澄境筆記 0.10.20

澄境筆記 0.10.20

純本地端模式（macOS／Windows）

設定最上方新增「連線與隱私 → 純本地端模式」，預設關閉。開啟後，澄境只允許軟體更新檢查及安裝檔下載連外，其餘應用網路請求封鎖。

• Google 同步與雲端復原、AI Provider／模型下載、第二大腦、社群、許願池、網頁匯入及 MCP 外部工具連接反灰停用。為避免模型載入時補抓遠端檔案，本模式也暫停本機 AI 入口。
• 本地筆記、白板、看板、待辦、附件、本地檔案匯入匯出與本地備份保持可用。
• 切換時先儲存本機變更，再重新開啟澄境，以結束既有資料流、工作程序及連線。若儲存失敗，不會假裝切換成功。
• 限制由桌面主程式管理，在介面與背景功能啟動前載入，不依賴按鈕是否反灰。
• 一般網路工作階段全面禁止遠端資源，包括圖片、媒體、iframe、fetch 與 WebSocket。原生 AI、Google、匯入及排隊中的同步也有獨立攔截，進行中的下載與上傳會取消。
• 更新使用獨立、不永久保存的工作階段，只允許唯讀取得澄境官方發布資訊與安裝檔；一般功能不能借用更新例外連線。
• 不刪除筆記、雲端資料、帳號綁定或既有設定。關閉模式也會先重開，之後原先啟用的同步才恢復，離線變更仍會保留。

驗證與範圍

已在 macOS 的獨立測試資料環境驗證：原生請求及雲端操作入口阻擋、下載資料流中止、遠端圖片與新 WebSocket 阻擋、重開後限制仍有效、拒絕的測試網址未進入 DNS 解析、更新檢查及 GitHub 安裝檔下載轉址正常、本地附件讀取、本地備份寫入，以及筆記跨模式切換保留並進入完整備份。另有前端與桌面單元測試，發版流程會對 macOS 封裝成品重做原生驗證。Windows 共用相同主程式與限制；本機未進行 Windows 實機操作驗證。

這是澄境電腦版的連線限制，不是整台電腦的防火牆，也不是第三方資安認證。其他程式或作業系統的連線不受此開關控制。尤其本地備份若放在 Google Drive、OneDrive 等同步資料夾，其他軟體仍可能自行上傳；公司設備應選真正的本機資料夾。Android 本次沿用既有功能，尚未開放這個開關，不能宣稱具有相同限制。

English

Local-only mode for macOS and Windows

A new Connections & Privacy → Local-only mode switch appears at the top of Settings. It is off by default. When enabled, only software-update checks and installer downloads can connect; other ChengJing network requests are blocked.

• Google sync and cloud recovery, AI providers and model downloads, Second Brain, community, Wish Pool, web import and external MCP connections are disabled and dimmed. Local AI entry points are also paused to prevent model-loading fallback downloads.
• Local notes, whiteboards, kanban boards, tasks, attachments, file import/export and local backups remain available.
• Switching saves local changes and restarts ChengJing to end existing streams, workers and connections. A failed save does not report a successful switch.
• The desktop main process loads the policy before the UI or background managers start. Enforcement does not depend on disabled buttons.
• The ordinary network session blocks remote resources, including images, media, iframes, fetch and WebSockets. Native AI, Google, web import and queued sync operations have additional guards; in-progress transfers are cancelled.
• Updates use a separate, non-persistent session restricted to read-only official release metadata and installer assets. Other features cannot borrow this exception.
• Notes, cloud data, account links and existing settings are not deleted. Turning the mode off also restarts before previous cloud features resume; offline edits remain recorded.

Verification and limits

Native macOS tests use an isolated profile and verify blocked network requests and cloud IPC, transfer cancellation, remote images and new WebSockets, persistence after restart, denial before DNS resolution, successful update metadata and installer redirects, local attachments, local backups, and notes preserved across the switch and included in a complete backup. Frontend and desktop unit tests are included; release CI repeats native checks against the packaged macOS app. Windows shares the same main-process enforcement, but has not been manually exercised on a local Windows device for this change.

This controls ChengJing desktop, not the entire operating system or other applications, and is not an independent security certification. Backup folders managed by Google Drive, OneDrive or another sync application may still be uploaded by that application; use a genuinely local folder on company devices. Android retains its existing behavior and does not expose this switch in this release.