feat(import): scale GitHub imports and simplify private access

[ThisIs-Developer]

What changed

• Removed the 30-file cap so repository and folder results show every Markdown file GitHub returns, including complete subtree traversal when a recursive tree is truncated.
• Added branch, tag, and commit URL resolution, including branch names containing /, and pinned imports to the resolved immutable commit SHA.
• Added private-repository imports through a compact named-token flow:
  • Fine-grained and classic PATs are accepted automatically.
  • GitHub validates each token through the authenticated /user endpoint.
  • Named tokens can be added, selected, persisted across refresh/app restarts, and removed without a passphrase or unlock step.
  • Token actions use accessible GitHub-branded toasts, and retired credential formats are removed during upgrade.
• Restored the original importer widths: 520px for the GitHub URL step and 760px for the Markdown selection step, with responsive full-width behavior on small screens.
• Kept the repository name on the left and grouped a wider resolved branch/ref badge with the immutable commit on the right. Long refs remain safely truncated but expose the complete value through hover text and an accessible label; direct commit URLs show only the commit.
• Added a two-stage loading flow: immediate Import-button spinner, then repository context and a reduced-motion-aware shimmer tree until discovery completes.
• Added file search with the selected-count, stateless collapse/expand-all, and stable select-all controls aligned directly on its right, plus GitHub-style file/folder rows. The folder command returns to the normal toolbar icon color after collapsing the tree, while tree folders mirror Explorer with neutral closed icons and accent-colored open icons.
• Completed and fully audited interface translations across all 14 supported languages, including dynamic labels, loading states, token statuses, errors, tooltips, and accessibility text.
• Cleaned locale source discovery so embedded dictionaries, translated phrases, versions, icon classes, and HTML/code fragments cannot become English source keys.
• Added a repeatable catalog audit for key parity, source pollution, empty values, placeholders, merged translations, encoding/generator artifacts, protected product terms, and unexpected English fallbacks.
• Normalized equivalent text and icons through shared semantic size roles while preserving intentional hierarchy for headings, secondary copy, and brand marks.
• Changed local, drag-and-drop, desktop, and GitHub imports to save documents in Explorer without opening every file as a tab.
• Batched bulk tab-close operations so hundreds of tabs close with one state update/render.
• Synchronized browser/desktop resources and updated the changelog and user documentation.

Why

Large repositories were capped at 30 Markdown files, non-default refs were not handled reliably, and private repositories had no supported import path. Later UI refinements also made both importer steps use the compact URL width and left newer importer copy absent from the broad locale catalogs. This update makes repository discovery complete, restores the intended amount of selection space, preserves exact branch context, and keeps the full importer workflow localized.

Credential security model

• PAT payloads are encrypted with AES-GCM before persistence; plaintext PAT values are not written to Local Storage, workspace metadata, URLs, logs, backups, or the Markdown Viewer backend.
• Browser builds keep a non-extractable AES key in a dedicated IndexedDB key store.
• The Neutralino desktop build keeps key material in its system app storage and imports it as a non-extractable runtime key.
• Authentication headers are restricted to HTTPS requests whose origin is exactly https://api.github.com; redirects are rejected.
• Private content uses GitHub's authenticated Contents API and never sends the PAT to raw.githubusercontent.com.
• Tokens persist until individually removed or local site/app data is cleared.
• Local removal deletes ciphertext from the app but does not revoke the PAT on GitHub.

User impact

• Every Markdown file in a public or authorized private repository/folder can be found and searched.
• Default branches, other branches, slash-containing branch names, tags, and commit URLs work with exact commit context.
• The compact URL step expands to the original wider selection view when file choices need more space.
• Long branch names receive substantially more badge width and remain readable in full on hover without making the repository row taller.
• Fine-grained and classic PATs work without an extra token-type choice.
• Multiple named credentials survive refreshes/app restarts and remain individually removable.
• The entire importer is available in every supported interface language without English fallback for the audited workflow.
• Imported files remain organized in Explorer without flooding the tab bar.

Validation

• npm run build — static build smoke check passed.
• npm run build in desktop-app — all seven standalone targets built successfully.
• node --check script.js
• git diff --check
• Browser and desktop importer scripts/styles are synchronized.
• Locale audit: 14 catalogs × 1,158 clean interface keys, zero missing/extra/empty entries, zero placeholder mismatches, zero merged/newline values, zero generator/encoding artifacts, protected GitHub/Markdown terms preserved, and zero unexpected English fallbacks.
• Repaired 75 previously merged/corrupt localized values and removed non-interface source-key pollution from every catalog.
• UI layout, accessibility, responsive, reduced-motion, dark-theme, and semantic sizing scenarios: 9/9 passed.
• GitHub importer Playwright scenarios: 9/9 passed.
• Runtime localization scenario passed across English plus all 13 translated locales.
  • all 2,717 mocked Markdown files render and remain searchable/bulk-selectable;
  • truncated trees traverse every subtree;
  • branch/tag/commit resolution and slash-containing refs work;
  • long refs use the wider right-side badge, truncate safely, and expose the full hover/accessibility value;
  • search, selected-count, and tree actions share one aligned row without mobile or landscape overflow;
  • the collapse/expand command changes its icon and accessible label while retaining the normal toolbar color; GitHub folder rows also switch between neutral closed and accent-colored open icons;
  • URL/selection widths resolve to 520px and 760px respectively;
  • loading, toolbar, private PAT, persistence, secure private-content, import-without-tabs, and mobile-layout scenarios pass;
  • the complete two-stage importer renders correctly in English plus all 13 translated locales.

[cloudflare-workers-and-pages]

Deploying markdownviewer with    Cloudflare Pages

Latest commit:	fb77b68
Status:	✅  Deploy successful!
Preview URL:	https://6320d4de.markdownviewer.pages.dev
Branch Preview URL:	https://agent-show-all-github-markdo.markdownviewer.pages.dev

View logs

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
markdown-viwer	Ready	Preview	Aug 2, 2026 2:01pm

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}