Skip to content

Releases: lakshayxi/LocalMD

Release list

LocalMD v0.2.0

LocalMD v0.2.0 Latest
Latest

Choose a tag to compare

View all tags
@lakshayxi lakshayxi released this 12 Aug 20:40
v0.2.0
89ddc93

LocalMD is now available two ways: in your browser, and as a native macOS application.

macOS (Apple Silicon), unsigned beta

  • Native Open, Save, and Save As, through real macOS dialogs.
  • Native close and quit protection. The red button, Cmd+W, Cmd+Q, and Quit
    all show a native Save / Don't Save / Cancel alert for unsaved work.
    A clean document closes immediately.
  • This build has no Developer ID signature and no Apple notarization. macOS
    Gatekeeper needs one extra step before it opens. Read
    reports/macos/distribution.md
    before you install — it explains the exact steps, including the curl
    download path that skips the Gatekeeper prompt entirely.
  • Download LocalMD_0.2.0_aarch64.dmg below. SHA-256:
    7d4f0ddcf2dfaeb3302f26963d1198de3f69556fa31afe6a29c9025e0323856f

Browser

  • Adds an offline app shell. LocalMD reloads without a network connection
    after your first visit.
  • Adds reader-controlled updates. LocalMD installs a new version only after
    you accept a prompt, never silently.
  • Everything from v0.1.0 continues to work: Read, Edit, Split, save-in-place
    where the browser supports it, draft recovery, external-change protection,
    recents, and multi-tab warnings.
  • Live at https://localmd-12t.pages.dev. No install.

Full detail

Assets 3
Loading

LocalMD v0.1.0

LocalMD v0.1.0

Choose a tag to compare

View all tags
@lakshayxi lakshayxi released this 11 Aug 22:16
v0.1.0
abbe743

Markdown stays local. A browser-based Markdown reader — with editing when you need it — that never sends your document anywhere. No uploads, no accounts, no document backend.

Live: https://localmd-12t.pages.dev

This is the M4 release: open → read → edit → save, end to end.

Highlights

  • Open by picker, drag-and-drop, paste, recent file, or a new blank document. New opens straight into a focused editor.
  • Read CommonMark and GFM — heading links, tables, task lists, footnotes, syntax-highlighted code, KaTeX math, and Mermaid diagrams.
  • Edit in Read, Edit, or Split without losing editor state, with a command palette, keyboard shortcuts, a wide-screen outline, deep links, reading preferences, and print styles.
  • Save back to the file you opened, where the browser allows it; everywhere else the same bytes download. LF/CRLF, a UTF-8 BOM, and the final newline all survive the round trip.
  • Don't lose work. Bounded local drafts with recovery after an interrupted session, a refusal to silently overwrite a file that changed on disk, and a warning when the same file is open in several LocalMD tabs.

Privacy and safety

The guarantee, stated at its true strength — it rests on two layers that are not equally strong:

  1. connect-src 'none', served as a response header (structural). No fetch, XHR, WebSocket, sendBeacon, or EventSource can leave the page, even if a dependency is compromised. Verified against the live origin on every release, not just against the meta tag in the build.
  2. The renderer's image gate (application code). Remote images and media are blocked unless you opt in, per document. img-src https: has to stay permitted for that opt-in to work at all, so this layer is code rather than policy — a bug here could still produce a cross-origin request. It is backed by a test rather than a promise: e2e/privacy.spec.ts asserts zero cross-origin requests against a real production build, on all three browsers, on every commit.

No analytics, no error reporting, no CDN, no third-party runtime dependencies, no upload endpoint, no document backend. Markdown is treated as untrusted input and sanitized against a maintained XSS corpus.

Three standing caveats, unchanged: a remote URL in your own document would make your browser contact that host if you allow it; static hosting sees that you loaded the app, as any website does; and drafts in IndexedDB are not encrypted by us.

Browser save behavior

Browser Behavior
Chrome, Edge (desktop) Save in place after permission; Save As adopts the new file for later saves
Firefox, Safari Download fallback with identical bytes; the UI says Download

Performance and verification

CI runs typecheck, lint, unit tests, the production build with a third-party-URL assertion, the bundle budget, and the full Playwright suite on every push.

  • 215 unit tests, 288 e2e tests across Chromium, Firefox, and WebKit (27 skipped as browser-gated).
  • 25/25 live production checks — CSP directives as actually served, no console errors, zero cross-origin requests, no service worker, the privacy page and its caveats, and remote images withheld.
  • Initial bundle 88.4 KB JS and 9.7 KB CSS gzipped, against 150 KB / 30 KB budgets; 1.7 MB of grammars, diagrams, math, and the editor load only when a document needs them.
  • Strict render budgets on an Apple M4: 104ms for a 45KB README, 458ms for 250KB, 1795ms for a 1MB torture document — with no main-thread task over 50ms.

Known limitations

  • Save-in-place is Chromium-only. Firefox and Safari download instead, because they have no handles for user files.
  • Remote resources stay blocked by default, per document; there is no persisted per-origin allowlist yet.
  • Relative local assets (./diagram.png) do not resolve — that needs folder support, which is not shipped.
  • No offline or PWA support. No service worker is registered, deliberately.
  • Drafts are browser-local, bounded, and best-effort. They are not a backup.
  • The native Edge picker UI was not manually verified on the sign-off machine. Everything downstream of the returned handle is automated against a real Chromium FileSystemFileHandle.

Evidence

Found something broken? https://github.com/lakshayxi/LocalMD/issues

Loading