Renderer (app/index.html):
- Guard the router so navigateTo and the hashchange/popstate handlers only
load relative .md paths (isSafePagePath). Blocks fetching attacker-
controlled external URLs injected via the location hash.
- Stop treating in-page heading anchors (#heading) as page files, which
previously replaced the page with a 404.
- HTML-escape meta.title, link href/title attributes, not-found/offline
messages, and the icon fallback img; block javascript:/data: hrefs via
safeUrl.
- Hydrate mdcms tags nested inside tabs/accordions/callouts.
- Configure marked once instead of on every render.
- Validate stored theme value; fix text-align center; resolve per-category
offline message after categories initialise.
CLI (mdcms.py):
- Restore CDN_DEPS, _WOFF2_URL_RE, _fetch_bunny_fonts, _patch_index_html so
fetch-deps no longer raises NameError.
- Compare site markers against SITE_FORMAT_VERSION with zero-padded version
comparison, removing the spurious "update available" warning on v0.6 sites.
- Bump CLI to 0.6.1.
https://claude.ai/code/session_018KXUwmSNMGF2UBywTChCcS
- mdcms.py: CLI_VERSION 0.4.0, updated docstring and comment
- pyproject.toml: version 0.4.0
- app/index.html: site format marker → mdcms v0.4
- app/config.yml: site format marker → mdcms v0.4
- app/theme.yml: add site format marker mdcms v0.4
https://claude.ai/code/session_01UP8Wo2CKPNhvvTkzX48CWF
- Add generate_pwa(): builds manifest.json (name, short_name, theme_color,
standalone display, favicon icon) and service-worker.js with a
cache-first strategy; cache name is versioned by a hash of the precache
file list so new builds automatically invalidate old caches; precache
list covers index.html, config.yml, nav.yml, search.json, theme file,
and all pages/posts/assets
- Call generate_pwa() from run_build() when pwa: yes/true in config.yml
- index.html: add <link rel="manifest"> and SW registration script in
<head>; both silently no-op when the generated files are absent
- index.html boot(): write offline-message from config to localStorage
on every load so the message survives cache eviction
- index.html navigateTo(): show localStorage offline message when a page
fetch fails instead of the generic not-found message
- Update CLAUDE.md with PWA config key reference
https://claude.ai/code/session_015XtsgTMi8UtmgxEgb5Qt2c
- Replace interactive TUI with click-based subcommands:
register, delete, view, build
- build accepts NAME (registry), --path, or CWD for GitHub Actions use
- Switch to PyYAML for frontmatter and nav.yml parsing
- Add pyproject.toml with click + PyYAML deps and mdcms entry point
- Add v0.3 version marker to app/config.yml and app/index.html
- Registry moves to ~/.config/mdcms/sites.json (XDG-compliant)
- Project root is now the directory containing index.html (no website/ subdir)
- register auto-downloads template from GitHub if no site found
https://claude.ai/code/session_01MqEqGhP1guGx5VuFsLaws2
