improve developer toolkit

[neuralnexus]

What changed

Human-friendly byte tooling

• Rebuilds Hexdump as a local-first Hex Viewer with explicit text, hex, base64, binary, and local-file input.
• Adds the 18-group byte-spectrum view plus semantic and color-free modes.
• Adds paging, hex/text search, offset jumps, statistics, byte details, synchronized hex/ASCII selection, and 32 MiB file handling.
• Maps clickable structure regions for PNG, JPEG, GIF, ZIP, ELF, PE, and PDF files, including bounded parsing and truncation warnings.

Better local workflows

• Replaces the shallow payload diff with strict text/hex/base64 decoding, two-file local comparison, byte-level change runs, synchronized selection, paging, and change navigation.
• Adds a deterministic Recipe Pipeline with presets, intermediate-value traces, JSON/gzip/encoding transforms, versioned import/export, and definition-only browser saves. Payloads are never persisted.
• Makes Hexyr installable and useful offline. The service worker caches static same-origin assets and explicitly bypasses every /api/* request.

Production hardening

• Splits every tool route into an on-demand chunk; the production entry remains about 253 kB before gzip / 80 kB gzip.
• Adds keyboard command navigation, safe preference storage, route-level failure recovery, offline status, and unknown-route recovery.
• Adds CSP and defense-in-depth response headers, no-store API responses, strict JSON content type, 1 MiB request limits, bounded upstream reads, and bounded in-memory rate buckets.
• Hardens opt-in network tools against local/private/reserved targets, unsafe schemes, credentials, custom ports, unsafe redirects, and private DNS resolutions.
• Adds a Worker deployment dry-run to CI and completes OpenAPI, privacy, security, deployment, tool, PWA, and contributor documentation.
• Marks the application and integration API as 1.0.0.

Privacy and safety

Browser transforms, recipes, file inspection, and file diffing remain local. Recipe definitions may be saved, but inputs, outputs, and intermediate payloads are not. API calls and network lookups are explicitly documented as remote operations; service-worker caching never touches them.

Validation

• Frozen install with pinned pnpm 10.6.1
• pnpm lint
• pnpm typecheck
• pnpm test — 45 files, 130 tests
• pnpm build
• wrangler deploy --dry-run — 993.66 KiB / 222.40 KiB gzip
• OpenAPI JSON parse and git diff --check
• Production preview smoke check for SPA fallback, manifest, shortcuts, and service-worker API bypass

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[github-actions]

/gemini review

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	hexyr-com	c07fcb7	Commit Preview URL Branch Preview URL	Jul 23 2026, 05:48 PM

[github-actions]

/gemini review