Releases

What's Changed

• dev -> main: sprint-40 — Compare picker, disposable fixture, LaTeX Resolved surface by @ranawaqas-ai in #358

Full Changelog: v0.5.1...v0.5.2

What's Changed

• dev -> main: reading font reverted to Charter 20px + typography freeze by @ranawaqas-ai in #350

Full Changelog: v0.5.0...v0.5.1

What's Changed

• dev -> main: standing integration PR (G8) — epic #276 complete by @ranawaqas-ai in #346

Full Changelog: v0.4.2...v0.5.0

What's Changed

• dev -> main: standing integration PR (G8) — #311 by @ranawaqas-ai in #328

Full Changelog: v0.4.1...v0.4.2

What's Changed

• dev -> main: standing integration PR (G8) — #320 by @ranawaqas-ai in #323

Full Changelog: v0.4.0...v0.4.1

What's Changed

• dev -> main: standing integration PR (G8) by @ranawaqas-ai in #321

Full Changelog: v0.3.0...v0.4.0

What's Changed

• dev -> main: standing integration PR (G8) by @ranawaqas-ai in #237

Full Changelog: v0.2.1...v0.3.0

A patch release for the sign-in screen.

Rate-limited sign-in links are now visible

Magic-link sends are capped (3 per address per 15 minutes) to prevent abuse. Until now a throttled request was indistinguishable from a successful one — the screen still said "a link is on its way", so you waited on an email that was never sent.

The sign-in screen now tells you:

You've already requested 3 links for you@example.com in the last 15 minutes, so a new one wasn't sent. Your most recent link still works — check your inbox and spam. You can request another in about N minutes.

It also always shows a short footnote ("Didn't get it? Check your spam folder. Sign-in links are limited to 3 per 15 minutes per address").

Note on how this is done

/auth/magic-link still returns a single constant response — it never reveals whether an address exists or what its rate state is, so account enumeration and rate probing remain impossible. The notice is derived from the browser's own local request history, so you are told what you did without the server disclosing anything. The footnote is identical for everyone and leaks nothing.

mdreview grows from a single-user tool into a hosted service you can share.

Accounts and per-document custody

Native sign-in (magic link), no third-party identity provider required. Every review belongs to whoever created it, and access is gated at a single custody choke point rather than per-route — a document you did not create is not yours to read, comment on, or delete. Anonymous callers get nothing.

Sharing

• Public link — flip a review to a view-only link that anyone can open (never search-indexed).
• Named people — invite by email with view or comment rights; revocation is immediate.
• Available on markdown and LaTeX reviews.

Admin console

Manage the people on your instance: grant/revoke admin, ban and unban, revoke API tokens and live sessions, and maintain an email/IP blocklist enforced at the sign-in step. Admin write routes require CSRF.

Rebuilt interface

One shared design-token layer drives every page, with light/dark following the system. Dashboard, account, and admin pages rebuilt on component styles. Viewer improvements: the comment composer now sits beside the text it annotates, comments stay anchored to their block as the document changes, and version history gained a source diff.

For agents

Per-user API tokens are minted from your account page and dropped into an MCP config once; every create_review from then on lands in your dashboard, scoped to you. The MCP wrapper self-updates from the server it talks to.

Notes

• The LaTeX review mode from v0.1.0 now has full comment and sharing parity with markdown reviews.
• Images publish to GHCR: mdreview-service, mdreview-service-latex, and mdreview-watcher (:v0.2.0 and :latest).
• Changelog: https://mdreview.space/releases/

Opt-in LaTeX paper review mode — review research papers in an Overleaf-style split view (source + live-compiled PDF), with the same threaded comments as markdown reviews.

Highlights

• Overleaf-style LaTeX review — enable with MDREVIEW_ENABLE_LATEX. A self-contained src/latex_review/ module compiles with Tectonic in a hardened, unprivileged container. Comments anchor to source lines; the PDF is always live, never stale. MCP create_review gains a kind parameter.
• Template catalog — create_review(kind=latex, template=<id>) seeds a paper from a bundled starter (IEEE, ACM, arXiv, Elsevier, LNCS). Non-CTAN conference styles (ACL, ICLR) download on first use from a pinned, sha256-verified registry and cache under /data — never baked into the image.
• Unchanged by default — ships as a separate mdreview-service-latex image; the default slim image and all flag-off behavior are byte-for-byte identical.

Docker images

• ghcr.io/waqaskhan137/mdreview-service:v0.1.0 (slim, default)
• ghcr.io/waqaskhan137/mdreview-service-latex:v0.1.0 (LaTeX, opt-in)

Full Changelog: v0.0.2...v0.1.0

What's Changed

• ci: publish Docker images to GHCR on release + stop tracking .claude/CLAUDE.md by @waqaskhan137 in #41
• dev -> main: GHCR release images + .claude untrack + macOS packaging by @waqaskhan137 in #42

Full Changelog: v0.0.1...v0.0.2

What's Changed

• review-dashboard: dashboard, provenance, history, Google-Docs comments (MR-001..007) by @waqaskhan137 in #1
• Process hardening (sprint-02) + process-hardening-2 (sprint-03): tighter ui/gate/planner discipline by @waqaskhan137 in #2
• mcp-wrapper: stdlib stdio MCP server over the HTTP API (MR-015..018) by @waqaskhan137 in #3
• landing-page: buildless GitHub Pages landing page (MR-019, MR-020 partial) by @waqaskhan137 in #4
• rich-rendering (sprint-06): render LaTeX math + attach/serve local images (MR-022..026) by @waqaskhan137 in #5
• theme-awareness (sprint-07): neutral image mat for legible figures on dark panes (MR-027) by @waqaskhan137 in #6
• render-fidelity (sprint-08): GFM footnotes + syntax highlighting in the viewer (MR-028..030) by @waqaskhan137 in #7
• dashboard-redesign (sprint-09): dense, searchable, collapsible reviews dashboard (MR-031) by @waqaskhan137 in #8
• dev → main: comment-resolution workflow (sprint-11) + flat-grid dashboard (sprint-10) by @waqaskhan137 in #9
• dev → main: mcp-agent-effectiveness (sprint-12) — provably self-serve MCP by @waqaskhan137 in #10
• dev → main: legacy-feedback-retire + MCP browser-open (MR-048) + viewer comment UX (MR-049) by @waqaskhan137 in #11
• dev → main: MR-050 viewer delete-comment (issue #12) by @waqaskhan137 in #13
• Standing dev→main: agent-handoff-baton + agent-watcher (both epics complete) by @waqaskhan137 in #17
• docs(site): subtle Apache 2.0 link in footer by @waqaskhan137 in #24
• UI re-skin: landing + dashboard + viewer to the new mockup (epic viewer-dashboard-reskin, sprint-28) by @waqaskhan137 in #32
• refactor: split mcp_server.py + watch.py into the mcp/ and watcher/ packages by @waqaskhan137 in #35
• refactor: OOP decomposition + src/ restructure (epic oop-refactor-src-layout, sprint-27) by @waqaskhan137 in #33
• feat(ui): viewer Send-to-agent gating + dashboard viewport-fit pagination, projects top-N, hover fix by @waqaskhan137 in #36
• feat(packaging): macOS .app — freeze, launcher, dashboard Quit, Developer ID release CI (#38) by @waqaskhan137 in #40
• feat(web): public docs site at /docs/ (rendered via the product's own renderer) by @waqaskhan137 in #39
• Standing dev→main: watcher epics + opt-in containerized watcher + agent-turn transparency (#18 #25 #26 #27 #30) by @waqaskhan137 in #29

New Contributors

• @waqaskhan137 made their first contribution in #1

Full Changelog: https://github.com/waqaskhan137/mdreview-service/commits/v0.0.1