From 7ef2dde1cf6db49a7f832d17bd49ec79f030da82 Mon Sep 17 00:00:00 2001 From: Ben Vinegar Date: Sat, 25 Jul 2026 21:43:01 -0400 Subject: [PATCH] chore(release): 0.12.0 --- .changeset/bright-mermaids-expand.md | 5 ----- .changeset/clean-agents-connect.md | 5 ----- .changeset/dark-hoops-obey.md | 2 -- .changeset/fresh-dots-dance.md | 5 ----- .changeset/iframe-csrf-headers.md | 13 ------------- .changeset/orange-onions-roll.md | 2 -- .changeset/public-read-sse-race.md | 9 --------- .changeset/send-test-post.md | 5 ----- .changeset/skeleton-loading-states.md | 5 ----- .changeset/sync-release-main.md | 2 -- .changeset/tidy-tools-shrink.md | 5 ----- CHANGELOG.md | 28 +++++++++++++++++++++++++++ package-lock.json | 4 ++-- package.json | 2 +- 14 files changed, 31 insertions(+), 61 deletions(-) delete mode 100644 .changeset/bright-mermaids-expand.md delete mode 100644 .changeset/clean-agents-connect.md delete mode 100644 .changeset/dark-hoops-obey.md delete mode 100644 .changeset/fresh-dots-dance.md delete mode 100644 .changeset/iframe-csrf-headers.md delete mode 100644 .changeset/orange-onions-roll.md delete mode 100644 .changeset/public-read-sse-race.md delete mode 100644 .changeset/send-test-post.md delete mode 100644 .changeset/skeleton-loading-states.md delete mode 100644 .changeset/sync-release-main.md delete mode 100644 .changeset/tidy-tools-shrink.md diff --git a/.changeset/bright-mermaids-expand.md b/.changeset/bright-mermaids-expand.md deleted file mode 100644 index c54a6f3..0000000 --- a/.changeset/bright-mermaids-expand.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"sideshow": minor ---- - -Add fullscreen Mermaid diagrams and guidance for vertical, card-friendly flowcharts. diff --git a/.changeset/clean-agents-connect.md b/.changeset/clean-agents-connect.md deleted file mode 100644 index 5a31614..0000000 --- a/.changeset/clean-agents-connect.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"sideshow": patch ---- - -Port the cleaner connect-an-agent onboarding screen from sideshow-cloud to the self-hosted viewer. diff --git a/.changeset/dark-hoops-obey.md b/.changeset/dark-hoops-obey.md deleted file mode 100644 index a845151..0000000 --- a/.changeset/dark-hoops-obey.md +++ /dev/null @@ -1,2 +0,0 @@ ---- ---- diff --git a/.changeset/fresh-dots-dance.md b/.changeset/fresh-dots-dance.md deleted file mode 100644 index 628764a..0000000 --- a/.changeset/fresh-dots-dance.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"sideshow": patch ---- - -Show a pulsing sidecar dot next to the version pill when a post revision was updated recently. diff --git a/.changeset/iframe-csrf-headers.md b/.changeset/iframe-csrf-headers.md deleted file mode 100644 index 0146a3b..0000000 --- a/.changeset/iframe-csrf-headers.md +++ /dev/null @@ -1,13 +0,0 @@ ---- -"sideshow": patch ---- - -Harden the trusted viewer against clickjacking and referrer leaks. The viewer -HTML (the app origin, shared with the authenticated API and the comment→agent -channel) now sends `Content-Security-Policy: frame-ancestors 'self'`, refusing -cross-origin framing; the sandboxed `/s/:id` surface documents are unaffected -and keep their own `sandbox` CSP. External links the viewer opens — the -`openLink` bridge's `window.open`, the release-notes markdown links, and the -image/trace/footer anchors — now use `rel="noopener noreferrer"` (and the -`noreferrer` window feature), so the current URL (which can carry the `?key=` -deploy token) never rides an outbound `Referer`. diff --git a/.changeset/orange-onions-roll.md b/.changeset/orange-onions-roll.md deleted file mode 100644 index a845151..0000000 --- a/.changeset/orange-onions-roll.md +++ /dev/null @@ -1,2 +0,0 @@ ---- ---- diff --git a/.changeset/public-read-sse-race.md b/.changeset/public-read-sse-race.md deleted file mode 100644 index f9ada26..0000000 --- a/.changeset/public-read-sse-race.md +++ /dev/null @@ -1,9 +0,0 @@ ---- -"sideshow": patch ---- - -Fix blank page when opening a post permalink (`/p/:id`) on a -`publicRead="session"` workspace without authentication. The SSE connection -fired before the viewer discovered the post's session ID, hitting `/api/events` -without the required `?session=` param and getting a 401. The connection is now -deferred until after the initial post fetch resolves. diff --git a/.changeset/send-test-post.md b/.changeset/send-test-post.md deleted file mode 100644 index 76584e3..0000000 --- a/.changeset/send-test-post.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"sideshow": minor ---- - -Add `send_test_post` — a built-in welcome/test post for newly connected agents. One no-arg call publishes a fixed card (shipped with sideshow, themed for light/dark) that confirms the connection works and shows the user example prompts to try. Available on all three tiers: the `send_test_post` MCP tool (HTTP and stdio), `POST /api/test-post`, and `sideshow test-post`. Idempotent — if the welcome card is already on the board it is returned (`alreadySent: true`), never duplicated. The MCP initialize instructions now nudge freshly connected agents toward it. diff --git a/.changeset/skeleton-loading-states.md b/.changeset/skeleton-loading-states.md deleted file mode 100644 index 348564d..0000000 --- a/.changeset/skeleton-loading-states.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"sideshow": patch ---- - -Add reusable skeleton loading states for viewer streams and lists. diff --git a/.changeset/sync-release-main.md b/.changeset/sync-release-main.md deleted file mode 100644 index a845151..0000000 --- a/.changeset/sync-release-main.md +++ /dev/null @@ -1,2 +0,0 @@ ---- ---- diff --git a/.changeset/tidy-tools-shrink.md b/.changeset/tidy-tools-shrink.md deleted file mode 100644 index a9a37e8..0000000 --- a/.changeset/tidy-tools-shrink.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -"sideshow": patch ---- - -Reduce MCP instruction and tool-schema context overhead while preserving every canonical and deprecated tool. diff --git a/CHANGELOG.md b/CHANGELOG.md index cff02a7..fe74111 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,33 @@ # Changelog +## 0.12.0 + +### Minor Changes + +- a11db09: Add fullscreen Mermaid diagrams and guidance for vertical, card-friendly flowcharts. +- 9e9eb90: Add `send_test_post` — a built-in welcome/test post for newly connected agents. One no-arg call publishes a fixed card (shipped with sideshow, themed for light/dark) that confirms the connection works and shows the user example prompts to try. Available on all three tiers: the `send_test_post` MCP tool (HTTP and stdio), `POST /api/test-post`, and `sideshow test-post`. Idempotent — if the welcome card is already on the board it is returned (`alreadySent: true`), never duplicated. The MCP initialize instructions now nudge freshly connected agents toward it. + +### Patch Changes + +- d6e56e0: Port the cleaner connect-an-agent onboarding screen from sideshow-cloud to the self-hosted viewer. +- ef445fd: Show a pulsing sidecar dot next to the version pill when a post revision was updated recently. +- b4d6a42: Harden the trusted viewer against clickjacking and referrer leaks. The viewer + HTML (the app origin, shared with the authenticated API and the comment→agent + channel) now sends `Content-Security-Policy: frame-ancestors 'self'`, refusing + cross-origin framing; the sandboxed `/s/:id` surface documents are unaffected + and keep their own `sandbox` CSP. External links the viewer opens — the + `openLink` bridge's `window.open`, the release-notes markdown links, and the + image/trace/footer anchors — now use `rel="noopener noreferrer"` (and the + `noreferrer` window feature), so the current URL (which can carry the `?key=` + deploy token) never rides an outbound `Referer`. +- bf0dd67: Fix blank page when opening a post permalink (`/p/:id`) on a + `publicRead="session"` workspace without authentication. The SSE connection + fired before the viewer discovered the post's session ID, hitting `/api/events` + without the required `?session=` param and getting a 401. The connection is now + deferred until after the initial post fetch resolves. +- 32ed841: Add reusable skeleton loading states for viewer streams and lists. +- 5d2bd91: Reduce MCP instruction and tool-schema context overhead while preserving every canonical and deprecated tool. + ## 0.11.1 ### Patch Changes diff --git a/package-lock.json b/package-lock.json index 6565bc9..5b0651d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "sideshow", - "version": "0.11.1", + "version": "0.12.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "sideshow", - "version": "0.11.1", + "version": "0.12.0", "license": "MIT", "dependencies": { "@hono/node-server": "^1.14.0", diff --git a/package.json b/package.json index 0b36ba0..27e3508 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "sideshow", - "version": "0.11.1", + "version": "0.12.0", "description": "A live visual surface for terminal coding agents — agents draw HTML snippets, you watch them in the browser and comment back.", "keywords": [ "agent-tools",