project-logbook 0.3.3 → 0.3.4

package/dist/lib/entry-paths.js

@@ -0,0 +1,55 @@
+import { join } from 'node:path';
+/**
+ * Encapsulates knowledge of logbook entry folder structure.
+ * Provides consistent path construction for entry-related files.
+ */
+/**
+ * Get the base directory path for a logbook entry.
+ * @param logbookDir - The root logbook directory (e.g., "/project/logbook")
+ * @param entrySlug - The entry's slug (e.g., "LB-43-my-feature")
+ * @returns Path to the entry folder (e.g., "/project/logbook/LB-43-my-feature")
+ */
+export function getEntryPath(logbookDir, entrySlug) {
+    return join(logbookDir, entrySlug);
+}
+/**
+ * Get the path to an entry's index.md file.
+ * @param logbookDir - The root logbook directory
+ * @param entrySlug - The entry's slug
+ * @returns Path to index.md
+ */
+function getEntryIndexPath(logbookDir, entrySlug) {
+    return join(getEntryPath(logbookDir, entrySlug), 'index.md');
+}
+/**
+ * Get the path to an entry's ticket.md file.
+ * @param logbookDir - The root logbook directory
+ * @param entrySlug - The entry's slug
+ * @returns Path to ticket.md
+ */
+function getEntryTicketPath(logbookDir, entrySlug) {
+    return join(getEntryPath(logbookDir, entrySlug), 'ticket.md');
+}
+/**
+ * Get the path to an entry's log.md file.
+ * @param logbookDir - The root logbook directory
+ * @param entrySlug - The entry's slug
+ * @returns Path to log.md
+ */
+function getEntryLogPath(logbookDir, entrySlug) {
+    return join(getEntryPath(logbookDir, entrySlug), 'log.md');
+}
+/**
+ * Get all standard entry file paths at once.
+ * Useful when you need to access index, ticket, and log files.
+ * @param logbookDir - The root logbook directory
+ * @param entrySlug - The entry's slug
+ * @returns Object with paths to index.md, ticket.md, and log.md
+ */
+export function getEntryFilePaths(logbookDir, entrySlug) {
+    return {
+        index: getEntryIndexPath(logbookDir, entrySlug),
+        ticket: getEntryTicketPath(logbookDir, entrySlug),
+        log: getEntryLogPath(logbookDir, entrySlug),
+    };
+}

package/dist/lib/git-helpers.d.ts

@@ -5,8 +5,10 @@ import type { GitCommit } from './template-types.js';
  *
  * Uses indexOf/lastIndexOf to delimit fields so commit messages containing `|`
  * are preserved correctly instead of being silently truncated.
+ *
+ * Note: Relative time calculation is done client-side via JavaScript, not here.
  */
-export declare function parseGitLogOutput(raw: string, now?: Date): GitCommit[];
+export declare function parseGitLogOutput(raw: string): GitCommit[];
 /**
  * Fetch git commits that touched `dir`, up to `maxCount`.
  * Returns an empty array if git is unavailable or the directory is not a repo.
@@ -25,3 +27,11 @@ export declare function getGitTags(): Promise<{
  * Kept synchronous intentionally; simple-git is used for the heavier async build operations.
  */
 export declare function getCurrentBranch(cwd?: string): string | undefined;
+/**
+ * Calculate the changed LOC (insertions + deletions) for the active branch or main working tree.
+ */
+export declare function getChangedLOC(logbookDir: string, cwd?: string): Promise<{
+    total: number;
+    insertions: number;
+    deletions: number;
+}>;

package/dist/lib/git-helpers.js

@@ -9,8 +9,10 @@ function getGit() {
  *
  * Uses indexOf/lastIndexOf to delimit fields so commit messages containing `|`
  * are preserved correctly instead of being silently truncated.
+ *
+ * Note: Relative time calculation is done client-side via JavaScript, not here.
  */
-export function parseGitLogOutput(raw, now = new Date()) {
+export function parseGitLogOutput(raw) {
     if (!raw.trim())
         return [];
     return raw
@@ -26,34 +28,10 @@ export function parseGitLogOutput(raw, now = new Date()) {
         const timestamp = line.slice(lastPipe + 1);
         if (!sha || !message || !timestamp)
             return null;
-        const relativeTime = formatRelativeTime(timestamp, now);
-        return { sha: sha.slice(0, 7), message, timestamp, relativeTime };
+        return { sha: sha.slice(0, 7), message, timestamp };
     })
         .filter((c) => c !== null);
 }
-function formatRelativeTime(isoTimestamp, now) {
-    const d = new Date(isoTimestamp);
-    if (isNaN(d.getTime()))
-        return isoTimestamp;
-    const diffMs = now.getTime() - d.getTime();
-    const diffSec = Math.floor(diffMs / 1000);
-    if (diffSec < 60)
-        return 'just now';
-    const diffMin = Math.floor(diffSec / 60);
-    if (diffMin < 60)
-        return `${diffMin} minute${diffMin === 1 ? '' : 's'} ago`;
-    const diffHour = Math.floor(diffMin / 60);
-    if (diffHour < 24)
-        return `${diffHour} hour${diffHour === 1 ? '' : 's'} ago`;
-    const diffDay = Math.floor(diffHour / 24);
-    if (diffDay < 30)
-        return `${diffDay} day${diffDay === 1 ? '' : 's'} ago`;
-    const diffMonth = Math.floor(diffDay / 30);
-    if (diffMonth < 12)
-        return `${diffMonth} month${diffMonth === 1 ? '' : 's'} ago`;
-    const diffYear = Math.floor(diffMonth / 12);
-    return `${diffYear} year${diffYear === 1 ? '' : 's'} ago`;
-}
 /**
  * Fetch git commits that touched `dir`, up to `maxCount`.
  * Returns an empty array if git is unavailable or the directory is not a repo.
@@ -114,3 +92,27 @@ export function getCurrentBranch(cwd = process.cwd()) {
         return undefined;
     }
 }
+/**
+ * Calculate the changed LOC (insertions + deletions) for the active branch or main working tree.
+ */
+export async function getChangedLOC(logbookDir, cwd = process.cwd()) {
+    try {
+        const branchName = getCurrentBranch(cwd) || 'main';
+        const git = simpleGit(cwd);
+        let summary;
+        if (branchName === 'main') {
+            summary = await git.diffSummary(['HEAD', '--', '.', `:!${logbookDir}`]);
+        }
+        else {
+            summary = await git.diffSummary(['main...HEAD', '--', '.', `:!${logbookDir}`]);
+        }
+        return {
+            total: summary.insertions + summary.deletions,
+            insertions: summary.insertions,
+            deletions: summary.deletions,
+        };
+    }
+    catch {
+        return { total: 0, insertions: 0, deletions: 0 };
+    }
+}

package/dist/lib/hast-helpers.d.ts

@@ -0,0 +1,10 @@
+import type { Root, Element } from 'hast';
+/**
+ * Generic HAST tree visitor that traverses depth-first and applies a callback
+ * to elements matching the specified tagName(s).
+ *
+ * @param node - Root or Element node to traverse
+ * @param tagNames - Single tag name or array of tag names to match
+ * @param visitor - Callback applied to each matching element
+ */
+export declare function visitHastElements(node: Root | Element, tagNames: string | string[], visitor: (node: Element) => void): void;

package/dist/lib/hast-helpers.js

@@ -0,0 +1,22 @@
+/**
+ * Generic HAST tree visitor that traverses depth-first and applies a callback
+ * to elements matching the specified tagName(s).
+ *
+ * @param node - Root or Element node to traverse
+ * @param tagNames - Single tag name or array of tag names to match
+ * @param visitor - Callback applied to each matching element
+ */
+export function visitHastElements(node, tagNames, visitor) {
+    const tagNamesSet = new Set(Array.isArray(tagNames) ? tagNames : [tagNames]);
+    function traverse(n) {
+        for (const child of n.children) {
+            if (child.type === 'element') {
+                if (tagNamesSet.has(child.tagName)) {
+                    visitor(child);
+                }
+                traverse(child);
+            }
+        }
+    }
+    traverse(node);
+}

package/dist/lib/html-attributes.d.ts

@@ -0,0 +1,17 @@
+/**
+ * HTML attribute name constants.
+ * Centralized definitions for data attributes and class names used in templates
+ * to maintain consistency between template generation and JavaScript consumers.
+ */
+/** data-page-slug: Identifies the current page/entry slug in the document body */
+export declare const ATTR_PAGE_SLUG = "data-page-slug";
+/** data-entry-slug: Identifies a timeline entry's slug */
+export declare const ATTR_ENTRY_SLUG = "data-entry-slug";
+/** data-date: Stores a timestamp for client-side date formatting */
+export declare const ATTR_DATA_DATE = "data-date";
+/** Class name for commit SHA display */
+export declare const CLASS_COMMIT_SHA = "commit-sha";
+/** Class name for commit timestamp display */
+export declare const CLASS_COMMIT_TIME = "commit-time";
+/** Class name for commit message display */
+export declare const CLASS_COMMIT_MESSAGE = "commit-message";

package/dist/lib/html-attributes.js

@@ -0,0 +1,17 @@
+/**
+ * HTML attribute name constants.
+ * Centralized definitions for data attributes and class names used in templates
+ * to maintain consistency between template generation and JavaScript consumers.
+ */
+/** data-page-slug: Identifies the current page/entry slug in the document body */
+export const ATTR_PAGE_SLUG = 'data-page-slug';
+/** data-entry-slug: Identifies a timeline entry's slug */
+export const ATTR_ENTRY_SLUG = 'data-entry-slug';
+/** data-date: Stores a timestamp for client-side date formatting */
+export const ATTR_DATA_DATE = 'data-date';
+/** Class name for commit SHA display */
+export const CLASS_COMMIT_SHA = 'commit-sha';
+/** Class name for commit timestamp display */
+export const CLASS_COMMIT_TIME = 'commit-time';
+/** Class name for commit message display */
+export const CLASS_COMMIT_MESSAGE = 'commit-message';

package/dist/lib/html-escape.d.ts

@@ -0,0 +1,16 @@
+/**
+ * HTML entity escaping utility.
+ * Escapes characters that have special meaning in HTML to prevent XSS attacks.
+ */
+export declare function escapeHtml(str: string): string;
+/**
+ * Validates a hex color string.
+ * Accepts 3-digit (#abc), 6-digit (#abcdef), or 8-digit (#abcdef00) hex colors.
+ * Returns true if valid, false otherwise.
+ */
+export declare function isValidHexColor(color: string): boolean;
+/**
+ * Validates that a URL has a safe scheme (http or https).
+ * Returns the URL if valid, undefined if invalid.
+ */
+export declare function validateUrlScheme(url: string): string | undefined;

package/dist/lib/html-escape.js

@@ -0,0 +1,38 @@
+/**
+ * HTML entity escaping utility.
+ * Escapes characters that have special meaning in HTML to prevent XSS attacks.
+ */
+export function escapeHtml(str) {
+    if (!str)
+        return '';
+    return str
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Validates a hex color string.
+ * Accepts 3-digit (#abc), 6-digit (#abcdef), or 8-digit (#abcdef00) hex colors.
+ * Returns true if valid, false otherwise.
+ */
+export function isValidHexColor(color) {
+    return /^#[0-9a-fA-F]{3}(?:[0-9a-fA-F]{3})?(?:[0-9a-fA-F]{2})?$/.test(color);
+}
+/**
+ * Validates that a URL has a safe scheme (http or https).
+ * Returns the URL if valid, undefined if invalid.
+ */
+export function validateUrlScheme(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol === 'https:' || parsed.protocol === 'http:') {
+            return url;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/lib/image-helpers.js

@@ -1,13 +1,9 @@
 import fs from 'fs-extra';
-import { join, dirname, relative } from 'node:path';
-import { unified } from 'unified';
-import remarkParse from 'remark-parse';
-import remarkGfm from 'remark-gfm';
-import remarkRehype from 'remark-rehype';
-import rehypeSlug from 'rehype-slug';
-import rehypeFormat from 'rehype-format';
-import rehypeStringify from 'rehype-stringify';
-import chalk from 'chalk';
+import { join, dirname, relative, resolve } from 'node:path';
+import { warning } from './theme.js';
+import { visitHastElements } from './hast-helpers.js';
+import { isExternalUrl } from './url-helpers.js';
+import { createImageCollectionProcessor } from './markdown-processors.js';
 /** Regex to match image links in markdown: ![alt](path) */
 const imageLinkRegex = /!\[.*?\]\(([^)]+\.(?:png|jpe?g|gif|svg|webp|bmp|ico))\)/gi;
 /**
@@ -34,12 +30,12 @@ class ImageProcessor {
     /** Rehype plugin: collect image paths from markdown */
     rehypeCollectImages = () => {
         return (tree) => {
-            visitImages(tree, (node) => {
+            visitHastElements(tree, 'img', (node) => {
                 const src = node.properties?.src;
                 if (typeof src !== 'string')
                     return;
                 // Skip external URLs and data URIs
-                if (/^[a-z][a-z\d+\-.]*:/i.test(src))
+                if (isExternalUrl(src))
                     return;
                 if (src.startsWith('data:'))
                     return;
@@ -49,24 +45,15 @@ class ImageProcessor {
     };
 }
 const imageProcessor = new ImageProcessor();
-function visitImages(node, visitor) {
-    for (const child of node.children) {
-        if (child.type === 'element') {
-            if (child.tagName === 'img')
-                visitor(child);
-            visitImages(child, visitor);
-        }
-    }
-}
 /** Rehype plugin: rewrite relative image paths to use /images/ subfolder */
 export const rehypeRewriteImagePaths = () => {
     return (tree) => {
-        visitImages(tree, (node) => {
+        visitHastElements(tree, 'img', (node) => {
             const src = node.properties?.src;
             if (typeof src !== 'string')
                 return;
             // Skip external URLs and data URIs
-            if (/^[a-z][a-z\d+\-.]*:/i.test(src))
+            if (isExternalUrl(src))
                 return;
             if (src.startsWith('data:'))
                 return;
@@ -87,15 +74,7 @@ export const rehypeRewriteImagePaths = () => {
  */
 export async function mdToHtmlWithImages(md) {
     imageProcessor.reset();
-    const processorWithImages = unified()
-        .use(remarkParse)
-        .use(remarkGfm)
-        .use(remarkRehype)
-        .use(imageProcessor.rehypeCollectImages)
-        .use(rehypeRewriteImagePaths)
-        .use(rehypeSlug)
-        .use(rehypeFormat)
-        .use(rehypeStringify);
+    const processorWithImages = createImageCollectionProcessor(imageProcessor.rehypeCollectImages, rehypeRewriteImagePaths);
     const result = await processorWithImages.process(md);
     return { html: result.toString(), imagePaths: imageProcessor.getImagePaths() };
 }
@@ -108,6 +87,7 @@ export async function mdToHtmlWithImages(md) {
 export async function copyImages(sourceDir, outputDir, imagePaths) {
     await fs.mkdirp(outputDir);
     const processedPaths = new Set();
+    const projectRoot = resolve(process.cwd());
     for (const imagePath of imagePaths) {
         // Skip if already processed
         if (processedPaths.has(imagePath))
@@ -119,7 +99,13 @@ export async function copyImages(sourceDir, outputDir, imagePaths) {
         if (imagePath.startsWith('/')) {
             // Absolute path like /static/screenshot.jpg -> copy from project root to public/static/
             const relativeToProjectRoot = imagePath.substring(1); // Remove leading /
-            sourcePath = join(process.cwd(), relativeToProjectRoot);
+            sourcePath = join(projectRoot, relativeToProjectRoot);
+            // Path traversal protection: ensure resolved path stays within project root
+            const resolvedSource = resolve(sourcePath);
+            if (!resolvedSource.startsWith(projectRoot + '/') && resolvedSource !== projectRoot) {
+                console.warn(warning(`  Path traversal blocked: ${imagePath}`));
+                continue;
+            }
             destRelPath = relativeToProjectRoot;
         }
         else {
@@ -130,12 +116,19 @@ export async function copyImages(sourceDir, outputDir, imagePaths) {
             }
             const fullPath = join(sourceDir, resolvedPath);
             sourcePath = fullPath;
+            // Path traversal protection: ensure resolved path stays within source directory
+            const resolvedSource = resolve(sourcePath);
+            const resolvedSourceDir = resolve(sourceDir);
+            if (!resolvedSource.startsWith(resolvedSourceDir + '/') && resolvedSource !== resolvedSourceDir) {
+                console.warn(warning(`  Path traversal blocked: ${imagePath}`));
+                continue;
+            }
             // Get the relative path from source dir to maintain folder structure
             destRelPath = relative(sourceDir, fullPath);
         }
         // Check if image exists
         if (!(await fs.pathExists(sourcePath))) {
-            console.warn(chalk.yellow(`  Image not found: ${sourcePath}`));
+            console.warn(warning(`  Image not found: ${sourcePath}`));
             continue;
         }
         const destPath = join(outputDir, destRelPath);

package/dist/lib/lint-runner.js

@@ -1,4 +1,4 @@
-import chalk from 'chalk';
+import { error, info, warning } from './theme.js';
 import { linters } from '../linters/index.js';
 export async function runLinters(context) {
     const issues = [];
@@ -8,23 +8,23 @@ export async function runLinters(context) {
             issues.push(...result);
         }
         catch (err) {
-            console.error(chalk.red(`Error running linter '${linter.name}':`), err);
+            console.error(error(`Error running linter '${linter.name}':`), err);
         }
     }
     if (issues.length === 0) {
         return true;
     }
     if (context.entryName) {
-        console.log(chalk.blue(`\nEntry: ${context.entryName}`));
+        console.log(info(`\nEntry: ${context.entryName}`));
     }
     let hasErrors = false;
     for (const issue of issues) {
         if (issue.level === 'error') {
-            console.error(chalk.red(`  [${issue.category.toUpperCase()}] ${issue.message}`));
+            console.error(error(`  [${issue.category.toUpperCase()}] ${issue.message}`));
             hasErrors = true;
         }
         else {
-            console.warn(chalk.yellow(`  [${issue.category.toUpperCase()}] ${issue.message}`));
+            console.warn(warning(`  [${issue.category.toUpperCase()}] ${issue.message}`));
         }
     }
     return !hasErrors;

package/dist/lib/markdown-processors.d.ts

@@ -0,0 +1,18 @@
+import { unified } from 'unified';
+import type { Plugin } from 'unified';
+import type { Root } from 'hast';
+/**
+ * General markdown processor for project files (README.md, etc.)
+ * Used for files that don't need image path rewriting
+ */
+export declare function createGeneralMarkdownProcessor(rehypeRewriteMdLinks: Plugin<[], Root>): ReturnType<typeof unified.prototype.use>;
+/**
+ * Entry markdown processor with image path rewriting
+ * Used for logbook entry content (index.md, ticket.md, log.md)
+ */
+export declare function createEntryMarkdownProcessor(rehypeRewriteMdLinks: Plugin<[], Root>, rehypeRewriteImagePaths: Plugin<[], Root>): ReturnType<typeof unified.prototype.use>;
+/**
+ * Image collection processor
+ * Collects all image paths during markdown-to-html conversion
+ */
+export declare function createImageCollectionProcessor(imageCollectionPlugin: Plugin<[], Root>, rehypeRewriteImagePaths: Plugin<[], Root>): ReturnType<typeof unified.prototype.use>;

package/dist/lib/markdown-processors.js

@@ -0,0 +1,42 @@
+import { unified } from 'unified';
+import remarkParse from 'remark-parse';
+import remarkGfm from 'remark-gfm';
+import remarkRehype from 'remark-rehype';
+import rehypeSlug from 'rehype-slug';
+import rehypeFormat from 'rehype-format';
+import rehypeStringify from 'rehype-stringify';
+/**
+ * Create a markdown processor with custom rehype plugins
+ *
+ * @param plugins - Array of rehype plugins to inject before formatting
+ * @returns A unified processor
+ */
+function createMarkdownProcessor(plugins = []) {
+    const processor = unified().use(remarkParse).use(remarkGfm).use(remarkRehype);
+    // Apply custom plugins before formatting
+    for (const plugin of plugins) {
+        processor.use(plugin);
+    }
+    return processor.use(rehypeSlug).use(rehypeFormat).use(rehypeStringify);
+}
+/**
+ * General markdown processor for project files (README.md, etc.)
+ * Used for files that don't need image path rewriting
+ */
+export function createGeneralMarkdownProcessor(rehypeRewriteMdLinks) {
+    return createMarkdownProcessor([rehypeRewriteMdLinks]);
+}
+/**
+ * Entry markdown processor with image path rewriting
+ * Used for logbook entry content (index.md, ticket.md, log.md)
+ */
+export function createEntryMarkdownProcessor(rehypeRewriteMdLinks, rehypeRewriteImagePaths) {
+    return createMarkdownProcessor([rehypeRewriteMdLinks, rehypeRewriteImagePaths]);
+}
+/**
+ * Image collection processor
+ * Collects all image paths during markdown-to-html conversion
+ */
+export function createImageCollectionProcessor(imageCollectionPlugin, rehypeRewriteImagePaths) {
+    return createMarkdownProcessor([imageCollectionPlugin, rehypeRewriteImagePaths]);
+}

package/dist/lib/package-version.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Get the package version from package.json
+ * This centralizes version reading across the CLI to avoid duplication and path inconsistencies
+ */
+export declare function getPackageVersion(): string;

package/dist/lib/package-version.js

@@ -0,0 +1,16 @@
+import fs from 'fs-extra';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * Get the package version from package.json
+ * This centralizes version reading across the CLI to avoid duplication and path inconsistencies
+ */
+export function getPackageVersion() {
+    // Get the directory of this file (src/lib/)
+    const __filename = fileURLToPath(import.meta.url);
+    const __dirname = dirname(__filename);
+    // Navigate from src/lib to dist/lib (compiled) or keep as-is for ESM
+    const pkgPath = join(__dirname, '../../package.json');
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+    return pkg.version || '0.0.0';
+}

package/dist/lib/styles.js

@@ -1,13 +1,16 @@
 import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isValidHexColor } from './html-escape.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 export function getStyles(primaryColor) {
     const cssPath = join(__dirname, '../templates/styles.css');
     const staticCss = readFileSync(cssPath, 'utf8');
+    // Validate the primary color to prevent CSS injection
+    const validatedColor = isValidHexColor(primaryColor) ? primaryColor : '#2563eb';
     const root = `:root {
-    --primary: ${primaryColor};
-    --primary-soft: ${primaryColor}15;
+    --primary: ${validatedColor};
+    --primary-soft: ${validatedColor}15;
     --bg: #fdfdfd;
     --text: #1a1a1a;
     --text-muted: #666666;

package/dist/lib/template-helpers.d.ts

@@ -1,4 +1,5 @@
 import type { TimelineEntry, TimelineCommitItem, TimelineTagItem, EntryLink, GitCommit } from './template-types.js';
+export declare const html: (strings: TemplateStringsArray, ...values: unknown[]) => string;
 export declare const navLink: (entry: EntryLink, dir: "prev" | "next") => string;
 export declare const renderTagsAndWorkspaces: (tags: string[] | undefined, workspaces: string[] | undefined) => string;
 export declare const renderCommits: (commits: GitCommit[] | undefined) => string;

package/dist/lib/template-helpers.js

@@ -1,20 +1,25 @@
 import { linkJiraIds } from './jira-helpers.js';
-const html = (strings, ...values) => {
+import { formatAbsoluteDate } from '../utils/date.js';
+import { escapeHtml } from './html-escape.js';
+import { ATTR_ENTRY_SLUG, ATTR_DATA_DATE, CLASS_COMMIT_SHA, CLASS_COMMIT_TIME, CLASS_COMMIT_MESSAGE, } from './html-attributes.js';
+export const html = (strings, ...values) => {
     return strings.reduce((acc, str, i) => acc + str + (values[i] ?? ''), '');
 };
 export const navLink = (entry, dir) => {
     const label = dir === 'prev' ? '← Previous' : 'Next →';
-    const t = `${entry.ticket ? `${entry.ticket}: ` : ''}${entry.title}`;
+    const ticket = entry.ticket ? escapeHtml(entry.ticket) : '';
+    const title = escapeHtml(entry.title);
+    const t = `${ticket ? `${ticket}: ` : ''}${title}`;
     return `<a href="../${entry.slug}/index.html" class="post-nav-link"><span class="post-nav-label">${label}</span><span class="post-nav-title">${t}</span></a>`;
 };
 const renderWorkspaces = (workspaces) => {
     if (!workspaces || workspaces.length === 0)
         return '';
-    return workspaces.map((ws) => `<span class="tag-badge tag-workspace">${ws}</span>`).join('');
+    return workspaces.map((ws) => `<span class="tag-badge tag-workspace">${escapeHtml(ws)}</span>`).join('');
 };
 export const renderTagsAndWorkspaces = (tags, workspaces) => {
     const tagsHtml = tags && tags.length > 0
-        ? tags.map((tag) => `<span class="tag-badge tag-${tag.replace('#', '')}">${tag}</span>`).join('')
+        ? tags.map((tag) => `<span class="tag-badge tag-${tag.replace('#', '')}">${escapeHtml(tag)}</span>`).join('')
         : '';
     const wsHtml = renderWorkspaces(workspaces);
     if (!tagsHtml && !wsHtml)
@@ -26,43 +31,49 @@ export const renderCommits = (commits) => {
     if (!commits || commits.length === 0)
         return '';
     const rows = commits
-        .map((c) => `<div class="commit-item"><span class="commit-sha">${c.sha}</span><span class="commit-message">${c.message}</span><span class="commit-time" title="${c.timestamp}">${c.relativeTime}</span></div>`)
+        .map((c) => {
+        const formatted = formatAbsoluteDate(c.timestamp);
+        const sha = escapeHtml(c.sha);
+        const message = escapeHtml(c.message);
+        return `<div class="commit-item"><span class="${CLASS_COMMIT_SHA}">${sha}</span><span class="${CLASS_COMMIT_MESSAGE}">${message}</span><span class="${CLASS_COMMIT_TIME}" title="${c.timestamp}" ${ATTR_DATA_DATE}="${c.timestamp}">${formatted}</span></div>`;
+    })
         .join('');
     return `<div class="commit-list"><h3 class="commit-list-heading">Git Commits</h3>${rows}</div>`;
 };
-export const renderTimelineEntryItem = (e) => html `<div class="timeline-item" data-entry-slug="${e.slug}">
+export const renderTimelineEntryItem = (e) => {
+    const ticket = e.ticket ? escapeHtml(e.ticket) : '';
+    const title = e.title ? escapeHtml(e.title) : '';
+    const llm = e.llm ? escapeHtml(e.llm) : '';
+    const harness = e.harness ? escapeHtml(e.harness) : '';
+    const prompter = e.prompter ? escapeHtml(e.prompter) : '';
+    const summary = e.summary ? escapeHtml(e.summary) : '';
+    return html `<div class="timeline-item" ${ATTR_ENTRY_SLUG}="${e.slug}">
     <a class="timeline-card" href="./${e.slug}/index.html"
       ><div class="item-content">
         <div class="item-meta">
-          <span data-date="${e.dateStart}">${e.displayDate}</span> • <span class="sort-time">${e.sortTime}</span> •
-          ${e.llm ? ` ${e.llm} via ` : ''}${e.harness}${e.prompter ? ` / ${e.prompter}` : ''}
+          <span ${ATTR_DATA_DATE}="${e.dateStart}">${e.displayDate}</span> •
+          ${llm ? ` ${llm} via ` : ''}${harness}${prompter ? ` / ${prompter}` : ''}
         </div>
         <h3 class="item-title">
-          <span class="new-badge" style="display:none;">NEW</span>${e.ticket ? `${e.ticket}: ` : ''}${e.title}
+          <span class="new-badge" style="display:none;">NEW</span>${ticket ? `${ticket}: ` : ''}${title}
         </h3>
-        <div class="item-summary">${e.summary}</div>
+        <div class="item-summary">${summary}</div>
         ${renderTagsAndWorkspaces(e.tags, e.workspaces)}
       </div>
       <span class="item-arrow">›</span></a
     >
   </div>`;
+};
 export const renderTimelineCommitItem = (c, jiraBaseUrl, jiraPrefix) => {
-    const message = jiraBaseUrl && jiraPrefix ? linkJiraIds(c.message, jiraBaseUrl, jiraPrefix) : c.message;
-    return `<div class="timeline-item timeline-item--commit"><div class="commit-chip"><span class="commit-sha">${c.sha}</span><span class="commit-message">${message}</span><span class="commit-time" title="${c.timestamp}" data-date="${c.timestamp}">${c.relativeTime}</span></div></div>`;
+    const message = jiraBaseUrl && jiraPrefix ? linkJiraIds(c.message, jiraBaseUrl, jiraPrefix) : escapeHtml(c.message);
+    const formatted = formatAbsoluteDate(c.timestamp);
+    const sha = escapeHtml(c.sha);
+    return `<div class="timeline-item timeline-item--commit"><div class="commit-chip"><span class="${CLASS_COMMIT_SHA}">${sha}</span><span class="${CLASS_COMMIT_MESSAGE}">${message}</span><span class="${CLASS_COMMIT_TIME}" title="${c.timestamp}" ${ATTR_DATA_DATE}="${c.timestamp}">${formatted}</span></div></div>`;
 };
 export const renderTimelineTagItem = (t) => {
-    const formatted = new Date(t.timestamp)
-        .toLocaleString('de-DE', {
-        year: 'numeric',
-        month: '2-digit',
-        day: '2-digit',
-        hour: '2-digit',
-        minute: '2-digit',
-        second: '2-digit',
-        hour12: false,
-    })
-        .replace(',', '');
-    return `<div class="timeline-item timeline-item--tag"><div class="tag-chip"><span class="tag-chip-icon">🏷</span><span class="tag-chip-name">${t.name}</span><span class="tag-chip-date" title="${t.timestamp}">${formatted}</span></div></div>`;
+    const formatted = formatAbsoluteDate(t.timestamp);
+    const name = escapeHtml(t.name);
+    return `<div class="timeline-item timeline-item--tag"><div class="tag-chip"><span class="tag-chip-icon">🏷</span><span class="tag-chip-name">${name}</span><span class="tag-chip-date" title="${t.timestamp}" ${ATTR_DATA_DATE}="${t.timestamp}">${formatted}</span></div></div>`;
 };
 export const paginationLinks = (currentPage, totalPages) => {
     let links = '';