v1.5.1 - Chronica: guided setup & sync fixes

v1.5.0 - Chronica: faster sync, quick add, next 7 days & keyring secrets

Faster sync, quick add, next 7 days and keyring secrets

New

• Next 7 days: the 7 days pill (or u) lists the coming week, with a title per day.
• Event details: click an event to read its description.
• Quick add: type Lunch tomorrow 1pm-2pm or Dentiste demain 14h in the title field and press Enter. The date and times fill in; you still review and save.
• IPC for key bindings: omarchy-shell promaa.clock addEvent, quickAdd "Gym tomorrow 7am", nextEvent.
• CalDAV read: an entry with caldavUrl, username and password is read over CalDAV. The published .ics link becomes optional.

Faster

• Incremental sync: ICS ETag / Last-Modified, CalDAV getctag / sync-token, Google list ETag, JMAP CalendarEvent/changes.
• One long-lived helper process (fetch-events.py --serve) runs every sync and edit in turn, so two writes never race.

Fixes

• Settings changes from the panel (on/off, color, remove, add calendar) failed since v1.2.2; they are saved again.
• Two reminders due at the same time now both appear; events just after midnight get their reminder.
• VALUE=DATE-TIME events no longer show as all-day; VALARM text no longer replaces the description.
• Google: calendars with more than 250 events show all of them; read-only shared calendars no longer offer edit and delete.
• New RFC 5545 recurrence engine: BYSETPOS, BYMONTHDAY with BYDAY, INTERVAL on monthly rules, BYWEEKNO, BYYEARDAY, BYHOUR, RDATE. Checked against python-dateutil on 186 rules.
• The form refuses an end before the start; delete asks for a second click and shows errors.
• Google sign-in stops after an error or 10 minutes instead of waiting forever.

Privacy & security

• Passwords, JMAP tokens and the Google refresh token move to the desktop keyring (Secret Service, secret-tool) at the first sync. The JSON files keep "@keyring". Without a keyring, nothing changes.
• Passwords are never sent over http:// or to another host after a redirect.

Note: after the keyring move, an older version of the plugin cannot read "@keyring". Keep a copy of ~/.config/omarchy/calendars.json if you may downgrade.

Full Changelog: v1.4.5...v1.5.0

v1.4.5 - Chronica: recurring events on the right day across timezones

Recurring events land on the right day across timezones

Recurring events from .ics / webcal feeds were expanded after converting to your local time, but the repeat rule is written for the event's own timezone. When the two zones sit on opposite sides of midnight, or change daylight saving time on different dates:

• a Wednesday 15:00 New York series showed on Wednesday at 04:00 in Seoul instead of Thursday, and its first occurrence went missing;
• a series drifted by an hour whenever only one of the two zones changed daylight saving time.

Recurring events are now expanded in their own timezone and then converted to yours, so days, times, UNTIL limits, excluded dates and edited occurrences all line up. Google, JMAP and CalDAV-created events were not affected.

Full Changelog: v1.4.4...v1.4.5

v1.4.4 - Chronica: Outlook recurring edits, ICS durations & Google write access

Recurring events edited in Outlook no longer show twice

When a single occurrence of a series is edited, moved or cancelled, Outlook / Microsoft 365 (and any RFC 5545 feed) sends an override event with the same UID and a RECURRENCE-ID. Chronica now drops the occurrence the override replaces, so:

• an edited occurrence shows once, with its new details;
• a moved occurrence shows only on its new date;
• a cancelled occurrence disappears.

Fix and diagnosis by @michael-rowe (#17).

Event lengths from DURATION

Feeds that describe events with DTSTART + DURATION and no DTEND (university timetables, for example) now show the real length instead of a flat hour. By @Sabrefront (#7).

Adding and deleting Google events works

The Google sign-in asked for read-only access, so every add or delete on a Google calendar failed with 403 insufficientPermissions. It now asks for the calendar.events scope. By @iboard (#15).

If you use the Google Calendar API, sign in once more: click Reconnect in the plugin settings or run python3 ~/.config/omarchy/plugins/promaa.clock/google-auth.py. Syncing keeps working until you do; only adding and deleting need the new access.

Reminder notifications show a calendar glyph

Reminders now go through omarchy-notification-send with a Nerd Font glyph instead of a themed icon name that most icon themes lack, which drew a broken-image placeholder. By @Chase-Fournier (#9).

Under the hood

• The test suite runs on every push and pull request, and fails on leftover merge conflict markers like the one that broke v1.4.1 and v1.4.2.

Full Changelog: v1.4.3...v1.4.4

v1.4.3 - Chronica: calendar popup opens again

The calendar popup opens again

v1.4.1 and v1.4.2 shipped Panel.qml with a leftover git conflict marker. QML refused to parse the file, so the clock rendered in the bar but clicking it did nothing (#14). The marker is gone and the popup loads again.

Also fixed: the NEW EVENT header in the add-event form (title and the close button) was invisible, because an anchor inside a Row made Qt disable the whole row.

Both fixes by @TerrifiedBug (#13). Thanks to @ozzyozzo for the report and @salmun-nister for confirming.

After updating, run omarchy restart shell. A plugin hot-reload keeps the stale compiled QML and shows the same error.

Full Changelog: v1.4.2...v1.4.3

v1.4.2 - Chronica: readable listing, 16:9 preview & private feed auth

A marketplace listing that says what Chronica does

plugins.omarchy.org and Omarchy's bar-widget picker both clip the description to
a single line, so the old copy stopped at "Date/time label with an interactive
calendar popup, t". Both descriptions are rewritten so the point lands in the
visible ~50 characters, and a contract test now fails when a description has no
clause break inside that window.

The preview is now 1600x900 (16:9) instead of a 1000x1000 square that the
720x405 card thumbnail cropped to its middle. It shows the headline, the sync
targets, and the bar widget above the panel it opens.

Private feeds and symlinked configs

• HTTP Basic Auth for private iCalendar/CalDAV feeds (Radicale and friends):
  add username and password to the calendar entry, or embed them in the URL.
• Symlinked config paths: calendars.json and the Google token file can now
  live behind a symlink (dotfiles repos, stow) without tripping the
  O_NOFOLLOW directory checks.

Also since v1.4.0 (1.4.1)

• Full grid & Vim navigation: h/j/k/l, 0/^/$, H/L,
  {/} for years, PgUp/PgDn, Enter to create an event, r to sync,
  w to toggle the week start.
• Shortcuts cheatsheet: press ? in the calendar popup.
• Prose cleanup across the README and comments.

Full Changelog: v1.4.0...v1.4.2

v1.4.0 - Chronica: CalDAV push to iCloud and Nextcloud

The plugin has a name: Chronica. Same plugin, same id (promaa.clock), so
existing installs upgrade in place.

Push events to Apple iCloud, Nextcloud and any CalDAV server

Creating events only ever worked on Google, JMAP and the local calendar. An
iCloud calendar showed up in the agenda but never in the "add event" picker,
because a published webcal:// link is anonymous and read-only.

Add three fields to the calendar entry in ~/.config/omarchy/calendars.json
and the same calendar becomes writable:

"caldavUrl": "https://pXX-caldav.icloud.com/1234567890/calendars/home/",
"username": "you@icloud.com",
"password": "xxxx-xxxx-xxxx-xxxx"

Apple needs an app-specific password from appleid.apple.com, not your Apple ID
password. To find your collection URL:

~/.config/omarchy/plugins/promaa.clock/fetch-events.py --caldav-discover "Apple iCloud"

Reading still goes through the published feed, so nothing about your existing
setup changes. Deleting works too, including events Apple Calendar itself
created under a server-chosen filename. Credentials are HTTPS-only and pinned
to the calendar's own host across redirects.

Works the same way for Nextcloud, Radicale, Baikal and Zimbra.

Also in this release

• Fresh screenshots, and preview.png is now a purpose-built marketplace card
  instead of a copy of a README image. Tracked image weight is down from
  1366 KB to 974 KB.
• The README no longer implies every listed provider accepts writes. Two-way is
  Google, JMAP, CalDAV and the local calendar.

Full Changelog: v1.3.2...v1.4.0

v1.3.1 — Clock format preference and Shibumi support

What’s new

• Added a persistent 12-hour / 24-hour clock selector to Preferences.
• Applied the selected time format consistently to the status-bar clock, calendar agenda, desktop notifications, and copied Markdown agendas.
• Preserved existing clock layouts and prior AM/PM choices during upgrades.
• Added Shibumi Shell support, including the semantic clock capability so the plugin is treated as the exclusive clock provider in Shibumi’s center region.
• Added Shibumi installation instructions and plugin-contract tests.

This release builds on v1.3.0 and includes its two-way sync, event creation/deletion, timezone-aware parsing, and local offline calendar features.

v1.3.0 - Two-Way Sync, Event Management, Timezone Awareness & Local Calendar

Highlights in v1.3.0

1. Timezone Awareness & Local Wall-Time Conversion (#3)

• Automatic Offset & UTC Conversion: Accurately converts UTC (Z), ISO numeric offsets ([+-]HH:MM), and TZID parameters across iCalendar, Google Calendar, and JMAP feeds into local wall time.
• Robust Timezone Resolution: Supports IANA timezone identifiers, prefixed timezone strings (/mozilla.org/...), and common Windows/Exchange timezone aliases (e.g., Eastern Standard Time, Central European Standard Time).
• RFC 5545 Compliance: Floating times remain floating naive, all-day dates are preserved without timezone drift, and exclusive midnight DTEND bounds are respected.

2. Two-Way Event Synchronization & Management

• Event Creation & Deletion: Add and delete events directly from the UI or CLI for Google Calendar, JMAP, and Local Calendars.
• Local Offline Calendar: Built-in writable local calendar for private offline task tracking without third-party services.
• Interactive Event Creation Modal: Modal dialog with date/time pickers, duration selector, and calendar targeting.

3. Security Hardening & Work Limits

• Meeting Link Sanitization: Validates video conference URLs (Google Meet, Zoom, Teams, Webex, Jitsi, etc.) and filters malformed or dangerous URI schemes.
• Secure Stdin Config Ingestion: Saves sensitive credentials and tokens via stdin rather than process argument lists.
• Recurrence Work Limits: Enforces CPU ceiling limits and time window bounding on multi-day and recurring event expansions.
• Data Purge Utility: Complete uninstall and clean purge options for credentials and caches.

Validation

• 50 automated unit tests passing across security, timezone resolution, recurrence bounds, and two-way synchronization.

v1.2.1 - JMAP and Secure Storage Hardening

Security fixes

• Require credential-free HTTPS for JMAP session and API URLs before bearer authentication is attached.
• Reject cross-origin redirects, mismatched final response origins, and cross-origin apiUrl values from session discovery.
• Make persisted JSON reads descriptor-bound with no-follow, regular-file, owner, and size validation.
• Replace predictable PID temporary files with random, exclusive, descriptor-relative atomic writes, including fsync and bounded output.

Validation

• Added 15 regression tests covering the reported credential-disclosure and local path-replacement cases.
• Re-ran Python compilation, QML linting, manifest parsing, config/auth CLI checks, and an end-to-end empty-calendar sync at commit 59976dd.