Skip to content

README screenshots, code-aware Mermaid extraction, release 2.2.1 - #4

Merged
kanad13 merged 10 commits into
mainfrom
docs/readme-screenshots
Oct 26, 2026
Merged

kanad13 merged 10 commits into
mainfrom
docs/readme-screenshots

Conversation

@kanad13

@kanad13 kanad13 commented Oct 26, 2026

Copy link
Copy Markdown
Owner

Redrafts the README around screenshots of each feature, with a readme images test and rule. Makes Mermaid extraction and mode detection ignore code samples, shows the diagram source after a syntax error, and adds page-contract tests. Records the CSP review and release lessons in the guides, and copies sibling-extensions.md from NotionDown. Bumps the version to 2.2.1.

Checks: npm test (144 pass), npm audit --omit=dev (0 vulnerabilities), vsce package.

The shared file had drifted: it lacked the Tools and authority section and
had a table-padding difference. Copying NotionDown's main makes the five
repositories identical again.
Agents should read GitHub, Marketplace, and Open VSX state with gh, vsce,
and ovsx instead of asking for web pages, and change state only on the
maintainer's word. The section points to the canonical text in
sibling-extensions.md.
The README showed only a GIF, which search visitors cannot scan. The new
examples/showcase.md is the source for six PNG screenshots, one per
feature, in a dark and a light theme. They were captured from the real
webview page via scripts/render-harness.js in headless Chromium with VS
Code Dark+/Light+ variables, not in a VS Code window. readme-*.png stays
out of the package so the vsix does not grow.
Heading, a plain sentence, then a screenshot for each feature a visitor
searches for. The GIF stays in assets/ but leaves the README. Install now
covers VS Code, Open VSX and a .vsix file, and a What it does not do
section replaces the Features list, which repeated the sections above.
Relative or blob image links break on the Marketplace and Open VSX pages
because the package leaves assets out, and SVG is rejected. The readme
images suite checks absolute raw URLs, that each file exists, PNG only,
alt text of 10+ characters, and at least four images. Sabotage check:
a relative URL and a missing file each fail the suite.
A regex over the whole text ended a ::: mermaid block at the class
shorthand in A:::hot --> B, extracted a Mermaid fence quoted inside another
code block, and matched ::: mermaid in mid-line text. hasSlideDelimiter
also counted a <!-- slide --> shown inside a code fence, which switched a
Mermaid-only file into slide mode and showed no slides.

Both functions now scan line by line with the renderer's fence rules. Four
and more backticks and tilde fences stay deferred in decisions.md because
the renderer and splitSlides share that limit. Each new test failed before
the change, and removing each branch of the new scan fails a test.
A diagram with a syntax error showed Mermaid's own error graphic, while
the note above it said the source was shown below. Mermaid now draws no
error graphic (suppressErrorRendering) and the failed node gets its source
text back, so the note is true. The page was never at risk: other slides,
other diagrams, and navigation kept working, and no stray element reached
the body. Checked in the browser harness with a bad diagram.

The page-contract tests read the generated template and pin the policy
before the scripts, the nonce on both scripts, the renderer before the
module, the Mermaid configuration, the stale-render guard, and the
position key. A sabotage run had left five of these unguarded. The
splitSlides fence test now asserts the delimiter stays in slide text,
because it passed with fence tracking removed. Each guard was broken once
and failed a test.
Re-pushing an old vX.Y.Z tag would run that release again, Open VSX can be
read-only and then a manual workflow run retries it, and the Marketplace
page lags 5 to 10 minutes. The guides now say so and name the commands
(gh release view, ovsx show, vsce show) that replace a polling loop.
The review found no path for document text to run script and no message
to the host, and that img-src https: is deliberate. The finding sits in
architecture.md and the rejected host allow-list in decisions.md.
architecture.md and testing.md also describe the line-by-line extraction,
the diagram error handling, and the page-contract tests.
Two extraction bugs and one diagram-error display bug are fixed, and the
README now shows screenshots. The changelog lists the user-visible changes.
@kanad13
kanad13 merged commit c942473 into main Oct 26, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant