@hardikg/mdview 0.7.1 → 0.9.0

package/CHANGELOG.md

@@ -7,6 +7,66 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.9.0] — 2026-09-14
+
+Eight palettes, each with its own ground texture — and code blocks that are
+smaller than they were at five.
+
+### Added
+- **Five new palettes: Everforest, Rosé Pine, Kanagawa, Catppuccin, and Flexoki** — each with a full light and dark variant and its own Shiki theme pair, so code blocks stay inside the palette. Base colours come from each project's own palette file; all six upstream projects are MIT.
+- **Each palette now has its own ground texture.** Previously one texture was defined per light/dark theme, so a warm brown grain (`rgba(120, 70, 30, …)`) was washed over every palette including the cool ones. There are now three patterns, assigned per palette: a dot grain tinted with the palette's own ink on the paper-like palettes (flexoki, paper, solarized), fibre noise on the two lowest-contrast grounds (everforest, kanagawa), and an accent wash — a wide bleed of the palette's accent down from the top edge — on rose-pine and catppuccin. `high-contrast` gets none, because texture over a maximum-contrast ground works against the one thing that palette exists to provide. The noise is an SVG `feTurbulence` data URI, which the existing `img-src 'self' data: blob:` already permits, so the CSP is untouched.
+
+  Texture is deliberately not a setting. It is part of a palette's identity, and a four-way picker crossed with eight palettes is 32 combinations nobody would author or test.
+- **VS Code extension: two-way cursor sync.** Clicking a heading or an internal link in the preview moves the editor cursor and reveals the line; moving the cursor in the editor scrolls the preview to the nearest heading at or above that line, debounced at 80ms. A suppression window breaks the feedback loop so VS Code's own selection-change event isn't echoed back as a jitter loop. Inbound paths from the webview are canonicalized with `realpath` and rejected unless they stay inside the workspace folder. The extension is still unpublished (`0.1.0`).
+- VS Code extension: `mdview: Open in Browser` command, and the preview now follows the active editor and the VS Code colour theme.
+
+### Changed
+- **Code blocks are rendered for the active palette only, and are far smaller for it.** Every token used to carry one CSS variable per (palette, mode) pair, so adding palettes inflated every document that contained code — 16 variables per token at eight palettes. A token now carries two, `--shiki-light` and `--shiki-dark`. `/api/file` accepts a `palette` query param, checked against the allow-list and falling back to the default rather than failing the request, and the client refetches when you change palette. The light/dark toggle still repaints with no request, since both its variants ship in every response. `test-fixtures/showcase.md` went from 204 KB to 30 KB — smaller than it was before any of the new palettes landed.
+- **Flexoki is the new default palette**, replacing `classic`. It keeps the warm-cream editorial look but is built on a measured 15-step base ramp rather than hand-picked creams, and it is the only palette here designed for reading prose rather than for reading code.
+- The VS Code extension's `auto` palette no longer picks a different palette for light and dark themes. Light versus dark is a separate axis in the renderer — every palette defines both — so `auto` now follows only the high-contrast kinds and otherwise leaves the palette alone.
+
+### Removed
+- **The `classic` and `nord` palettes.** `--palette classic` and `--palette nord` now exit non-zero and list the valid names. A `palette` of either in `.mdview.json` or a stale one in `localStorage` degrades silently to the default, which is the existing behaviour for any unrecognised palette — no migration needed.
+- The VS Code extension drops both from the `mdview.palette` setting enum.
+
+### Security
+- `fastify` 5.8.5 → 5.12.3. Closes a schema-validation bypass via root primitive coercion (GHSA-w2qp-rph6-63g4) and `X-Forwarded-*` spoofing under `trustProxy` hop-count (GHSA-3m5p-2c4r-xxw2). Neither is reachable here — the server defines no root-primitive schemas and never sets `trustProxy` — but the dep ships to users.
+- `js-yaml` 3.15.1 → 3.15.2 (transitively, via `gray-matter`). Closes unbounded CPU use on empty merge sources (GHSA-2883-xcg3-v3hh). This one is reachable: `js-yaml` parses frontmatter out of whatever markdown the user opens.
+
+## [0.8.1] — 2026-08-24
+
+### Fixed
+- Live reload stopped working for any URL that named a file without its root id — a bookmark from before 0.8.0, or the VS Code extension sending a workspace-relative path. Such a request resolves against the primary root and the server answers with the workspace-scoped path, but the page kept comparing watch events against the path it had asked for, so nothing ever matched and the document silently stopped updating on save. The comparison now uses the path the server actually served. The first load always worked, which is why this got past the 0.8.0 checks.
+
+## [0.8.0] — 2026-08-24
+
+One background server, many folders. `mdview <path>` no longer holds the terminal.
+
+### Added
+- **`mdview <path>` returns the shell.** It starts one detached background server the first time it's needed; every later `mdview <path>`, in any repo, adds that folder to the same server and opens it. So unrelated folders — `~/work/api/docs` and `~/notes` — can be read side by side in one window at one stable URL. `--foreground` (`-f`) runs a server in the terminal as before.
+- `mdview ls` (open folders, server pid/port, log path), `mdview rm <name|path>…` (stop serving a folder), `mdview stop` (stop the server).
+- Folders persist in `~/.config/mdview/workspace.json` until removed, across restarts and reboots. Capped at 8, because each holds a live recursive watcher. Opening a file or subfolder inside an already-open folder reuses it instead of adding a duplicate.
+- The background server runs until `mdview stop` or a reboot. `MDVIEW_IDLE_TIMEOUT` opts into having it exit after that many minutes with no browser tab connected (it clears its record, and the next `mdview` starts it again) — off by default, since a server that stays put keeps the URL reliable.
+- `--port` and `--palette` now imply `--foreground`: each overrides a setting belonging to a whole server, and the background one is shared. A useful side effect is that every invocation that worked before behaves exactly as it did — only the bare `mdview [path]` form changed.
+- The printed and opened URL is now `http://mdview.localhost:7331/` instead of `http://127.0.0.1:7331/`. `*.localhost` is reserved to loopback by RFC 6761 and resolves with no setup, no `/etc/hosts` entry and no privileges; the server still binds `127.0.0.1` only. If the local resolver doesn't answer the name with a loopback address the CLI falls back to the literal address rather than printing a URL that could leave the machine. `--vscode` keeps `127.0.0.1` unconditionally, because the extension validates that exact prefix.
+- `PORT` is honoured as the default port when `--port` is omitted, so mdview runs unchanged under a local reverse proxy such as [portless](https://github.com/vercel-labs/portless) for a port-free URL. Invalid values are ignored rather than fatal.
+
+### Changed
+- **Paths in URLs are now workspace-scoped**: `?file=docs/api.md` becomes `?file=<rootId>/docs/api.md`, and asset URLs become `/__asset/<rootId>/<path>`. This is what lets one server host several unrelated folders at once. An unprefixed path still resolves against the first root, so existing links and existing bookmarks keep working, as does the VS Code extension.
+- `/api/tree` now returns `{ roots, tree, config }`. With a single root its contents stay at the top level exactly as before; a second root is what introduces a folder node per root. Window-level settings (palette, font, line width) come from the first root; `ignore` stays per-root.
+- Folder search covers every open folder root and labels each hit with its root. The 200-hit cap is a budget for the whole search rather than per root.
+- With more than one folder open the sidebar groups each under its own heading, expanded by default. `⌘P` and folder search span every folder and show which one each result is in. Live reload learns a `workspace` event, so a folder opened or closed elsewhere appears in tabs that are already open without a reload. Closing the last folder shows an empty state rather than an endless skeleton.
+
+### Security
+- There is deliberately **no HTTP endpoint that changes which folders are served**. The CLI writes `workspace.json` and the server watches it, so adding a root requires filesystem access, which a web page does not have — nothing to CSRF, and no shared token to store or leak. `/api/health` is read-only and reports ids, a pid and a start time, never absolute paths.
+- `mdview stop` checks the recorded pid **and** its start time against what the process reports before signalling it, so a recycled pid belonging to an unrelated process is never killed.
+- State files are written `0600` inside a `0700` directory, each through a temp file and one rename so a reader never sees a half-written file. `workspace.json` is validated defensively on read: a hand-edited or truncated file degrades to fewer folders, never to a crash or an unchecked path.
+- Concurrent `mdview` invocations are serialised through a lock file, so two shells can't race into two servers fighting over the port.
+- Every request's `Host` header is now checked against a loopback allow-list (`localhost`, `*.localhost`, the loopback literals) in an `onRequest` hook, and anything else gets a bare `403`. Closes a DNS-rebinding hole: binding `127.0.0.1` never stopped a page the user was already browsing from re-resolving its own domain to loopback and reading every file mdview serves. Verified against a running server — `Host: evil.com` returned `200` before this change.
+- `@fastify/static` 9 → 10 (major). Closes two high-severity advisories in the component that serves the SPA: authorization bypass via non-canonical URL paths (GHSA-8pvw-jcv7-9cmj) and route-guard bypass via path traversal (GHSA-83w8-p2f5-377r). The plugin is registered at a single call site with a `root` + `prefix` only, and v10 changes nothing we use — its diff against v9 is `fastify-plugin` ^5 → ^6 and `content-disposition` ^1 → ^2.
+- Lockfile-only bumps clearing five further high-severity shipped-dep advisories: `brace-expansion` (DoS via unbounded expansion), `fast-uri` (host confusion via backslash authority delimiter), `find-my-way` (HTTP/2 DoS), `js-yaml` (quadratic CPU in `!!omap`), `linkify-it` (quadratic `mailto:` scan). `npm audit --omit=dev` is back to zero.
+- The one remaining advisory is the `low`, dev-only `esbuild` one already deferred in 0.7.1: it is reachable only through `tsup`/`vite`, is absent from shipped deps, and never enters the published tarball. `npm audit fix` still cannot resolve it without a breaking parent bump.
+
 ## [0.7.1] — 2026-07-01
 
 ### Security

package/README.md

@@ -50,26 +50,93 @@ node bin/mdview.mjs ./docs
 ### Share with friends without publishing
 
 ```bash
-npm run build && npm pack    # produces mdview-0.6.0.tgz
+npm run build && npm pack    # produces hardikg-mdview-<version>.tgz
 ```
 
 Send them the `.tgz` (Slack/Drive/AirDrop). They install with:
 
 ```bash
-npm install -g ./mdview-0.6.0.tgz
+npm install -g ./hardikg-mdview-<version>.tgz
 ```
 
 ## Usage
 
 ```bash
-mdview <path>              # file or folder
+mdview <path>              # open a file or folder; the shell comes straight back
 mdview                     # current directory
-mdview --port 9000         # custom port (default 7331; auto-fallback unless --port is explicit)
+mdview ls                  # what's open, and where the server is
+mdview rm <name>           # stop serving a folder
+mdview stop                # stop the background server
+mdview --foreground        # run in this terminal instead (Ctrl-C to stop)
 mdview --no-open           # don't auto-launch the browser
+mdview --port 9000         # one-off server on a specific port (implies --foreground)
+mdview --palette kanagawa  # palette for this run (implies --foreground)
 mdview --help              # show usage
 ```
 
-Closes when you `Ctrl-C` or `kill` the process. Set `MDVIEW_DEBUG=1` for full stack traces on unexpected errors.
+### One server, many folders
+
+`mdview` does not hold your terminal. It starts a single background server the
+first time you need one, and every later `mdview <path>` — in any repo — adds
+that folder to the same server and opens it. So you can read
+`~/work/api/docs` and `~/notes` side by side in one window, with one stable
+URL, whether or not the folders are anywhere near each other.
+
+```console
+$ mdview ~/work/api
+mdview → http://mdview.localhost:7331/?root=api
+added: /Users/you/work/api (api)
+$ cd ~/notes && mdview .
+mdview → http://mdview.localhost:7331/?root=notes
+added: /Users/you/notes (notes)
+$ mdview ls
+● api    ~/work/api    (primary)
+● notes  ~/notes
+
+server:  http://mdview.localhost:7331/  (pid 40113)
+logs:    ~/.config/mdview/daemon.log
+```
+
+Folders stay open until you remove them with `mdview rm <name>`, across restarts
+and reboots. Up to 8 at a time — each one holds a live file watcher, so the
+limit is there to keep mdview from quietly watching your whole disk. Opening a
+file or subfolder inside a folder that's already open reuses it rather than
+adding a duplicate.
+
+The server keeps running until you `mdview stop` it, or you reboot. If you'd
+rather it stood down on its own, set `MDVIEW_IDLE_TIMEOUT` to a number of
+minutes and it will exit that long after the last browser tab disconnects; the
+next `mdview` starts it again.
+
+Its state lives in `~/.config/mdview/` (`daemon.json`, `workspace.json`,
+`daemon.log`) and nowhere else. `workspace.json` is also how the CLI talks to
+the server: `mdview <path>` writes the file and the server picks the change up,
+which is why there is no HTTP endpoint that can change what's being served.
+
+The URL is `http://mdview.localhost:7331/` — `*.localhost` always resolves to
+loopback (RFC 6761) with no setup, and the server still listens on `127.0.0.1`
+only. If your resolver doesn't answer the name, mdview falls back to printing
+`http://127.0.0.1:<port>/`. Setting `PORT` changes the default port, so mdview
+works as-is behind a local proxy like
+[portless](https://github.com/vercel-labs/portless) if you want the port gone
+entirely.
+
+`--palette` takes `flexoki`, `paper`, `solarized`, `everforest`, `rose-pine`,
+`kanagawa`, `catppuccin`, or `high-contrast`.
+It wins over both `.mdview.json` and the global config, and never writes to
+either. There is also a `--vscode` flag, used by the VS Code extension to run
+mdview as a sidecar; it implies `--no-open` and prints a single JSON ready line
+instead of the human-readable output.
+
+`--port` and `--palette` both override a setting that belongs to a whole server,
+and the background one is shared with every other folder you have open — so each
+implies `--foreground`, giving you a server of your own. That also means every
+invocation that worked before still behaves exactly as it did; only the bare
+`mdview [path]` form returns the shell now.
+
+`--foreground` closes when you `Ctrl-C` or `kill` it. The background server is
+stopped with `mdview stop`. Set `MDVIEW_DEBUG=1` for full stack traces on
+unexpected errors.
 
 ## Keyboard shortcuts
 
@@ -102,7 +169,7 @@ Click the keyboard icon in the header anytime to see the full list.
 - 3-pane layout: folder tree, content, outline. Both sidebars collapse to a thin label rail; both have drag handles to resize (widths persist).
 - Editorial typography (serif body, italic accent H1, paper-grain background, JetBrains Mono in code blocks).
 - Light & dark theme — follows your OS preference, with a manual override that persists.
-- Five built-in palettes: classic / paper / nord / solarized / high-contrast. Pick one from the header palette swatch. Code blocks follow the palette (Nord syntax in Nord, Solarized in Solarized, etc.).
+- Eight built-in palettes: flexoki / paper / solarized / everforest / rose-pine / kanagawa / catppuccin / high-contrast. Pick one from the header palette swatch. Each defines a full light and dark variant and its own ground texture: a dot grain on the paper-like palettes, fibre noise on Everforest and Kanagawa, an accent wash on Rosé Pine and Catppuccin, and none at all on high-contrast. Code blocks follow the palette (Everforest syntax in Everforest, Catppuccin in Catppuccin, etc.).
 - Reading-progress bar pinned to the bottom of the header.
 - Doc stats strip below the H1 (reading time, word count, heading count, "Updated N ago").
 - Focus mode dims everything except the section at the viewport center.
@@ -118,7 +185,7 @@ Click the keyboard icon in the header anytime to see the full list.
 
 **Rendering**
 - CommonMark + GFM (tables, task lists, strikethrough, autolinks).
-- Server-side syntax highlighting via Shiki, palette-aware (10 variants per token — one for every palette/theme combination) — zero client highlighter bundle, no re-render on theme/palette swap.
+- Server-side syntax highlighting via Shiki, palette-aware: two variants per token, light and dark, for whichever palette is active. Zero client highlighter bundle, and the light/dark toggle repaints with no request.
 - Mermaid diagrams, lazy-loaded only when a doc contains a `mermaid` fence.
 - Math via KaTeX (`$inline$` and `$$block$$`), lazy-loaded only when a doc contains math.
 - Custom-styled task list checkboxes (filled accent when checked, hollow when unchecked).
@@ -150,7 +217,7 @@ Two layered files, both optional, same schema:
 
 ```json
 {
-  "palette": "nord",
+  "palette": "everforest",
   "fontFamily": "serif",
   "lineWidth": "70ch",
   "defaultCollapsed": { "tree": false, "outline": false },
@@ -186,7 +253,7 @@ Node 20+, TypeScript, Fastify 5, markdown-it 14, Shiki 1, gray-matter, chokidar
 ## Tests
 
 ```bash
-npm test            # vitest, server + client (289 tests)
+npm test            # vitest, server + client
 npm run typecheck   # both tsconfigs
 npm run build       # vite (client) + tsup (server CLI)
 ```