v0.9.0

New: publish to Vercel. tdoc now has a second publish target alongside Cloudflare.

Added

• Vercel publish target — tdoc publish --platform vercel <slug> deploys the same worker to a Vercel Function (docs → Vercel Blob, metadata/comments → Upstash Redis). Cloudflare stays the default and existing users are unaffected — the platform is chosen once on first publish. Known Vercel tradeoffs (no per-doc comment-write serialization; ~4.5 MB upload cap) are documented in vercel/README.md. Contributed by @julies-claw (#76). 🎉

Fixed

• Vercel sessions now expire — the Upstash KV shim dropped the worker's expirationTtl, so login sessions on Vercel never expired (unbounded key growth + no server-side expiry). The shim now forwards the TTL, matching Cloudflare KV (#77).

Full notes: CHANGELOG.md

🤖 Generated with Claude Code

v0.8.1

Fable code audit of the v0.8.0 pins release — a fresh-engine pass over the new comment-pins feature, every finding adversarially verified (16 confirmed).

Fixed

• Comments/replies could be lost silently. A comment or reply the server rejected (any error, or a network blip) cleared your text as if it saved. Now it shows the error and keeps your text.
• Reactions leaked across versions (local dev server). Older versions of a doc showed the agent's resolved emoji (✅/🟡/❓) even where the comment was still open, and replies appeared on versions before they were written. The per-version fold now scopes both correctly, matching the hosted worker.
• Anchor-click could fire repeatedly — clicking a comment's anchored image/chart could trigger its card many times (a listener stacked up on every refresh). One handler now.
• Pinned card lost its selected state after a refresh (highlight + "move anchor" gone). Restored.

Internal

• The v0.8.0 pin layout (clustering / spreading / overflow-fold) now has unit tests guarding against regressions.
• Small performance and dead-code cleanups.

Full notes: CHANGELOG.md

🤖 Generated with Claude Code

v0.8.0

Comment margin redesign: pins instead of a card stack. The right gutter can no longer overflow ("拍不下") no matter how many comments a doc has. Built behind a full scenario audit (88 scenarios, every gap adversarially verified) and confirmed in a real browser.

Added — pins in the margin (wide mode)

• The right gutter now shows one avatar pin per comment (green ✓ ring when resolved) instead of a column of full cards. The full card floats open on hover and stays open (pinned) on click; click-outside, a second click, or Esc closes it. Floating cards cap at 70vh with internal scroll.
• Same-line comments merge into a count badge that opens a list popover (mouse or keyboard). Clustering only fires for genuinely co-located comments — otherwise pins spread apart and show individually as long as there's room; a dense page folds the overflowing tail into one badge so the column still can't overflow.
• Narrow/mobile is unchanged: comments still flow in the bottom drawer.

Fixed

• Resolved comments no longer leave an in-text anchor — addressed comments drop the gold highlight + dashed marker while keeping their margin card and "✓ fixed · vN" chip; replies collapsed by default.
• A reply/react/re-anchor no longer makes the open card vanish — the refresh those actions trigger now preserves and restores the pinned card.
• Pin avatars are no longer treated as commentable artifacts — hovering a pin no longer pops the "comment on this image" pill over tdoc's own UI.
• Cluster popover clamped to the viewport + keyboard-navigable; broken avatars fall back to a placeholder; a flipped-up card clears the old-version strip.

Full notes: CHANGELOG.md

v0.7.11

Dual-engine code audit (Codex + Claude subagents, every finding adversarially verified). Both engines independently flagged the same top issues. Real data-loss + security fixes — marketplace installs (pinned to the manifest version) should update.

Fixed — data loss

• Reactions silently disappeared on a normal toggle. A reaction's event id baked in add-vs-remove, so add → remove → add folded to a stale "removed" and the reaction vanished. The id also omitted the version, so the same reaction across document versions clobbered each other. Fixed with one version-scoped id shared by add+remove; reactions stored before this release migrate automatically.

Fixed — security

• Comment anchor could hijack rendering (verified in a real browser). A stored anchor id was interpolated into a CSS selector, so a crafted id from a signed-in commenter could anchor a comment onto <body> or throw an error that broke comment rendering for everyone. Anchors now match by attribute equality — no selector is ever built from stored data.
• CLI slug path traversal — tdoc publish/pull/unpublish now validate the slug (kebab-case) before it's used in a path or URL, so a .. slug can't escape the tdoc directory.
• Hardening: server-side slug/version validation before storage keys; reserved object keys rejected as emoji; constant-time upload-token check; sign-in modal escapes its values and only opens https github.com URLs; published.json created 0600 from the start.

Fixed — robustness

• Comment refresh survives an API error body; reaction clicks re-auth on expired sessions and surface failures; sign-in handles network/edge errors; text highlights re-anchor correctly without the CSS Custom Highlight API; tdoc update --check reports the real commit count.

Full notes: CHANGELOG.md

🤖 Generated with Claude Code

v0.7.10

Releases four user-facing fixes that were sitting unreleased on main since 0.7.9. Most relevant if you installed via the plugin marketplace — those installs are pinned to the manifest version, so you were stuck on the buggy 0.7.9 until now. (Git-clone users already had these via main.)

Fixed

• Plugin manifest rejected at startup (#42) — plugin.json's repository used the npm {type, url} object form; Claude Code requires a string URL and threw a validation error on every launch. Flattened to a string.
• /plugin marketplace add failed (#36) — marketplace.json was missing the required owner object. Added it; also dropped a stale per-plugin version pin that silently froze marketplace users on an old version.
• publish aborted on modern macOS wrangler (#37) — the CLI hardcoded the legacy ~/.wrangler token path; wrangler 4.x stores it under ~/Library/Preferences/.wrangler. Now resolves the token in wrangler's own precedence, honors CLOUDFLARE_API_TOKEN/CF_API_TOKEN, and doctor reports publish_token_ok instead of falsely saying "logged in."
• Dead Cloudflare onboarding link (404) (#38) — updated to ?to=/:account/workers-and-pages everywhere it was emitted.

Engineering (no behavior change)

Manifest schema + version-drift CI guard (kills the #36/#42 bug class), supply-chain hardening (SHA-pinned actions, least-privilege, ShellCheck), SECURITY.md, CODEOWNERS, issue/PR templates, CodeQL, and Dependabot for GitHub Actions.

Full notes: CHANGELOG.md

🤖 Generated with Claude Code

tdoc v0.7.9 — clear native selection after commenting

Fixes a confusing visual bug when commenting on selected text.

Reported: select one line, comment on it, and afterward that line plus everything below appears highlighted (worst across table cells).

Root cause was not the comment anchor — that's correct (the stored anchor and the highlight range are exactly the selected text). It was the browser's native text selection lingering after submit: closePopup() cleared the pending tdoc highlight but never called getSelection().removeAllRanges(), so the OS selection stayed painted over the doc until you clicked elsewhere.

Fix: closePopup() now clears the native selection too — one place, covering submit / cancel / Esc / click-away. Verified no regression to existing anchor highlights.

🤖 Generated with Claude Code

tdoc v0.7.8 — template restyle, identity health checks, table layout

Three improvements that landed since v0.7.7. Worker already deployed.

Default doc template restyled to match Claude Code's markdown rendering

• Tables: rounded cells with white gutters (border-collapse: separate) instead of bottom-border rows
• Task lists: circle checkboxes
• Blockquote: soft gray bar + gray text (was black bar)
• Pre: rounded bordered panel (was left-rule slab)
• Headings: larger h1/h2, tighter letter-spacing

Identity-verifying health checks

A foreign local service can squat tdoc's port (seen in the wild: another daemon bound 7878) and answer 200 on /api/ping, making ping-based health checks false-positive and routing local doc URLs to the wrong service. /api/ping (local server + worker) now returns {ok, service: 'tdoc'} — the service field is the identity marker — and tdoc-new distinguishes tdoc-up / port-free / port-squatted and honors TDOC_PORT.

Desktop table layout fix

display:block on a <table> discards real table layout (uneven rows/gaps on some engines, reported on a published doc). The responsive overflow fallback is now scoped to max-width:760px, so desktop always gets true table layout.

🤖 Generated with Claude Code

tdoc v0.7.7 — Codex compatibility + version sync

No worker/runtime change — no redeploy. Rolls up the v0.7.6 work (whose GitHub release was never cut) plus a version-drift cleanup.

Codex compatibility (from v0.7.6, additive — Claude Code path unchanged)

• The skill is host-aware: AskUserQuestion (used only for first-run telemetry consent) falls back to plain-text prompts when not available; setup resolves the skill dir for ~/.claude/skills/tdoc or ~/.codex/skills/tdoc (TDOC_SKILL_DIR override).
• README: honest framing — first-class Claude Code, runs under Codex — plus a 'Using tdoc with Codex' section documenting the install location and the one rough edge (no native /tdoc slash-command registration on Codex).

Version sync (v0.7.7)

• plugin.json was frozen at 0.1.44 (marketplace would advertise a stale version) → synced to 0.7.7.
• README telemetry example skill_version 0.1.66 → 0.7.7.

🤖 Generated with Claude Code

tdoc v0.7.5 — DO data-integrity fixes (Codex review)

An independent Codex review of the Durable Object work returned NOT SAFE. All six findings verified and fixed; worker redeployed.

P1 (data loss):

• Read-side first-touch migration was non-transactional — a concurrent mutation could be clobbered by a read writing back stale state. Reads now resolve inside a storage transaction.
• /api/doc DELETE wiped only the KV mirror, leaving canonical DO storage — delete-then-recreate resurrected old comments. Now wipes through the DO. Verified: recreate → 0 resurrected.

P2:

• Removed the post-commit KV mirror (could finish out of order and silently lose a committed update; never a reliable fallback). DO storage is the sole source of truth.
• Corrupt stored value now fails CLOSED (409, bytes preserved) instead of silently migrating to [] and overwriting recoverable data.

P3:

• Reaction labels escaped in the fork/export banner + overlay chip.
• Upload requires html to be a string (was a generic 500).

Re-verified live: 8 real comments intact, 25-way concurrency 0 lost, delete→recreate 0 resurrected, non-string html → 400.

🤖 Generated with Claude Code

tdoc v0.7.4 — docs refreshed

Docs-only. No worker/runtime change.

README + CONTRIBUTING brought current through v0.7.3:

• Reframed as "Google Docs for markdown, with your agent as collaborator" — multiplayer comments, status sync, version history, CLI.
• Documented shipped-but-undocumented features: Durable Object per-doc comment serialization (#34), cross-version comment preservation (#11), old-version banner, XSS hardening (#33). New Version history + Reliability sections.
• Added an honest Roadmap (not built yet) section (suggestion mode, edit mode, collaborative editing, track-changes) so the feature list doesn't overclaim.
• Fixed the stale Testing section (now npm test / npm run test:all).

🤖 Generated with Claude Code