replying to @dtinth-bot
Nice. Do an adversarial security review pls.
Commit
34f76bc
On it: adversarial security review of next (server auth, API, git/token handling, path traversal, preview iframe, Docker). Will post findings and fixes.
Review pass done, now fixing. Worst find: the GitHub App token for one repo works on every repo in the installation. Also: note aliases can write files outside the site dir (../), and symlinks in the vault are followed.
I created a dedicated app and installed it on just two directories. BTW, my GITHUB_APP_PRIVATE_KEY is a PEM file with multiline, how do I set it in
.env?Paste it as one line, either way works now (650a0f2): GITHUB_APP_PRIVATE_KEY=<output of base64 -w0 key.pem> (on macOS: base64 -i key.pem), or the PEM with \n escapes. A dedicated app on just those two repos is ideal. Tokens are now also scoped to one repo each.
On my VPS:
Do I have to do something special? Also, I just need to create a blank folder and on first run would the vault be populated?
sh-session
$ id -u 1003
Both handled in 306e3e5.
uid: in Dokploy, set the build args (Environment, Build-time Arguments) NOTES_UID=1003 and NOTES_GID=<your id -g>. The image then runs as that user, so vault files stay yours on the host.
Blank folder: yes. Create it (owned by you), bind-mount it at…
GitHubGitHub · Change is constant. GitHub keeps you ahead. · GitHubJoin the world's most widely adopted, AI-powered developer platform where millions of developers, businesses, and the largest open source community build software that advances humanity.
It works great!
- Can you make it so that the sidebar shows recent note first.
- Add an action menu where I can set note to public (updates frontmatter to
public: true + adds created if not created yet) and add revision (adds an updates entry)
- To rename a note I can just…Glad it works! On it: recent-first sidebar and an actions menu (Make public, Add revision). I will check the frontmatter format the live notes use for created/updates, then answer the rename question.
Done in 1ea8a67, CI green. Redeploy to get it.
Sidebar: most recently changed first, with ages. "Changed" means the last commit touching the file, or its mtime while it has uncommitted edits, because after a clone every mtime is the same.
Actions menu, next to Save:
- Make…
Want a favicon so I can easily identify the tab. Propose pls.
I like A. Please also implement Cmd+K for searching and linking. Pressing Cmd+K with text highlighted in editor would let me easily add cross-ref. See legacy vscode ext.
A it is. On it: favicon A plus Cmd+K search-and-link, modeled on the legacy VS Code extension. Reading that now.
Oh also, inside the service, when it does Git operations, please set GitHub committer/author to dtinth.
Done in 7684fdd, CI green. Redeploy to get it.
Cmd+K, ported from the legacy extension:
- With text selected in the editor, it replaces the text with [text](PickedNote).
- With nothing selected, or from anywhere on the page, it opens the picked note.
- Before you type anything,…
dt.in.thThai Pangsakulyanont
Please add some quality of life improvements: Typing star while text selected adds a star around the selected text (instead of replacing it with a star). Same for underscores. Please make editor font size a bit larger too.
Done in fadd265, CI green.
- Typing * or _ with text selected now wraps it, and the text stays selected. So ** makes it bold, and _ after that adds italics. Each wrap is one undo step. It works with multiple cursors too.
- Editor font is now 16px (was 14).
Want backtick (code)…
Yes for backticks! Also:
- Let me toggle the preview pane.
- Let me open the preview on the website at
dt.in.th/private/<Slug> (in a new window).Done in 9a152b0, CI green.
- Backticks now wrap the selection too.
- A Preview button in the editor bar hides and shows the preview pane. The browser remembers your choice, and no preview is rendered while it is hidden.
- Open on dt.in.th ↗ opens dt.in.th/private/<Slug> in a new…
dt.in.thThai Pangsakulyanont
Ok so I tried writing some stuff.
- Right now when I change text, the preview flashes, like a new page load. Is it possible to hot-reload the preview? (notes-frontend has a hot reload functionality in
/private/<Slug> by pressing r)
- When I have my agent update the draft, then I switch back, would be great if the web editor can show that there's an update. Maybe the web editor can remember the initial state of the editor, then when switch back to tab, it can detect change and do a 3-way merge?
- Not working well on mobile.commit 34f76bc
On it, all three: preview hot reload (I will study how /private does it on r), detecting outside edits with a 3-way merge against what you started from, and a proper mobile layout. Will post as each lands.
All three done in e83f3bc, CI green. Redeploy to get them.
1. Preview no longer flashes. Each render loads in a hidden second frame and swaps in once it settles, at the same scroll position. Tested over several edits; the scroll position was kept.
2. Agent edits: the editor…