Write the notes in an app, a school day at a time

The notes existed but there was nowhere to write them: a CLI command on a
laptop, a tool call through Claude, or a file in a Docker volume. None of
those is reachable from a phone in a lesson, which is where notes are
actually taken.

So: `/app`, served only when WEB_PASSWORD is set. A login, the day's
notes, and a settings page for the Schulcloud token — the one surface
here meant for a person rather than a program.

The shape follows how the notes are written: one note per school day,
one `##` heading per lesson, prose and lists and tables beneath. That
turns out to be the design decision that matters, twice over.

First, it is what lets WebUntis earn its keep. Opening a day with no
note fills in that day's lessons — numbered, with times, teacher and
room, cancellations dropped and substitutions marked. Retyping the
timetable is exactly the work the second upstream exists to avoid, and
"Stunden ergänzen" tops up a note started before the day ended without
touching what is already written.

Second, it changes how notes are indexed. A day note is indexed per
lesson, not whole: search answers "my own note, Deutsch, 18.09.2026"
rather than "my own note, Friday", and `list_notes subject=Deutsch`
finds a day whose frontmatter names no subject at all. Indexed whole,
every hit would read as a weekday and "what did we do in Deutsch" would
match notes whose other five lessons were something else. `lessonHeading`
and `subjectFromHeading` are a loop — the app writes the heading, the
indexer reads the subject back out — and a test holds them to it.

Notes taken in a lesson cannot be retaken, so the editor is built
around not losing them: autosave, every keystroke mirrored to local
storage, a save when the phone locks, and a fallback to the local copy
when the request never arrives. A save that would overwrite a version
the editor never saw is refused and the choice handed back — the notes
folder is synced and open in more than one place, and a phone must not
silently win over a laptop. `replaceNote` is separate from `writeNote`
for that reason: never-overwrite is right for `add_note` and exactly
wrong for an editor.

WEB_PASSWORD is the first credential here a human types, so it is the
first that can be guessed: scrypt at startup, never stored or compared
in the clear, per-address rate limiting — which is not decoration, since
the scrypt cost is itself a denial-of-service vector without it. The
session is a signed HttpOnly SameSite=Strict cookie whose key is derived
from the password, so changing it logs everyone out and there is no
second secret to keep. It opens /api, because a session is the user, and
never /mcp, because nothing in a browser speaks MCP.

Also here, because the app made them matter: frontmatter now reads the
indented `- item` list form editors write, so an Obsidian vault
round-trips its tags; and a four-digit folder is a filing scheme, not a
subject, so `2026/` does not file a school year under one.

357 tests; 106/107 smoke against the local instance, the one failure
being the H5P service that instance does not run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CLAUDE.md

@@ -18,7 +18,7 @@ have what the teacher stressed. An answer that silently merges them is worse
 than one that says which said what.
 
 Three entry points over one core:
-- `src/bin/http.ts` — Streamable HTTP + `/api`, the deployed form, behind Caddy on a Pi.
+- `src/bin/http.ts` — Streamable HTTP + `/api` + `/app`, the deployed form, behind Caddy on a Pi.
 - `src/bin/stdio.ts` — stdio, for local Claude Code / Desktop use.
 - `src/bin/cli.ts` — the `schulcloud` CLI, which talks to the HTTP server, never
   to Schulcloud.
@@ -61,8 +61,8 @@ exercised and can never touch real notes. The degradation paths are supported
 modes, not fallbacks nobody exercises.
 
 The check counts are a tripwire, so re-measure them rather than trusting this
-line after a change: **88/89 against the local instance** on 2026-09-18 (the one
-failure is the H5P service, which that instance does not run). The live counts
+line after a change: **106/107 against the local instance** on 2026-09-19 (the
+one failure is the H5P service, which that instance does not run). The live counts
 are stale — they were last taken before the notes and class-register work, and
 could not be retaken because the live session had lapsed. Every Schulcloud check fails with 401 when the live
 session has lapsed — check the container's keepalive log before suspecting code.
@@ -108,8 +108,17 @@ bin/cli.ts ──HTTP──────────┘   cli/{config,client,sync
     from Profil → Freigaben, so there is no session and no keepalive on this
     side. Resolves the payload's element ids to names and returns every day in
     a range, empty ones included. See Invariants for why the allowlist is there.
+  - **`day-note.ts`** — a school day as a note: the timetable turned into one
+    `##` heading per lesson. `lessonHeading` and `notes.ts`'s
+    `subjectFromHeading` are a **loop** — the app writes the heading and the
+    indexer reads the subject back out of it, so a change to either without the
+    other files a day's notes under nothing. `test/day-note.test.ts` holds them
+    to it.
   - **`notes.ts`** — the user's own lesson notes as a directory of Markdown
-    files with a small frontmatter dialect. The files are the truth and the
+    files with a small frontmatter dialect. A note with `##` headings is a
+    school day and is indexed **per lesson**, not whole: indexed whole, every
+    hit would read "my note, Monday" and "what did we do in Deutsch" would match
+    a note whose other five lessons were something else. The files are the truth and the
     index is a view of them, so `list_notes`/`get_note` read disk and answer
     before the first crawl and while Postgres is down. **The one thing anything
     here writes** — see Invariants. `docs/NOTES.md` is the guide.
@@ -130,6 +139,20 @@ bin/cli.ts ──HTTP──────────┘   cli/{config,client,sync
   open `/api`. Besides those: the optional `/<secret>/mcp` for clients without
   headers (`MCP_PATH_SECRET`), and `/token`, a page that PUTs a fresh token to
   `/api/token`. docs/AUTH.md and docs/DEPLOYMENT.md say why each exists.
+- **`http/app-page.ts` + `http/app/`** — `/app`, the one surface meant for a
+  person rather than a program: the day's notes and a settings page for the
+  Schulcloud token. Served only when `WEB_PASSWORD` is set. Its assets are
+  **files** under `src/http/app/`, copied to `dist/` by `scripts/copy-assets.mjs`
+  and read relative to `import.meta.dirname` — real HTML, CSS and JS that an
+  editor and a linter understand, which is also what the CSP requires, since it
+  forbids inline script.
+- **`http/web-auth.ts`** — the app's login, which is a different kind of
+  credential from everything else here: a password a person types, not a token a
+  program was configured with. scrypt at startup, a signed `HttpOnly` /
+  `SameSite=Strict` session cookie, per-address rate limiting. The session key
+  is **derived from the password**, so changing it logs every session out and
+  there is no second secret to store. The cookie opens `/api` — a session *is*
+  the user — and never `/mcp`. See Invariants.
 - **`store/`** — crawl generations, identity diffs, `german` + `pg_trgm` FTS.
   `Store.open` returns `undefined` when Postgres is down; callers degrade.
 - **`indexer/`** — crawl → persist → mirror bytes → extract text → index.
@@ -178,6 +201,16 @@ neither the bearer nor the `jwt` cookie may go with it. `refresh_index` and `POS
 own index and mirror, and `PUT /api/token` only to the server's own token — every
 upstream call they make is still a GET.
 
+**The app's session opens `/api`, never `/mcp`, and the app is not served
+without a password.** `WEB_PASSWORD` is the only credential here a human types,
+so it is the only one that can be guessed: the rate limiter in `web-auth.ts` is
+not decoration, and the scrypt cost that makes guessing expensive is itself a
+denial-of-service vector without it. The password is hashed at startup and never
+stored, compared or logged in the clear — it is a secret by the rule below, and
+so is the session cookie. Unset means the app does not exist, the same rule the
+`untis_*` and note tools follow: a login screen no password can open is worse
+than no page, because it looks like a way in.
+
 **The notes directory is the only thing anything here writes to.** That is not
 an exception to the invariant above — it is a different store: the user's own
 files, never Schulcloud and never WebUntis. It is bounded by the same two
@@ -210,7 +243,8 @@ the property that makes that acceptable. Do not add a write tool without the
 user explicitly asking for one and understanding this.
 
 **Never log or echo secrets.** `TSC_JWT_COOKIE` grants full read access to the
-account; `MCP_AUTH_TOKEN` and `MCP_CONNECTOR_TOKEN` guard the endpoint;
+account; `MCP_AUTH_TOKEN`, `MCP_CONNECTOR_TOKEN` and `WEB_PASSWORD` guard the
+endpoint;
 `UNTIS_SECRET` authenticates as the user in WebUntis and outlives every other
 credential here, since it does not expire. None belongs in
 logs, error messages, or tool output. `.env` is git-ignored — keep it that way.
@@ -462,8 +496,8 @@ bundle (2.1.272), not its docs:
 `.env` holds `TSC_URL`, `TSC_JWT_COOKIE`, `MCP_AUTH_TOKEN`, and optionally
 `MCP_CONNECTOR_TOKEN` or `MCP_PATH_SECRET`, plus the four `UNTIS_*` values (all
 four or none — a half-filled block is a paste that went wrong, so it throws),
-`NOTES_DIR` and `UNTIS_HISTORY_DAYS`; docker-compose sets `STATE_DIR` and
-`NOTES_DIR`. See `.env.example` for the
+`NOTES_DIR`, `UNTIS_HISTORY_DAYS` and `WEB_PASSWORD` (the app at `/app`);
+docker-compose sets `STATE_DIR` and `NOTES_DIR`. See `.env.example` for the
 full set and `docs/AUTH.md` for refreshing the JWT — `schulcloud token set`,
 no restart. `npm run probe` and `schulcloud token` report the clocks: days until
 hard expiry and the session budget.