Material Designer
upstream 517f39a
Provenance verified
Unavailable
Updated at
Unavailable until build provenance is supplied.
A local daemon detects the coding-agent command-line tool you already have installed and drives it. Projects, files and database stay on local disk.
Continuous integration builds the Windows Squirrel installer and publishes the exact output only when packaging and release publication complete. Actions does not run tests or lint, so a published release proves packaging and publication only.
What that does not prove is that any particular feature works. The smoke test starts the application and stops it; it never touches the interface. The Standards section says, one requirement at a time, what is built and what is not.
A workspace that runs entirely on your own machine. A local daemon detects whichever coding-agent command-line tool you already have installed and drives it to generate single-page design artifacts — prototypes, live dashboards, decks, images and motion pieces — rendered in a sandboxed preview and exportable to HTML, PDF, PPTX, ZIP, Markdown and MP4. Projects, files and database stay on local disk.
Two different things are described on this site, and they are never mixed. The product's existing behaviour is the imported upstream release, which works today. The Material Design 3 redesign and the standards conformance are this project's own work, and that work is in progress.
The product's own interface, rebuilt on the M3 colour-role tokens, type scale, shape scale, elevation and motion easing. The token layer and the custom window chrome are in the released build; the components have not been rebuilt on them yet.
In progress
Product name, window title, installer and application identity. Internal package names, the command-line name, its environment variables and its storage keys are left exactly as upstream wrote them, so the port stays diffable against its source.
In progress
A committed shell script re-derives the whole "this is upstream, unmodified" claim from git alone, and the licence notice is the same list the script enforces.
Runnable today
Language modes and funny levels, appearance customization, a regex builder beside every search field, tabbed navigation, non-blocking notifications, a command palette, accessibility as a completion blocker. This page implements them; the application does not yet.
In progress
Every row says how it was checked. A row that says "never run" means exactly that.
| Claim | State | How it was checked |
|---|---|---|
| The imported tree matches upstream exactly | Verified | By running the committed verifier locally, on a checkout with LF line endings. It reports zero gaps and exits 0. |
| Every difference from upstream is declared | Verified | Same run. The licence notice is the allowlist the script reads, so an undeclared change fails and a declaration for an unchanged file fails too. |
| The application builds, installs and starts | Verified | A release run installed the Windows package it had just built, launched it, saw the running process answer its own health endpoint, and uninstalled it without residue. |
| Continuous integration passes | Verified | The release run and site deployment have completed. Actions performs packaging and publication only, so a published release is evidence of those steps, not a test verdict. |
| A release exists | Published | With an unsigned Squirrel installer, its checksum, RELEASES feed, NuGet packages and a dim sum code name. A SmartScreen warning may appear on first run. |
| The application follows Material Design 3 | Partly | The token sheet transcribed from the mockup is in the released build, and Windows now draws the application's own title bar instead of the operating system's. The component inventory has not been rebuilt on those tokens, and no screenshot of the running application appears on this site. |
| This site meets the project's own standards | Partly | The standards this page can carry are implemented here and can be exercised in the browser. The Standards section says which, and which are still missing. |
This page records the thirty feature contracts in the project inventory. Each row describes this page's own equivalent and its honest boundary. It is not evidence that the desktop application implements the feature.
These settings affect this page and visitor-local state only. They do not claim control of the installed application.
The demonstration changes one session-only preview record.
Choose a versioned local JSON file. Original wording remains active until the complete file is valid.
Nothing is uploaded, networked, logged, exported, or written into history. Replacements apply only to this private page boundary.
No file loaded. Original wording is active.
No matching controls on this surface.
Only redacted action and time are kept here. File contents and metadata never enter history.
Choose a shipped mark or local custom image. The display mark changes, while package and storage identity stay fixed.
The feature matrix needs JavaScript to render its local filters and review state. The project inventory remains available in .codex/verification/feature-lineage/inventory.json.
This is the ported upstream functionality: what the application already does, inherited verbatim from Open Design v0.16.1.
A local daemon detects whichever coding-agent command-line tool is installed on the machine and drives it. Nothing new to sign up for.
Prototypes, live dashboards, decks, images and motion pieces, each generated as a single self-contained page.
Generated pages render in a sandboxed preview rather than being trusted with the application's own privileges.
Export to HTML, PDF, PPTX, ZIP, Markdown and MP4.
Projects, files and database stay on local disk. The workspace runs entirely on your own machine.
Read from source, not from a running application Everything above is inherited from the imported upstream release and described from its own documentation and source. The packaged build has been installed, started and uninstalled by a smoke test, which proves the application runs — it does not exercise any of these features, so none of them has been observed working here.
The Material Design 3 redesign and the standards work are in progress. The token layer and the window chrome have landed in the application; everything else below is specified and not built.
The colour-role tokens, type scale, shape scale, elevation and motion easing, with no legacy or ad-hoc design elements left behind.
Partly
English, playful Hong Kong Cantonese and a bilingual mode, with two independent 1–5 sliders. This page has them; the application does not yet.
Not started in the application
Guided construction, a raw pattern editor, flag toggles, sample text and live match display, anchored beside the field it belongs to.
Not started in the application
A persistent tab strip with an overflow surface, reordering, pinning and a searchable tab list, all persisted.
Partial in design only
Corner toasts that auto-dismiss and stack without overlapping, with a notification centre that keeps dismissed ones reviewable. A modal is only for a decision.
Designed, not built
Keyboard reachable throughout, visible focus, correct roles and names, sufficient contrast in both themes, reduced motion respected.
Not started in the application
This page is built on the same Material Design 3 token contract as the application redesign: colour roles, type scale, shape scale, elevation and motion easing.
These swatches are painted from the live tokens. Change the seed colour or the theme in Settings and every one of them moves, because nothing on this page hard-codes a colour.
Display small
Headline medium
Title large
Body large — the measure this documentation is set in.
LABEL MEDIUM
mono — 517f39acde402c1a7af2189167a8d6957a3dac71
No web fonts are loaded. The site uses a system font stack, because every asset must be bundled locally and a font file cannot be authored by hand.
| Token | Curve | Where it is used |
|---|---|---|
--md-sys-motion-emphasized | cubic-bezier(.2,0,0,1) | The default for a change the reader should notice: a tab becoming active, a panel opening. |
--md-sys-motion-emphasized-decel | cubic-bezier(.05,.7,.1,1) | Anything entering the screen, so it arrives quickly and settles gently. |
--md-sys-motion-spring | linear(…) | Transforms only — the press of a button, the travel of a switch handle. |
All of it collapses to a single millisecond when the reader has asked for reduced motion.
Browser-local mediation only. This documentation surface never writes to the desktop filesystem.
The browser equivalent keeps output in memory until you explicitly download it.
No source selected.
No adapters match this search.
No adapters match this search.
No adapters match this search.
No adapters match this search.
No adapters match this search.
No adapters match this search.
No adapters match this search.
No adapters match this search.
No files are queued.
Continuous integration builds the Windows Squirrel installer on every push and manual dispatch, then attaches the exact unsigned output it actually built. Actions does not run tests or lint.
This link points at one specific published build rather than at whatever is newest, so the checksum on the Releases section describes exactly the file it hands you. Newer builds are on the releases page.
Summarised here; the Releases section covers each item, and is the one that gets corrected.
An unsigned installer trips SmartScreen This repository has no code-signing certificate. Windows shows "Windows protected your PC" with an unknown publisher on first run, and the button that continues is hidden behind More info. That stays true until a certificate is obtained, so verify the published checksum against the file you downloaded before you go past it.
The exact commands, the toolchain versions and the Windows prerequisites are in the Building section. Expect the first run to be a real build rather than a formality — one native dependency compiles from source.
Continuous integration builds and publishes the Windows Squirrel installer on every push and manual dispatch. The workflow does not run tests or lint, so release evidence is limited to packaging and publication results.
Downloading this runs the unsigned Squirrel installer that the publishing run actually built. Windows may show an unknown-publisher warning.
| Tag | v0.21.550-r549.1 |
|---|---|
| Application version | 0.21.550 |
| Code name | Steamed Bitter Melon Stuffed with Fish · 鯪魚釀苦瓜 |
| Built from | 3a354d2 |
| Installer | material-designer-0.21.550-win-x64-setup.exe |
| SHA-256 | e3af17c3fd115c4acdc2d4bfaf06364df6edc8cbe63146b4e5edecaf6a3550a9 |
| Dim sum photograph | codename-hk-dish-0035.png 6d9f064a562a82274e0bbc6e98291c52644563abd1ef20c9e45b620fd6950e29 |
| Packaged smoke test | Unavailable No published release record is loaded in this source copy. |
The installer is not code-signed, and Windows will say so This repository has no code-signing certificate, so SmartScreen shows "Windows protected your PC" with an unknown publisher on first run. The button that continues is hidden behind More info. Check the published SHA-256 against the file you downloaded before you do that — an unsigned installer is exactly the case where the checksum is worth the minute it costs.
Squirrel.Windows updates are ready when you are Stable Windows builds use this project's own metadata feed. The release path verifies the Squirrel Setup.exe signature before publication; the app downloads it in the background, verifies its SHA-256, asks the renderer to finish pending sketch saves, and waits for you to choose Restart to install update or Later.
The same set every time, produced by the run that published it.
| Asset | What it is |
|---|---|
…-win-x64-setup.exe |
The unsigned Windows Squirrel installer built and published by the same run. |
…-win-x64-setup.exe.sha256 |
The checksum of that exact file, computed by the run after the build. It is also printed in the release notes, so the two have to agree. |
codename-…png |
The photograph of the dim sum dish this release is named after, taken from the catalogue bundled in this repository. No image is fetched, generated or re-encoded at publish time. |
The notes carry the rest: how to install, the checksum, the smoke-test outcome, the line count, and the provenance statement naming the upstream project, its licence and the pinned commit this fork was taken from.
v<application version>-r<run number>.<attempt>
v0.16.1-r70.1
v0.16.1-r71.1The run number climbs on its own and never repeats, so every tag is unique and in order without anybody maintaining a counter. The attempt number is part of it because a re-run of a failed job keeps the same run number — without it, the second attempt would try to create a tag that already exists and the publish would fail at the very last step, after the whole build had succeeded.
No tag is ever reused and no release is overwritten. A published release is a permanent record of one commit, and editing one in place would quietly change what a reader already downloaded.
Every release is also named after a dim sum dish, in English and Traditional Chinese, and carries that dish's photograph. It sits beside the version rather than replacing it: a version number is what a machine identifies a build by, and a code name is what a person remembers it as.
A dish is used once. The picker reads the dishes already spent out of the existing release notes rather than from a counter, so a re-run cannot hand out the same dish twice — two builds sharing a name would defeat the one job a code name has. It also skips any dish whose image is not actually present, because a code name that renders as a broken image is worse than none.
| Tag | Code name | Published |
|---|---|---|
v0.16.1-r71.1 |
Bamboo Shoot Har Gow · 筍尖蝦餃 | |
v0.16.1-r19.1 |
Cha Chaan Teng Baked Seafood Rice · 茶記焗海鮮飯 | |
v0.16.1-r18.1 |
Cha Chaan Teng Baked Pork Chop Rice · 茶記焗豬扒飯 | |
v0.16.1-r8.1 |
Beef with Oyster Sauce · 蠔油牛肉 | |
v0.16.1-r7.1 |
Beef with Black Bean and Peppers · 豉椒炒牛肉 |
This table was written by hand and does not update itself. Where it disagrees with the releases page, the releases page is right.
Each release states how many lines of code the project had at the exact commit it was built from. Continuous integration runs the committed counter during the release run, so the number belongs to the released commit rather than to whenever somebody last thought to measure.
It is never one total. The table separates this repository's own source, its tests, its styles and markup, its documentation and its generated files, and it names what was excluded — the vendored upstream tree is not this project's code, and folding it in would flatter the number by a factor nobody could see. It also splits the surviving lines by whether a person or an agent wrote them, which is stated without spin in either direction.
Some of these run in continuous integration; the rest are transcribed Installing, typechecking, testing and packaging are what the release run does on a Windows runner, so those are known to work there. The development-orchestrator commands have not been exercised from this repository and are transcribed from the ported project's own package scripts. Treat the first local run as a real build, and expect to spend time on native compilation.
| Requirement | Version | Why it is exact |
|---|---|---|
| Node.js | 24 |
Declared in the engines field by the workspace root and by every package, and pinned by the version file. Upstream's own answer to "can I use Node 22 instead" is no. |
| pnpm | 10.33.2 |
The package manager field is pinned to that exact version. |
| Visual Studio Build Tools | 2022+ |
With the Desktop C++ workload. The SQLite binding has no prebuilt binary for this platform on Node 24, so installing compiles it from source through node-gyp. |
| Python | 3.x |
Required by node-gyp for that same native build, and it must be on the path. |
On Windows, enabling corepack fails with a permission error because it cannot write shims into the system program directory. Install pnpm with npm instead.
npm install -g pnpm@10.33.2There is no package file at the repository root — the workspace root is the imported tree, so every command runs from inside it. Installing triggers the root postinstall, which builds 18 workspace targets in dependency order and unpacks a bundled export helper.
cd design
pnpm installThere is deliberately no root dev or start script. The development orchestrator is its own tool, and the daemon defaults to loopback on port 7456.
pnpm tools-dev run web
pnpm tools-dev run web --daemon-port 17456 --web-port 17573
pnpm tools-dev status --json
pnpm tools-dev logs --json
pnpm tools-dev stop
pnpm tools-dev checkpnpm --filter @open-design/tools-pack build
pnpm tools-pack win build --to squirrel
pnpm tools-pack win install
pnpm tools-pack win cleanupThe supported Windows target is genuine Squirrel.Windows. It emits Setup.exe, RELEASES and full and delta NuGet packages. The installer is intentionally unsigned, and packaging runs on the pinned Windows workflow image.
Tests are package-scoped by design — there is no root aggregate test script. Build the three prerequisites first, exactly as upstream's own continuous integration does, then run a package's suite.
pnpm typecheck
pnpm guard
pnpm i18n:check
pnpm --filter @open-design/daemon build
pnpm --filter @open-design/desktop build
pnpm --filter @open-design/web build:sidecar
pnpm --filter @open-design/daemon test
pnpm --filter @open-design/web test
pnpm --filter @open-design/contracts testWindows native is upstream's best-effort tier Upstream states that macOS, Linux and WSL2 are its primary supported paths. This project targets Windows, which makes those rough edges this project's problem to fix rather than a caveat to pass along. The release run builds and packages on Windows, so the ones that break a build have been dealt with; the ones that only show up in daily use have not been looked for.
The claim "the imported tree is upstream, unmodified" is worth nothing unless a reader can check it in one command. That is what the committed verifier is for. It is pure git and POSIX shell — no Node, no dependencies, nothing to install — which makes it the only claim in this repository that anybody can reproduce with no toolchain at all.
git submodule update --init # optional — see below
scripts/verify-port.sh # human-readable report
scripts/verify-port.sh --json # machine-readable, one lineThe submodule is not required. When it is absent the verifier falls back to a committed manifest of upstream paths, modes and blob ids, and says which source it used. When the submodule is present, the manifest must agree with it, and a disagreement is a hard error rather than a quiet preference for one of them.
They are separate because they fail for different reasons, and one cannot see what the other catches.
Every file on disk is hashed with filters disabled and compared to the upstream blob id. This catches a stray edit, a truncated copy or a missing file.
Every tracked path must carry the upstream file mode as well as the upstream blob id. This catches line-ending normalisation and lost executable bits, which Check A cannot see.
| Counter | Meaning |
|---|---|
expected | Files in the pinned upstream tree. |
tracked | Paths tracked under the imported directory in this repository. |
present | Expected files actually found on disk. |
declared | Paths listed in the licence notice — the size of the allowlist. It moves as more of the rebrand lands, so read it from the script rather than from any page. |
missing | Expected upstream files not present on disk. |
bytes differ | On-disk bytes do not hash to the upstream blob id. |
mode mismatch | A file mode recorded here differs from upstream's. |
oid mismatch | A committed blob id differs from upstream's. |
extra | Paths tracked here that upstream does not have. |
untracked | Non-ignored files loose in the imported tree — what an interrupted copy leaves behind. |
stale notice | A path declared in the licence notice that no longer differs from upstream. |
gaps | Total undeclared differences. This is the number that must stay at zero. |
The verifier reads the modifications notice as its allowlist. Paths are declared as list items, and HTML-comment blocks are skipped so the file can document its own entry format without that template being mistaken for a declaration. Two consequences follow, and both are the point.
So the Apache-2.0 section 4(b) notice and the code cannot drift apart: the licence notice is the same list the machine checks.
Check out with LF line endings A CRLF checkout rewrites bytes in the imported tree, and Check A will correctly report thousands of byte differences for a tree that is otherwise fine. Turn automatic line-ending conversion off before the checkout, or run the verifier on Linux. On Windows, run it from a POSIX shell — the one bundled with git works.
No transcript is pasted on this page Every counter except gaps moves as rebranding work lands, so a frozen copy is wrong shortly after it is written. Run the script; prefer its answer to any paragraph, this one included.
These are the project's own requirements for every user-facing surface it ships — the application, and equally this site, its settings, and every panel and dialog inside either. "It is small", "it is only docs" and "nobody customizes that one" are not exemptions. Almost none of them is satisfied in the application today; that gap is the work.
The two status columns are deliberately separate. This page is one surface and the application is another, and a standard met here says nothing whatsoever about the application.
| Standard | In the application | On this site |
|---|---|---|
| Language modes and two funny-level sliders | Not started — nineteen locales ship upstream; Cantonese is not one of them, and no tone slider exists. | Implemented here — three modes and two independent sliders, in Settings. |
| Material Design 3 conformance | Partly — the token sheet and the custom window chrome are in the released build; the component inventory has not been rebuilt on them. | Implemented here — the token sheet is transcribed from that same mockup. |
| Runtime appearance customization | Not started | Partly — theme, density, seed colour, scale and the colour translator. Per-element editors, font control and named presets are not here. |
| A regex builder beside every search field | Not started — the mockup draws one shared panel, which does not meet the anchored-per-field requirement. | Implemented here — every search field on the site has its own, anchored beside it, with its own pattern and flags. |
| Browser-style tabs everywhere | Partial in design only | Partly — the shell has overflow, reordering, pinning, persistent groups, four independent discovery searches, docking on all four edges and previewed inverse bulk close with reopen recovery. |
| Non-blocking notifications and a centre | Designed, not built | Implemented here |
| Super confirmation for destructive actions | Not started, not yet designed | Partly — site-owned preferences and tab closures expose the destructive-action seam, with a preview before close and a recovery path for closed sections; final super-confirmation evidence remains pending. |
| A command palette | Designed, not built | Implemented here — every command, setting and destination, with the live control rendered in the row. |
| An in-app changelog viewer | Designed, not built | Partly — the releases published so far are listed with their code names, but a filterable, searchable viewer is not built here. |
| Local version history for documents, records and settings | Designed, not built | Partly — site-owned preferences, tab structure, notifications and close actions have explicit local-history integration seams; the browser Git history implementation remains pending. |
| Export everything, bulk-act on everything | Partial upstream — several export formats already exist; the full matrix, the archive options and universal bulk actions do not. | Not here yet |
| The startup dim sum surprise | Not started — the mockup draws it with an off switch, which the standard forbids. | Implemented here — a one-in-ten draw on load from the bundled catalogue, non-blocking, no opt-out. |
| A release code name and a line count | Published — every release so far carries a dish name and a line-count table produced at the released commit. | Implemented here — the Releases section names each published build's dish and links its notes. |
| Accessibility and sizing as completion blockers | Not started | Implemented here — keyboard reachable throughout, visible focus, roles and names, reduced motion respected, and readable from a narrow window up to a doubled scale. |
| Every asset bundled locally | Not met — the mockup loads its fonts from a third-party network origin. | Implemented here — this page makes no network request at all, which is checked at publish time rather than trusted. |
| Documentation, changelog and roadmap current in the same task | In force — applies to both surfaces from now on. | |
| Not started | No code, and possibly no design. |
|---|---|
| Not started, not yet designed | Not even specified by the mockup. These carry the most risk, because the shape of the work is unknown. |
| Designed, not built | The mockup specifies it completely enough to implement. Nothing runs. |
| Partly | Some of it exists. The gap is named beside it rather than left for the reader to discover. |
| Implemented here | Built on this site and exercisable in this browser right now. It says nothing about the application. |
Nothing is at "met" yet A standard is promoted only when the verification described in its own documentation has actually been run and its result recorded. Code existing is not promotion.
The reference documentation is a tree of Markdown files in the repository, organised into eight categories holding 68 articles. This panel indexes it and links every article at its source.
The published bundle contains the complete Markdown tree, so reading an article does not require a network request.
This reader uses one isolated renderer for provider-authored Markdown. Internal article links stay inside the reader, external links are labelled, and a missing or invalid manifest is reported instead of becoming an empty spinner.
Loading the bundled article manifest…
Select an article to read its bundled content.
The question you arrived with, and the page that answers it.
| If you want to… | Read |
|---|---|
| Understand what the product actually is | architecture/overview.md |
| Know how the upstream copy got here, and why it can be trusted | porting/verification.md |
| Build an installer, or read what the release run does | build/ci.md |
| Build it locally instead | build/from-source.md |
| Understand how a release is produced, and what proves it works | release/ |
| Diagnose a failure somebody here has already hit | troubleshooting/ |
| Know what this project holds itself to | standards/ |
| Publish or change this site | site/ |
| Call the local daemon over HTTP | api/ |
Each category has an index that lists its own articles. The index is the authority — a new article is added to it, and to nothing else.
porting/
How the upstream tree was imported byte-for-byte, and the verifier plus licence-notice contract that proves it stayed that way. The verification article is the longest and most careful page in the tree, and the one to read if you only read one.
architecture/
The daemon, the web interface, the desktop shell, the packaged application and this site: how the pieces connect, which ports they bind, what configures them, and how they fail.
build/
Why builds run in continuous integration rather than on somebody's laptop, what each workflow does step by step, and the exact commands for building locally including the Windows prerequisites that catch people out.
release/
How a release is produced end to end, what the packaged smoke test actually proves and what it does not, how the line count is produced and what its scopes mean, how a dim sum code name is chosen and spent exactly once, and what each published file is.
troubleshooting/
Failures this project actually hit, never hypothetical ones: the symptom as it appeared in a log, the cause, the fix, and how to avoid reintroducing it. Plus a table of signals — what thousands of even differences usually mean, what zero tests executed usually means.
standards/
The requirements this product is being brought up to, one article per standard, each stating the requirement, its honest implementation status, and how conformance will be checked once it exists. This is where the gap between the site and the application is written down.
site/
This page: what it is built from, the workflow that deploys it, the publish-time check that refuses to ship it if any asset would be fetched from somewhere else, and the base-path trap that makes a green deployment serve nothing but 404s.
api/
The local daemon's HTTP surface, grouped by route file, with its authentication and origin posture and the security notes that go with binding a local service to anything wider than loopback.
Written by hand, so it lags the tree. Where this list and a category index disagree, the index is right.
| Article | What it covers |
|---|---|
porting/verbatim-import.md |
How the copy was made: raw blob extraction with every filter disabled, the four separate ways an ordinary working-tree copy fails, restoring the executable bit, and the files that had to be force-added. |
porting/verification.md |
The verifier in full: its two independent checks, every counter, the exit codes and why "the check failed" and "the check did not happen" are different numbers, the licence notice as a machine-read allowlist, its self-tests, and the line-ending trap. |
architecture/overview.md |
The processes and what each one is responsible for, the shared packages, the ports and bind addresses, the environment variables, the runtime requirements, the failure modes and the security posture. |
architecture/daemon.md |
The only stateful process: what it owns, its startup order, the three probe endpoints, the command-line entry point, every network and path variable, and why reaching its API is equivalent to shell access. |
architecture/web-runtime.md |
The single-page interface and the three genuinely different ways it reaches the daemon — development rewrites, static export, packaged server-side rendering — plus the locales, the boundary it may not cross, and the Material Design 3 token layer as it currently stands. |
architecture/desktop-shell.md |
The desktop main process: why it never guesses the web port, the sidecar control channel that doubles as the test harness, the frameless Windows window and its renderer-drawn title bar, the window-control channels, and the preload trust boundary. |
architecture/packaged-runtime.md |
What actually launches when somebody runs the installed application: the launcher, the custom URL scheme and its retry, sidecar stamps and namespaces, the child-environment allowlist, the namespace-scoped path layout, and a packaged-versus-development comparison. |
architecture/data-directory.md |
The single most important invariant in the codebase: one process, one data root, resolved once. What derives from it, how it propagates to child processes and packaged builds, the sanctioned exceptions, the known escape patterns, and what actually breaks when it is violated. |
build/ci.md |
The verification gate and the release run, step by step: why the gate checks out without the submodule, what the release notes carry, the triggers, the tokens, and the unsigned-installer position. |
build/from-source.md |
Building locally: the prerequisites, the package manager on Windows, the line endings to fix before cloning rather than after, installing, running, typechecking, testing, packaging, and what goes wrong at each step. |
release/release-pipeline.md |
The whole release run, step by step: the line-ending guard, port verification inside the release job, install, typecheck, the Windows-only identity suites, the installer build with its explicit existence check, the smoke test, the notes, and publication. |
release/packaged-smoke-test.md |
The only step that checks the product works: it installs the built installer, launches it, makes the running process answer its own health endpoint, screenshots it, uninstalls it and asserts zero residue. Assertion by assertion — with an explicit list of what it does not prove. |
release/line-count.md |
How the published figure is produced by a committed script at the released commit, what its two scopes and three totals mean, how authorship is attributed per surviving line rather than by summing added lines, and why nobody ever counts by hand. |
release/code-names.md |
How the dim sum code name is chosen from the bundled catalogue, why the spent dishes are read out of prior releases rather than a counter, why a dish is spent exactly once, and why a missing dish never blocks a release. |
release/release-assets.md |
What each published file is, which uploads go to the run rather than the release, and what is deliberately absent — no signature and no non-Windows artifacts; new Windows releases also carry Squirrel RELEASES, NuGet packages and the project-owned metadata feed. |
troubleshooting/line-endings.md |
A byte comparison reporting thousands of differing files against a tree nobody had touched, because the checkout translated line endings on the way to disk — and why the guard has to come before the checkout step rather than after it. |
troubleshooting/platform-specific-tests.md |
Tests asserting a Unix executable bit on a filesystem that has none, and tests building a symlinked layout a runner may not be permitted to create. Both fixed by splitting the suites by what each platform can answer — a split, not a skip. |
troubleshooting/unbuilt-package-imports.md |
Three suites dying at import time with a missing module, because they import built output that the install step does not build. Zero tests executed and no failures reported means nothing loaded — look for an import error, not an assertion. |
troubleshooting/test-timeouts.md |
Two platform-gated specs doing real filesystem work, inheriting a five-second default budget written for a fast local disk — and how to tell a budget failure from a hang before assuming either. |
troubleshooting/packaging-schema-drift.md |
An installer build rejected before packing anything, because a configuration property moved between major versions of the build tool and now fails schema validation on sight. Nothing was attempted, so nothing was tested. |
standards/language-modes.md |
The three language modes and the two tone sliders, the rule that voice changes and facts never do, and what registering a Cantonese locale in the application actually requires. |
standards/material-design-3.md |
Material Design 3 conformance and appearance customization: the token handoff map, the component inventory, the colour roles, the shape and motion scales, and the window chrome. |
standards/regex-builder.md |
What the pattern builder must offer, why it has to be anchored beside the field it belongs to rather than shared, which engine and dialect it names, and the guards that keep a pasted pattern from freezing the interface. |
standards/tabs.md |
Tabbed navigation: overflow, reordering, pinning, grouping, the four tab-discovery searches, the two bulk-close actions, and why persistence needs a stable identity rather than an index. |
standards/notifications.md |
Non-blocking notifications and the notification centre, then the super-confirmation gate for destructive actions — which this tree flags as the largest undesigned gap in the whole set, because it guards the actions where getting it wrong destroys someone's work. |
standards/accessibility.md |
Keyboard reach, visible focus, roles and names, contrast, reduced motion, the no-clipping matrix, element sizing, and the rule that anything drawn to look operable must actually be operable. |
standards/export-and-bulk-actions.md |
Export as a property of every surface rather than a feature of a few, the format matrix, the archive options, multi-select and bulk actions, and saying what will be lost before an export runs instead of truncating quietly. |
standards/releases.md |
The installer requirement, the line-count rules, the code names, the in-app changelog viewer, local version history, the startup surprise, and how the dim sum catalogue is assembled. |
standards/appearance-customization.md |
An appearance editor on every rendered element rather than a global theme alone, an infinite colour picker with a colour-space translator, word-processor-depth typography, named presets that export and import, and per-element and global resets. |
standards/command-palette.md |
One shortcut over every command, setting and destination, with live inline controls in the rows rather than labels alone, and a teleport that opens the surface and reveals the exact control instead of dropping the user on the right tab. |
standards/changelog-viewer.md |
Every released version readable in the application itself, with a commit link on every entry, an advanced date filter that also accepts typed dates, a search that composes with it rather than overriding it, and export that honours both. |
standards/version-history.md |
A local version history covering documents, records and settings — not documents alone — where restoring is recorded as a new revision so an undo can itself be undone, and history is append-only rather than rewritten. |
standards/super-confirmation.md |
The gate every destructive action passes: two independently operated keys, then a full-range slider, an always-available emergency exit, and focus returned to the control that started it. The largest undesigned gap in the whole set. |
standards/dim-sum-surprise.md |
One launch in ten shows a dish, named in both languages, from a catalogue bundled in the repository — non-blocking, auto-dismissing, never gating startup, and with no off switch at all. |
standards/local-assets.md |
No script, stylesheet, font or image fetched from a third-party origin and no tracking, on every surface individually — with the publish-time gate that reads the built output and refuses to ship anything that would reach off-origin. |
standards/external-editor.md |
Detecting installed editors, persisting the choice, degrading with a clear message when none is found — and opening every export in one action, as a workspace root rather than a single file with no context around it. |
standards/overlays.md |
Every popover, menu and anchored panel paints its own background, border and elevation, stays bounded by the viewport, and scrolls inside that bound rather than silently hiding the content past a height cap. |
standards/context-menu-shortcuts.md |
Every context-menu item showing the shortcut that actually works in that context, derived from the same registry that binds it so the two cannot drift — and every context menu carrying its own search field. |
standards/long-operations.md |
A long operation reporting real progress in the surface that started it rather than a bare spinner, guarding against re-entry in the handler and not only by disabling a button, and offering its recovery route where the failure was discovered. |
standards/documentation-currency.md |
Documentation, changelog and roadmap brought current in the same task that changes the project — because stale documentation is worse than none, being confidently wrong with no way for the reader to tell. |
site/pages-deployment.md |
How this page is deployed, the publish-time gate that reads the built output for any reference to a third-party origin, the base-path trap, and the rule about what a download button may point at. |
api/README.md |
The daemon's HTTP surface grouped by route file, its base URL, its authentication and origin posture, and the security notes that apply before exposing it beyond the local machine. |
Each category also has its own index, listing every article in that category with a one-line description and stating what is implemented and what is not. Those are linked from the cards above.
Stated here because a convention whose reason is unwritten gets tidied away by the next person.
| Path | What it is |
|---|---|
MODIFICATIONS.md |
The change notice the licence requires, and at the same time the machine-read allowlist of files permitted to differ from upstream. One file, two jobs, which is what keeps the notice and the code from drifting apart. |
CHANGELOG.md |
What has changed, each entry linked to the commit that made it, so a claim can be followed to the code rather than taken on trust. |
ROADMAP.md |
What is done, what is committed but unproven, and what has not been started, kept as three distinct states rather than two. |
scripts/ |
The verifier, the upstream manifest it falls back to, the line counter continuous integration runs at a released commit, the code-name picker, and the importer that brings dim sum images in byte-for-byte. |
postman/ |
A request collection for the daemon's HTTP surface, for exercising it without writing a client first. |
site/ |
The source of this page. Static files with no build step — what is committed is what is served. |
This documentation page can inspect a file you choose and keep local queue metadata in this browser. It cannot write desktop files or call the desktop host.
Choose a local file. No bytes leave this page.
PDF inspection is available. Split, merge, extract, reorder, rotate, and metadata writes remain unavailable without a verified bundled rewrite engine.
Image formats stay visible, but browser output writing is unavailable on this documentation page.
Audio formats stay visible, but no bundled browser codec is claimed.
Video formats stay visible, but no bundled browser codec is claimed.
Archive formats stay visible, but no bundled browser codec is claimed.
JSON and related text can be identified from bounded bytes. Conversion output is not written.
UTF-8 text can be identified locally. Source bytes are not persisted in the queue.
Known binary signatures are inspected locally. The page does not write encoded output.
The application source in design/ is a byte-for-byte port of Open Design v0.16.1, pinned at commit 517f39acde402c1a7af2189167a8d6957a3dac71 and licensed under Apache-2.0.
The upstream project on GitHub Opens in a new tab
Apache License 2.0. The full text ships with the imported tree and applies to everything in it. Work added by this repository is offered under the same licence.
The modifications notice is the prominent notice Apache-2.0 section 4(b) requires for changed files, kept in one place so a reader sees the whole delta without diffing two repositories — and it is the machine-checked allowlist described under Verifying the port.
Apache-2.0 grants no trademark rights (section 6). The "Open Design" name, its logo and the upstream application identity belong to the upstream project. Builds published from this repository are branded Material Designer with their own application identity, and are not produced by, endorsed by, or affiliated with the upstream project.
Deliberately minimal and confined to the user-visible identity: product name, window title, installer and application id. Internal package names, the command-line name, its environment variables and its storage keys are left exactly as upstream wrote them, so the port stays diffable against its source and future upstream changes stay mergeable.
The identity changes are correctness fixes rather than cosmetics. Installed side by side, an unmodified build of this fork and the upstream product are the same application as far as the operating system is concerned: they would share a data directory, a single-instance lock, a named pipe and an uninstall registry key, and the packaged build would poll upstream's release feed and replace itself with the other product. An application must never update itself into something else.
The upstream repository stays checked in as a pinned submodule. It is not built and nothing imports from it; it exists so the provenance claim has a source of truth on disk and so the verifier has something to compare against.
What this repository adds is the Material Design 3 redesign, a minimal rebrand, and the standards work. Every change to the ported tree is declared in MODIFICATIONS.md, which a script enforces.
This site makes no network requests. Every asset is bundled locally: no content delivery network, no web fonts, no analytics, no third-party trackers.
Your language mode, funny levels, theme, density, seed colour, UI scale, tab order and pinned tabs are stored in this browser's local storage and nowhere else. Clearing this site's data resets every one of them.
Licensed under Apache-2.0. The full licence text ships with the source.
Cantonese text on this page is marked up as zh-HK so a screen reader reads it in the right voice.
Every preference on this page is stored in your browser and applied immediately. Nothing is sent anywhere.
Shared local preferences for this page. Nothing is sent anywhere, and missing provenance remains unavailable.
Choose which language this site speaks. Bilingual shows both, English first.
Two independent sliders, one per language. They restyle the voice of the copy and never the facts: version numbers, commit ids, file counts, licence terms and warnings read identically at every level.
The funny level styles every message It applies to warnings and errors too. What changes is the voice; what never changes is the fact — a warning still names exactly what will happen and what your options are.
Changes apply to the live page as you make them, and survive a reload. The seed colour accepts any colour at all, not just the four presets.
A custom seed derives its dependent colour roles rather than tinting one button, so the whole page moves with it and stays readable in both themes. The translator shows the contrast the derived primary will actually have.
Choose a bundled mark or select a local image. The mark changes presentation only, never application identity.
Installer preview only: this mark does not change package identity, installer identity, update feed, or signing state.
Choose a versioned local JSON file to adapt private UI wording. The original wording stays active until a valid file is supplied.
Nothing is uploaded, networked, logged, exported, or written into history. Replacements apply only to this private UI boundary.
No matching controls on this surface.
Choose a versioned local JSON file to adapt private UI wording. The original wording stays active until a valid file is supplied.
Nothing is uploaded, networked, logged, exported, or written into history. Replacements apply only to this private UI boundary.
No file loaded. Original wording is active.
No matching controls on this surface.
Only redacted action and time are kept here. File contents and metadata never enter history.
Choose a shipped mark or a local custom image. The display mark changes, but package identity and storage location do not.
Choose a versioned local JSON file to adapt private UI wording. The original wording stays active until a valid file is supplied.
Nothing is uploaded, networked, logged, exported, or written into history. Replacements apply only to this private UI boundary.
No file loaded. Original wording is active.
No matching controls on this surface.
Only redacted action and time are kept here. File contents and metadata never enter history.
Choose a shipped mark or a local custom image. The display mark changes, but package identity and storage location do not.
Configure a browser-local speed bump for the protected example. This is for fun only, not security or encryption. Clear this site's browser storage to recover.
Create the local toy lock before trying the protected example.
Each reset affects only what it names. Nothing here touches anything outside this browser.