@carlesandres/house 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -1,10 +1,60 @@
 # Changelog
 
-All notable changes to house land here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html) from v0.1.0 onward.
+## 0.10.0
+
+### Minor Changes
+
+- Browser previews now include static syntax highlighting, a native collapsible table of contents,
+  and locally bundled Mermaid rendering with readable source fallbacks, so project documentation
+  remains useful offline and when browser enhancement fails.
+
+### Patch Changes
+
+- Browser previews now sanitize authored HTML and URLs, apply a restrictive local-page policy, and
+  serve only immutable built-in assets from loopback-validated requests.
+- Releases now use Changesets: each pull request carries its own release note, and a bot keeps a
+  "chore: version packages" pull request current, so publishing a version is a single merge.
+- CI now runs the PTY suite (`bun run test:pty`) after workspace tests, so real-terminal regressions
+  for editor, new-file, sidebar selection, status popover, and extension allow-list paths are gated.
+- npm-installed `house` run from a deleted or inaccessible directory now says so and exits,
+  instead of failing with an unknown error, so the fix (`cd` elsewhere) is clear.
+- The Browser TUI now exits at startup if the markdown highlighter cannot initialize, instead of
+  rendering raw source. CLI and standalone builds fail the same check.
+- `house --root` pointing at a file, missing path or unreadable directory now prints an error before
+  the TUI starts, instead of exiting silently, so the bad root is obvious.
+- npm install smoke (and publish verification) now use Node `>=26.4.0`, matching OpenTUI 0.5.11’s
+  engine floor so `engine-strict` installs succeed.
+- CI and release workflows now pin every action to a commit SHA, kept current by Dependabot, so a
+  moved or compromised tag cannot change what runs.
+- Contributors now install dependencies with pnpm instead of Bun, so Dependabot can raise security
+  alerts and open updates that include the lockfile. Bun still builds and runs house.
+- `ROADMAP.md` is removed; planned work is now tracked in Linear (House team), with public items
+  mirrored to GitHub issues, so plans no longer drift between a file and the issue tracker.
+- Markdown headings, emphasis, and fenced code now highlight again. `web-tree-sitter` is pinned to
+  OpenTUI's `0.25.10` peer so the highlighter can load `tree-sitter.wasm`.
+
+## [0.9.0] — 2026-09-12
 
-The publish workflow (`.github/workflows/publish.yml`) runs on the `release: published` event, builds per-platform binaries, publishes platform packages then the main package via Trusted Publisher, and lets GitHub auto-generate release notes from commit subjects; this file is the curated, narrative version.
+### Changed
+
+- Opening a selected file now hides the Sidebar by default so the Reader gets the full pane; set
+  `autoHideSidebar = false` or use `--no-auto-hide-sidebar` to keep the two-pane view.
+- Release preparation now runs from a dispatchable GitHub workflow, and merging its PR creates and verifies the release, so publishing no longer depends on a clean local checkout or a long-running terminal.
+- The publish job no longer waits for a GitHub `npm` environment reviewer, so creating the GitHub Release (or a `main` dispatch) is enough to ship. The environment still allows only `v*` tags and `main`.
+- Empty CLI `--extensions` / `--show` again override file and env lists after the Effect 4.0.0-beta.107 bump, so an explicit empty allow-list still wins.
+- House now runs on OpenTUI 0.5.9, matching `@house/ui` and the current renderer/input stack.
+
+### Fixed
+
+- Release preparation now creates GitHub-verified commits, so release pull requests satisfy the
+  repository's signed-commit rule and can be merged normally.
+- Release preparation now rejects stale managed branches, requests maintainer review, and reports
+  dispatched CI on the pull request, so release approvals remain visible through GitHub and `gh`.
+- Release preparation now passes GitHub authentication and step outputs through Turborepo, so
+  dispatches can create release pull requests and start their CI.
+- Shift+A no longer drops a hidden-file selection when toggling hidden files back on, so the original file is reselected after the re-walk.
+- Theme resolution now keeps 8-digit hex alpha from bundled palettes, so muted and border tokens in themes like Cursor stay distinct from opaque text.
 
-## [Unreleased]
 
 ## [0.8.0] — 2026-08-30
 
@@ -442,7 +492,7 @@ The v1 MVP, published as `@carlesandres/openmdr` on npm.
 
 Search, stdin, URL fetching, cross-file link following, `$EDITOR` hand-off, syntax highlighting, persistent config, OS-appearance auto-detect, single-binary distribution (issue [#2](https://github.com/carlesandres/openmdr/issues/2)), Homebrew tap. All tracked.
 
-[Unreleased]: https://github.com/carlesandres/house/compare/v0.8.0...HEAD
+[0.9.0]: https://github.com/carlesandres/house/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/carlesandres/house/compare/v0.7.0...v0.8.0
 [0.7.0]: https://github.com/carlesandres/house/compare/v0.6.0...v0.7.0
 [0.6.0]: https://github.com/carlesandres/house/compare/v0.5.2...v0.6.0

package/README.md

@@ -11,7 +11,7 @@ A terminal markdown reader and navigator — themable and configurable, with a k
 - **Fuzzy search** across nested folders (`.gitignore`-aware)
 - **Command palette**
 - **Keyboard-driven**
-- **Open in browser**
+- **Open in browser** with syntax highlighting, document contents, and Mermaid diagrams
 - **Open in `$EDITOR`**
 
 Install with npm or Bun. Prebuilt binaries cover macOS and Linux (arm64/x64); no Bun required to *run* on those platforms.
@@ -19,7 +19,7 @@ Install with npm or Bun. Prebuilt binaries cover macOS and Linux (arm64/x64); no
 ## Runtime requirements
 
 - **Run:** a prebuilt binary for your platform (pulled in automatically on install). No Bun needed at runtime on supported platforms.
-- **Install:** Node/npm or Bun both work. Prefer `npm install -g` for the normal end-user path.
+- **Install:** Node/npm (`>=26.4.0`) or Bun both work. Prefer `npm install -g` for the normal end-user path.
 
 Supported on macOS and Linux (arm64/x64, glibc Linux). Windows is unsupported and unvalidated (see [#129](https://github.com/carlesandres/house/issues/129)).
 
@@ -59,6 +59,13 @@ house --order tree     # files-before-directories instead of recency
 house --serve README.md
 ```
 
+Press `O` in the TUI, choose **Open in browser** from the command palette, or use `--serve` to
+open a live local preview. Code highlighting and a collapsible table of contents are present in
+the HTML itself. Mermaid diagrams enhance in the browser from assets bundled with house; their
+source remains readable if JavaScript is unavailable or a diagram cannot render. Built-in preview
+features work offline while house is running. Relative images and other linked local assets are
+not served yet ([#75](https://github.com/carlesandres/house/issues/75)).
+
 ### Options
 
 | Flag                 | Default           | Description                                                                                                  |
@@ -68,6 +75,8 @@ house --serve README.md
 | `--width <N>`        | `80`              | Reader wrap width used when wrapping is enabled                                                              |
 | `--wrap`             | off               | Start with reader wrapping enabled                                                                           |
 | `--no-wrap`          | off               | Start with reader wrapping disabled                                                                          |
+| `--auto-hide-sidebar` | on               | Hide the sidebar after explicitly opening a file                                                             |
+| `--no-auto-hide-sidebar` | off           | Keep the sidebar visible after explicitly opening a file                                                     |
 | `--show <list>`      | `""`              | Reveal normally-skipped entries; comma-separated subset of `hidden`, `gitignored`. Use `--show ""` to clear. |
 | `--root <dir>`       | current directory | Discovery root to walk; overrides `defaultRoot` config/env                                                   |
 | `--focus <mode>`     | `sidebar`         | Startup focus: `sidebar`, `reader`, or `filter`. `filter` opens the sidebar filter prompt immediately.       |
@@ -97,27 +106,33 @@ tone  = "dark"
 extensions = []
 width = 80
 wrap = false
+autoHideSidebar = true
 show  = ["hidden", "gitignored"]
 focus = "sidebar"
 defaultRoot = "cwd" # or "git"
 order = "recently-modified" # or "tree"
 ```
 
-Supported keys: `theme`, `tone`, `extensions`, `width`, `wrap`, `show`, `focus`, `defaultRoot`, `order`.
+Supported keys: `theme`, `tone`, `extensions`, `width`, `wrap`, `autoHideSidebar`, `show`, `focus`, `defaultRoot`, `order`.
 
 `show` is a list of normally-skipped categories to opt into. Known categories: `hidden` (dot-prefixed entries), `gitignored` (entries matched by a `.gitignore`). Default is the empty list. Hard skips (`node_modules`, `.git`, `.venv`) always apply.
 
 Precedence, highest to lowest:
 
-1. CLI flags (`--theme`, `--tone`, `--ext`, `--width`, `--wrap`, `--no-wrap`, `--show`, `--focus`, `--order`, `--root`)
-2. Env vars (`HOUSE_THEME`, `HOUSE_TONE`, `HOUSE_EXTENSIONS`, `HOUSE_WIDTH`, `HOUSE_WRAP`, `HOUSE_SHOW`, `HOUSE_FOCUS`, `HOUSE_DEFAULT_ROOT`, `HOUSE_ORDER`)
+1. CLI flags (`--theme`, `--tone`, `--ext`, `--width`, `--wrap`, `--no-wrap`, `--auto-hide-sidebar`, `--no-auto-hide-sidebar`, `--show`, `--focus`, `--order`, `--root`)
+2. Env vars (`HOUSE_THEME`, `HOUSE_TONE`, `HOUSE_EXTENSIONS`, `HOUSE_WIDTH`, `HOUSE_WRAP`, `HOUSE_AUTO_HIDE_SIDEBAR`, `HOUSE_SHOW`, `HOUSE_FOCUS`, `HOUSE_DEFAULT_ROOT`, `HOUSE_ORDER`)
 3. Config file
-4. Built-in defaults (`opencode` / `dark` / `extensions = []` / `width = 80` / `wrap = false` / `show = []` / `focus = "sidebar"` / `defaultRoot = "cwd"` / `order = "recently-modified"`)
+4. Built-in defaults (`opencode` / `dark` / `extensions = []` / `width = 80` / `wrap = false` / `autoHideSidebar = true` / `show = []` / `focus = "sidebar"` / `defaultRoot = "cwd"` / `order = "recently-modified"`)
 
 `HOUSE_SHOW` takes a comma-separated list (`HOUSE_SHOW=hidden,gitignored`). For `show` specifically, each source completely replaces the next — categories don't merge across layers. Press `shift+a` in the TUI to round-trip between the configured set and the full vocabulary without editing config.
 
 `width` is the fixed reader width used when wrapping is enabled. `wrap` controls startup mode; press `w` in the TUI to toggle reader wrapping for the current session without editing config.
 
+`autoHideSidebar` hides the sidebar when you explicitly open a selected file with `↵`, `→`, `l`,
+the command palette, or a matching filter Return. Selection movement still previews files without
+hiding it. Press `s` or `/` to bring the sidebar back. Set the option to `false` to retain the
+two-pane view after Open file.
+
 `order` is the File Navigator browse order when no filter query is active. `recently-modified` (default) lists the most recently updated files first, using filesystem modification time, then tree order for ties. `tree` lists files before directories, alphabetically within each group, so current-directory files appear before nested subtrees. An active filter still ranks by relevance first.
 
 The file is optional — a missing file is fine. Invalid keys, unknown themes, invalid `defaultRoot`, or malformed TOML fail loudly with a one-line error. Per-project config (`.house/config.toml`) and additional keys are deferred.
@@ -157,7 +172,7 @@ The footer only shows essential app controls (`W`, `q`, `tab`, `s`, `ctrl+p`) to
 | `G`                             | Last file                                                                                 |
 | `/`                             | Filter files (fuzzy match on path)                                                        |
 | `A`                             | Toggle hidden + gitignored entries (session-only; round-trips with the configured `show`) |
-| `↵` / `→` / `l`                 | Open file (focus reader)                                                                  |
+| `↵` / `→` / `l`                 | Open file (focus reader and auto-hide the sidebar when enabled)                           |
 
 ### Reader
 

package/dist/bin.js

@@ -39,6 +39,15 @@ export const resolveBinaryPath = (packageName, resolve = require.resolve) =>
 
 export const shouldCaptureOutput = (argv) => argv.some((arg) => fastExitFlags.has(arg))
 
+export const hasAccessibleCwd = (cwd = process.cwd) => {
+	try {
+		cwd()
+		return true
+	} catch {
+		return false
+	}
+}
+
 export const main = (
 	argv = process.argv.slice(2),
 	platform = process.platform,
@@ -50,6 +59,13 @@ export const main = (
 		process.exit(0)
 	}
 
+	if (!hasAccessibleCwd()) {
+		console.error(
+			"house: the current directory no longer exists or is not accessible; cd to another directory and retry",
+		)
+		process.exit(1)
+	}
+
 	const packageName = binaryPackageNameFor(platform, arch, libc)
 	if (packageName === undefined) {
 		console.error(