Saved
Settings
Local vault · nothing leaves this machine unless you sync.
Appearance
ThemeSwaps the stylesheet live — no reload. Try
?theme=terminal too.Colour schemePin dark or light, or follow the OS — System repaints live when the OS flips.
DensityComfy is the default; Compact tightens every surface further.
Editing
Autosave intervalWrites to disk after you stop typing.
Click preview to editClicking rendered text jumps to that line in Raw.
Home docWhere the vault button (top left) goes. Vault-relative path; blank means the first doc.
Keyboard shortcuts⌘E raw · ⌘S save · ⌘K search · Esc dismiss.
Recently deleted
Keep deleted documentsAfter this many days, the scheduled cleanup permanently removes them.
Git sync
GitHub tokenStored in the system keychain; the server only ever sends it masked.
BranchCommits land here on every sync.
Auto-syncPush after each autosave, pull on focus.
Auto-sync intervalCommits once changes have settled for this long.
—
Secrets
—
Vault passphrase
Re-wraps
.znotes/identity.age under a new passphrase. The vault key itself does not change, so every block you already have still decrypts.
Where this is storedThe two password fields in this panel answer that differently.
Your passphrase is not stored anywhere. It is typed into the crypto worker, spent on scrypt, and dropped — never written to
What the backend keeps is the wrapped key:
Contrast the terminal password further down: the server has to verify that one, so it stores a scrypt hash of it and checks what you type against it. There is no equivalent here, because the server never sees a passphrase or a plaintext — it stores and serves two opaque strings.
This does not rotate the vault key. The same key encrypts and decrypts every block before and after, and older copies of
.znotes/settings.toml, never to the sqlite index, never to sessionStorage, and never sent to the server. Nothing in this app can show it to you again.What the backend keeps is the wrapped key:
.znotes/identity.age — your age identity encrypted under the passphrase — and the public recipient .znotes/vault.pub. Both are committed with the vault, which is what makes it portable: any clone of the repo plus the passphrase in your head can decrypt. Changing the passphrase rewrites that one file and nothing else.Contrast the terminal password further down: the server has to verify that one, so it stores a scrypt hash of it and checks what you type against it. There is no equivalent here, because the server never sees a passphrase or a plaintext — it stores and serves two opaque strings.
This does not rotate the vault key. The same key encrypts and decrypts every block before and after, and older copies of
identity.age in git history stay decryptable with the old passphrase. If a passphrase was actually exposed, changing it does not undo that — rotating the key means re-encrypting every block in the vault, and rotating the secrets themselves.
Lock when idleNo typing, clicking or scrolling for this long.
Lock when hiddenThis tab has been in the background this long.
Session ceilingOne unlock never lasts longer than this, however busy you are.
Clear clipboard afterA copied secret is wiped from the clipboard on this countdown.
AI
Base URLOpenAI-compatible endpoint (
/v1/responses).API keyMasked · relayed server-side, never in the browser.
ModelUsed for chat and proposed edits.
Reasoning effortHigher effort, slower and more thorough.
Max replyCeiling on a single answer.
Context budgetHow much of your notes may be assembled into one turn.
EndpointCapability probed at save.
Terminal
—
Terminal password
Set one to enable the terminal. Independent of your vault passphrase.
UnlockRe-locks itself when idle, and whenever this tab is closed.
Enable terminalOff also hides the command tool from the assistant.
Lock when idleNo command for this long and the terminal re-locks.
ShellAbsolute path, or empty for
$SHELL.Starting directoryAbsolute path, or empty for the vault root.
Let the assistant run commands without asking
Off: every AI command waits for your Run. Notes and fetched pages can carry injected instructions — this is what stops them becoming a shell.
$
Save sends changed fields to PUT /api/settings.