Shelf v0.4.1

Shelf v0.4.1

Shelf v0.4.1 is a security hardening and performance optimization update. It addresses findings from the security audit, optimizes page tree traversals and database operations, refactors the state management layer, and refines the build bundle hygiene.

Changes

• Security Hardening:

  • Remediated database and WAL sidecar permissions to strict 0o600 (L2).
  • Hardened dynamic KaTeX formula rendering by locking trust: false against adversarial XSS injection (L1).
  • Scoped Content Security Policy connect-src header dynamically to the exact ephemeral port bound by the local Studio PDF server (L3).
  • Documented macOS ad-hoc library validation constraints (M2).
  • Cleaned up build bundle hygiene by filtering out dev files, lockfiles, and configs from the released bundle (M1).

• Performance Optimizations:

  • Optimized page tree traversals (visible page lookups, descendant scans, and page move validations) from quadratic $O(n²)$ to linear $O(n)$ using parent-children index maps.
  • Eliminated redundant page re-renders in the Sidebar and Command Palette by wrapping Zustand store selectors in useShallow.
  • Consolidated sequential column writes in updatePage into a single dynamic SQLite UPDATE query.
  • Reduced Electron IPC message size by omitting large page text/content when querying Studio page links.
  • Bypassed costly JSON.parse operations and exceptions for plain-text search results in page preview queries.
  • Pre-computed sorting maps in database row tables, reducing JSON parsing complexity from $O(n \log n)$ to $O(n)$.

• Refactoring & Architecture:

  • Decomposed the monolith useAppStore into focused slices (pagesSlice, studioSlice, profileSlice, sharedSlice) to improve code health and modularity.
  • Replaced the new page icon in the sidebar nav with a cleaner Lucide SquarePen icon.

Tester Notes

Ensure the application launches correctly and runs cold startup within budget. Verify that large documents (800+ pages) and search results render instantly without UI lag.