Feature/document viewer

.claude/commands/changelog.md

@@ -0,0 +1,26 @@
+Run `git diff HEAD` and `git diff --cached` to see all uncommitted changes (staged and unstaged). Analyze the diffs to understand what was changed, then update the changelog accordingly.
+
+## Where to add entries
+
+There are two files that must stay in sync:
+
+1. **In-app changelog:** `src/app/components/welcome-modal/changelog.ts` — add lines to the current version's `items` array in the appropriate section (`New Features`, `Improvements`, or `Bug Fixes`)
+2. **Markdown changelog:** `changelog/v{version}.md` — add matching lines under the same section heading
+
+## When to add to the existing version vs create a new one
+
+- **Add to the current version** when the changes are part of ongoing work for that release — bug fixes, tweaks, new features that haven't been shipped yet. Check `APP_VERSION` in `changelog.ts` to see the current version.
+- **Create a new version** only when the user explicitly asks to bump the version, or when changes are being made after a release has already been shipped/tagged. To create a new version:
+  1. Bump `APP_VERSION` in `changelog.ts`
+  2. Add a new entry at the top of the `CHANGELOG` array
+  3. Create a new `changelog/v{version}.md` file
+
+## Entry format
+
+- Keep entries concise — one line per change
+- Use action verbs: "Added ...", "Fixed ...", "Improved ...", etc.
+- Categorize correctly:
+  - **New Features**: entirely new functionality
+  - **Improvements**: enhancements to existing features, UI polish, performance
+  - **Bug Fixes**: corrections to broken behavior
+- Don't duplicate entries that already exist in the changelog

.devcontainer/Dockerfile

@@ -0,0 +1,102 @@
+FROM node:20
+
+ARG TZ
+ENV TZ="$TZ"
+
+ARG CLAUDE_CODE_VERSION=latest
+
+# Install basic development tools and iptables/ipset
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  less \
+  git \
+  procps \
+  sudo \
+  fzf \
+  zsh \
+  man-db \
+  unzip \
+  gnupg2 \
+  iptables \
+  ipset \
+  iproute2 \
+  dnsutils \
+  aggregate \
+  jq \
+  nano \
+  vim \
+  && apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# Ensure default node user has access to /usr/local/share
+RUN mkdir -p /usr/local/share/npm-global && \
+  chown -R node:node /usr/local/share
+
+ARG USERNAME=node
+
+# Persist bash history.
+RUN SNIPPET="export PROMPT_COMMAND='history -a' && export HISTFILE=/commandhistory/.bash_history" \
+  && mkdir /commandhistory \
+  && touch /commandhistory/.bash_history \
+  && chown -R $USERNAME /commandhistory
+
+# Set `DEVCONTAINER` environment variable to help with orientation
+ENV DEVCONTAINER=true
+
+# Create workspace and config directories and set permissions
+RUN mkdir -p /workspace /home/node/.claude && \
+  chown -R node:node /workspace /home/node/.claude
+
+WORKDIR /workspace
+
+ARG GIT_DELTA_VERSION=0.18.2
+RUN ARCH=$(dpkg --print-architecture) && \
+  wget "https://github.com/dandavison/delta/releases/download/${GIT_DELTA_VERSION}/git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb" && \
+  sudo dpkg -i "git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb" && \
+  rm "git-delta_${GIT_DELTA_VERSION}_${ARCH}.deb"
+
+# Set up non-root user
+USER node
+
+# Install global packages
+ENV NPM_CONFIG_PREFIX=/usr/local/share/npm-global
+ENV PATH=$PATH:/usr/local/share/npm-global/bin
+
+# Set the default shell to zsh rather than sh
+ENV SHELL=/bin/zsh
+
+# Set the default editor and visual
+ENV EDITOR=nano
+ENV VISUAL=nano
+
+# Default powerline10k theme
+ARG ZSH_IN_DOCKER_VERSION=1.2.0
+RUN sh -c "$(wget -O- https://github.com/deluan/zsh-in-docker/releases/download/v${ZSH_IN_DOCKER_VERSION}/zsh-in-docker.sh)" -- \
+  -p git \
+  -p fzf \
+  -a "source /usr/share/doc/fzf/examples/key-bindings.zsh" \
+  -a "source /usr/share/doc/fzf/examples/completion.zsh" \
+  -a "export PROMPT_COMMAND='history -a' && export HISTFILE=/commandhistory/.bash_history" \
+  -x
+
+# Install mise (runtime version manager)
+RUN curl https://mise.run | sh && \
+  echo 'eval "$(~/.local/bin/mise activate zsh)"' >> ~/.zshrc && \
+  echo 'eval "$(~/.local/bin/mise activate bash)"' >> ~/.bashrc
+ENV PATH="/home/node/.local/share/mise/shims:/home/node/.local/bin:$PATH"
+
+# Disable git push (block pushing over both HTTPS and SSH)
+RUN git config --global --add safe.directory /workspace && \
+  printf '#!/bin/sh\necho "git push is disabled in this devcontainer." >&2\nexit 1\n' > /home/node/.local/bin/git-push-blocked && \
+  chmod +x /home/node/.local/bin/git-push-blocked && \
+  git config --global alias.push '!git-push-blocked'
+
+# Install Claude
+RUN npm install -g @anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}
+
+
+# Copy and set up firewall script
+COPY init-firewall.sh /usr/local/bin/
+USER root
+RUN chmod +x /usr/local/bin/init-firewall.sh && \
+  echo "node ALL=(root) NOPASSWD: /usr/local/bin/init-firewall.sh" > /etc/sudoers.d/node-firewall && \
+  chmod 0440 /etc/sudoers.d/node-firewall
+USER node

.devcontainer/devcontainer.json

@@ -0,0 +1,56 @@
+{
+  "name": "Claude Code Sandbox",
+  "build": {
+    "dockerfile": "Dockerfile",
+    "args": {
+      "TZ": "${localEnv:TZ:America/Los_Angeles}",
+      "CLAUDE_CODE_VERSION": "latest",
+      "GIT_DELTA_VERSION": "0.18.2",
+      "ZSH_IN_DOCKER_VERSION": "1.2.0"
+    }
+  },
+  "runArgs": [
+    "--cap-add=NET_ADMIN",
+    "--cap-add=NET_RAW"
+  ],
+  "customizations": {
+    "vscode": {
+      "extensions": [
+        "anthropic.claude-code",
+        "dbaeumer.vscode-eslint",
+        "esbenp.prettier-vscode",
+        "eamodio.gitlens"
+      ],
+      "settings": {
+        "editor.formatOnSave": true,
+        "editor.defaultFormatter": "esbenp.prettier-vscode",
+        "editor.codeActionsOnSave": {
+          "source.fixAll.eslint": "explicit"
+        },
+        "terminal.integrated.defaultProfile.linux": "zsh",
+        "terminal.integrated.profiles.linux": {
+          "bash": {
+            "path": "bash",
+            "icon": "terminal-bash"
+          },
+          "zsh": {
+            "path": "zsh"
+          }
+        }
+      }
+    }
+  },
+  "remoteUser": "node",
+  "mounts": [
+    "source=claude-code-bashhistory-${devcontainerId},target=/commandhistory,type=volume",
+    "source=claude-code-config-${devcontainerId},target=/home/node/.claude,type=volume"
+  ],
+  "containerEnv": {
+    "NODE_OPTIONS": "--max-old-space-size=4096",
+    "CLAUDE_CONFIG_DIR": "/home/node/.claude",
+    "POWERLEVEL9K_DISABLE_GITSTATUS": "true"
+  },
+  "workspaceMount": "source=${localWorkspaceFolder},target=/workspace,type=bind,consistency=delegated",
+  "workspaceFolder": "/workspace",
+  "postStartCommand": "echo 'Dev container ready.'"
+}

.devcontainer/init-firewall.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+set -euo pipefail  # Exit on error, undefined vars, and pipeline failures
+IFS=$'\n\t'       # Stricter word splitting
+
+# 1. Extract Docker DNS info BEFORE any flushing
+DOCKER_DNS_RULES=$(iptables-save -t nat | grep "127\.0\.0\.11" || true)
+
+# Flush existing rules and delete existing ipsets
+iptables -F
+iptables -X
+iptables -t nat -F
+iptables -t nat -X
+iptables -t mangle -F
+iptables -t mangle -X
+ipset destroy allowed-domains 2>/dev/null || true
+
+# 2. Selectively restore ONLY internal Docker DNS resolution
+if [ -n "$DOCKER_DNS_RULES" ]; then
+    echo "Restoring Docker DNS rules..."
+    iptables -t nat -N DOCKER_OUTPUT 2>/dev/null || true
+    iptables -t nat -N DOCKER_POSTROUTING 2>/dev/null || true
+    echo "$DOCKER_DNS_RULES" | xargs -L 1 iptables -t nat
+else
+    echo "No Docker DNS rules to restore"
+fi
+
+# First allow DNS and localhost before any restrictions
+# Allow outbound DNS
+iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
+# Allow inbound DNS responses
+iptables -A INPUT -p udp --sport 53 -j ACCEPT
+# Block outbound SSH (prevents git push over SSH)
+iptables -A OUTPUT -p tcp --dport 22 -j REJECT
+# Allow localhost
+iptables -A INPUT -i lo -j ACCEPT
+iptables -A OUTPUT -o lo -j ACCEPT
+
+# Create ipset with CIDR support
+ipset create allowed-domains hash:net
+
+# Resolve and add allowed domains
+for domain in \
+    "registry.npmjs.org" \
+    "api.anthropic.com" \
+    "sentry.io" \
+    "statsig.anthropic.com" \
+    "statsig.com" \
+    "marketplace.visualstudio.com" \
+    "vscode.blob.core.windows.net" \
+    "update.code.visualstudio.com"; do
+    echo "Resolving $domain..."
+    ips=$(dig +noall +answer A "$domain" | awk '$4 == "A" {print $5}')
+    if [ -z "$ips" ]; then
+        echo "ERROR: Failed to resolve $domain"
+        exit 1
+    fi
+
+    while read -r ip; do
+        if [[ ! "$ip" =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
+            echo "ERROR: Invalid IP from DNS for $domain: $ip"
+            exit 1
+        fi
+        echo "Adding $ip for $domain"
+        ipset add allowed-domains "$ip"
+    done < <(echo "$ips")
+done
+
+# Get host IP from default route
+HOST_IP=$(ip route | grep default | cut -d" " -f3)
+if [ -z "$HOST_IP" ]; then
+    echo "ERROR: Failed to detect host IP"
+    exit 1
+fi
+
+HOST_NETWORK=$(echo "$HOST_IP" | sed "s/\.[0-9]*$/.0\/24/")
+echo "Host network detected as: $HOST_NETWORK"
+
+# Set up remaining iptables rules
+iptables -A INPUT -s "$HOST_NETWORK" -j ACCEPT
+iptables -A OUTPUT -d "$HOST_NETWORK" -j ACCEPT
+
+# Set default policies to DROP first
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT DROP
+
+# First allow established connections for already approved traffic
+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+# Then allow only specific outbound traffic to allowed domains
+iptables -A OUTPUT -m set --match-set allowed-domains dst -j ACCEPT
+
+# Explicitly REJECT all other outbound traffic for immediate feedback
+iptables -A OUTPUT -j REJECT --reject-with icmp-admin-prohibited
+
+echo "Firewall configuration complete"
+echo "Verifying firewall rules..."
+if curl --connect-timeout 5 https://example.com >/dev/null 2>&1; then
+    echo "ERROR: Firewall verification failed - was able to reach https://example.com"
+    exit 1
+else
+    echo "Firewall verification passed - unable to reach https://example.com as expected"
+fi
+
+# Verify Anthropic API access
+if ! curl --connect-timeout 5 https://api.anthropic.com >/dev/null 2>&1; then
+    echo "ERROR: Firewall verification failed - unable to reach https://api.anthropic.com"
+    exit 1
+else
+    echo "Firewall verification passed - able to reach https://api.anthropic.com as expected"
+fi

CLAUDE.md

@@ -1,12 +1,5 @@
 # Project Instructions for Claude
 
-## Changelog Policy
-After every code change, update the changelog:
-- **In-app changelog:** `src/app/components/welcome-modal/changelog.ts` — add a line to the current version's items array
-- **Markdown changelog:** `changelog/v{version}.md` — add a matching line
-- If the change warrants a new version, bump `APP_VERSION` in `changelog.ts`, create a new `changelog/v{version}.md` file, and add a new entry to the `CHANGELOG` array
-- Keep entries concise (one line per change)
-
 ## Testing
 - Run tests with `npm test` after changes
 - When creating or significantly modifying a component/service, add or update tests to maintain coverage

changelog/v0.6.0.md

@@ -16,3 +16,10 @@
 - Middle-click table rows to open document in a new tab
 - Default columns for new users: Ticker, Form, Company, Tags, Description, Date Filed, Size
 - Table cell text vertically centered in rows
+- Document viewer settings dropdown with Experimental Viewer and Page View toggles, persisted via Strings API
+- Page View mode centers documents in a max-width container with responsive margins for readability on wide screens
+- Fixed browser back button navigating within iframe instead of returning to filings
+- Fixed document viewer page mode content collapsing to a short height instead of filling the viewport
+- Fixed white bars appearing on sides of document in experimental viewer with page view mode
+- Moved viewer settings (Styled/Page toggles) from dropdown menu to inline toggle buttons in the top bar
+- Styled viewer strips inline font declarations from SEC HTML for consistent app typography and larger text

src/app/components/welcome-modal/changelog.ts

@@ -30,6 +30,13 @@ export const CHANGELOG: ChangelogEntry[] = [
           'Middle-click table rows to open document in a new tab',
           'Default columns for new users: Ticker, Form, Company, Tags, Description, Date Filed, Size',
           'Table cell text vertically centered in rows',
+          'Document viewer settings dropdown with Experimental Viewer and Page View toggles, persisted via Strings API',
+          'Page View mode centers documents in a max-width container with responsive margins for readability on wide screens',
+          'Fixed browser back button navigating within iframe instead of returning to filings',
+          'Fixed document viewer page mode content collapsing to a short height instead of filling the viewport',
+          'Fixed white bars appearing on sides of document in experimental viewer with page view mode',
+          'Moved viewer settings (Styled/Page toggles) from dropdown menu to inline toggle buttons in the top bar',
+          'Styled viewer strips inline font declarations from SEC HTML for consistent app typography and larger text',
         ],
       },
     ],