project-logbook 0.3.3 → 0.4.0

package/dist/lib/config.js

@@ -1,5 +1,6 @@
 import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { getGitRemoteUrl, parseRemoteUrlToWebUrl } from './git-helpers.js';
 export function getWorkspaces(cwd = process.cwd()) {
     const pkgPath = join(cwd, 'package.json');
     if (!existsSync(pkgPath))
@@ -26,16 +27,39 @@ export const DEFAULT_CONFIG = {
 };
 export function getConfig(cwd = process.cwd()) {
     const configPath = join(cwd, '.project-logbook');
+    let config = { ...DEFAULT_CONFIG };
     if (existsSync(configPath)) {
         try {
             const userConfig = JSON.parse(readFileSync(configPath, 'utf8'));
-            return { ...DEFAULT_CONFIG, ...userConfig };
+            config = { ...DEFAULT_CONFIG, ...userConfig };
         }
         catch (err) {
             const errorMessage = err instanceof Error ? err.message : String(err);
             console.warn(`Warning: Failed to parse .project-logbook config — using defaults. (${errorMessage})`);
-            return DEFAULT_CONFIG;
         }
     }
-    return DEFAULT_CONFIG;
+    if (!config.repositoryUrl) {
+        config.repositoryUrl = parseRemoteUrlToWebUrl(getGitRemoteUrl(cwd));
+    }
+    return config;
+}
+/**
+ * Get the absolute path to the logbook directory.
+ * Convenience function to avoid repeating: join(process.cwd(), config.logbookDir)
+ * @param config - The logbook config
+ * @param cwd - Optional working directory (defaults to process.cwd())
+ * @returns Absolute path to the logbook directory
+ */
+export function getLogbookDirPath(config, cwd = process.cwd()) {
+    return join(cwd, config.logbookDir);
+}
+/**
+ * Get the absolute path to the output directory.
+ * Convenience function to avoid repeating: join(process.cwd(), config.outputDir)
+ * @param config - The logbook config
+ * @param cwd - Optional working directory (defaults to process.cwd())
+ * @returns Absolute path to the output directory
+ */
+export function getOutputDirPath(config, cwd = process.cwd()) {
+    return join(cwd, config.outputDir);
 }

package/dist/lib/entry-id.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Entry ID utilities for handling slug/ticket pairs.
+ * Normalizes the relationship between entry slug and optional ticket ID.
+ */
+/**
+ * Get the display ID for an entry.
+ * Falls back to slug if ticket is not available.
+ * Used when displaying entries in lists, timelines, etc.
+ * @param ticket - Optional ticket ID (e.g., "LB-43", "PROJ-100")
+ * @param slug - Fallback slug (e.g., "LB-43-my-feature")
+ * @returns The ticket if available, otherwise the slug
+ */
+export declare function getEntryDisplayId(ticket: string | undefined, slug: string): string;
+/**
+ * Get the title/display name for an entry.
+ * Falls back to slug if title is not available.
+ * Used when displaying entries without a proper title.
+ * @param title - Optional title (e.g., "Implement feature X")
+ * @param slug - Fallback slug (e.g., "LB-43-my-feature")
+ * @returns The title if available, otherwise the slug
+ */
+export declare function getEntryDisplayTitle(title: string | undefined, slug: string): string;

package/dist/lib/entry-id.js

@@ -0,0 +1,26 @@
+/**
+ * Entry ID utilities for handling slug/ticket pairs.
+ * Normalizes the relationship between entry slug and optional ticket ID.
+ */
+/**
+ * Get the display ID for an entry.
+ * Falls back to slug if ticket is not available.
+ * Used when displaying entries in lists, timelines, etc.
+ * @param ticket - Optional ticket ID (e.g., "LB-43", "PROJ-100")
+ * @param slug - Fallback slug (e.g., "LB-43-my-feature")
+ * @returns The ticket if available, otherwise the slug
+ */
+export function getEntryDisplayId(ticket, slug) {
+    return ticket || slug;
+}
+/**
+ * Get the title/display name for an entry.
+ * Falls back to slug if title is not available.
+ * Used when displaying entries without a proper title.
+ * @param title - Optional title (e.g., "Implement feature X")
+ * @param slug - Fallback slug (e.g., "LB-43-my-feature")
+ * @returns The title if available, otherwise the slug
+ */
+export function getEntryDisplayTitle(title, slug) {
+    return title || slug;
+}

package/dist/lib/entry-paths.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Encapsulates knowledge of logbook entry folder structure.
+ * Provides consistent path construction for entry-related files.
+ */
+/**
+ * Get the base directory path for a logbook entry.
+ * @param logbookDir - The root logbook directory (e.g., "/project/logbook")
+ * @param entrySlug - The entry's slug (e.g., "LB-43-my-feature")
+ * @returns Path to the entry folder (e.g., "/project/logbook/LB-43-my-feature")
+ */
+export declare function getEntryPath(logbookDir: string, entrySlug: string): string;
+/**
+ * Get all standard entry file paths at once.
+ * Useful when you need to access index, ticket, and log files.
+ * @param logbookDir - The root logbook directory
+ * @param entrySlug - The entry's slug
+ * @returns Object with paths to index.md, ticket.md, and log.md
+ */
+export declare function getEntryFilePaths(logbookDir: string, entrySlug: string): {
+    index: string;
+    ticket: string;
+    log: string;
+};

package/dist/lib/entry-paths.js

@@ -0,0 +1,55 @@
+import { join } from 'node:path';
+/**
+ * Encapsulates knowledge of logbook entry folder structure.
+ * Provides consistent path construction for entry-related files.
+ */
+/**
+ * Get the base directory path for a logbook entry.
+ * @param logbookDir - The root logbook directory (e.g., "/project/logbook")
+ * @param entrySlug - The entry's slug (e.g., "LB-43-my-feature")
+ * @returns Path to the entry folder (e.g., "/project/logbook/LB-43-my-feature")
+ */
+export function getEntryPath(logbookDir, entrySlug) {
+    return join(logbookDir, entrySlug);
+}
+/**
+ * Get the path to an entry's index.md file.
+ * @param logbookDir - The root logbook directory
+ * @param entrySlug - The entry's slug
+ * @returns Path to index.md
+ */
+function getEntryIndexPath(logbookDir, entrySlug) {
+    return join(getEntryPath(logbookDir, entrySlug), 'index.md');
+}
+/**
+ * Get the path to an entry's ticket.md file.
+ * @param logbookDir - The root logbook directory
+ * @param entrySlug - The entry's slug
+ * @returns Path to ticket.md
+ */
+function getEntryTicketPath(logbookDir, entrySlug) {
+    return join(getEntryPath(logbookDir, entrySlug), 'ticket.md');
+}
+/**
+ * Get the path to an entry's log.md file.
+ * @param logbookDir - The root logbook directory
+ * @param entrySlug - The entry's slug
+ * @returns Path to log.md
+ */
+function getEntryLogPath(logbookDir, entrySlug) {
+    return join(getEntryPath(logbookDir, entrySlug), 'log.md');
+}
+/**
+ * Get all standard entry file paths at once.
+ * Useful when you need to access index, ticket, and log files.
+ * @param logbookDir - The root logbook directory
+ * @param entrySlug - The entry's slug
+ * @returns Object with paths to index.md, ticket.md, and log.md
+ */
+export function getEntryFilePaths(logbookDir, entrySlug) {
+    return {
+        index: getEntryIndexPath(logbookDir, entrySlug),
+        ticket: getEntryTicketPath(logbookDir, entrySlug),
+        log: getEntryLogPath(logbookDir, entrySlug),
+    };
+}

package/dist/lib/git-helpers.d.ts

@@ -1,12 +1,26 @@
 import type { GitCommit } from './template-types.js';
+/**
+ * Clean the repository URL by removing trailing slashes and .git extensions.
+ */
+export declare function cleanRepositoryUrl(url: string): string;
+/**
+ * Generate a URL to view a specific commit in a web interface (GitHub, GitLab, Bitbucket, etc.).
+ */
+export declare function getCommitUrl(repositoryUrl: string | undefined, sha: string): string | undefined;
+/**
+ * Generate a URL to view a specific tag in a web interface (GitHub, GitLab, Bitbucket, etc.).
+ */
+export declare function getTagUrl(repositoryUrl: string | undefined, tag: string): string | undefined;
 /**
  * Parse the raw output of `git log --pretty=format:"%H|%s|%aI"` into GitCommit objects.
  * Pure function (no I/O) — unit-testable without spawning git.
  *
  * Uses indexOf/lastIndexOf to delimit fields so commit messages containing `|`
  * are preserved correctly instead of being silently truncated.
+ *
+ * Note: Relative time calculation is done client-side via JavaScript, not here.
  */
-export declare function parseGitLogOutput(raw: string, now?: Date): GitCommit[];
+export declare function parseGitLogOutput(raw: string): GitCommit[];
 /**
  * Fetch git commits that touched `dir`, up to `maxCount`.
  * Returns an empty array if git is unavailable or the directory is not a repo.
@@ -20,8 +34,25 @@ export declare function getGitTags(): Promise<{
     name: string;
     timestamp: string;
 }[]>;
+/**
+ * Get the git remote URL for origin.
+ * Synchronous execution — safe to use during synchronous config parsing.
+ */
+export declare function getGitRemoteUrl(cwd?: string): string | undefined;
+/**
+ * Parse a git remote URL (SSH or HTTPS) into a clean web/HTTP(S) repository homepage URL.
+ */
+export declare function parseRemoteUrlToWebUrl(remoteUrl: string | undefined): string | undefined;
 /**
  * Synchronous branch detection — used in session resolution (not the build pipeline).
  * Kept synchronous intentionally; simple-git is used for the heavier async build operations.
  */
 export declare function getCurrentBranch(cwd?: string): string | undefined;
+/**
+ * Calculate the changed LOC (insertions + deletions) for the active branch or main working tree.
+ */
+export declare function getChangedLOC(logbookDir: string, cwd?: string): Promise<{
+    total: number;
+    insertions: number;
+    deletions: number;
+}>;

package/dist/lib/git-helpers.js

@@ -1,5 +1,55 @@
 import { execSync } from 'node:child_process';
 import { simpleGit } from 'simple-git';
+/**
+ * Clean the repository URL by removing trailing slashes and .git extensions.
+ */
+export function cleanRepositoryUrl(url) {
+    let cleaned = url.trim();
+    if (cleaned.endsWith('/')) {
+        cleaned = cleaned.slice(0, -1);
+    }
+    if (cleaned.endsWith('.git')) {
+        cleaned = cleaned.slice(0, -4);
+    }
+    if (cleaned.endsWith('/')) {
+        cleaned = cleaned.slice(0, -1);
+    }
+    return cleaned;
+}
+/**
+ * Generate a URL to view a specific commit in a web interface (GitHub, GitLab, Bitbucket, etc.).
+ */
+export function getCommitUrl(repositoryUrl, sha) {
+    if (!repositoryUrl)
+        return undefined;
+    const baseUrl = cleanRepositoryUrl(repositoryUrl);
+    const lowerUrl = baseUrl.toLowerCase();
+    if (lowerUrl.includes('gitlab')) {
+        return `${baseUrl}/-/commit/${sha}`;
+    }
+    if (lowerUrl.includes('bitbucket')) {
+        return `${baseUrl}/commits/${sha}`;
+    }
+    // Default to GitHub style
+    return `${baseUrl}/commit/${sha}`;
+}
+/**
+ * Generate a URL to view a specific tag in a web interface (GitHub, GitLab, Bitbucket, etc.).
+ */
+export function getTagUrl(repositoryUrl, tag) {
+    if (!repositoryUrl)
+        return undefined;
+    const baseUrl = cleanRepositoryUrl(repositoryUrl);
+    const lowerUrl = baseUrl.toLowerCase();
+    if (lowerUrl.includes('gitlab')) {
+        return `${baseUrl}/-/tags/${tag}`;
+    }
+    if (lowerUrl.includes('bitbucket')) {
+        return `${baseUrl}/src/${tag}`;
+    }
+    // Default to GitHub style
+    return `${baseUrl}/releases/tag/${tag}`;
+}
 function getGit() {
     return simpleGit(process.cwd());
 }
@@ -9,8 +59,10 @@ function getGit() {
  *
  * Uses indexOf/lastIndexOf to delimit fields so commit messages containing `|`
  * are preserved correctly instead of being silently truncated.
+ *
+ * Note: Relative time calculation is done client-side via JavaScript, not here.
  */
-export function parseGitLogOutput(raw, now = new Date()) {
+export function parseGitLogOutput(raw) {
     if (!raw.trim())
         return [];
     return raw
@@ -26,34 +78,10 @@ export function parseGitLogOutput(raw, now = new Date()) {
         const timestamp = line.slice(lastPipe + 1);
         if (!sha || !message || !timestamp)
             return null;
-        const relativeTime = formatRelativeTime(timestamp, now);
-        return { sha: sha.slice(0, 7), message, timestamp, relativeTime };
+        return { sha: sha.slice(0, 7), message, timestamp };
     })
         .filter((c) => c !== null);
 }
-function formatRelativeTime(isoTimestamp, now) {
-    const d = new Date(isoTimestamp);
-    if (isNaN(d.getTime()))
-        return isoTimestamp;
-    const diffMs = now.getTime() - d.getTime();
-    const diffSec = Math.floor(diffMs / 1000);
-    if (diffSec < 60)
-        return 'just now';
-    const diffMin = Math.floor(diffSec / 60);
-    if (diffMin < 60)
-        return `${diffMin} minute${diffMin === 1 ? '' : 's'} ago`;
-    const diffHour = Math.floor(diffMin / 60);
-    if (diffHour < 24)
-        return `${diffHour} hour${diffHour === 1 ? '' : 's'} ago`;
-    const diffDay = Math.floor(diffHour / 24);
-    if (diffDay < 30)
-        return `${diffDay} day${diffDay === 1 ? '' : 's'} ago`;
-    const diffMonth = Math.floor(diffDay / 30);
-    if (diffMonth < 12)
-        return `${diffMonth} month${diffMonth === 1 ? '' : 's'} ago`;
-    const diffYear = Math.floor(diffMonth / 12);
-    return `${diffYear} year${diffYear === 1 ? '' : 's'} ago`;
-}
 /**
  * Fetch git commits that touched `dir`, up to `maxCount`.
  * Returns an empty array if git is unavailable or the directory is not a repo.
@@ -98,6 +126,47 @@ export async function getGitTags() {
         return [];
     }
 }
+/**
+ * Get the git remote URL for origin.
+ * Synchronous execution — safe to use during synchronous config parsing.
+ */
+export function getGitRemoteUrl(cwd = process.cwd()) {
+    try {
+        return (execSync('git remote get-url origin', {
+            encoding: 'utf8',
+            cwd,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim() || undefined);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Parse a git remote URL (SSH or HTTPS) into a clean web/HTTP(S) repository homepage URL.
+ */
+export function parseRemoteUrlToWebUrl(remoteUrl) {
+    if (!remoteUrl)
+        return undefined;
+    let url = remoteUrl.trim();
+    // If it's already an HTTP/HTTPS URL, clean and return it
+    if (url.startsWith('https://') || url.startsWith('http://')) {
+        return cleanRepositoryUrl(url);
+    }
+    // Strip ssh:// scheme and git@ user if present
+    if (url.startsWith('ssh://')) {
+        url = url.slice(6);
+    }
+    if (url.startsWith('git@')) {
+        url = url.slice(4);
+    }
+    // Replace first colon with slash to map SSH path to web path (e.g. host:owner/repo -> host/owner/repo)
+    const firstColon = url.indexOf(':');
+    if (firstColon !== -1) {
+        url = url.slice(0, firstColon) + '/' + url.slice(firstColon + 1);
+    }
+    return `https://${cleanRepositoryUrl(url)}`;
+}
 /**
  * Synchronous branch detection — used in session resolution (not the build pipeline).
  * Kept synchronous intentionally; simple-git is used for the heavier async build operations.
@@ -114,3 +183,27 @@ export function getCurrentBranch(cwd = process.cwd()) {
         return undefined;
     }
 }
+/**
+ * Calculate the changed LOC (insertions + deletions) for the active branch or main working tree.
+ */
+export async function getChangedLOC(logbookDir, cwd = process.cwd()) {
+    try {
+        const branchName = getCurrentBranch(cwd) || 'main';
+        const git = simpleGit(cwd);
+        let summary;
+        if (branchName === 'main') {
+            summary = await git.diffSummary(['HEAD', '--', '.', `:!${logbookDir}`]);
+        }
+        else {
+            summary = await git.diffSummary(['main...HEAD', '--', '.', `:!${logbookDir}`]);
+        }
+        return {
+            total: summary.insertions + summary.deletions,
+            insertions: summary.insertions,
+            deletions: summary.deletions,
+        };
+    }
+    catch {
+        return { total: 0, insertions: 0, deletions: 0 };
+    }
+}

package/dist/lib/hast-helpers.d.ts

@@ -0,0 +1,10 @@
+import type { Root, Element } from 'hast';
+/**
+ * Generic HAST tree visitor that traverses depth-first and applies a callback
+ * to elements matching the specified tagName(s).
+ *
+ * @param node - Root or Element node to traverse
+ * @param tagNames - Single tag name or array of tag names to match
+ * @param visitor - Callback applied to each matching element
+ */
+export declare function visitHastElements(node: Root | Element, tagNames: string | string[], visitor: (node: Element) => void): void;

package/dist/lib/hast-helpers.js

@@ -0,0 +1,22 @@
+/**
+ * Generic HAST tree visitor that traverses depth-first and applies a callback
+ * to elements matching the specified tagName(s).
+ *
+ * @param node - Root or Element node to traverse
+ * @param tagNames - Single tag name or array of tag names to match
+ * @param visitor - Callback applied to each matching element
+ */
+export function visitHastElements(node, tagNames, visitor) {
+    const tagNamesSet = new Set(Array.isArray(tagNames) ? tagNames : [tagNames]);
+    function traverse(n) {
+        for (const child of n.children) {
+            if (child.type === 'element') {
+                if (tagNamesSet.has(child.tagName)) {
+                    visitor(child);
+                }
+                traverse(child);
+            }
+        }
+    }
+    traverse(node);
+}

package/dist/lib/html-attributes.d.ts

@@ -0,0 +1,17 @@
+/**
+ * HTML attribute name constants.
+ * Centralized definitions for data attributes and class names used in templates
+ * to maintain consistency between template generation and JavaScript consumers.
+ */
+/** data-page-slug: Identifies the current page/entry slug in the document body */
+export declare const ATTR_PAGE_SLUG = "data-page-slug";
+/** data-entry-slug: Identifies a timeline entry's slug */
+export declare const ATTR_ENTRY_SLUG = "data-entry-slug";
+/** data-date: Stores a timestamp for client-side date formatting */
+export declare const ATTR_DATA_DATE = "data-date";
+/** Class name for commit SHA display */
+export declare const CLASS_COMMIT_SHA = "commit-sha";
+/** Class name for commit timestamp display */
+export declare const CLASS_COMMIT_TIME = "commit-time";
+/** Class name for commit message display */
+export declare const CLASS_COMMIT_MESSAGE = "commit-message";

package/dist/lib/html-attributes.js

@@ -0,0 +1,17 @@
+/**
+ * HTML attribute name constants.
+ * Centralized definitions for data attributes and class names used in templates
+ * to maintain consistency between template generation and JavaScript consumers.
+ */
+/** data-page-slug: Identifies the current page/entry slug in the document body */
+export const ATTR_PAGE_SLUG = 'data-page-slug';
+/** data-entry-slug: Identifies a timeline entry's slug */
+export const ATTR_ENTRY_SLUG = 'data-entry-slug';
+/** data-date: Stores a timestamp for client-side date formatting */
+export const ATTR_DATA_DATE = 'data-date';
+/** Class name for commit SHA display */
+export const CLASS_COMMIT_SHA = 'commit-sha';
+/** Class name for commit timestamp display */
+export const CLASS_COMMIT_TIME = 'commit-time';
+/** Class name for commit message display */
+export const CLASS_COMMIT_MESSAGE = 'commit-message';

package/dist/lib/html-escape.d.ts

@@ -0,0 +1,16 @@
+/**
+ * HTML entity escaping utility.
+ * Escapes characters that have special meaning in HTML to prevent XSS attacks.
+ */
+export declare function escapeHtml(str: string): string;
+/**
+ * Validates a hex color string.
+ * Accepts 3-digit (#abc), 6-digit (#abcdef), or 8-digit (#abcdef00) hex colors.
+ * Returns true if valid, false otherwise.
+ */
+export declare function isValidHexColor(color: string): boolean;
+/**
+ * Validates that a URL has a safe scheme (http or https).
+ * Returns the URL if valid, undefined if invalid.
+ */
+export declare function validateUrlScheme(url: string): string | undefined;

package/dist/lib/html-escape.js

@@ -0,0 +1,38 @@
+/**
+ * HTML entity escaping utility.
+ * Escapes characters that have special meaning in HTML to prevent XSS attacks.
+ */
+export function escapeHtml(str) {
+    if (!str)
+        return '';
+    return str
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+/**
+ * Validates a hex color string.
+ * Accepts 3-digit (#abc), 6-digit (#abcdef), or 8-digit (#abcdef00) hex colors.
+ * Returns true if valid, false otherwise.
+ */
+export function isValidHexColor(color) {
+    return /^#[0-9a-fA-F]{3}(?:[0-9a-fA-F]{3})?(?:[0-9a-fA-F]{2})?$/.test(color);
+}
+/**
+ * Validates that a URL has a safe scheme (http or https).
+ * Returns the URL if valid, undefined if invalid.
+ */
+export function validateUrlScheme(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol === 'https:' || parsed.protocol === 'http:') {
+            return url;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/lib/image-helpers.js

@@ -1,13 +1,9 @@
 import fs from 'fs-extra';
-import { join, dirname, relative } from 'node:path';
-import { unified } from 'unified';
-import remarkParse from 'remark-parse';
-import remarkGfm from 'remark-gfm';
-import remarkRehype from 'remark-rehype';
-import rehypeSlug from 'rehype-slug';
-import rehypeFormat from 'rehype-format';
-import rehypeStringify from 'rehype-stringify';
-import chalk from 'chalk';
+import { join, dirname, relative, resolve } from 'node:path';
+import { warning } from './theme.js';
+import { visitHastElements } from './hast-helpers.js';
+import { isExternalUrl } from './url-helpers.js';
+import { createImageCollectionProcessor, rehypeRewriteMdLinks } from './markdown-processors.js';
 /** Regex to match image links in markdown: ![alt](path) */
 const imageLinkRegex = /!\[.*?\]\(([^)]+\.(?:png|jpe?g|gif|svg|webp|bmp|ico))\)/gi;
 /**
@@ -34,12 +30,12 @@ class ImageProcessor {
     /** Rehype plugin: collect image paths from markdown */
     rehypeCollectImages = () => {
         return (tree) => {
-            visitImages(tree, (node) => {
+            visitHastElements(tree, 'img', (node) => {
                 const src = node.properties?.src;
                 if (typeof src !== 'string')
                     return;
                 // Skip external URLs and data URIs
-                if (/^[a-z][a-z\d+\-.]*:/i.test(src))
+                if (isExternalUrl(src))
                     return;
                 if (src.startsWith('data:'))
                     return;
@@ -49,24 +45,15 @@ class ImageProcessor {
     };
 }
 const imageProcessor = new ImageProcessor();
-function visitImages(node, visitor) {
-    for (const child of node.children) {
-        if (child.type === 'element') {
-            if (child.tagName === 'img')
-                visitor(child);
-            visitImages(child, visitor);
-        }
-    }
-}
 /** Rehype plugin: rewrite relative image paths to use /images/ subfolder */
 export const rehypeRewriteImagePaths = () => {
     return (tree) => {
-        visitImages(tree, (node) => {
+        visitHastElements(tree, 'img', (node) => {
             const src = node.properties?.src;
             if (typeof src !== 'string')
                 return;
             // Skip external URLs and data URIs
-            if (/^[a-z][a-z\d+\-.]*:/i.test(src))
+            if (isExternalUrl(src))
                 return;
             if (src.startsWith('data:'))
                 return;
@@ -87,15 +74,7 @@ export const rehypeRewriteImagePaths = () => {
  */
 export async function mdToHtmlWithImages(md) {
     imageProcessor.reset();
-    const processorWithImages = unified()
-        .use(remarkParse)
-        .use(remarkGfm)
-        .use(remarkRehype)
-        .use(imageProcessor.rehypeCollectImages)
-        .use(rehypeRewriteImagePaths)
-        .use(rehypeSlug)
-        .use(rehypeFormat)
-        .use(rehypeStringify);
+    const processorWithImages = createImageCollectionProcessor(imageProcessor.rehypeCollectImages, rehypeRewriteImagePaths, rehypeRewriteMdLinks);
     const result = await processorWithImages.process(md);
     return { html: result.toString(), imagePaths: imageProcessor.getImagePaths() };
 }
@@ -108,6 +87,7 @@ export async function mdToHtmlWithImages(md) {
 export async function copyImages(sourceDir, outputDir, imagePaths) {
     await fs.mkdirp(outputDir);
     const processedPaths = new Set();
+    const projectRoot = resolve(process.cwd());
     for (const imagePath of imagePaths) {
         // Skip if already processed
         if (processedPaths.has(imagePath))
@@ -119,7 +99,13 @@ export async function copyImages(sourceDir, outputDir, imagePaths) {
         if (imagePath.startsWith('/')) {
             // Absolute path like /static/screenshot.jpg -> copy from project root to public/static/
             const relativeToProjectRoot = imagePath.substring(1); // Remove leading /
-            sourcePath = join(process.cwd(), relativeToProjectRoot);
+            sourcePath = join(projectRoot, relativeToProjectRoot);
+            // Path traversal protection: ensure resolved path stays within project root
+            const resolvedSource = resolve(sourcePath);
+            if (!resolvedSource.startsWith(projectRoot + '/') && resolvedSource !== projectRoot) {
+                console.warn(warning(`  Path traversal blocked: ${imagePath}`));
+                continue;
+            }
             destRelPath = relativeToProjectRoot;
         }
         else {
@@ -130,12 +116,19 @@ export async function copyImages(sourceDir, outputDir, imagePaths) {
             }
             const fullPath = join(sourceDir, resolvedPath);
             sourcePath = fullPath;
+            // Path traversal protection: ensure resolved path stays within source directory
+            const resolvedSource = resolve(sourcePath);
+            const resolvedSourceDir = resolve(sourceDir);
+            if (!resolvedSource.startsWith(resolvedSourceDir + '/') && resolvedSource !== resolvedSourceDir) {
+                console.warn(warning(`  Path traversal blocked: ${imagePath}`));
+                continue;
+            }
             // Get the relative path from source dir to maintain folder structure
             destRelPath = relative(sourceDir, fullPath);
         }
         // Check if image exists
         if (!(await fs.pathExists(sourcePath))) {
-            console.warn(chalk.yellow(`  Image not found: ${sourcePath}`));
+            console.warn(warning(`  Image not found: ${sourcePath}`));
             continue;
         }
         const destPath = join(outputDir, destRelPath);