feat: add public chat share links (#33)

* feat: add public chat share links

* fix: render public share markdown

* fix: render public share markdown

* fix: use hostname labels for public share urls

* fix: render share source urls as links

* fix: remove duplicate public share summary excerpt

* Add link to sourcecode at bottom.

Author: darron

CHANGELOG.md

@@ -5,6 +5,14 @@ development date for the change set.
 
 ## Recent Improvements
 
+### Public Chat Shares (2026-05-15)
+
+- **Added**: Completed browser Chat answers can now be shared as stable public `/share/{slug}` pages, with deterministic summaries, categories, original external URLs, and per-owner share history in the web UI.
+- **Hardening**: Public share pages bypass web auth only for `/share/{slug}`, render with server-side escaping, avoid booting the authenticated SPA, and redact internal source keys, lookup IDs, note paths, local filesystem paths, and protected app routes.
+- **Display**: Public share pages now render the sanitized chat answer as Markdown-derived HTML without duplicating the raw Markdown summary excerpt, convert source URLs into real links, include source titles/summaries beside full original URL links, and clean trailing URL punctuation/backticks including `%60`-encoded backticks so copied links do not 404, while keeping raw HTML inert.
+- **Schema/Tests**: Added DB-backed share storage with HMAC slugs derived from a local random share salt, plus migration and web auth boundary regression tests.
+- **Location**: `internal/store/`, `web/`, `web/ui/`
+
 ### Authenticated Access Logging (2026-05-14)
 
 - **Operations**: Web requests now emit app-layer access logs with the authenticated GitHub identity after session validation, which keeps Funnel traffic attributable even without Tailscale identity headers.

go.mod

@@ -101,6 +101,7 @@ require (
 	github.com/tailscale/wireguard-go v0.0.0-20250716170648-1d0488a3d7da // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/yuin/goldmark v1.8.2 // indirect
 	go4.org/mem v0.0.0-20240501181205-ae6ca9944745 // indirect
 	go4.org/netipx v0.0.0-20231129151722-fdeea329fbba // indirect
 	golang.org/x/crypto v0.46.0 // indirect

go.sum

@@ -297,6 +297,8 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
 github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=
 github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM=
+github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE=
+github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg=
 github.com/zalando/go-keyring v0.2.6 h1:r7Yc3+H+Ux0+M72zacZoItR3UDxeWfKTcabvkI8ua9s=
 github.com/zalando/go-keyring v0.2.6/go.mod h1:2TCrxYrbUNYfNS/Kgy/LSrkSQzZ5UPVH85RwfczwvcI=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=

internal/store/migrations.go

@@ -6,7 +6,7 @@ import (
 	"time"
 )
 
-const currentSchemaVersion = 8
+const currentSchemaVersion = 9
 
 type schemaMigration struct {
 	Version int
@@ -95,6 +95,13 @@ var schemaMigrations = []schemaMigration{
 			return s.ensureAuthUserTables()
 		},
 	},
+	{
+		Version: 9,
+		Name:    "public_chat_shares",
+		Run: func(s *Store) error {
+			return s.ensurePublicChatShareTables()
+		},
+	},
 }
 
 func (s *Store) migrate(reporter MigrationReporter) error {