feat(ai): complete Phase 4-5 — AI command execution + plugin bridge

.github/RELEASE.md

@@ -2,26 +2,72 @@
 
 ## Overview
 
-Releases are automated via GitHub Actions. When you push a tag starting with `v` (e.g., `v0.1.0`), the release workflow builds and publishes distributables for macOS, Windows, and Linux.
+Releases follow Git Flow and are fully automated via GitHub Actions.
+
+## Flow
+
+```
+develop → release/X.Y.Z branch → PR to main → merge
+  ↓ auto-tag.yml triggers:
+  1. Creates git tag vX.Y.Z from package.json version
+  2. Merges main → develop (keeps branches aligned)
+  ↓ release.yml triggers (on tag push):
+  3. Builds distributables (macOS, Windows, Linux)
+  4. Creates draft GitHub Release with artifacts
+  5. Posts tweet announcement
+```
 
 ## Creating a Release
 
 ```bash
-# 1. Update version in apps/desktop/package.json
-# 2. Commit the change
-git add apps/desktop/package.json
-git commit -m "chore: bump version to 0.1.0"
-
-# 3. Create and push the tag
-git tag v0.1.0
-git push origin main --tags
+# 1. Create release branch from develop
+git checkout develop
+git pull origin develop
+git checkout -b release/0.9.0
+
+# 2. Bump version in root package.json + apps/desktop/package.json
+# 3. Update CHANGELOG.md
+# 4. Commit and push
+git add -A
+git commit -m "chore(release): bump version to 0.9.0"
+git push -u origin release/0.9.0
+
+# 5. Create PR targeting main
+gh pr create --base main --title "chore(release): v0.9.0" --body "Release 0.9.0"
+
+# 6. Once CI passes and PR merges → tag + release + sync happen automatically
 ```
 
-The workflow will:
+The release workflow will:
+
+1. Validate tag matches `package.json` version
+2. Build packages for all platforms (macOS, Windows, Linux)
+3. Sign and notarize the macOS build (if secrets are configured)
+4. Create a draft GitHub Release with all artifacts
+5. Post tweet announcement
+
+## Versioning
+
+- **Format:** SemVer with `v` prefix — `v0.9.0`, `v0.9.1`, `v1.0.0`
+- **Tags are created ONLY by GitHub Actions** (auto-tag.yml)
+- **No manual tags** — the automation reads version from `package.json`
+
+## Tag Protection Rules (GitHub Settings)
+
+Configure in **Repository Settings > Rules > Tag protection rules**:
+
+| Setting           | Value                             |
+| ----------------- | --------------------------------- |
+| Tag name pattern  | `v*`                              |
+| Restrict creation | Enabled                           |
+| Allowed to create | GitHub Actions, Repository admins |
+| Force push        | Disabled                          |
+
+This prevents:
 
-1. Build packages for all platforms
-2. Sign and notarize the macOS build (if secrets are configured)
-3. Create a draft GitHub release with all artifacts
+- Manual tags outside the release flow
+- Force-pushing tags (rewriting release history)
+- Tags that don't follow SemVer
 
 ## Required Secrets
 

.github/workflows/auto-tag.yml

@@ -0,0 +1,59 @@
+name: Auto Tag & Sync
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+permissions:
+  contents: write
+
+jobs:
+  tag-and-sync:
+    if: github.event.pull_request.merged == true && startsWith(github.event.pull_request.head.ref, 'release/')
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GH_TOKEN }}
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Read version from package.json
+        id: version
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+
+      - name: Check tag doesn't already exist
+        id: check
+        env:
+          TAG_VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          if git rev-parse "v${TAG_VERSION}" >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create and push tag
+        if: steps.check.outputs.exists == 'false'
+        env:
+          TAG_NAME: ${{ steps.version.outputs.tag }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git tag -a "${TAG_NAME}" -m "Release ${TAG_NAME}"
+          git push origin "${TAG_NAME}"
+
+      - name: Merge main → develop
+        run: |
+          git fetch origin develop
+          git checkout develop
+          git merge main --no-edit
+          git push origin develop

.github/workflows/release.yml

@@ -10,7 +10,32 @@ permissions:
   contents: write
 
 jobs:
+  # ── Validate tag matches package.json ─────────
+  validate:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/')
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate tag matches package.json
+        env:
+          GIT_REF: ${{ github.ref }}
+        run: |
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+          TAG_VERSION=${GIT_REF#refs/tags/v}
+
+          if [ "$PACKAGE_VERSION" != "$TAG_VERSION" ]; then
+            echo "::error::Tag version (${TAG_VERSION}) does not match package.json (${PACKAGE_VERSION})"
+            exit 1
+          fi
+
+          echo "✓ Tag v${TAG_VERSION} matches package.json ${PACKAGE_VERSION}"
+
+  # ── Build for all platforms ───────────────────
   build:
+    needs: [validate]
+    if: always() && (needs.validate.result == 'success' || needs.validate.result == 'skipped')
     strategy:
       matrix:
         include:

.gitignore

@@ -39,3 +39,4 @@ npm-debug.log*
 # Claude cache (keep plans)
 .claude/plugins/
 .claude/statsig/
+.vercel

CHANGELOG.md

@@ -12,6 +12,51 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [0.9.0] - 2026-03-13
+
+### Added
+
+#### Website
+
+- Full website redesign with shadcn/ui + Magic UI
+
+#### Auth
+
+- Auth UX rethink with Enable Sync flow
+- Auth middleware fix: return 401 instead of 500 on invalid tokens
+
+#### Sync
+
+- Error propagation for sync failures
+- Exponential backoff on retry
+- Abort sync on logout
+- Typed token refresh
+- Sync onboarding prompt after 5 notes
+- Offline queue visibility in the UI
+
+#### AI Commands (Cmd+K v1)
+
+- Command panel for AI interactions
+- AI settings configuration
+- Keybindings for AI commands
+
+#### AI Knowledge (Cmd+K v2)
+
+- RAG-based knowledge retrieval
+- Ask Notes: query your own notes with AI
+- Related context suggestions
+
+#### AI Extensibility
+
+- Plugin API for AI commands
+- Presets import/export
+
+#### Documentation
+
+- API documentation
+
+---
+
 ## [0.1.2] - 2026-01-01
 
 ### Fixed