lantern: 0.1.1 — lantern://local file serving, faster read-dir, hardened asset resolver

Changed

 RELEASES.md | 17 +++++++++++++++++
 package.sgl |  2 +-
 2 files changed, 18 insertions(+), 1 deletion(-)

Diff

RELEASES.mdmodified

@@ -17,6 +17,23 @@ slug: releases

# Lantern Releases

+20

## 0.1.1

+21

+22

Better file handling for local apps: a new `lantern://local/` route streams a real file's bytes straight to the page instead of inlining them as a base64 data URI, and large directory listings return about twice as fast. Existing projects build without changes.

+23

+24

### Stream local files to the page over `lantern://local/`

+25

+26

An app can now hand the webview a real file to load by URL. `fs.serve-file` registers a file the page is allowed to read and returns an opaque handle, and the page loads its bytes with `<img src="lantern://local/<handle>">` (or any element that takes a URL). That replaces the old base64 data URI approach, which inflated every file by a third and pushed one giant string through the DOM. Slate's new image viewer uses this to show a picture the moment you open it. The route is handle-scoped: it serves only files an app explicitly registered through the grant-checked `fs.serve-file`, so it can never become an arbitrary full-disk read, and it adds no authority beyond the `fs.read-file` you already had.

+27

+28

### Directory listings about twice as fast

+29

+30

`fs.read-dir` now returns its listing over the bulk data channel instead of encoding it as JSON on the host. The old path did per-character string work that grew quadratically with the listing, so a 600-file folder spent roughly 359ms of a 607ms call just on the encode. The new path is a single linear pass, and the same folder now lists in about 288ms. Folder browsing and image paging in Slate feel noticeably snappier.

+31

+32

### A hardened asset path resolver

+33

+34

The `lantern://` asset resolver now strips all leading slashes from a request path before resolving it. A crafted path with a leading slash could previously leave an absolute remainder that resolved off the asset root, and that case is now closed and covered by a test. This only touches the app's own asset origin: the file-serving route above was handle-scoped from the start.

+35

+36

## 0.1.0

The first release. Point Lantern at a Sigil web build and get a native desktop app: a real window, a secure JavaScript to Sigil bridge, and optional local filesystem and terminal access, built all the way down in Sigil over sigil-ffi. No Rust, no Node, no C glue. Linux-first, on GTK4 and WebKitGTK, with the backend interface leaving room for macOS and Windows later.

package.sglmodified

@@ -14,7 +14,7 @@

(workspace

name: "lantern"

−17

version: "0.1.0"

+17

version: "0.1.1"

description: "A Sigil-native desktop wrapper for web apps"

url: "https://codeberg.org/sigil/lantern"

license: "BSD-3-Clause"