# vist

**vist** /vɪst/ — view a gist.

> At https://vist.briwa.dev: any GitHub account's public markdown gists, rendered, at /u/<user>. Add `sandbox: true` in the frontmatter and code blocks run as live JavaScript figures. Write your own at /code, saved to your GitHub gists.

The pages are client-side apps: without JavaScript they are empty shells. This file describes what they do.

## Pages

- `/` — what the site is, with a way into the editor, sign-in, and someone's gists by name.
- `/u/<user>` — a GitHub user's public gists that have markdown in them, newest first, scrolling for more. Other files in a gist are counted, not shown.
- `/u/<user>/<gist-id>` — one gist's markdown files, rendered, sandboxes running. Secret gists open by id too.
- `/code` — the editor. `/code/<gist-id>` opens a gist's first markdown file in it, `/code/<gist-id>/<file>` a given one; anyone's, as a copy, signed in or not.

## The editor

- **Markdown editor** built on CodeMirror, with a live preview and keyboard shortcuts modelled on VS Code (quick open, command palette, tabs).
- **Live code sandboxes**: a markdown file with `sandbox: true` in its frontmatter turns its code fences into runnable figures — HTML, CSS and JavaScript rendered in sandboxed iframes next to the text. `/snippet` and `/lib` insert sandbox blocks. The rendering comes from [`@briwa.dev/sandbox`](https://github.com/briwa/sandbox).
- **Offline-first**: files live in the browser (IndexedDB). After the first visit the editor works without a connection, and installs to the dock or home screen.
- **Sync to GitHub gists**: sign in with GitHub (gist scope only, no repository access) to push files to gists — secret by default, public if chosen before the first push. Nothing is merged automatically; a divergence is a conflict resolved as *keep mine* or *take theirs*.
- **Images**: `/image` uploads a picked image into the file's gist and links it.
- **Deploy hook**: optionally trigger a Cloudflare deploy hook after pushing, so a gist can feed a static site.

## Privacy

No analytics or third-party tracking. Stored data is the user's own files in their browser and a session cookie on sign-in. The GitHub token never reaches the browser; a Cloudflare Worker holds it in a sealed httpOnly cookie. Public gist listings and file lists are read from gist.github.com without the API and cached at the edge for a few minutes, the same for every visitor.

## Links

- Site: https://vist.briwa.dev
- Sandbox package: https://github.com/briwa/sandbox