Kanso

The project

What it does

1. 01Writing that stays out of the way: Markdown pairs and continues as you type, [[wiki-links]] autocomplete into backlinks and unlinked mentions, - [ ] task @2026-10-25 becomes a dated task with reminders, and the mic dictates into the cursor with NVIDIA's Parakeet model running on the CPU — nothing leaves the device.
2. 02A SQLite library with trigram full-text search, every replaced version kept in history (whether the edit came from you, the API, sync or an import) and a daily backup kept for two weeks.
3. 03Sync where the server is blind: notes, titles, IDs and attachments are sealed with XChaCha20-Poly1305 under keys derived from an Argon2id master key that never leaves the device; a Worker stores ciphertext in D1 and R2, and on a conflict the newer edit wins while the loser stays in the note's history.
4. 04Publishing as an encrypted link: the page is sealed with its own AES-256-GCM key and the key rides in the URL fragment, which browsers never send — the server keeps a copy it cannot read.
5. 05Agents on a short leash: a local REST API compatible with Inkdrop's plus a native MCP endpoint on port 19840, short-lived tokens scoped to chosen notebooks, and suggested edits that wait in a review queue for Apply. Locked, trashed and #ai-exclude notes are never sent.
6. 06Locked notes (my contribution): a note sealed with its own password — Argon2id at 256 MiB into XChaCha20-Poly1305, bound to the note's ID — whose plaintext history is erased on lock, which travels through sync unchanged and opens on any device with the same password, or with Touch ID on a Mac.

Screens

How it works

How the data moves

The core paths through the system — a dot travels each hop, and the caption says what happens there.

From the code

A few lines that matter

fn seal_with_nonce(&self, note_id: &str, body: &str, nonce: &[u8; NONCE_LEN]) -> Envelope {
    let plaintext = Zeroizing::new(
        serde_json::to_vec(&Sealed {
            body: body.to_owned(),
        })
        .expect("a string serializes"),
    );
    Envelope {
        v: FORMAT_V1,
        salt: b64(&self.salt),
        m: self.params.m_kib,
        t: self.params.t,
        p: self.params.p,
        data: b64(&seal_raw(&self.key, nonce, &aad(note_id), &plaintext)),
    }
}

pub fn parse_hex(text: &str) -> Option<u32> {
    let text = text.trim();
    let digits = text.strip_prefix('#').unwrap_or(text);
    if !digits.chars().all(|c| c.is_ascii_hexdigit()) {
        return None;
    }
    let value = u32::from_str_radix(digits, 16).ok()?;
    match digits.len() {
        6 => Some(value),
        // Each digit doubled: `#fa0` is `#ffaa00`.
        3 => {
            let (r, g, b) = ((value >> 8) & xf, (value >> 4) & xf, value & xf);
            Some(((r * x11) << 16) | ((g * x11) << 8) | (b * x11))
        }
        _ => None,
    }
}

Decisions

Calls that shaped it