The onchange handler used `new URL(location)`. Inline event handler
attributes execute inside an implicit `with(document){...}` scope, and
`document.URL` is a built-in string property — so the bare `URL`
identifier resolved to that string instead of the global URL
constructor, throwing "URL is not a constructor" on every change.
The error wasn't visible anywhere in the UI, so the dropdown appeared
to update (its own selected option changed) while the page silently
never navigated, and a reload reverted it to the default.
Fix: reference `window.URL` explicitly to bypass the shadowing.
Verified the dropdown now actually re-sorts the sidebar and the
change survives a reload on both the Links and Prompts pages.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Kategorien and Hersteller/Quellen lists were hardcoded to sort by
count descending. Add a small dropdown (Name A-Z / Anzahl) above the
lists on both the Links and Prompts pages, backed by a new facet_sort
query param plumbed through facets()/prompt_facets(). Defaults to
alphabetical, which was the actual ask; count sort stays available
for anyone who preferred the old behavior. All sidebar facet links
carry the current facet_sort so it doesn't reset when filtering.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
A short, native <details>/<summary> reference (no JS) next to the
hint text, listing the basic syntax the new markdown rendering
supports: headings, bold/italic, lists, quotes, inline code, code
blocks, links.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
New /prompts section extends the existing database (new Prompt model,
same SQLite file) and mirrors the Links experience: add a prompt, get
it auto-categorized and tagged by AI, filter by category, full-text
search, sort, edit, or have the AI re-categorize it. A header nav
switch ("Links" / "Prompts") toggles between the two collections; the
shared topbar/menu markup was factored into _topbar.html and
_topbar_actions.html so both pages (and settings) stay in sync.
Each prompt card has a dedicated copy-to-clipboard icon next to
edit/delete, so a stored prompt can be reused immediately. Copying
uses the raw markdown source (not the rendered HTML) so structure
survives when pasted into another AI tool. The copy handler tries the
async Clipboard API first and falls back to a hidden-textarea +
execCommand('copy') for plain-http/non-secure contexts, with clear
success/failure icon feedback either way.
Prompt content supports Markdown and is rendered server-side
(app/mdrender.py) for the card preview. Since this is user-supplied
HTML-adjacent content, rendering goes through two defenses: the raw
text is escaped (only '<' and '&', not '>', so blockquotes keep
working) before conversion so no raw tag can survive, and the
resulting HTML is passed through bleach with a tag/attribute/protocol
allowlist so Markdown-generated links can't carry a javascript: URL.
Verified against raw <script>, <img onerror>, and javascript: link
payloads. The edit form always shows the raw Markdown source, never
the rendered HTML.
Also bumps the default APP_VERSION (shown in the footer) from 1.0.0
to 2.0.0 to mark this feature addition.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
