Skip to content

WIP: lists/channel (trail), element/block (mark)#17

Draft
hzoo wants to merge 23 commits intomainfrom
trail
Draft

WIP: lists/channel (trail), element/block (mark)#17
hzoo wants to merge 23 commits intomainfrom
trail

Conversation

@hzoo
Copy link
Copy Markdown
Owner

@hzoo hzoo commented Sep 15, 2025

(arena like lexicon)
trail is an arena channel (a list of things), a mark is an element in the list, a block in arena. trails are just links to atproto things or urls so it could be a trail itself.
profile page shows lists of trails: https://henry.ink/profile/henryzoo.com
example trail: https://henry.ink/profile/henryzoo.com/trail/3lxzmgaa75sti
bookmarklet to add a trail: https://henry.ink/tools/bookmarklet, https://henry.ink/tools/quick-mark

  • but we need code to be able to render diff atproto lexicons, one at a time
  • i think if you dont have a UI that people are already on, it's hard to input a lot of data unless someone is very motivated? can use a bookmarklet or extension but not sure that is for a new user. ideally it's a inline button next to the thing itself (like a tweet + bookmark, or bsky post + bookmark, or arena block which lets you add to any channel if you find it interesting). if there is no UI with content then you need to copy paste the url and create an entry but i find that tedious.

hzoo and others added 23 commits August 28, 2025 13:42
- Extract shared CORS utility (4 duplicate implementations -> 1)
- Bound all in-memory caches: archive (50), youtube (200), domains (500), profiles (10k)
- O(n) single-pass CSS URL rewriting (was O(n^2) with per-URL regex construction)
- Precompile regex patterns at module level
- Cache Intl.Segmenter, count graphemes without array allocation
- Add compound SQLite indexes for JOIN queries, enable mmap + temp_store=MEMORY
- Exponential backoff on ingester reconnect (was fixed 5s)
- Move youtube cache expiry scan to periodic interval (off hot path)
- Add deploy:api script (git pull, bun install, pm2 restart, health check)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…limiting

- Strip scripts, iframes, embeds, mXSS vectors (noscript/template/math)
- Sanitize SVGs: keep visual elements, strip scriptable children
- Block dangerous URI schemes (javascript:, vbscript:, blob:, data:!image)
- Scope all CSS via Lightning CSS visitor, strip @import, reject oversized CSS
- Strip non-asset CSS url() references (tracking pixel prevention)
- SSRF: block all IP encodings, require domain names, validate URLs
- CORS: reject unknown origins instead of wildcard fallback
- Rate limit archive (3 burst, 1/5s) and asset proxy (30 burst, 5/s)
- Client-side DOMPurify defense-in-depth with FORBID_TAGS
- Style attribute whitelist on ArchiveModeWrapper
- Merge JSDOM passes, add client-side archive cache
- Tighten asset proxy: type validation, domain tracking, SSRF protection
- Remove error.message leaks from all API responses

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ith examples

- Move content mode toolbar (reader/archive/wayback/arena/original) into header bar
- Fix dark mode CSS: use .dark class instead of prefers-color-scheme for Arena links
- Login button color: bg-blue-400 → bg-blue-600 for consistency
- Merge sidebar control bar into tab row, saving vertical space
- Homepage: lead with example carousel, collapse instructions into details
- FAB: add post count badge on mobile
- Resize handle: w-1 → w-1.5 for easier grab target

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant