# v0.3.0

**Released:** 2026-06-07

Changes since v0.2.0 (`61d00bd`..`e924858`).

## Features

- **Wikilinks and backlinks** (PR #62 by @HugoluizMTB): `[[Note Title]]` syntax renders as a link to the matching note, and each note shows the other notes that link to it.

- **Fish shell support** (PR #70 by @rafaeloledo): The `fed` / `fed-update` / `fed-stop` helpers are now available for fish in `~/.config/frankmd/fed.fish`, with full parity to the bash version (browser detection, env-var forwarding, images-mount lookup).

- **Custom Hugo frontmatter template** (closes #69): Drop a `.hugo_template.md` file at the notes root to fully customize the generated frontmatter. Placeholders `{{title}}`, `{{slug}}`, and `{{date}}` are substituted on each new post. Falls back to the built-in template when absent.

- **Hugo flat path style**: New `hugo_path_style = flat` config option to keep all posts as `slug.md` in the current folder instead of the nested `YYYY/MM/DD/slug/index.md` structure.

- **Configurable Thruster ports** (PR #43 by @rafaself): `THRUSTER_TARGET_PORT` and `EXTERNAL_PORT` are honored by the Docker entrypoint and compose setup.

- **Copy button on code blocks** in preview mode.

- **AI-assisted contributions guide**: New `AGENTS.md` and `CLAUDE.md` documenting the architecture, conventions, and rules for AI-assisted work in this repo.

## Bug Fixes

- **macOS browser auto-detection** (PR #89, fixes #86 reported by @matheus-rodrigues00): `fed` now also looks up `.app` bundles under `/Applications/` on macOS in the same priority order as the Linux PATH probe. `FRANKMD_BROWSER` also accepts a full executable path.

- **Saving failed (422) over Cloudflare Tunnel** (fixes #63 reported by @davidvidmar): Rails' `forgery_protection_origin_check` compared the browser's `https://` Origin against the `http://` base URL it computed behind the SSL-terminating proxy, rejecting every save even though the CSRF token was present and valid. Disabled the origin check in production; the CSRF token itself still protects writes.

- **Hugo template emitted a stray hyphen** (fixes #69): The generated frontmatter had `tags:` followed by a bare `-`, a null YAML list entry that breaks Hugo. Now emits the valid empty list `tags: []`.

- **Broken symlinks in notes directory caused 500**: A dangling symlink (e.g. a file linked to a path that doesn't exist inside the container) made `NotesService#build_tree` raise `Errno::ENOENT` from `File.mtime`, taking down every page that listed the tree. Filter children through `exist?` so a single broken link no longer takes the whole site down.

- **Image and asset files in notes directory not served in preview**: Preview now reads image and asset files alongside markdown.

- **Occurrence highlighting confusing with multi-selection**.

- **Active line highlight persisting when editor loses focus**.

- **Ollama models failing with ModelNotFoundError**.

- **Folder images appearing grayed out and unselectable in image picker**.

- **Controller `config` action overrode Rails internals**: Renamed to avoid the collision.

- **Omarchy README links fixed** (PR #45 by @matheusdcunha).

## Refactor

- **Image generation moved to RubyLLM + OpenRouter**: Replaced direct Gemini HTTP calls with RubyLLM through OpenRouter for image generation, with a small monkey-patch to surface the OpenRouter response shape.

## Security

- Cleared transitive CVEs for `addressable` (ReDoS), `erb` (deserialization guard bypass), `faraday` and `faraday-net_http` (protocol-relative URI host-scoping bypass), and `net-imap` (SCRAM iteration DoS, STARTTLS stripping, command-injection via raw / Symbol arguments). All bumped to patched versions.

## Dependencies

- Rails 8.1.3
- puma 7.2.0 -> 8.0.2 (with an explicit `bind "tcp://0.0.0.0:..."` in `config/puma.rb` so Thruster and Docker keep working regardless of puma 8's IPv6-by-default behavior)
- ruby_llm 1.14.1 -> 1.15.0
- thruster 0.1.20 -> 0.1.21
- aws-sdk-s3 1.218.0 -> 1.225.0
- bootsnap 1.23.0 -> 1.24.6
- jbuilder 2.14.1 -> 2.15.1
- propshaft 1.3.1 -> 1.3.2
- selenium-webdriver 4.41.0 -> 4.44.0
- addressable 2.8.9 -> 2.9.0, erb 6.0.2 -> 6.0.4, faraday 2.14.1 -> 2.14.2, faraday-net_http 3.4.2 -> 3.4.4, net-imap 0.6.3 -> 0.6.4 (transitive, security)

## Infrastructure

- `bin/deploy` script for one-command production deploys (build + push + restart).
- `.lobster/` agent artifacts gitignored.

## Test Coverage

- 449 Ruby tests, 1,393 JavaScript tests (1,842 total)