jekyll-theme-zer0 1.29.0 → 1.30.0

data/_sass/core/_navbar.scss

@@ -137,21 +137,16 @@
     overflow: visible;
   }
 
+  // No transform on :hover. A translate moves the element out from under a
+  // pointer parked on the edge it vacates, hover exits, the element returns —
+  // an infinite flicker. Nav items are thin enough for a 1px lift to do it.
   #bdNavbar .nav-link:hover {
     background-color: var(--bs-tertiary-bg);
-    transform: translateY(-1px);
   }
 
   .nav-hover-dropdown .dropdown-toggle-split {
     padding: var(--zer0-space-1) var(--zer0-space-2);
 
-    &::after {
-      transition: transform 0.2s ease-in-out;
-    }
-
-    &:hover::after {
-      transform: translateY(2px);
-    }
   }
 }
 
@@ -181,12 +176,18 @@
     &:hover {
       color: var(--bs-primary);
       background-color: var(--bs-tertiary-bg);
-      transform: translateY(-1px);
       box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
+      // These are `.btn`s, and _ui-enhancements.scss lifts every button by 2px
+      // on hover. Dropping the navbar's own translateY(-1px) is not enough —
+      // the inherited lift flickers the same way. `transform: none` is the
+      // repo's existing corrective pattern (see _post-navigation.scss).
+      transform: none;
     }
     
+    // A pressed cue is safe: :active only holds while the button is held down,
+    // so the pointer cannot leave and re-enter in a loop.
     &:active {
-      transform: translateY(0);
+      transform: translateY(1px);
       box-shadow: 0 1px 2px rgba(0, 0, 0, 0.1);
     }
     
@@ -197,11 +198,6 @@
     
     i {
       font-size: 1.15rem;
-      transition: transform 0.15s ease-in-out;
-    }
-    
-    &:hover i {
-      transform: scale(1.1);
     }
   }
 }
@@ -446,16 +442,11 @@
     #bdNavbar .nav-link i {
       margin-right: 0;
       font-size: 1rem;
-      transition: transform 0.15s ease-in-out;
     }
 
     #bdNavbar .nav-link:hover {
       background-color: var(--bs-tertiary-bg);
       border-radius: 0.375rem;
-
-      i {
-        transform: scale(1.1);
-      }
     }
 
     .nav-hover-dropdown > .nav-link {
@@ -681,7 +672,6 @@
       
       &:hover {
         background-color: var(--bs-tertiary-bg);
-        transform: rotate(90deg);
       }
       
       &:focus-visible {
@@ -768,20 +758,10 @@
   i {
     font-size: 1rem;
     width: 1.5rem;
-    transition: transform 0.15s ease-in-out;
   }
   
   &:hover {
     background-color: var(--bs-tertiary-bg);
-
-    // translateX widens overflow; desktop menus sit inside a clipped nav track
-    @media (max-width: 991.98px) {
-      transform: translateX(4px);
-    }
-
-    i {
-      transform: scale(1.1);
-    }
   }
   
   &:focus-visible {

data/_sass/layouts/_navbar-extras.scss

@@ -53,13 +53,18 @@
       display: block;
     }
 
+    // No transform on :hover — a lift moves the FAB out from under a pointer
+    // parked on its bottom edge, hover exits, it drops back: infinite flicker.
+    // These are `.btn`s, so the 2px lift _ui-enhancements.scss puts on every
+    // button has to be cancelled explicitly, not merely not-added here.
     &:hover,
     &:focus-visible {
-      transform: translateY(-1px);
+      transform: none;
     }
 
+    // :active is safe, because the button is held down for its whole duration.
     &:active {
-      transform: translateY(0);
+      transform: translateY(1px);
     }
   }
 }
@@ -112,13 +117,18 @@
       display: block;
     }
 
+    // No transform on :hover — a lift moves the FAB out from under a pointer
+    // parked on its bottom edge, hover exits, it drops back: infinite flicker.
+    // These are `.btn`s, so the 2px lift _ui-enhancements.scss puts on every
+    // button has to be cancelled explicitly, not merely not-added here.
     &:hover,
     &:focus-visible {
-      transform: translateY(-1px);
+      transform: none;
     }
 
+    // :active is safe, because the button is held down for its whole duration.
     &:active {
-      transform: translateY(0);
+      transform: translateY(1px);
     }
   }
 }

data/assets/css/main.scss

@@ -44,6 +44,7 @@
 @import "components/book";
 @import "components/recipe";
 @import "components/setup-wizard";
+@import "components/mermaid";
 
 // 6. Layout partials
 @import "layouts/landing";

data/assets/js/ai-chat.js

@@ -28,8 +28,10 @@
  * the tool_result back, and continues the loop.
  *
  * Security:
- * - Proxy mode (recommended) keeps the Anthropic key and GitHub token
- *   server-side; the browser only ever talks to the same-origin proxy.
+ * - Proxy mode (recommended) keeps the provider key and GitHub token
+ *   server-side; the browser only ever talks to the same-origin proxy,
+ *   which answers with Claude or Grok (the reply is always Anthropic
+ *   Messages SSE — the proxy translates for xAI).
  * - Direct mode sends x-api-key from the page and requires the
  *   anthropic-dangerous-direct-browser-access header — local dev only.
  * - GitHub "url" mode never touches a token: it opens pre-filled
@@ -586,14 +588,53 @@
 
     // URL mode: open a pre-filled github.com form — the user submits it
     // with their own account, so no token is ever needed in the browser.
-    var params = new URLSearchParams();
-    params.set('title', String(inputData.title).slice(0, 256));
+    //
+    // The URL is composed by the shared fleet builder (FleetFeedbackCore, in
+    // assets/js/fleet-feedback.js) when the page-feedback widget is enabled,
+    // which is what removed the THIRD hand-rolled issue-URL builder in this
+    // theme. Two things come with it: the same `<!-- fleet-feedback v1 -->`
+    // marker the issue pipeline reads, and a real over-budget path — this used
+    // to `.slice(0, 6000)` the body, silently dropping whatever Claude had
+    // written past that point, with nobody the wiser.
     var body = String(inputData.body);
     if (meta.page_url && body.indexOf(meta.page_url) === -1) {
       body += '\n\n---\nPage: ' + meta.page_url;
     }
-    params.set('body', body.slice(0, 6000));
     var labels = mergedLabels(inputData.labels);
+    var title = String(inputData.title).slice(0, 256);
+    var FF = window.FleetFeedbackCore;
+
+    if (FF) {
+      var issue = {
+        title: title,
+        // The chat writes prose, not a capture, so it fills the description
+        // slot whole; only the footer is contributed by the contract.
+        sections: {
+          description: body,
+          footer: '---\n_Filed from ' + (meta.page_url || location.href) +
+            ' via the AI chat assistant (fleet-feedback v' + FF.VERSION + ')._\n' +
+            '<!-- fleet-feedback v1 type=chat -->'
+        },
+        labels: labels,
+        assignees: []
+      };
+      var built = FF.buildUrl(issue, { repo: CONFIG.github.repository });
+      var win = window.open(built.url, '_blank', 'noopener');
+      if (!win) {
+        return toolResult(block.id, 'The browser blocked the pop-up, so no issue form opened. Ask the user to allow pop-ups for this site and try again.', true);
+      }
+      if (built.overBudget && navigator.clipboard && navigator.clipboard.writeText) {
+        navigator.clipboard.writeText(built.fullBody).catch(function () {});
+        return toolResult(block.id, 'A pre-filled GitHub issue form was opened in a new browser tab. The report was too long for the URL, so the full text was copied to the user clipboard — tell them to paste it over the pre-filled body before submitting.');
+      }
+      return toolResult(block.id, 'A pre-filled GitHub issue form was opened in a new browser tab. The user reviews and submits it there (a GitHub account is required).');
+    }
+
+    // No page-feedback widget on this site, so the shared builder is not
+    // loaded. Compose the URL directly; the body is capped rather than trimmed.
+    var params = new URLSearchParams();
+    params.set('title', title);
+    params.set('body', body.slice(0, 6000));
     if (labels.length) params.set('labels', labels.join(','));
     window.open('https://github.com/' + CONFIG.github.repository + '/issues/new?' + params.toString(), '_blank', 'noopener');
     return toolResult(block.id, 'A pre-filled GitHub issue form was opened in a new browser tab. The user reviews and submits it there (a GitHub account is required).');
@@ -735,6 +776,7 @@
         var accumulated = '';
         var payload = {
           model: CONFIG.model,
+          provider: CONFIG.provider || 'anthropic', // honoured by the proxy only when that provider has a key
           max_tokens: CONFIG.maxTokens,
           system: buildSystemPrompt(meta),
           messages: history.slice(),

data/assets/js/fleet-feedback-capture.js

@@ -0,0 +1,124 @@
+/*!
+ * fleet-feedback capture v0.2.0 — the early console/error ring buffer.
+ * Source: bamr87/bamr87 templates/feedback/ (spec: specs/FEEDBACK.md, UPS-FB-04).
+ *
+ * Load this FIRST — before any other script, as high in <head> as you can get
+ * it — so the errors that happen during page load are in the buffer by the time
+ * a reader opens the feedback dialog. fleet-feedback.js installs the same
+ * buffer if this file is absent, but by then the interesting failures have
+ * already happened silently.
+ *
+ *   <script src="/assets/js/fleet-feedback-capture.js"></script>     <!-- Jekyll/Django -->
+ *   <Script src="/fleet-feedback-capture.js" strategy="beforeInteractive" />  <!-- Next.js -->
+ *
+ * Small enough to inline verbatim into a <script> tag when a extra request
+ * costs more than the bytes (the Jekyll adapter does exactly that).
+ *
+ * Contract — window.__fleetFeedback:
+ *   logs        [{ t: ISO-8601, level: 'warn'|'error'|'net', msg: string }]
+ *   limit       ring size (default 40)
+ *   installed   true once the hooks are in place; a second load is a no-op
+ *   version     kit version that installed it
+ *   breadcrumb(level, message)  push a structured entry (fetch wrappers use this)
+ *   snapshot()  a copy of the buffer, newest last
+ *   clear()     empty it
+ *
+ * Privacy: in-memory only. Never persisted, never transmitted, never read until
+ * the reader opens the dialog, previews the lines, and submits. Every entry is
+ * redacted (bearer tokens, API keys, JWTs, email addresses) and truncated.
+ */
+/* fleet-feedback:capture:begin — byte-identical in fleet-feedback.js (tests/contract.test.mjs asserts it) */
+(function (root) {
+  'use strict';
+
+  var VERSION = '0.2.0';
+  var LIMIT = 40;
+  var MAX_ENTRY = 600;
+
+  var g = (root.__fleetFeedback = root.__fleetFeedback || {
+    logs: [],
+    limit: LIMIT,
+    installed: false,
+    version: VERSION
+  });
+  if (g.installed) { return; }
+
+  // Secrets end up in console output far more often than anyone expects — an
+  // Authorization header logged by a fetch wrapper, a signed URL in a 403, a
+  // user's address in a validation message. Redact BEFORE the line enters the
+  // buffer, so it can never be previewed, copied, or filed.
+  var SCRUB = [
+    // The credential can carry a scheme word of its own ("Authorization: Bearer
+    // <token>"), and a rule that stops at the scheme leaves the secret in the
+    // buffer — which is exactly what the first version of this did.
+    [/\b(authorization|proxy-authorization|bearer|token|api[-_]?key|access[-_]?token|refresh[-_]?token|client[-_]?secret|secret|password|passwd)(\s*[:=]\s*|\s+)((?:bearer|basic|digest|token)\s+)?([^\s,;"'&]{6,})/gi, '$1$2$3***'],
+    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+/g, '***jwt***'],
+    [/\bgh[pousr]_[A-Za-z0-9]{16,}/g, '***github-token***'],
+    [/\bsk-[A-Za-z0-9_-]{16,}/g, '***api-key***'],
+    [/\b[\w.+-]+@[\w-]+\.[\w.-]{2,}\b/g, '***@***']
+  ];
+
+  function redact(text) {
+    var out = String(text == null ? '' : text);
+    for (var i = 0; i < SCRUB.length; i++) {
+      out = out.replace(SCRUB[i][0], SCRUB[i][1]);
+    }
+    return out;
+  }
+
+  function stringify(value) {
+    if (typeof value === 'string') { return value; }
+    if (value instanceof Error) {
+      return (value.name || 'Error') + ': ' + (value.message || '') +
+        (value.stack ? '\n' + String(value.stack).split('\n').slice(1, 4).join('\n') : '');
+    }
+    try { return JSON.stringify(value); } catch (e) { return String(value); }
+  }
+
+  function push(level, parts) {
+    try {
+      var line = redact(parts.map(stringify).join(' '));
+      if (line.length > MAX_ENTRY) { line = line.slice(0, MAX_ENTRY) + '…'; }
+      g.logs.push({ t: new Date().toISOString(), level: level, msg: line });
+      while (g.logs.length > g.limit) { g.logs.shift(); }
+    } catch (e) { /* capture must never break the page it is watching */ }
+  }
+
+  // Only warn/error are hooked. console.log is noise at this budget — 40 lines
+  // of debug chatter push the actual failure out of a ring this size.
+  if (root.console) {
+    ['warn', 'error'].forEach(function (level) {
+      var original = root.console[level];
+      root.console[level] = function () {
+        push(level, Array.prototype.slice.call(arguments));
+        if (original) { return original.apply(root.console, arguments); }
+      };
+    });
+  }
+
+  if (root.addEventListener) {
+    root.addEventListener('error', function (e) {
+      if (!e) { return; }
+      var where = e.filename ? ' (' + e.filename + ':' + (e.lineno || 0) + ':' + (e.colno || 0) + ')' : '';
+      push('error', [(e.message || 'Uncaught error') + where]);
+    });
+    root.addEventListener('unhandledrejection', function (e) {
+      var reason = e && e.reason;
+      push('error', ['Unhandled promise rejection:', reason && reason.message ? reason.message : reason]);
+    });
+  }
+
+  g.version = VERSION;
+  g.installed = true;
+  g.redact = redact;
+  /**
+   * Push a structured entry. An app's fetch wrapper calls this on a failed
+   * request so the report carries the API call that broke, not just the
+   * exception it surfaced as:
+   *   FF.breadcrumb('net', 'GET /api/analysis → 502 (1243ms) req=abc123')
+   */
+  g.breadcrumb = function (level, message) { push(level || 'net', [message]); };
+  g.snapshot = function () { return g.logs.slice(); };
+  g.clear = function () { g.logs.length = 0; };
+})(typeof window !== 'undefined' ? window : globalThis);
+/* fleet-feedback:capture:end */