Skip to content

fix: images in the Mac app; docs: a screenshot tour of every feature - #15

Merged
jkyberneees merged 1 commit into
mainfrom
docs/feature-gallery
Oct 31, 2026
Merged

jkyberneees merged 1 commit into
mainfrom
docs/feature-gallery

Conversation

@jkyberneees

Copy link
Copy Markdown
Contributor

Bug fix: images in the Mac app

Every image (JPEG, PNG, GIF, SVG…) failed in the Mac app with "This image could not be decoded", in the image viewer and in Markdown previews. Images are fetched with the auth header and drawn from blob: URLs, and the window's content rule list only allowed http:// and ws:// on its own port. The fix adds one anchored allow rule for blob:http://127.0.0.1:<port>/; only script on that origin can mint such URLs, and navigation to blob: is still cancelled. Verified with the real rule list compiled into a WKWebView. Linux (Chromium) was not affected.

Also:

  • .jfif, .jpe, .apng, TIFF and HEIC open as images (TIFF/HEIC decode in WebKit).
  • An image the window cannot decode falls back to the hex dump under a notice.
  • Markdown previews skip images over 20 MB (/api/raw?max=N answers 413).
  • The SVG "View source" toggle ignores letter case.

Landing page: a tour of every feature

  • Four chapters, 20 features, each with light/dark screenshots cropped to the feature, srcset half-size variants for phones, and copy checked against the source.
  • bun run shots retakes them reproducibly: a deterministic demo repo, an isolated server/config/HOME/prompt, and an offscreen WKWebView driver (packaging/macos/appshot.swift).
  • New hero and Open Graph image; README, SECURITY.md, AGENTS.md updated; DESIGN.md round 10 records the review findings (accuracy, visual/a11y, security) and fixes.

Tests

bun run test: 1306 pass, 0 fail. New: test/images.test.ts (formats, server/client lists in sync, the Mac rule set), test/client.imageview.test.ts (hex-dump fallback, SVG toggle case), /api/raw?max coverage.

🤖 Generated with Claude Code

The Mac app's content rules blocked the blob: URLs that the image viewer and
Markdown previews draw images from, so every image failed with "could not be
decoded". One anchored allow rule for blob: on the window's own origin fixes
it. Also: .jfif/.jpe/.apng/TIFF/HEIC open as images, an undecodable image
falls back to the hex dump, Markdown previews skip images over 20 MB
(/api/raw?max=), and the SVG source toggle ignores letter case.

The landing page gains "A tour of every feature": 20 features with light and
dark screenshots taken by `bun run shots` in a deterministic demo repository
(scripts/shots.ts, demo-repo.ts, packaging/macos/appshot.swift). Reviewed for
accuracy, visual design/accessibility and security (DESIGN.md round 10).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Oct 31, 2026 •

Copy link
Copy Markdown

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status Deployment URL Commit Updated (UTC) See this deployment's details
  • Build: Failed ❌

View logs ↗
a8a2035 2026-10-31T09:12:57.062Z View logs ↗

@jkyberneees
jkyberneees merged commit 6657787 into main Oct 31, 2026
4 of 5 checks passed
@jkyberneees
jkyberneees deleted the docs/feature-gallery branch October 31, 2026 09:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant