A live recording indicator now appears below the editor toolbar while dictating — waveform bars, MM:SS elapsed timer, Stop and Cancel buttons. Uses prefers-reduced-motion for the waveform fallback.

42. v0.9.3

    Apr 2026

    F4 — Mood sparkline: A 7-day inline SVG sparkline appears in the sidebar (desktop only) showing recent mood trend with mood-colored dots and a connecting path. Silent on no data.

43. v0.9.4

    Apr 2026

    Blog — 7 new posts: Hydrated the blog from Substack with posts covering the origin story, encryption model, privacy philosophy, AI insights architecture, self-hosting rationale, build reflections, and mobile alpha — each with unique hero images.

44. v1.0.0

    May 2026

    dompurify 3.3.3 → 3.4.0 (GHSA-39q2-94rc-95cp).

45. v1.1.0

    May 2026

    StillHaven — somatic companion module built into all desktop and browser builds. Uses bilateral audio stimulation (alternating left-right tones, 0.5–2.0 Hz) to help settle the nervous system before journaling. Opt-in: enable in Settings → Health to unlock.

46. v1.2.0

    May 2026

    Voice memo draft pipeline (Phase 5) — watch recordings now surface as reviewable draft cards in the Timeline before being published to the journal. Each draft shows transcription preview, inferred mood, biometric context chip, and hashtag suggestions. Full TipTap editor with MoodSelector for editing before publish.

47. v1.1.0.1

    May 2026

    Split RichTextEditor.tsx (1 424 lines) into EditorToolbar, EditorRecording, EditorLinkDialog, EditorIcons, and EditorStyles.css — orchestrator now ~320 lines

48. v1.2.1

    May 2026

    [HIGH] Path traversal in media storage: get_media_dir now validates entry_id before using it as a filesystem path component. A malicious trusted peer could previously create directories outside the app sandbox via a crafted entry ID in peer sync. Entry IDs are now checked for traversal characters (/, \, .., NUL bytes) and the final path is canonicalized against app_data_dir.

49. v1.3.0

    May 2026

    Word count tracking — word_count column added to journal_entries via additive DB migration. JournalEntry.wordCount exposed on the TypeScript type; populated from countWords() on every save and import. Displayed below tags in the Timeline entry cards.

50. v1.3.0.1

    May 2026

    Live HR adaptation count in StillHaven summary — when a session was adapted to biometric signals from the Wear OS watch, the summary screen now shows "Session adapted N times to your biometrics".

51. v1.3.1.0

    Jun 2026

    2FA backend enforcement — unlock_app now verifies that both authentication factors were completed in Rust before granting access. Previously, a compromised WebView could bypass 2FA by calling unlock_app directly after verify_password. A new TwoFactorPendingState managed struct tracks auth progress (verify_password → verify_2fa_totp or verify_backup_code → unlock_app) and rejects out-of-order calls.

52. v1.3.2.0

    Jun 2026

    Journaling streak counted wrong for users who skip today — the "allow missing today" path in the streak calculation used the wrong date for comparison, making it unreachable; a user who last journaled yesterday now correctly shows a streak of 1+ instead of 0.

53. v1.4.0

    May 2026

    StillHaven Effect card — Session History now shows a per-protocol table of average activation drop and post-session mood, and a recommendation chip ("X tends to work best for you") once you have 3 or more sessions with a linked journal entry. still_get_effect_stats Rust command added.

54. v1.5.0

    Jun 2026

    Wrist Loop foundation — watch can now send a still_trigger signal to request a StillHaven protocol start on desktop. New useWristLoop hook manages pending-trigger state; WristLoopBanner renders a dismissable toast with "Start StillHaven" / "Not now" actions. Signal-to-session links stored in new still_signal_links table via still_link_signal_to_session Rust command.

55. v1.6.0

    Jun 2026

    Forest and Sky environments — two new immersive StillHaven environments: forest (nature sounds, green palette) and sky (ambient tones, blue palette). Selectable from the environment picker before starting a session.

56. v1.6.0.1

    Jun 2026

    CI: move still_link_signal_to_session before #[cfg(test)] mod tests in db/still.rs — Clippy 1.96 items_after_test_module lint caused build failures on all 3 platforms after the v1.5.0/v1.6.0 rebase merge.

57. v1.7.0

    Jun 2026

    Cloud sync: Dropbox + Google Drive — connect your account in Settings → Sync and push/pull your encrypted backup blob. OAuth 2.0 PKCE flow; tokens stored encrypted in SQLite; WebDAV remains available. No MoodHaven servers involved.

58. v1.7.1

    Jun 2026

    Mobile layout gates — responsive layout extended to cover iOS and narrow browser viewports; dead-code sweep removes unused exports, types, and components.

59. v1.7.2

    Jun 2026

    PT1–PT3 findings — encrypt_in_place WAL/SHM retry loop + Windows rename retry (SQLC-001); PBKDF2 key wrapped in Zeroizing<String> (SQLC-003); public key removed from UDP probe broadcasts (RECON-003); pubkey_hint removed from mDNS TXT (RECON-002); PIN removed from QR payload (PAIRING-C06); get_entries_on_this_day added to ACL (ACL-001).

60. v1.7.3

    Jun 2026

    PT4 findings — verify_password PBKDF2 key and base64 hash string wrapped in Zeroizing (MEM-001); DbKeyState::get() key copy zeroized before encrypt_in_place (MEM-002); three stale ACL entries removed from app-commands.toml (ACL-002).

61. v1.7.4

    Jun 2026

    PT5 findings — write_text_file path blocklist extended to cover Windows Startup and System32 attack paths (C1); factory_reset now deletes WAL/SHM sidecar files and the media preview cache (C3); PBKDF2-derived key material in two_factor.rs, data_management.rs, and media.rs wrapped in Zeroizing for stack overwrite on drop (A5).

62. v1.7.5

    Jun 2026

    SQLCipher at-rest encryption — PBKDF2-derived key material in data_management.rs and journal.rs wrapped in Zeroizing<[u8; 32]> for guaranteed stack overwrite on drop; TCP sync server start hoisted into unlock_app to prevent sync before session is fully authenticated.

63. v1.8.0

    Jun 2026

    Activity tagging — tag journal entries with what you were doing (Work, Exercise, Social, and more). Custom activities supported (up to 50). Filter the All Entries timeline by activity. Powered by 7 new Tauri commands and a new activities + entry_activities schema.

64. v1.8.1

    Jun 2026

    Update authenticity — the in-app updater now verifies the minisign signature of a downloaded build (not just its SHA-256 checksum) before installing; a missing or invalid signature aborts the update. SHA-256 remains as an additional integrity check.

65. v1.8.2

    Jun 2026

    Seamless silent updates on Windows — installing an in-app update no longer opens the NSIS wizard. Because MoodHaven installs per-user into %LOCALAPPDATA%, the updater now runs the installer silently (/S, no UAC prompt) and relaunches the app automatically once the new files are in place. Your settings and encrypted database live in %APPDATA% and are untouched by install/uninstall, so they carry over with no action. Linux AppImage updates were already in-place and silent; macOS still opens the disk image (silent install is gated on notarization — tracked in the roadmap).

66. v1.9.0

    Jun 2026

    BYO-Cloud folder sync (desktop) — back up to any folder your own cloud client already syncs (Dropbox, Google Drive, OneDrive, Syncthing, …). Encrypted client-side using the same AES-256-GCM envelope as the .moodhaven export, so the provider only ever sees ciphertext. (#149)