heyiam 0.3.6 → 0.3.9

package/dist/routes/publish.js

@@ -55,7 +55,7 @@ export function createPublishRouter(ctx) {
     // Render project preview HTML
     router.post('/api/projects/:project/render-preview', async (req, res) => {
         try {
-            const { username, slug, title, narrative, repoUrl, projectUrl, screenshotUrl, timeline, skills, totalSessions, totalLoc, totalDurationMinutes, totalAgentDurationMinutes, totalFilesChanged, totalTokens, sessionCards, } = req.body;
+            const { username, slug, title, narrative, repoUrl, projectUrl, screenshotUrl, timeline, skills, totalSessions, totalLoc, totalDurationMinutes, totalAgentDurationMinutes, totalFilesChanged, totalTokens, sessionCards, hideSessionDates, } = req.body;
             const renderData = buildProjectRenderData({
                 username: username || 'preview',
                 slug, title, narrative,
@@ -69,6 +69,7 @@ export function createPublishRouter(ctx) {
                 totalFilesChanged: totalFilesChanged || 0,
                 totalTokens,
                 sessionCards: sessionCards || [],
+                hideSessionDates,
             });
             const templateName = getDefaultTemplate() || 'editorial';
             const html = renderProjectHtml(renderData, undefined, templateName);
@@ -181,6 +182,11 @@ export function createPublishRouter(ctx) {
                         send({ type: 'screenshot', status: 'capturing' });
                         const raw = screenshotBase64.includes(',') ? screenshotBase64.split(',')[1] : screenshotBase64;
                         imageBuffer = Buffer.from(raw, 'base64');
+                        // FIXME(security): ext detection only handles png/jpg, so an SVG
+                        // (allowed by the file picker's `accept="image/*"`) gets uploaded
+                        // to S3 with `Content-Type: image/png` while the bytes are SVG.
+                        // CSP on heyi.am mitigates script execution, but reject SVG here
+                        // (or convert it) instead of relying on downstream defenses.
                         ext = screenshotBase64.startsWith('data:image/jpeg') || screenshotBase64.startsWith('data:image/jpg') ? 'jpg' : 'png';
                     }
                     else if (projectUrl) {
@@ -424,7 +430,7 @@ export function createPublishRouter(ctx) {
                         fingerprint: 'portfolio-upload',
                         enhancedAt: new Date().toISOString(),
                         selectedSessionIds: detail.sessions.map((s) => s.id),
-                        result: { narrative: '', arc: [], skills: [], timeline: [], questions: [] },
+                        result: { tagline: '', narrative: '', arc: [], skills: [], timeline: [], questions: [] },
                     };
                     const selectedSessionIds = enhance !== null && enhance.selectedSessionIds !== undefined
                         ? enhance.selectedSessionIds
@@ -720,6 +726,7 @@ export function createPublishRouter(ctx) {
                         enhancedAt: new Date().toISOString(),
                         selectedSessionIds: detail.sessions.map((s) => s.id),
                         result: {
+                            tagline: '',
                             narrative: '',
                             arc: [],
                             skills: [],

package/dist/settings.js

@@ -163,6 +163,8 @@ export function saveProjectEnhanceResult(projectDirName, selectedSessionIds, res
         ...(extras?.repoUrl ? { repoUrl: extras.repoUrl } : {}),
         ...(extras?.projectUrl ? { projectUrl: extras.projectUrl } : {}),
         ...(extras?.screenshotBase64 ? { screenshotBase64: extras.screenshotBase64 } : {}),
+        ...(extras?.template ? { template: extras.template } : {}),
+        ...(extras?.hideSessionDates ? { hideSessionDates: true } : {}),
         result,
     };
     writeFileSync(projectEnhancePath(projectDirName, configDir), JSON.stringify(cache, null, 2), { mode: 0o600 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "heyiam",
-  "version": "0.3.6",
+  "version": "0.3.9",
   "description": "Turn AI coding sessions into portfolio case studies",
   "type": "module",
   "license": "MIT",