v2.1.2 — X-Robots-Tag noindex on every response

Search-engine noindex hardening.

Added

• X-Robots-Tag: noindex, nofollow on every viewer response (SEC_HEADERS) — the existing robots meta only covers HTML; the header extends the no-indexing guarantee to every response the viewer emits, including error pages
• Robots meta upgraded from noindex to noindex, nofollow to match the header

v2.1.1 — viewer rendering: tables, dark mode, sanitizer gaps

Viewer rendering round — table/dark-mode/element styling from a user report on mobile.

Fixed

• GFM strikethrough (~~text~~) survives sanitization — <del> is not in
  sanitize-html's default allowlist and was silently dropped, losing the strikethrough
  meaning entirely
• Table column alignment survives sanitization — marked emits GFM :--:/--: as a
  presentational align attribute on th/td, which the sanitizer stripped
• Tables render with real borders (border-collapse, cell padding, header background)
  instead of unstyled runs of text
• Wide tables scroll horizontally (display:block; overflow-x:auto) instead of bursting
  the layout on phones
• Dark mode: color-scheme: light dark plus a prefers-color-scheme: dark token set —
  the page, and the password form's input/button, now follow the system theme instead of
  always rendering white
• blockquote (left border + muted text) and img (max-width:100%; height:auto) are
  styled; large images no longer overflow on mobile

Changed

• Minor polish: inline code gets padding + radius (reset inside pre), kbd renders
  as a bordered keycap, task-list checkboxes drop the redundant list bullet
• Document <style>/style attributes remain stripped by design — styling belongs to
  the page template, content carries semantics only

v2.1.0 — User-audit round: precise rate limiting, delete confirm gate, clean npm audit

All findings from a post-2.0.0 security/behavior audit.

Changed

• Rate limiter counts only FAILED unlocks — reject at cap first, record on wrong password, clear on success; a legit user can no longer lock a doc for others by unlocking it repeatedly
• delete_shared_doc requires confirm: true — explicit-consent gate for an irreversible agent-exposed tool
• Gist content search filters before the limit (matches beyond the newest 20 are found)
• Gist append updates the local search excerpt only after the GitHub PATCH succeeds

Fixed

• npm audit clean: transitive @hono/node-server pinned ≥2.0.5 via overrides (unused by this package's stdio/native-http paths; all 70 tests pass)
• README: gist index privacy wording (stores first 200 chars for search, never full content), install examples pinned to @^2 so future breaking releases can't change behavior on cold start, Windows daemon options

70 offline tests. CHANGELOG

v2.0.0 — Security-hardened, daemon mode, delete & content search

Breaking: create_shared_file is removed — an arbitrary-path file-sharing tool is a prompt-injection exfiltration vector (.env, keys); removed rather than allowlisted.

Security

• Rate-limit counters persisted in SQLite (restart no longer resets brute-force counts), cross-process-atomic via BEGIN IMMEDIATE
• Full security-header set on every viewer response (CSP default-src 'none', nosniff, DENY framing, no-referrer, no-store)
• README now recommends Tailscale private (tailscale serve, tailnet-only) as the default exposure

Added

• sharedoc-mcp serve — standalone viewer daemon: selfhost links keep working after your MCP client closes
• delete_shared_doc — hard delete (link dies AND the record disappears; revoke keeps history)
• Content search — search_shared_docs gains content_query; empty call = list newest links
• GET /healthz — identity-aware health probe (also guards against port conflicts minting dead links)

65 offline tests. README · 繁體中文 · CHANGELOG

v1.0.0 — Share agent Markdown as links

Initial public release.

8 MCP tools over two pluggable backends:

• Gist backend (default): secret gists via your logged-in gh CLI — zero setup, local index for search/dedup, lazy expiry
• Selfhost backend: SQLite storage + localhost-only viewer — bcrypt passwords with rate-limited attempts, enforced expiry (410), revoke with 7-day grace, file sharing, sanitized markdown rendering; expose via the tunnel of your choice (Tailscale Funnel / Cloudflare Tunnel recipes in the README)

52 offline tests; Node ≥ 22.13.0. See README (繁體中文) and CHANGELOG.