vde-open 0.1.9 → 0.1.11

package/README.md

@@ -2,7 +2,7 @@
 
 [日本語](README.ja.md)
 
-A local document viewer for agents and people who work from the same material. Open Markdown and HTML documents, read them in a management UI in the browser, and let an agent search and read the same documents from the CLI. An agent can also ask a person questions, and the person submits the answers from the management UI.
+A local document viewer for agents and people who work from the same material. Open Markdown, HTML, and image files, read them in a management UI in the browser, and let an agent search and read the same documents from the CLI. An agent can also ask a person questions, and the person submits the answers from the management UI.
 
 - Agents can search and read only the documents you opened.
 - When you save a document, the management UI updates automatically.
@@ -28,7 +28,7 @@ To install from a clone of this repository (Node.js 24.21.0 is pinned in `mise.t
 pnpm install --frozen-lockfile
 pnpm build
 pnpm test:pack                                   # builds artifacts/vde-open-<version>.tgz and verifies an install in a separate directory
-bun add -g "$PWD/artifacts/vde-open-0.1.9.tgz"   # bun add -g needs an absolute path
+bun add -g "$PWD/artifacts/vde-open-0.1.11.tgz"   # bun add -g needs an absolute path
 ```
 
 ## `vde-open` and `vo`
@@ -45,7 +45,7 @@ Installing never overwrites or removes an existing `vo` (another tool's command,
 ```bash
 vo open README.md docs/design.md        # open documents (starts the daemon if needed)
 vo open docs -w                          # open a directory and follow new documents
-vo ui                                    # open the management UI (one-time URL)
+vo ui                                    # open the management UI (no authentication)
 vo list --json                           # list open documents
 vo search "authentication design" --json # search open documents
 vo read <documentId> --section sec_0003 --json   # read a section
@@ -53,6 +53,8 @@ vo close docs/design.md                  # remove from the list (the file is not
 vo daemon stop                           # stop the daemon
 ```
 
+The management UI does not require authentication. The URL printed by `vo ui --print-url` can be copied to another browser or tab on the same machine while the daemon is running. URLs that select a document work directly too. Both listeners bind to `127.0.0.1`; viewing from another machine is not supported.
+
 For how agents search, read, and ask questions, see [docs/agent-usage.md](docs/agent-usage.md).
 
 ## Agent skill
@@ -95,6 +97,20 @@ Markdown is rendered with TanStack Markdown 1.0.0. It is not fully compatible wi
 - Code is highlighted only for JS, JSX, TS, TSX, JSON, YAML, HTML, CSS, Bash, and Markdown. Code larger than 256 KiB and other languages are not highlighted.
 - Documents that cannot be parsed within 2 seconds, or that have more than 100,000 elements or more than 64 levels of nesting, are shown as source.
 
+## Image files
+
+```bash
+vo diagram.png                          # open an image directly
+vo open photo.jpg animation.gif --focus  # open images and switch the view
+vo open images -w                        # also open images added later
+```
+
+Recognized extensions include PNG/APNG, JPEG (`jpg`, `jpeg`, `jpe`, `jif`, `jfif`, `pjpeg`, `pjp`), GIF, WebP, AVIF, SVG, BMP, ICO/CUR, JPEG XL, TIFF, and HEIC/HEIF. Images initially fit the view; "Actual size" shows the original dimensions with scrolling. Saving the file updates the view. Pausing updates keeps the displayed revision. You can open the same image's management UI URL in another browser on the same machine.
+
+The browser decodes the original file without conversion. Supported formats depend on the browser and OS. Unsupported or damaged images show an error. SVG is displayed as an image; scripts and external references cannot run.
+
+Images are searchable by title and path (`vo search diagram --mode path`). Text extraction, `vo read`, and PDF export are for Markdown and HTML; images have no OCR. The existing 10 MiB per-file limit also applies to images.
+
 ## Exporting to PDF
 
 "Export PDF" in the header of a document saves the shown revision as a PDF, without a print dialog.
@@ -131,7 +147,7 @@ The person answers in the answer panel of the management UI. The answers are sub
 | Symptom | What to do |
 |---|---|
 | `vo` runs a different command | Use `vde-open`, or check the order of `PATH` |
-| The management UI asks you to open it again from the CLI | Open a new URL with `vo ui` (each URL works once; after the daemon restarts, earlier windows stop working) |
+| An earlier URL stops working after the daemon restarts | Open the current URL with `vo ui` (the port may change on restart) |
 | Exit code 8 (cannot connect to or start the daemon) | Check with `vo daemon status`, and look for leftover files with `vo doctor` |
 | Images or CSS are not shown | Open "Differences from the original document" and register them with `--assets-root` or `--asset` |
 | Search does not find a document | Check with `vo list --json` that the document is open and its `searchState` is `ready` |
@@ -143,7 +159,7 @@ The person answers in the answer panel of the management UI. The answers are sub
 |---|---|
 | Linux and macOS on CI (GitHub Actions `ubuntu-latest` and `macos-latest`, Node.js 24.21.0) | Verified (format, lint, typecheck, unit/integration, build, pack, e2e; `.github/workflows/ci.yml`) |
 | Windows on CI (`windows-latest`, Node.js 24.21.0) | Verified: build, pack smoke (install, both bins, IPC, starting and stopping the daemon, JSON output, the UI and workers), and the daemon and document integration tests. The other unit and integration tests and the e2e tests are not run on Windows |
-| Browsers | Chromium (Playwright's Chrome Headless Shell): the full suite is verified. Firefox and WebKit (Playwright 1.63.0): the view isolation, CSP, HTML bridge, and authentication tests (`pnpm test:e2e:cross`) are verified. Other UI interactions in Firefox and WebKit (search, answer panel, narrow screens, a list of 1,000 documents) are not verified |
+| Browsers | Chromium (Playwright's Chrome Headless Shell): the full suite is verified. Firefox and WebKit (Playwright 1.63.0): the view isolation, CSP, HTML bridge, and direct URL tests (`pnpm test:e2e:cross`) are verified. Other UI interactions in Firefox and WebKit (search, answer panel, narrow screens, a list of 1,000 documents) are not verified |
 | PDF export | macOS (development machine): verified with Google Chrome 154 and Microsoft Edge 154. Linux on CI: verified with the runner's Google Chrome (e2e). Windows: printing with a real browser is not verified (the pack smoke test checks rendering the print document) |
 
 More details: [docs/performance.md](docs/performance.md) (measurements), [docs/architecture.md](docs/architecture.md) and [docs/security-model.md](docs/security-model.md) (design). Development records (in Japanese): [docs/implementation-status.md](docs/implementation-status.md), [docs/dependency-validation.md](docs/dependency-validation.md), and [docs/adr/](docs/adr/).
@@ -162,7 +178,7 @@ cd ../..
 pnpm build:watch
 ```
 
-`build:watch` rebuilds when the sources, the build configuration, or the packaged files change; a failed build keeps the last successful output. The next linked CLI invocation uses the new build, but the watcher does not restart your daemon: run `vo daemon restart`, then `vo ui`. Restarting keeps registered documents and saved answers, but changes the UI address and invalidates earlier browser sessions and interactive HTML permissions.
+`build:watch` rebuilds when the sources, the build configuration, or the packaged files change; a failed build keeps the last successful output. The next linked CLI invocation uses the new build, but the watcher does not restart your daemon: run `vo daemon restart`, then `vo ui`. Restarting keeps registered documents and saved answers, but changes the UI address and invalidates earlier render grants and interactive HTML permissions.
 
 For frequent UI changes, use `pnpm dev` instead. It runs the daemon from source with a separate `.dev-home` and serves the UI with Vite HMR. It does not rebuild the linked CLI or restart the backend when its source changes. To run CLI commands against it, set `VDE_OPEN_HOME` to the absolute path of `.dev-home` (for example, `VDE_OPEN_HOME="$PWD/.dev-home" vo list` from the repository root).
 

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as decodeStateFile, D as daemonEntryPath, E as resolveStateRoot, O as referencedBlobs, S as renameWithRetry, T as resolveRuntimeLocation, a as DAEMON_LOCK_NAME, b as proofMatches, c as readIpcKey, d as inspectOwner, f as readCurrentLock, g as encodeFrame, h as FrameDecoder, i as requirePrivateDirectoryIfExists, k as version, l as readPointer, m as systemProcessProbe, n as ensurePrivateDirectory, o as POINTER_FILE, p as releaseLock, r as inspectPrivateDirectory, s as START_LOCK_NAME, t as startDaemon, u as acquireLock, v as computeProof, w as currentPathEnvironment, x as removeWithRetry, y as createNonce } from "./main-DwpMMOjm.js";
-import { A as successEnvelope, C as VdeError, D as ExitCode, E as isVdeError, O as envelopeSchema, T as isErrorCode, Y as LIMITS, k as errorEnvelope, w as exitCodeForError } from "./search-index-B7DqaWh6.js";
+import { C as decodeStateFile, D as daemonEntryPath, E as resolveStateRoot, O as referencedBlobs, S as renameWithRetry, T as resolveRuntimeLocation, a as DAEMON_LOCK_NAME, b as proofMatches, c as readIpcKey, d as inspectOwner, f as readCurrentLock, g as encodeFrame, h as FrameDecoder, i as requirePrivateDirectoryIfExists, k as version, l as readPointer, m as systemProcessProbe, n as ensurePrivateDirectory, o as POINTER_FILE, p as releaseLock, r as inspectPrivateDirectory, s as START_LOCK_NAME, t as startDaemon, u as acquireLock, v as computeProof, w as currentPathEnvironment, x as removeWithRetry, y as createNonce } from "./main-BH6i8EXC.js";
+import { A as successEnvelope, C as VdeError, D as ExitCode, E as isVdeError, O as envelopeSchema, T as isErrorCode, Y as LIMITS, k as errorEnvelope, w as exitCodeForError } from "./search-index-BoGly_y4.js";
 import fs, { fstatSync } from "node:fs";
 import { lstat, readFile, readdir, stat as stat$1, writeFile } from "node:fs/promises";
 import path, { join, resolve } from "node:path";
@@ -3815,23 +3815,22 @@ async function runCli(rawArgv, context) {
 		}
 	};
 	const openBrowser = async (connection) => {
-		const { data } = unwrap(await connection.request("ui.bootstrap", {}));
-		if (await browser.open(data.bootstrapUrl)) return [];
+		const { data } = unwrap(await connection.request("daemon.status", {}));
+		if (await browser.open(data.uiUrl ?? "")) return [];
 		return [{
 			code: "W_BROWSER_OPEN_FAILED",
 			message: "The browser could not be opened. Open the URL shown by `vde-open ui --print-url` in your browser.",
 			details: { uiUrl: data.uiUrl }
 		}];
 	};
-	const showUi = async (printUrl) => {
+	const showUi = async (printUrl, json = false) => {
 		const connection = await control.ensure();
 		try {
 			if (printUrl) {
-				const { data } = unwrap(await connection.request("ui.bootstrap", {}));
-				context.stderr("This URL contains a one-time secret valid for 60 seconds. Do not share it.\n");
-				context.stdout(`${data.bootstrapUrl}\n`);
+				const { data } = unwrap(await connection.request("daemon.status", {}));
+				if (!json) context.stdout(`${data.uiUrl ?? ""}\n`);
 				return { data: {
-					uiUrl: data.uiUrl,
+					uiUrl: data.uiUrl ?? "",
 					opened: false
 				} };
 			}
@@ -3849,7 +3848,7 @@ async function runCli(rawArgv, context) {
 		}
 	};
 	const program = new Command();
-	program.name(PROGRAM_NAME).description("Local CLI that shows opened Markdown and HTML in the browser and lets agents list, search, and read parts of them").version(CLI_VERSION, "-V, --version", "Show the version").helpOption("-h, --help", "Show help").addHelpText("after", "\n`vo` is the same command as `vde-open`. Passing a file directly is treated as `open` (for example: vo a.md).\nRunning with no arguments opens the management UI in the browser.").exitOverride().configureOutput({
+	program.name(PROGRAM_NAME).description("Local CLI that shows Markdown, HTML, and images in the browser and lets agents search documents and read text").version(CLI_VERSION, "-V, --version", "Show the version").helpOption("-h, --help", "Show help").addHelpText("after", "\n`vo` is the same command as `vde-open`. Passing a file directly is treated as `open` (for example: vo a.md).\nRunning with no arguments opens the management UI in the browser.").exitOverride().configureOutput({
 		writeOut: context.stdout,
 		writeErr: context.stderr
 	}).action(async () => {
@@ -4051,12 +4050,8 @@ async function runCli(rawArgv, context) {
 	watchCommand.command("remove").description("Remove a watch rule. Open documents stay open").argument("<watchId>", "Watch rule ID").option("--json", "Output the result as JSON", false).action(async (watchId, options) => {
 		await execute("watch.remove", options.json, () => viaDaemon("watch.remove", { watchId }), renderRules);
 	});
-	program.command("ui").description("Open the management UI in the browser").option("--print-url", "Print a one-time URL instead of opening the browser", false).option("--json", "Output the result as JSON", false).action(async (options) => {
-		if (options.printUrl && options.json) {
-			fail(new VdeError("E_INVALID_ARGUMENT", "--print-url cannot be combined with --json because its output contains a secret."), true);
-			return;
-		}
-		await execute("ui", options.json, () => showUi(options.printUrl), () => "");
+	program.command("ui").description("Open the management UI in the browser").option("--print-url", "Print the UI URL instead of opening the browser", false).option("--json", "Output the result as JSON", false).action(async (options) => {
+		await execute("ui", options.json, () => showUi(options.printUrl, options.json), () => "");
 	});
 	const renderStatus = (status) => status.state === "running" ? `running  pid=${String(status.pid)}  open documents: ${String(status.openDocuments)}  ${status.uiUrl ?? ""}` : "stopped";
 	const daemon = program.command("daemon").description("Start, inspect, and stop the daemon");

package/dist/daemon.js

@@ -1,5 +1,5 @@
-import { k as version, t as startDaemon, w as currentPathEnvironment } from "./main-DwpMMOjm.js";
-import { E as isVdeError } from "./search-index-B7DqaWh6.js";
+import { k as version, t as startDaemon, w as currentPathEnvironment } from "./main-BH6i8EXC.js";
+import { E as isVdeError } from "./search-index-BoGly_y4.js";
 //#region src/daemon.ts
 function notifyParent(message) {
 	if (!process.send) return;

package/dist/{html-static-BDV6MgA7.js → html-static-C_wwQAJx.js}

@@ -8090,6 +8090,10 @@ const ASSET_TYPES = {
 		mime: "image/png",
 		role: "image"
 	},
+	apng: {
+		mime: "image/apng",
+		role: "image"
+	},
 	jpg: {
 		mime: "image/jpeg",
 		role: "image"
@@ -8098,6 +8102,26 @@ const ASSET_TYPES = {
 		mime: "image/jpeg",
 		role: "image"
 	},
+	jpe: {
+		mime: "image/jpeg",
+		role: "image"
+	},
+	jif: {
+		mime: "image/jpeg",
+		role: "image"
+	},
+	jfif: {
+		mime: "image/jpeg",
+		role: "image"
+	},
+	pjpeg: {
+		mime: "image/jpeg",
+		role: "image"
+	},
+	pjp: {
+		mime: "image/jpeg",
+		role: "image"
+	},
 	webp: {
 		mime: "image/webp",
 		role: "image"
@@ -8114,6 +8138,38 @@ const ASSET_TYPES = {
 		mime: "image/svg+xml",
 		role: "svg"
 	},
+	bmp: {
+		mime: "image/bmp",
+		role: "image"
+	},
+	ico: {
+		mime: "image/x-icon",
+		role: "image"
+	},
+	cur: {
+		mime: "image/x-icon",
+		role: "image"
+	},
+	jxl: {
+		mime: "image/jxl",
+		role: "image"
+	},
+	tif: {
+		mime: "image/tiff",
+		role: "image"
+	},
+	tiff: {
+		mime: "image/tiff",
+		role: "image"
+	},
+	heic: {
+		mime: "image/heic",
+		role: "image"
+	},
+	heif: {
+		mime: "image/heif",
+		role: "image"
+	},
 	css: {
 		mime: "text/css; charset=utf-8",
 		role: "style"
@@ -8682,6 +8738,17 @@ function analyzeHtml(source) {
 	};
 }
 function analyzeDocument(source, format) {
+	if (format === "image") return {
+		title: null,
+		outline: [],
+		sections: [{
+			sectionId: "sec_0000",
+			level: 0,
+			title: "",
+			headingPath: [],
+			text: ""
+		}]
+	};
 	return format === "markdown" ? analyzeMarkdown(source) : analyzeHtml(source);
 }
 //#endregion