replying to @dtinth
On it: adversarial security review of next (server auth, API, git/token handling, path traversal, preview iframe, Docker). Will post findings and fixes.
Commit
807866c
Review pass done, now fixing. Worst find: the GitHub App token for one repo works on every repo in the installation. Also: note aliases can write files outside the site dir (../), and symlinks in the vault are followed.
I created a dedicated app and installed it on just two directories. BTW, my GITHUB_APP_PRIVATE_KEY is a PEM file with multiline, how do I set it in
.env?Paste it as one line, either way works now (650a0f2): GITHUB_APP_PRIVATE_KEY=<output of base64 -w0 key.pem> (on macOS: base64 -i key.pem), or the PEM with \n escapes. A dedicated app on just those two repos is ideal. Tokens are now also scoped to one repo each.
On my VPS:
Do I have to do something special? Also, I just need to create a blank folder and on first run would the vault be populated?
sh-session
$ id -u 1003
Both handled in 306e3e5.
uid: in Dokploy, set the build args (Environment, Build-time Arguments) NOTES_UID=1003 and NOTES_GID=<your id -g>. The image then runs as that user, so vault files stay yours on the host.
Blank folder: yes. Create it (owned by you), bind-mount it at…
GitHubGitHub · Change is constant. GitHub keeps you ahead. · GitHubJoin the world's most widely adopted, AI-powered developer platform where millions of developers, businesses, and the largest open source community build software that advances humanity.
It works great!
- Can you make it so that the sidebar shows recent note first.
- Add an action menu where I can set note to public (updates frontmatter to
public: true + adds created if not created yet) and add revision (adds an updates entry)
- To rename a note I can just…Glad it works! On it: recent-first sidebar and an actions menu (Make public, Add revision). I will check the frontmatter format the live notes use for created/updates, then answer the rename question.
Done in 1ea8a67, CI green. Redeploy to get it.
Sidebar: most recently changed first, with ages. "Changed" means the last commit touching the file, or its mtime while it has uncommitted edits, because after a clone every mtime is the same.
Actions menu, next to Save:
- Make…
Want a favicon so I can easily identify the tab. Propose pls.
I like A. Please also implement Cmd+K for searching and linking. Pressing Cmd+K with text highlighted in editor would let me easily add cross-ref. See legacy vscode ext.
A it is. On it: favicon A plus Cmd+K search-and-link, modeled on the legacy VS Code extension. Reading that now.
Oh also, inside the service, when it does Git operations, please set GitHub committer/author to dtinth.
Done in 7684fdd, CI green. Redeploy to get it.
Cmd+K, ported from the legacy extension:
- With text selected in the editor, it replaces the text with [text](PickedNote).
- With nothing selected, or from anywhere on the page, it opens the picked note.
- Before you type anything,…
dt.in.thThai Pangsakulyanont
Please add some quality of life improvements: Typing star while text selected adds a star around the selected text (instead of replacing it with a star). Same for underscores. Please make editor font size a bit larger too.
Done in fadd265, CI green.
- Typing * or _ with text selected now wraps it, and the text stays selected. So ** makes it bold, and _ after that adds italics. Each wrap is one undo step. It works with multiple cursors too.
- Editor font is now 16px (was 14).
Want backtick (code)…
Yes for backticks! Also:
- Let me toggle the preview pane.
- Let me open the preview on the website at
dt.in.th/private/<Slug> (in a new window).Done in 9a152b0, CI green.
- Backticks now wrap the selection too.
- A Preview button in the editor bar hides and shows the preview pane. The browser remembers your choice, and no preview is rendered while it is hidden.
- Open on dt.in.th ↗ opens dt.in.th/private/<Slug> in a new…
dt.in.thThai Pangsakulyanont
Ok so I tried writing some stuff.
- Right now when I change text, the preview flashes, like a new page load. Is it possible to hot-reload the preview? (notes-frontend has a hot reload functionality in
/private/<Slug> by pressing r)
- When I have my agent update the draft,…On it, all three: preview hot reload (I will study how /private does it on r), detecting outside edits with a 3-way merge against what you started from, and a proper mobile layout. Will post as each lands.
commit 807866c