feat: implement native wiki visualizer for openwiki

[Colin Francis (colifran)]

Summary

Adds an openwiki visualize command that serves a generated wiki as an interactive node graph with a live-reloading markdown reader.

• New subcommand openwiki visualize [path] [--port ] [--no-open] — defaults to ./openwiki, port 4321 (increments on conflict), opens the browser unless --no-open.
• Loopback-only HTTP server (src/visualize/server.ts): binds 127.0.0.1 exclusively, serves fixed string routes (no filesystem path is ever derived from the URL), and pushes live reloads over SSE backed by fs.watch (debounced). Ships a strict CSP and loads the graph/markdown/diagram libs from jsdelivr with SRI-pinned hashes.
• Browser client as testable TS modules (client.ts, client-lib.ts, page.ts, graph.ts) compiled via a separate DOM-enabled tsconfig.client.json. Wiki markdown is rendered through DOMPurify.sanitize(marked.parse(...)) before innerHTML as defense-in-depth on top of the CSP; scalar fields are HTML-escaped.
• README: documents the command, loopback behavior, and the CDN network requirement.

Tests

• Unit tests
• Manual E2E tests

Demo

Screen.Recording.2026-07-23.at.8.53.39.PM.mov

[corridor-security]

The PR introduces an unsanitized marked.parse() → innerHTML pipeline in the wiki reader panel: raw markdown body content (which can originate from external sources) is rendered to HTML and injected into the DOM without DOMPurify or equivalent sanitization, enabling stored XSS.

[corridor-security]

The backlink rendering in src/visualize/client.ts interpolates filename-derived node IDs directly into a data-id HTML attribute without escaping, enabling XSS via a crafted wiki filename; the page CSP permits scripts from cdn.jsdelivr.net, amplifying impact to arbitrary script execution.

[Brad Huffman (ppsplus-bradh)]

This is sweet.

[jyje]

Awesome, we don't need Obsidian anymore!

[Ben (Bennoo)]

This is exactly what is missing when working locally with the generated openwiki!

When can we expect a merge for this one?

[Colin Francis (colifran)]

Ben (@Bennoo) hoping very soon!

[changeset-bot]

🦋 Changeset detected

Latest commit: 4834590

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
openwiki	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR