New zero-dependency package understand-anything-viewer: a small Node
http server with the prebuilt dashboard embedded, replicating the dev
server's endpoints and security model (127.0.0.1 bind, one-time access
token on every data endpoint, graph filePath sanitisation, file-content
allowlist / 1MB cap / binary rejection, .ua with legacy
.understand-anything fallback). npm-packed and attached to each GitHub
release as understand-anything-viewer.tgz, so teammates without Claude
Code open a committed graph with:
npx https://github.com/Egonex-AI/Understand-Anything/releases/latest/download/understand-anything-viewer.tgz <project>
No npm registry publishing involved. End-to-end tests spawn the real
server and cover the token gate, sanitisation, allowlist, traversal
guards, and both data-directory layouts.
Two narrow Karpathy-parser path-resolution gaps degraded valid wikis:
Index.md/Log.md were only detected in lowercase — detect_format,
parse_wiki's index/log selection, and merge-knowledge-graph's
project-name detection now resolve known infra filenames
case-insensitively within their directory (exact lowercase still wins
when both casings exist; no recursive fuzzy matching).
Root index files that link with the article-root prefix included
([[wiki/concepts/Index]] when wiki/ is the detected article root) never
matched article ids relative to that root, so category membership
missed and every node landed in the Other layer. Category lookup and
wikilink resolution now try such targets both as written and with the
root prefix stripped; links outside the article root stay unresolved.
Fixes#342
merge-subdomain-graphs.py silently dropped contains_flow/flow_step/
cross_domain edges whenever an endpoint node wasn't in the merged set,
and the drop detail lived only in the in-process report — since
subdomain graph files are cleaned up after assembly, those hierarchy
edges were gone permanently with no trace.
Structural drops now emit Warning: lines in the merge report, every
dropped edge is persisted to .understand-anything/merge-report.json,
and the next merge run re-injects previously dropped structural edges
so they resolve once the missing endpoint's subdomain has arrived.
Fixes#529
Closes a cluster of community-profile gaps (#248, #249, #251, #252) in one
PR rather than four micro-PRs that all touch the same surface area.
### Templates (#251, #252)
- .github/ISSUE_TEMPLATE/bug_report.yml — required fields for repro
(plugin version, platform, OS, project language, file count); the four
pieces of context that are missing from ~every current bug report.
- .github/ISSUE_TEMPLATE/feature_request.yml — leads with the *problem*
rather than the proposed solution, which keeps maintainer review focused
on whether to solve, not just how.
- .github/ISSUE_TEMPLATE/question.yml — separate from bug to keep the
bug queue triagable.
- .github/ISSUE_TEMPLATE/config.yml — disables blank issues and routes
general discussion to README + Discussions.
- .github/PULL_REQUEST_TEMPLATE.md — includes the version-bump checklist
that CLAUDE.md says must stay in sync across 5 manifests; otherwise
every contributor learns this rule by getting their PR bounced.
### Community files
- CODE_OF_CONDUCT.md — short, project-specific document that names the
expectations and reporting path. Not a verbatim Contributor Covenant
to keep it readable.
- SECURITY.md — describes the project's local-only threat model
explicitly so reporters know what's in / out of scope before they
spend time on a writeup. Points at GitHub private vulnerability
reporting as the primary channel.
### CI (#249)
- ci.yml now also runs on pushes to main, not only PRs. Without this,
a direct push to main (which happens when maintainers merge a PR
branch locally) doesn't trigger CI, so a regression can land green-
looking and stay broken for days.
- Added a concurrency group that cancels stale runs for the same ref.
Saves runner minutes and keeps the per-ref status meaningful.
- Used `github.ref` (a controlled value), not user-controlled input,
so no script-injection surface.
### package.json (#248)
- Added description, license, repository, bugs, homepage, keywords —
the standard set for npm package discoverability and so GitHub's
community-profile check shows the project at 100%.
- typescript-eslint preset: strict -> recommended for a usable first-pass
baseline (per PR discussion); ratchet up in a follow-up.
- Drop the projectService/parserOptions block. Neither `recommended` nor
`strict` is type-aware, so it was unused; removing it also avoids the
pnpm-workspace tsconfig-resolution failure mode flagged in review.
- Add Node + browser globals via the `globals` package so .mjs scripts and
the dashboard stop hitting `no-undef`.
- Expand ignores: built bundles (**/public/**), Astro generated (.astro/),
and .private/ (eval scratch). Cuts 2400+ errors in vendored output.
- Allow `_`-prefixed unused vars/args/caught errors; skip irregular
whitespace inside comments (json-parser intentionally embeds ZWSP-escaped
block-comment examples in JSDoc).
- Fix the residual 13 genuine errors: drop dead imports/vars, replace
two `as any[]` in schema.ts with `Array<Record<string, unknown>>`,
drop unused destructure in change-classifier, drop unused catch binding
in extract-structure.mjs.
- Add EOF newline to eslint.config.mjs.
- Refresh pnpm-lock.yaml.
- Add `pnpm lint` step to .github/workflows/ci.yml so the tooling
actually enforces something.
pnpm lint now exits 0 locally; 33+13 test files / 1445 tests still pass.
- Replace static overview.png with two animated GIFs (structural + domain views)
- Reorder READMEs: Features section before Quick Start
- Remove redundant sections (Why, Who is this for, duplicate feature entries)
- Move project structure/tech stack/dev commands to CONTRIBUTING.md
- Homepage: use Supabase-hosted MP4 videos via GitHub variables, GIF fallback
- Add DEMO_STRUCTURAL_VIDEO_URL and DEMO_DOMAIN_VIDEO_URL to deploy workflow
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a demo mode to the dashboard that fetches graph data from Supabase
Storage instead of the local Vite dev server, bypasses the token gate,
and deploys alongside the homepage at /Understand-Anything/demo/.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Runs on every pull_request: builds core and skill packages (which also
serves as TypeScript type-check), then runs all Vitest tests.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Lum1104