aboutsummaryrefslogtreecommitdiffstats
path: root/docs/superpowers/specs/2026-08-24-signatures-design.md
AgeCommit message (Collapse)AuthorFilesLines
48 hoursdocs(specs): guard the signature splice against deleting the user's textDanilo M.1-5/+56
Finding a "-- " delimiter is not enough to authorise removing what follows it. The block is replaced only when its text matches one of the signatures on disk; otherwise the new signature is inserted and nothing is removed. "-- " can reach the buffer without the user ever choosing a signature, most plausibly pasted in with quoted text from another client, and the unguarded scan would have deleted everything after it silently. The failure is now directional: a block that matches is replaced, and one that does not produces a second signature, visible in the editor and one undo away. A wrong guess adds text rather than losing it. Two markers were considered for the same problem and refused, both recorded with the reasons. A zero-width character ships in the sent message, fingerprinting the client in outgoing mail, and has to survive the draft round trip through GMime, quoted-printable and MimeParser, which is the pipeline that normalises such characters away. A doubled delimiter is not the RFC 3676 separator, so no receiving client would recognise the signature, and it would not have caught the pasted-text case that prompted it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KEcn3u19xPqv6ggD15PG4c
48 hoursdocs(specs): design signatures, item 152Danilo M.1-0/+260
One markdown file per signature under ~/.config/qtmaildir/signatures/, spliced into the composer's buffer and switched from a control on the editor bar. MessageBuilder needs no change: it already builds text/plain from markdownBody verbatim and text/html from MarkdownRenderer over the same string, so one markdown signature in the buffer yields both forms correctly. That is the "transparent to the user" requirement the note asked for, and it is why a two-file text/HTML variant was dropped after being chosen: it buys designed HTML signatures at the cost of the signature no longer being visible while composing. The switch stays stateless. seedBody() deliberately refuses to track "my text" and "the quote" as separate pieces, and a toggle cannot duck that question the way the quote did; it answers it by scanning for the last "-- " block not followed by quoted lines, so nothing can desync from the undo stack. That same scan is what lets signature_position offer both end (the default) and above_quote over one implementation. The per-account key does not reopen the note's constraint: an account seeds the choice, the switch keeps every signature reachable, and the automatic follow stops once the user picks one. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KEcn3u19xPqv6ggD15PG4c