v1.5.0 — Reimagine, product repos for every tool, live health badges, self-driving funnel CI

Live: https://navigatorslab.com/tools/ · Free & open source (MIT) — no accounts, no uploads, nothing retained.

🎨 New tool: Reimagine (16th)

Redesign any HTML page in 17 directions from its own content — palette, motif, motion derived from the source. Nothing invented, nothing uploaded. Lives at /reimagine/, standalone repo reimagine-it, with a new Design category on the hub.

🧰 Every tool now has a full product repo

Each of the 15 tools has its own repo — and each repo runs the real tool on its own GitHub Pages (demo.html with the exact asset closure, self-hosted OCR/MP3 engines, meta-CSP intact), plus:

• a branded landing page and an in-depth README with in-task screenshots (file loaded, results on screen, export ready)
• links everywhere: navigatorslab.com/<Tool-Name> pretty URLs ↔ repo Pages ↔ hub
• verified end-to-end: zero 404s/console errors across all 30 pages + live QR round-trip on Pages

🩺 Live health badges on every repo README

• Pages deployment badge (GitHub deployments API)
• "live check" badge served from status.json-driven endpoint files (badge-<id>.json), regenerated by the weekly production watch and cached 5 minutes at the edge — the badge flips red the moment production breaks

🤖 Fully self-driving funnel CI

The funnel-sync workflow builds the hub, regenerates all 15 repos, force-pushes from CI (FUNNEL_TOKEN), and posts a job summary of pushed/up-to-date repos. Triggers on catalog, screenshot, or generator changes.

🔧 Fixes & hardening

• production regression caught and fixed: pretty URLs 404ing after the Reimagine deploy (stale worker bundle) — now 301ing again for all 15 tools + /Reimagine
• status checker now uses curl (Cloudflare bot-protection 403'd python's TLS fingerprint)
• hub E2E updated for 16 cards; funnel-sync builds before generating
• status page + badge coverage include external tools

Gates: 84 unit · 29 E2E · 26 security — all at the production URL shape · CI, Pages, and funnel-sync workflows green.

v1.4.3 — Pretty URLs, Live Status Page, Weekly Prod Watch

Live: https://navigatorslab.com/tools/ · Free & open source (MIT) — no accounts, no uploads, nothing retained.

🔗 Pretty URLs

Every tool now answers at a root-level short link — the edge worker 301s it to the tool page:
navigatorslab.com/QR-Studio · /Photo-Privacy-Kit · /Receipt-OCR · /PDF-Pages · … (15 total, matching the standalone repo names). Unit-tested alias resolver (resolveToolAlias).

🩺 Live status page

/tools/status — every tool with its verification method (route+headers, or full browser engine E2E) and last-checked timestamp. Generated by scripts/update-status.py running the two deep production probes (real OCR run, real EXIF strip) plus route checks. Never hand-edited — a scheduled workflow regenerates it weekly and deploys the result; any failure blocks the run.

⏰ Weekly prod watch (new workflow)

Mondays 06:00 UTC: run both production probes + 15 route checks → commit refreshed status.json → deploy to production. Fails loudly if anything on the live site breaks. Also runnable on demand (workflow_dispatch).

🎵 MP3 export — now byte-verified

The 29th E2E check exports MP3 and verifies the MPEG frame sync/ID3 header and that the LAME encoder was fetched same-origin — closing the loop on the earlier engine-URL bug class.

🧪 Gates — all at the production URL shape

84/84 unit tests · 29/29 E2E · 26/26 security · 0px mobile overflow. Security suite is now subpath/origin-agnostic (host derived from SEC_BASE).

🧭 Funnel repos updated

All 15 standalone per-tool repos re-pushed: redirector pages and READMEs now advertise the pretty URL (navigatorslab.com/<Tool-Name>) alongside the canonical tool page.

🤖 Generated with Codebuff

v1.4.2 — security-review fixes: production engine paths, full metadata stripping, MCP guards

Independent security review found real issues; every confirmed one is fixed and verified.

Critical

• OCR + MP3 export were 404 in production (engine scripts resolved against the origin root, not /tools/). Fixed by resolving against the page; CI now tests at the production URL shape so this class cannot hide again.
• Photo Privacy Kit now strips XMP (APP1), IPTC (APP13) and JPEG comments in addition to Exif APP1 — plus PNG text/eXIf chunks and WebP EXIF/XMP (canvas re-encode). Proven on production with a crafted 4-channel JPEG: output contains none of them.

High

• MCP endpoint: 1 MB request cap (413), per-IP rate limit (429), text_diff truncates inputs that would allocate >4M-cell LCS tables instead of OOMing.
• LICENSE (MIT) + NOTICE (LGPL lamejs, Apache tesseract) committed — GitHub license detection now works and third-party licensing is honest.

Medium

• Scan PDF pages sized at the documented 300 DPI; invoice taxes the discounted subtotal (labeled).
• Metadata Checker: PDF XMP shown + stripped, encrypted-PDF warning; OOXML dates/custom.xml/thumbnails/comment authors; real .odt support.
• E-Sign: encrypted-PDF warning; docs now say visual signature, not cryptographic.
• README/EXAMPLES: OCR model is 11 MB (was misstated as 24 MB).
• GitHub Pages mirror gets a meta CSP; scripts de-hardcoded (APPDATA paths, noreply email); account_id annotated as public routing info.

Gates: 82/82 unit · 28/28 E2E · 25/25 security — all at the production URL shape · CI green.

v1.4.0 — Agent Mode: MCP endpoint, deep links, and a visual upgrade

Live: https://navigatorslab.com/tools/ · Free & open source (MIT) — no accounts, no uploads, nothing retained.

🤖 Agent Mode (the headline)

The suite now serves AI agents as first-class users:

• MCP endpoint — POST /tools/mcp speaks Model Context Protocol (JSON-RPC 2.0, Streamable-HTTP-style, stateless, no auth). Four compute tools, all pure & unit-tested: nl_catalog, qr_payload (Wi-Fi/vCard/mailto/text with spec-correct \ ; , : escaping), text_diff (LCS), text_stats. GET→405, Origin allow-list, security headers stamped on every response — verified live on production.
• Deep links — every tool accepts strict allow-listed URL parameters: qr.html?text=…&ec=M renders with zero clicks, shrink.html?url=…&format=webp&targetKB=300 pre-loads a same-origin file and pre-sets the target, sign.html?url=…&date=1, ocr.html?url=…&autostart=1, textdiff.html?a=…&b=… auto-compares, and more. ?url= is same-origin only, enforced in code; applied params surface an "Agent mode" chip.
• Machine-readable docs — llms.txt + llms-full.txt at /tools/ and the site root, tools.json, and a full reference page at /tools/agents.

🎨 Visual upgrade

• Aurora hero (layered radial gradients + masked grid) with a gradient-headline
• Tool cards: gradient icon tiles, hover lift + glow, scroll-reveal entrance (reduced-motion aware)
• New "for AI agents, too" hub section with pill, CTA and cards — localized EN/TR/DE
• Table links darkened to pass WCAG 4.5:1 (agents page a11y 91 → 100)

✅ Verification

• 76/76 unit tests (17 new MCP tests: initialize/tools/list/tools/call, error codes, WIFI escaping, diff & stats engines)
• 27/27 E2E checks (4 new: agents page + llms served, ?text= auto-render, ?url= data: analysis, params pre-set)
• 25/25 security checks across all 17 pages · 0px mobile overflow (agents included)
• Lighthouse 97–100 on audited pages · CI green · production MCP round-trip + deep-link render verified in a real browser

v1.3.0 — paste-everywhere & deep upgrades across 12 tools

Live: https://navigatorslab.com/tools/ · Free & open source (MIT) — no uploads, no accounts, nothing retained.

✨ Suite-wide

• Paste anywhere — Ctrl/Cmd+V a screenshot or copied file into any tool; it lands in the drop zone. Snip → paste → done.

🔧 Per-tool upgrades

• Photo Privacy Kit — SHA-256 fingerprints of original vs. cleaned files: cryptographic proof of "same picture, minus the metadata" (gate verifies pixel-identical output)
• Image Shrinker — AVIF output (smallest), batch zip, per-file progress that survives unreadable images
• Scan & Screenshot Cleaner — auto-levels (black/white point stretch) + threshold (photocopy look) + crisper 300 DPI PDF text
• Local E-Sign Pad — optional date stamp under the signature (decoded and asserted by the E2E gate)
• PDF Pages — extract selected pages to a new PDF + insert blank page sized to its neighbor
• Receipt OCR → CSV — per-row expense categories + currency in the CSV (v2 header)
• QR Studio — Wi-Fi / URL / email / phone / vCard presets with spec-correct escaping (;, ,, :, \ — round-tripped through the decoder in CI) + selectable error-correction level
• Audio Trimmer — peak normalize to −0.1 dB before WAV/MP3 export
• Text Diff — similarity % + swap button
• Text Stats — live sentence-rhythm histogram with average words/sentence
• Batch Rename — prefix, suffix, and sequence start number
• Invoice Generator — line-items table no longer overflows narrow phones

✅ Verification gate (all green)

59/59 unit tests · 23/23 E2E browser checks (3 new: Wi-Fi QR round-trip, extract/blank pages, paste) · 24/24 security checks · 5/5 mobile overflow checks · CI green · deployed and feature-verified on production

v1.2.1 — Critical bug-fix pass & redesigned front page

Live: https://navigatorslab.com/tools/ · Free & open source (MIT) — no uploads, no accounts, nothing retained.

🐛 Critical fixes (found in a full code-review pass)

• Receipt OCR — one unreadable image no longer kills the batch: per-file error recovery, bad files reported and skipped, good rows still exported
• Image Shrinker — floor-guard: quality descent now terminates safely on tiny images instead of risking an endless loop
• Invoice Generator — negative quantities/prices are rejected at the calculation source, so totals can never be corrupted
• PDF Pages — "select all" checkbox stays in sync with manual selections
• Scan & Screenshot Cleaner — crop drag hardening carried over (fit-to-viewport canvas, pointer capture, touch-action: none)
• Dead code removal across pages

🎨 Redesigned front page

• Hero with live "proof cards" (GPS stripped, 16 MB → 294 KB, signed PDF, OCR'd receipt)
• Stats band: 15 tools · 0 uploads · 92+ automated checks · Lighthouse 98–100 · 0 cookies/trackers
• Six real example cards with numbers taken from actual CI verification runs — not marketing copy
• 15-row comparison table: what each tool runs on, what it sends over the network (nothing), and which automated test proves the output
• FAQ, full EN/TR/DE localization for every new section, zero horizontal overflow down to 320px

✅ Verification gate

48/48 unit tests · 20/20 E2E browser checks · 24/24 security checks · 5/5 mobile checks · Lighthouse 98–100 · CI green · deployed and re-verified on production

v1.2.0 — PDF Pages, Text Diff, Text Stats; crop fix; i18n

Live: https://navigatorslab.com/tools/ · Free & open source (MIT) — no accounts, no uploads, nothing retained.

🐛 Fixed (user-reported)

• ✂️ Crop dragging in Scan Cleaner — the preview canvas rendered at full size inside a scroll box and touch drags were hijacked by the browser, so crops silently failed. The image now scales to fit your screen, drags map correctly at any zoom, and touch/pen gestures work. Locked in with a dedicated E2E regression check — verified on production.

✨ Three new tools (12 → 15)

📑 PDF Pages

Reorder, rotate, delete, extract & merge PDF pages — live thumbnails (pdf.js), drag to reorder, rebuild any subset with pdf-lib. E2E-verified: delete one page → rebuilt PDF has exactly the rest.

🔬 Text Diff

Compare two texts with word-level highlights inside changed lines (unit-tested LCS engine), whitespace/case options, unified-diff export. Contracts and drafts never leave the tab.

📊 Text Stats

Live word/character/sentence counts, reading & speaking time, Flesch reading-ease with grade level, and keyword density (Unicode-aware, unit-tested engine).

🌍 Platform

• The hub now speaks English, Türkçe, and Deutsch — selector in the header, persisted locally
• What's new toast — returning users see new tools and fixes on their next visit (this toast is how many will learn about this release)
• Per-tool OG images for the new pages; hub, sitemap, manifest all at 15 tools

🔐 Verification gate (now 44+ checks + Lighthouse)

E2E:       20/20 ✅   (one per tool + offline-PWA + hub)
Security:  24/24 ✅   (network silence, exfil, storage, fuzz, xss, headers, secrets)
Units:     48/48 ✅   (EXIF + fuzzing, WAV math, receipt totals, diff engine, text stats)
Mobile:    0px  ✅    Lighthouse: 98–100 ✅

Guides: step-by-step examples for all 15 tools in EXAMPLES.md.

v1.1.0 — QR Studio, per-tool share images, Lighthouse 98–100

Live: https://navigatorslab.com/tools/ · Free & open source (MIT) — no accounts, no uploads, nothing retained.

✨ New tool

🔳 QR Studio (tool 12)

Generate and decode QR codes entirely on-device:

• Generate — text or URLs → auto-sized module grids at 256–1024 px, custom foreground/background colors, optional spec quiet zone, PNG (crisp, nearest-neighbor) and vector SVG export
• Decode — drop any QR image; jsQR reads it on-device with both inversion attempts (dark-on-light and light-on-dark). Wi-Fi passwords, links, and ticket codes never leave the tab.
• Proven in CI — the E2E gate encodes a unique payload, exports the PNG, feeds those exact bytes to the decoder, and asserts a character-for-character match — locally and on production.

🖼️ Social previews

• 13 rendered 1200×630 Open Graph images — one per tool plus a refreshed suite banner — each wired into its page's og:image/twitter:image, so every tool looks right when shared.

⚡ Lighthouse: 98–100 everywhere

All 13 pages audited across performance, accessibility, best-practices, and SEO:

• Performance (was 77–84 on 6 pages) — pdf-lib now lazy-loads only when a tool actually exports, keeping first paint fast
• Accessibility (was 74–93) — accessible names on every select/input, WCAG-passing accent-on-dark text

🔐 Verification gate (now 37 checks + Lighthouse)

E2E:        16/16 ✅   Security: 21/21 ✅   Units: 30/30 ✅
Mobile:     0px  ✅    Lighthouse: 98–100 ✅ (13 pages × 4 categories)

Full commit log: everything shipped in this release is client-side, MIT licensed, and works offline after first visit (PWA).