peter/daybook
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Document #009's substring-check limitation; fix #011's CDN docs and theme typo

Browse source 
#009: html_fragment's content-shape check is substring-based, so it can
false-positive on inert text inside <script>/<pre> (e.g. a JS string
literal that happens to contain "<html>"). Documented as a known
limitation in docs/api.md rather than implementing real HTML parsing - a
proper fix is a much bigger change than the narrow trigger justifies, and
substring matching is the same approach the client helper already uses.

#011: added a curated CDN Snippets section to SKILL.md for html_full
(Tailwind, Chart.js, with an offline/air-gapped caveat), scoped explicitly
to that kind only. Fixed daybook_post.py's --theme help text, which named
a non-existent "bootstrap" theme (written ahead of a vendored-Bootstrap
feature that was planned but never built, not a typo).

Also updated SKILL.md's kind cheat sheet, which never mentioned the
json/csv kinds and still pointed at the old --as-markdown workaround for
them - and filed issue #012 for a real gap that surfaced doing so: the
posting script itself doesn't support --kind json/csv yet, only the raw API
does.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
peter 2026-09-02 15:32:22 +01:00
parent 09ea0a8b4f
commit 532b4bd4eb
6 changed files with 254 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/api.md
View file

@ -102,6 +102,15 @@ valid JSON (`json.loads` must succeed). `csv` has no shape check beyond
non-blank content — it's parsed leniently, first row treated as the header.
A mismatch returns `400`.
**Known limitation:** this check is substring-based, not a real HTML parse.
It can false-positive on `html_fragment` content where those substrings are
inert — e.g. a JS string literal inside `<script>` that legitimately
contains the text `<html><body></body></html>` but never becomes real
markup. Avoid the literal strings `<html`, `<!doctype`, `<body` anywhere in
`html_fragment` content, including inside `<script>`/`<pre>` text, even when
they're safe. (Escaped text, e.g. `&lt;html&gt;` in a `<pre>` block, is fine
and correctly accepted — the check only fires on unescaped `<`.)
Optional fields:
| Field | Notes |