ijihun-planner-studio
v0.1.12
Published
A local owner-only timebox and Mandarart planner with Apple Reminders, autosave, and PDF output.
Downloads
1,615
Maintainers
Readme
Planner Studio
Owner-only local planner for timeboxing, Mandarart planning, Apple Reminders, autosave, and PDF output.
Run
npm install -g ijihun-planner-studio
planner-studio serve --port 4179Open http://127.0.0.1:4179/.
Owner Login Setup
Create .env.local in the working directory. The setup command reads the password from stdin and stores only a scrypt hash plus a session signing secret.
planner-studio setup --email [email protected] --env .env.local < password.txt
chmod 600 .env.localRequired environment values:
[email protected]
PLANNER_PASSWORD_HASH=scrypt$...
PLANNER_SESSION_SECRET=...
PLANNER_COOKIE_SECURE=0
PLANNER_REMINDERS_BRIDGE_ROOT=/Users/ijihun/apps/icloud-reminders-google-syncUse PLANNER_COOKIE_SECURE=1 only when the app is served over HTTPS. The default server binds to 127.0.0.1.
Security Notes
- The owner password is never shipped in the browser bundle.
- The app uses an HttpOnly
SameSite=Laxsession cookie and requires a CSRF header for state-changing API calls. - A new device can create a 10-minute, one-use QR login request. An already logged-in device must scan and approve it before the new device receives a session.
- Security headers include CSP,
X-Frame-Options: DENY,X-Content-Type-Options: nosniff,Referrer-Policy: no-referrer, and a restrictivePermissions-Policy. - Planner content is stored by the authenticated local server in
data/planner-state.json, with a browser localStorage copy used only as a fallback cache.
