All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
A six-feature release. Most of the work is rendering: diagrams, charts, in-page find, heading anchors, edit-on-GitHub, plus a polish pass on search.
editUrl in chapters.json```mermaid code blocks render as SVG diagrams (lazy-loaded from CDN). Chapters without diagrams pay nothing. Theme tracks the help-book light/dark toggle.```chart code blocks with JSON config render as interactive charts (lazy-loaded). Library is fetched from cdn.jsdelivr.net on demand — pages without a chart pay no cost. Charts re-render on theme toggle so axis/grid colors match. JSON parse and chart-init errors fall back to the original source plus an error banner.script-src and connect-src now include https://cdn.jsdelivr.net; worker-src 'self' blob: added for mermaid’s optional layout workers. Production deployments serving an HTTP CSP header must mirror these.<img> paths in chapter markdown are now resolved relative to the chapter’s own directory (PR #40 documented this, but help.js never wired it up — relative paths 404’d against the SPA root).images/foo.jpg; previously only ./ and ../-prefixed paths survived, so the sanitizer silently stripped src from any plain-relative image.Install/update ergonomics: one-shot update command, automatic rollback snapshot. No breaking changes — existing installs keep working unchanged until they update once.
help/update wrapper script — shipped inside the release ZIP. After one install, updating is:
bash help/update # → latest release
bash help/update v2.4.0 # → pin a specific version
No more copy-pasting the full curl | bash URL. The wrapper always targets the help/ folder it lives in, regardless of CWD.
index.html, help.css, help.js, logo.svg, update are snapshotted to help/.help-book-backup/ (one generation deep). Rollback hint is printed in the output.[help-book] update complete — v2.3.0 → v2.4.0 in ./help
[help-book] backup of previous version: ./help/.help-book-backup/
[help-book] rollback: cp ./help/.help-book-backup/*.* ./help/ ...
install.sh file-list split into REQUIRED (core 4 code files — must be in ZIP) and OPTIONAL (update). Older ZIPs without the wrapper install gracefully; downgrades keep the existing wrapper in place.update wrapper is bundled alongside index.html, help.css, help.js, logo.svg.Audit pass driven by impeccable /audit — addresses every P0/P1/P2/P3 finding. No breaking changes to the public surface (accent, CSP, chapters.json schema, install.sh).
<details> element in .help-content). The header TOC bar used to disappear under 768px with no replacement, leaving long chapters unnavigable on phones.--help-accent-deep / --help-accent-light redefine themselves under [data-theme="dark"]. Six [data-theme="dark"] override blocks collapsed into the token definition.color-mix with accent at 6%/10%).--help-text-tertiary lifted to WCAG AA 4.5:1: #888 → #6e6e6e on light, #888 → #9a9a9a on dark. Affects footer (11px), prev/next labels, copy-button label.-0.4px at 28px) — previously missing while 40px and 32px both had tracking..help-content max-width now fluid via clamp(72ch, 62vw, 84ch) so ultra-wide viewports gain breathing room while 1024-1440 stays at the 72ch readability target.<ol> / <ul> markers now use the brand accent for subtle cohesion.<code> gains a 1px border for clearer boundary against body text.accent in chapters.json now propagates consistently across all UI states (#33):
rgba(232,121,29,...) sites (selection, search-glow, sidebar-active, TOC-active, code-highlight) replaced with color-mix(in srgb, var(--help-accent) XX%, transparent) so tints track the override--help-accent-deep and --help-accent-light now derived from var(--help-accent) via color-mix() instead of hardcoded orange tones — fixes light-mode text reverting to default orange when a custom accent is setcurrentColor to inherit the accent), plus logo.svg registered as the browser tab faviconlogo.svg as a fourth code asset alongside index.html, help.css, help.jsscripts/install.sh — one-line installer/updater for downstream projects (curl ... | bash)help-book-vX.Y.Z.zip) on every tag, containing only index.html, help.css, help.js.help-book-installed marker file for robust install/update detection#18E299) back to warm orange (#e8791d); --help-accent-deep and --help-accent-light adjusted to matching tonesgit archive), attached atomically through gh release create (avoids release-without-asset state on partial failure)pull-requests:write permission; git push retries 3× with rebase + backoffunzip -n to never overwrite existing fileshelp.js, help.css, changelog.mjs; kept WHY-commentsrgba(24,226,153,...) (green) sites in help.css — selection, search-glow, code-highlight, sidebar-active and TOC-active backgrounds now use the orange accentBODY_REF_RE loopCHANGELOG.md against GITHUB_WORKSPACE (CWD fallback) so local invocation from a subdir writes to the right path^v[0-9]+\.[0-9]+\.[0-9]+(-pre)?$ before embedding in URLs (defeats injection via crafted API response or CLI arg)HELP_BOOK_DIR (system paths, $HOME directly)unzip -tq; bounded curl --connect-timeout/--max-time/--retry; trap covers EXIT INT TERM HUP$ in run: blocks is mapped through env: first (defeats script-injection via crafted workflow_dispatch tag input or malicious tag name); explicit tag-format validationset -euo pipefail at the top of every run: block#e8791d) to Mintlify green (#18E299) — still overridable via chapters.jsonDESIGN.md reference at repo root (via npx getdesign)<meta> policy with strict allowlist<meta> and FOUC-preventing inline theme bootstraparia-pressed/aria-expanded sync, focus trap on Escprefers-color-scheme change listener (auto-follow OS while no manual choice exists)storage event (falls back to OS pref when storage cleared)prefers-reduced-motion and @supports not (backdrop-filter) fallbacks@media print stylesheetnavigate(): stale fetch could overwrite newer chapter — now bails on navId !== currentIdhashchange re-entry: currentId set before hash update, plus decodeURIComponent to handle percent-encoded idsscrollSpyLocked leaked when a chapter had fewer than two <h2>s — now releasedposition: fixedjustify-content: center collapsed the scroll start at many items — now safe centerborder-radius clipped the scrollbar — sidebar now overflow: hidden, inner <ul> scrolls--help-bg-secondary)scrollToHeadingenv(safe-area-inset-top)ALLOWED_URI_REGEXP, FORBID_TAGS, FORBID_ATTR, controlled target/relaccent (CSS-color regex) and chapter.file (path regex with traversal-depth guard) from chapters.jsonObject.create(null) (prototype pollution dicht)target="_blank" links get rel="noopener noreferrer"referrerpolicy="no-referrer" on all CDN tagsframe-ancestors from <meta> CSP (only valid as HTTP header)encodeURIComponent in href attributesconfig variableescapeHtml with efficient string replacementchapters.json