@gmickel/gno 1.29.6 → 1.30.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gmickel/gno",
-  "version": "1.29.6",
+  "version": "1.30.4",
   "description": "Local semantic search for your documents. Index Markdown, PDF, and Office files with hybrid BM25 + vector search.",
   "keywords": [
     "embeddings",
@@ -66,6 +66,8 @@
     "test:web": "bun test test/serve/public --timeout 30000",
     "test:e2e": "bun scripts/web-ui-smoke.ts",
     "test:e2e:clipper": "bun test test/clipper/e2e.test.ts --timeout 240000",
+    "test:e2e:pdf": "bun scripts/pdf-viewer-smoke.ts",
+    "smoke:pdf-viewer": "bun scripts/pdf-viewer-smoke.ts",
     "test:e2e:install": "bunx playwright install chromium",
     "test:package": "bun scripts/package-smoke.ts",
     "test:package:clipper": "bun scripts/package-smoke-clipper-cli.ts",
@@ -151,77 +153,78 @@
     "prepack": "bun run package:clipper"
   },
   "dependencies": {
-    "@codemirror/lang-markdown": "6.5.0",
+    "@codemirror/lang-markdown": "6.5.1",
     "@codemirror/theme-one-dark": "6.1.3",
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "@radix-ui/react-collapsible": "1.1.12",
-    "@radix-ui/react-dialog": "1.1.15",
-    "@radix-ui/react-dropdown-menu": "2.1.16",
-    "@radix-ui/react-hover-card": "1.1.15",
-    "@radix-ui/react-progress": "1.1.8",
-    "@radix-ui/react-scroll-area": "1.2.10",
-    "@radix-ui/react-select": "2.2.6",
-    "@radix-ui/react-separator": "1.1.8",
-    "@radix-ui/react-slot": "1.2.4",
-    "@radix-ui/react-tooltip": "1.2.8",
+    "@modelcontextprotocol/sdk": "1.30.0",
+    "@radix-ui/react-collapsible": "1.1.20",
+    "@radix-ui/react-dialog": "1.1.23",
+    "@radix-ui/react-dropdown-menu": "2.1.24",
+    "@radix-ui/react-hover-card": "1.1.23",
+    "@radix-ui/react-progress": "1.1.16",
+    "@radix-ui/react-scroll-area": "1.2.18",
+    "@radix-ui/react-select": "2.3.7",
+    "@radix-ui/react-separator": "1.1.15",
+    "@radix-ui/react-slot": "1.3.3",
+    "@radix-ui/react-tooltip": "1.2.16",
     "ai": "6.0.68",
     "bun-plugin-tailwind": "0.1.2",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "cmdk": "1.1.1",
     "codemirror": "6.0.2",
-    "commander": "14.0.3",
+    "commander": "15.0.0",
     "embla-carousel-react": "8.6.0",
     "franc": "6.2.0",
     "jsonc-parser": "3.3.1",
-    "lucide-react": "1.8.0",
-    "markitdown-ts": "0.0.9",
-    "minimatch": "10.2.3",
-    "nanoid": "5.1.6",
-    "node-llama-cpp": "3.18.1",
-    "officeparser": "6.0.4",
+    "lucide-react": "1.28.0",
+    "markitdown-ts": "0.0.10",
+    "minimatch": "10.2.6",
+    "nanoid": "6.0.0",
+    "node-llama-cpp": "3.19.1",
+    "officeparser": "7.5.0",
+    "pdfjs-dist": "6.2.108",
     "picocolors": "1.1.1",
-    "react": "19.2.4",
-    "react-dom": "19.2.4",
-    "react-force-graph-2d": "1.29.0",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
+    "react-force-graph-2d": "1.29.1",
     "react-markdown": "10.1.0",
     "rehype-sanitize": "6.0.0",
     "remark-gfm": "4.0.1",
-    "shiki": "4.0.2",
+    "shiki": "4.3.1",
     "sqlite-vec": "0.1.9",
-    "streamdown": "2.1.0",
-    "tailwind-merge": "3.4.0",
-    "tailwindcss": "4.1.18",
-    "use-stick-to-bottom": "1.1.2",
-    "zod": "4.3.6"
+    "streamdown": "2.5.0",
+    "tailwind-merge": "3.6.0",
+    "tailwindcss": "4.3.3",
+    "use-stick-to-bottom": "1.1.6",
+    "zod": "4.4.3"
   },
   "devDependencies": {
     "@ai-sdk/openai": "3.0.25",
-    "@biomejs/biome": "2.3.14",
-    "@tailwindcss/cli": "4.1.18",
+    "@biomejs/biome": "2.5.6",
+    "@tailwindcss/cli": "4.3.3",
     "@testing-library/react": "16.3.2",
     "@testing-library/user-event": "14.6.1",
-    "@types/bun": "1.3.8",
-    "@types/react": "19.2.14",
+    "@types/bun": "1.3.14",
+    "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
     "@vscode/tree-sitter-wasm": "0.3.1",
     "ajv": "8.17.1",
     "ajv-formats": "3.0.1",
     "bun": "1.3.14",
-    "docx": "9.5.1",
+    "docx": "9.7.1",
     "evalite": "1.0.0-beta.16",
     "exceljs": "4.4.0",
-    "happy-dom": "20.8.9",
-    "lefthook": "2.1.4",
+    "happy-dom": "20.11.1",
+    "lefthook": "2.1.10",
     "oxfmt": "0.28.0",
     "oxlint": "1.43.0",
     "oxlint-tsgolint": "0.11.5",
     "pdf-lib": "1.17.1",
-    "playwright": "1.58.2",
+    "playwright": "1.62.0",
     "pptxgenjs": "4.0.1",
     "ultracite": "7.1.5",
-    "vitest": "4.1.0",
-    "web-tree-sitter": "0.26.8"
+    "vitest": "4.1.10",
+    "web-tree-sitter": "0.26.11"
   },
   "peerDependencies": {
     "typescript": "^5"

package/src/converters/adapters/officeparser/adapter.ts

@@ -1,6 +1,6 @@
 /**
  * officeparser adapter for PPTX conversion.
- * Uses parseOffice() v6 API with Buffer for in-memory extraction.
+ * Uses parseOffice() v7 API with Buffer for in-memory extraction.
  */
 
 import { parseOffice } from "officeparser";
@@ -76,12 +76,16 @@ export const officeparserAdapter: Converter = {
     try {
       // Zero-copy Buffer view (input.bytes is immutable by contract)
       const buffer = toBuffer(input.bytes);
-      // v6 API: parseOffice returns AST, use .toText() for plain text
+      // v7's async text renderer preserves notes while keeping the previous
+      // plain-text layout and omitting image placeholders.
       const ast = await parseOffice(buffer, {
         newlineDelimiter: "\n",
         ignoreNotes: false, // Include speaker notes
       });
-      const text = ast.toText();
+      const { value: text } = await ast.to("text", {
+        includeImages: false,
+        textConfig: { preserveLayout: false, renderNotes: true },
+      });
 
       if (!text || text.trim().length === 0) {
         return {

package/src/core/network-boundary-inventory.ts

@@ -218,6 +218,57 @@ export const NETWORK_BOUNDARY_INVENTORY = [
     action: "serve",
     enforcement: "loopback_only",
   },
+  {
+    // Loopback self-request that warms the SPA shell cache from the server's
+    // own bound port (127.0.0.1). Carries no collection data and never leaves
+    // the host.
+    id: "serve-spa-shell",
+    key: "src/serve/server.ts::fetch#1",
+    path: "src/serve/server.ts",
+    primitive: "fetch",
+    action: "serve",
+    enforcement: "loopback_only",
+  },
+  {
+    // Windows-only private SPA bundle listener. Bun does not support Unix
+    // sockets on Windows, so this binds an ephemeral loopback port instead.
+    id: "serve-spa-bundle-windows-listener",
+    key: "src/serve/spa-bundle-source.ts::bun_serve#1",
+    path: "src/serve/spa-bundle-source.ts",
+    primitive: "bun_serve",
+    action: "serve",
+    enforcement: "loopback_only",
+  },
+  {
+    // Unix-only private SPA bundle listener. The generated assets are exposed
+    // through a process-owned Unix-domain socket, never a TCP interface.
+    id: "serve-spa-bundle-unix-listener",
+    key: "src/serve/spa-bundle-source.ts::bun_serve#2",
+    path: "src/serve/spa-bundle-source.ts",
+    primitive: "bun_serve",
+    action: "serve",
+    enforcement: "local_process_only",
+  },
+  {
+    // Windows-only request from the public server to its private, ephemeral
+    // loopback SPA bundle listener.
+    id: "serve-spa-bundle-windows-fetch",
+    key: "src/serve/spa-bundle-source.ts::fetch#1",
+    path: "src/serve/spa-bundle-source.ts",
+    primitive: "fetch",
+    action: "serve",
+    enforcement: "loopback_only",
+  },
+  {
+    // Unix-only request over the process-owned SPA bundle socket. The HTTP URL
+    // is a Bun fetch API requirement; the request is routed through `unix`.
+    id: "serve-spa-bundle-unix-fetch",
+    key: "src/serve/spa-bundle-source.ts::fetch#2",
+    path: "src/serve/spa-bundle-source.ts",
+    primitive: "fetch",
+    action: "serve",
+    enforcement: "local_process_only",
+  },
   {
     id: "http-mcp-tools",
     key: "logical::http-mcp-tools",

package/src/core/project-profile.ts

@@ -146,13 +146,13 @@ const resolveContainedPath = async (
   | {
       ok: true;
       absolutePath: string;
-      metadata: Awaited<ReturnType<typeof stat>>;
+      metadata: NonNullable<Awaited<ReturnType<typeof stat>>>;
     }
   | { ok: false; diagnostic: ProjectProfileDiagnostic }
 > => {
   const candidate = resolve(profileRoot, normalizeLogicalPath(logicalPath));
   let absolutePath: string;
-  let metadata: Awaited<ReturnType<typeof stat>>;
+  let metadata: NonNullable<Awaited<ReturnType<typeof stat>>>;
   try {
     absolutePath = await realpath(candidate);
     metadata = await stat(absolutePath);

package/src/publish/encrypted-export.ts

@@ -221,7 +221,7 @@ const deriveKey = async (passphrase: string, salt: Uint8Array) => {
     {
       name: "PBKDF2",
       hash: "SHA-256",
-      salt,
+      salt: Uint8Array.from(salt),
       iterations: PBKDF2_ITERATIONS,
     },
     material,

package/src/serve/AGENTS.md

@@ -74,6 +74,8 @@ Answer generation uses shared module to stay in sync with CLI:
 | `/api/publish/export` | POST   | Export gno.sh publish artifact JSON        |
 | `/api/docs`           | GET    | List documents                             |
 | `/api/doc`            | GET    | Get document content                       |
+| `/api/doc-asset`      | GET    | Original source file bytes (Range, HEAD)   |
+| `/vendor/pdfjs/*`     | GET    | Same-origin pdfjs worker/cmaps/fonts       |
 | `/api/search`         | POST   | BM25 search                                |
 | `/api/query`          | POST   | Hybrid search                              |
 | `/api/ask`            | POST   | AI answer with citations                   |
@@ -106,7 +108,9 @@ gno serve --port 3000
 - Binds to `127.0.0.1` only (no LAN exposure)
 - CSP headers on all responses
 - CORS protection on POST endpoints
-- No external font/script loading
+- No external font/script loading — the PDF.js worker, cMaps, and standard fonts
+  are served same-origin from the installed `pdfjs-dist` package via
+  `/vendor/pdfjs/*`, so the CSP keeps `worker-src 'self'` and `font-src 'self'`
 
 ## Bun.serve() Patterns
 

package/src/serve/CLAUDE.md

@@ -76,6 +76,8 @@ Answer generation uses shared module to stay in sync with CLI:
 | `/api/publish/export` | POST   | Export gno.sh publish artifact JSON        |
 | `/api/docs`           | GET    | List documents                             |
 | `/api/doc`            | GET    | Get document content                       |
+| `/api/doc-asset`      | GET    | Original source file bytes (Range, HEAD)   |
+| `/vendor/pdfjs/*`     | GET    | Same-origin pdfjs worker/cmaps/fonts       |
 | `/api/search`         | POST   | BM25 search                                |
 | `/api/query`          | POST   | Hybrid search                              |
 | `/api/ask`            | POST   | AI answer with citations                   |
@@ -108,7 +110,9 @@ gno serve --port 3000
 - Binds to `127.0.0.1` only (no LAN exposure)
 - CSP headers on all responses
 - CORS protection on POST endpoints
-- No external font/script loading
+- No external font/script loading — the PDF.js worker, cMaps, and standard fonts
+  are served same-origin from the installed `pdfjs-dist` package via
+  `/vendor/pdfjs/*`, so the CSP keeps `worker-src 'self'` and `font-src 'self'`
 
 ## Bun.serve() Patterns
 

package/src/serve/fn112-routes.ts

@@ -0,0 +1,232 @@
+/**
+ * Production route factories for fn-112 doc-asset + pdfjs vendor surfaces.
+ * server.ts and tests MUST consume these — no duplicated route maps.
+ *
+ * Vendor: ONE production dispatcher (`handlePdfjsVendorRequest`) is the sole
+ * path for every /vendor/pdfjs/* request (valid or malformed, any method).
+ * server.ts routes that prefix through fetch; tests call the same function.
+ */
+
+import type { Config } from "../config/types";
+import type { SqliteAdapter } from "../store/sqlite/adapter";
+import type { ResidentRuntime } from "./resident-runtime";
+
+import { handlePdfjsAsset, PDFJS_ASSET_CACHE_CONTROL } from "./pdfjs-assets";
+import { handleResidentRead } from "./resident-request";
+import { handleDocAsset } from "./routes/api";
+
+const PDFJS_WORKER_BOOTSTRAP = `
+if (typeof Math.sumPrecise !== "function") {
+  Object.defineProperty(Math, "sumPrecise", {
+    configurable: true,
+    writable: true,
+    value(values) {
+      let sum = 0;
+      let compensation = 0;
+      for (const value of values) {
+        const next = sum + value;
+        compensation += Math.abs(sum) >= Math.abs(value)
+          ? sum - next + value
+          : value - next + sum;
+        sum = next;
+      }
+      return sum + compensation;
+    },
+  });
+}
+await import("/vendor/pdfjs/pdf.worker.raw.min.mjs");
+`.trimStart();
+
+export type SecurityHeaderWrap = (
+  response: Response,
+  isDev: boolean
+) => Response;
+
+export type DocAssetRouteContext = {
+  store: SqliteAdapter;
+  /** Live config getter (ctxHolder.config may change). */
+  getConfig: () => Config;
+  runtime: ResidentRuntime;
+  isDev: boolean;
+  withSecurityHeaders: SecurityHeaderWrap;
+};
+
+export type MethodHandlers = {
+  GET: (req: Request) => Promise<Response> | Response;
+  HEAD: (req: Request) => Promise<Response> | Response;
+};
+
+/** Exact production error envelopes for vendor routes (I1-04 round 3). */
+export const PDFJS_VENDOR_ERRORS = {
+  NOT_FOUND: {
+    code: "NOT_FOUND",
+    message: "Asset not found",
+  },
+  METHOD_NOT_ALLOWED: {
+    code: "METHOD_NOT_ALLOWED",
+    message: "Only GET and HEAD are supported",
+  },
+} as const;
+
+/**
+ * Production `/api/doc-asset` GET+HEAD handlers.
+ * Both methods traverse handleResidentRead (admission) then withSecurityHeaders.
+ */
+export function createDocAssetRouteHandlers(
+  ctx: DocAssetRouteContext
+): MethodHandlers {
+  const dispatch = async (req: Request): Promise<Response> => {
+    const url = new URL(req.url);
+    return ctx.withSecurityHeaders(
+      await handleResidentRead(ctx.runtime, req, () =>
+        handleDocAsset(ctx.store, ctx.getConfig(), url, req)
+      ),
+      ctx.isDev
+    );
+  };
+  return {
+    GET: dispatch,
+    HEAD: dispatch,
+  };
+}
+
+export type PdfjsVendorDispatchOptions = {
+  isDev: boolean;
+  withSecurityHeaders: SecurityHeaderWrap;
+};
+
+/**
+ * Production vendor dispatcher — the ONLY production path for `/vendor/pdfjs/*`.
+ *
+ * Handles every method and every pathname under the prefix (worker, cmaps,
+ * standard_fonts, multi-segment, empty, encoded traversal, invalid encoding).
+ * ALL responses — success, 404, 405 — go through withSecurityHeaders exactly once.
+ *
+ * server.ts must call this for the prefix (via fetch); tests must call this
+ * identical function (no separate test-only fallback).
+ */
+export async function handlePdfjsVendorRequest(
+  request: Request,
+  options: PdfjsVendorDispatchOptions
+): Promise<Response> {
+  const wrap = options.withSecurityHeaders;
+  const isDev = options.isDev;
+  const method = request.method.toUpperCase();
+  const pathname = new URL(request.url).pathname;
+
+  // Never double-wrap: build the inner response, then wrap once.
+  const inner = await dispatchPdfjsVendorInner(method, pathname);
+  return wrap(inner, isDev);
+}
+
+/**
+ * True when this request should be handled by the vendor dispatcher.
+ * Used by server fetch to claim the whole prefix.
+ */
+export function isPdfjsVendorPath(pathname: string): boolean {
+  return pathname === "/vendor/pdfjs" || pathname.startsWith("/vendor/pdfjs/");
+}
+
+async function dispatchPdfjsVendorInner(
+  method: string,
+  pathname: string
+): Promise<Response> {
+  // Only GET/HEAD are ever valid on any vendor path
+  if (method !== "GET" && method !== "HEAD") {
+    return methodNotAllowedResponse();
+  }
+
+  // Public worker bootstrap: install the ES2026 Math.sumPrecise compatibility
+  // required by pdfjs-dist before evaluating its worker module.
+  if (pathname === "/vendor/pdfjs/pdf.worker.min.mjs") {
+    const headers = {
+      "Cache-Control": PDFJS_ASSET_CACHE_CONTROL,
+      "Content-Type": "text/javascript",
+      "Content-Length": String(
+        new TextEncoder().encode(PDFJS_WORKER_BOOTSTRAP).byteLength
+      ),
+    };
+    return new Response(method === "HEAD" ? null : PDFJS_WORKER_BOOTSTRAP, {
+      headers,
+    });
+  }
+
+  // Package worker stays behind a fixed same-origin route; never referenced
+  // directly by application code, only by the bootstrap above.
+  if (pathname === "/vendor/pdfjs/pdf.worker.raw.min.mjs") {
+    return handlePdfjsAsset({ kind: "worker", method });
+  }
+
+  // cmaps/:file — single segment only
+  const cmapMatch = pathname.match(/^\/vendor\/pdfjs\/cmaps\/([^/]*)$/u);
+  if (cmapMatch) {
+    const raw = cmapMatch[1] ?? "";
+    if (raw === "") {
+      return notFoundResponse();
+    }
+    const file = decodeRouteSegment(raw);
+    if (file === null) {
+      return notFoundResponse();
+    }
+    return handlePdfjsAsset({ kind: "cmaps", file, method });
+  }
+
+  // standard_fonts/:file — single segment only
+  const fontMatch = pathname.match(
+    /^\/vendor\/pdfjs\/standard_fonts\/([^/]*)$/u
+  );
+  if (fontMatch) {
+    const raw = fontMatch[1] ?? "";
+    if (raw === "") {
+      return notFoundResponse();
+    }
+    const file = decodeRouteSegment(raw);
+    if (file === null) {
+      return notFoundResponse();
+    }
+    return handlePdfjsAsset({ kind: "standard_fonts", file, method });
+  }
+
+  // Multi-segment, empty prefix, unknown subpaths, traversal that doesn't
+  // collapse to a single-segment match → 404
+  return notFoundResponse();
+}
+
+function decodeRouteSegment(segment: string): string | null {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return null;
+  }
+}
+
+function notFoundResponse(): Response {
+  return Response.json(
+    { error: { ...PDFJS_VENDOR_ERRORS.NOT_FOUND } },
+    { status: 404 }
+  );
+}
+
+function methodNotAllowedResponse(): Response {
+  return Response.json(
+    { error: { ...PDFJS_VENDOR_ERRORS.METHOD_NOT_ALLOWED } },
+    { status: 405 }
+  );
+}
+
+/**
+ * @deprecated Use handlePdfjsVendorRequest — kept only if any import remains.
+ * Prefer the single production dispatcher.
+ */
+export async function dispatchPdfjsVendorRoute(
+  _routeMap: unknown,
+  request: Request,
+  options?: PdfjsVendorDispatchOptions
+): Promise<Response> {
+  if (!options) {
+    throw new Error(
+      "dispatchPdfjsVendorRoute requires production options; use handlePdfjsVendorRequest"
+    );
+  }
+  return handlePdfjsVendorRequest(request, options);
+}