Picklo gemini default

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1,12 @@
+* text=auto eol=lf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.webp binary
+*.ico binary
+*.pdf binary
+*.doc binary
+*.docx binary
+*.zip binary

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,23 @@
+## What changed
+
+Describe the user-visible result and why the change is needed.
+
+## Verification
+
+- [ ] `npm test` passes.
+- [ ] Tested on a narrow mobile viewport.
+- [ ] Tested on a desktop viewport.
+- [ ] No secret or private token was added.
+- [ ] Photos, documents, and generated files remain browser-only.
+- [ ] No device downloads a large local model automatically; Gemini remains the default.
+- [ ] Web-search citations use safe clickable `http`/`https` links and local filenames are not synced.
+- [ ] Transient work notes disappear after the answer and are not stored as messages.
+- [ ] Accessibility and dark mode still work for the changed interface.
+
+## Evidence
+
+Add screenshots for visual changes and concise reproduction steps for bug fixes.
+
+## Supabase or privacy impact
+
+State `None` or explain any Edge Function, Auth, database, RLS, or data-handling change.

.github/workflows/validate.yml

@@ -0,0 +1,27 @@
+name: Validate Picklo
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Run repository checks
+        run: npm test

.gitignore

@@ -0,0 +1,25 @@
+# Dependencies and generated output
+node_modules/
+coverage/
+dist/
+build/
+
+# Secrets and local environment
+.env
+.env.*
+!.env.example
+*.pem
+*.key
+
+# Editors and operating systems
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/
+*.swp
+
+# Logs and temporary archives
+*.log
+*.tmp
+*.zip
+*.tar.gz

CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+## 8.3.0 — Web Intelligence
+
+- Made Gemini the default AI runtime on phones, tablets, light computers, and capable WebGPU desktops.
+- Stopped automatic local text and vision model downloads during normal use.
+- Added Gemini Google Search grounding for current, changing, explicitly searched, and purchase-sensitive questions.
+- Added validated clickable web-source chips while keeping local file-source names browser-only.
+- Added brief transient activity notes for thinking, web search, local file reading, code preparation, calculations, and file delivery.
+- Kept photos, uploaded documents, and generated files in browser storage only; image analysis sends only a temporary resized copy to Gemini.
+- Added graceful Gemini-knowledge fallback when Search grounding is temporarily rate-limited or unavailable.
+- Updated PWA cache keys, release metadata, documentation, and repository validation.
+
+## 8.2.2 Fix4
+
+- Added browser-only photo and document messages, file downloads, Markdown links, syntax-coloured code, mobile keyboard layout fixes, and repository scaffolding.

CONTRIBUTING.md

@@ -0,0 +1,61 @@
+# Contributing to Picklo
+
+Thank you for helping improve Picklo. Keep pull requests focused, testable, and safe for both mobile and desktop users.
+
+## Development workflow
+
+1. Fork the repository and create a branch from `main`.
+2. Use a descriptive branch name such as `fix/mobile-composer` or `feature/local-file-preview`.
+3. Serve the repository over HTTP:
+
+   ```bash
+   python -m http.server 8080
+   ```
+
+4. Make one focused change.
+5. Run the repository checks:
+
+   ```bash
+   npm test
+   ```
+
+6. Test the affected interface on a narrow mobile viewport and a desktop viewport.
+7. Open a pull request and complete the checklist.
+
+## Required invariants
+
+- Never add `PICKLO_API`, a Supabase service-role key, passwords, or private tokens to browser files, commits, screenshots, or test fixtures.
+- Photos, uploaded documents, local filenames, and generated file contents must remain browser-only.
+- Do not write attachment bytes to Supabase Database or Storage.
+- Cloud conversation sync may contain text plus sanitized public web citations only; keep `attachments` empty and `artifact` null, and strip local filenames.
+- No device may initialize or download a large WebLLM model automatically. Gemini remains the default runtime on capable desktops too.
+- Google Search must run only through the Edge Function. Validate citation URLs as `http` or `https` before rendering or syncing them.
+- Keep `index.html` and all public assets deployable as a static site without a build step.
+- Treat AI and document output as untrusted text. Use DOM text APIs or explicit escaping, and allow only safe link protocols.
+
+## Code style
+
+- Use modern, dependency-light JavaScript and descriptive names.
+- Preserve accessibility labels, keyboard navigation, reduced-motion behavior, and safe-area handling.
+- Avoid adding visual clutter to the mobile header or composer.
+- Keep code blocks fenced with a language identifier when changing prompts or response formatting.
+- Prefer small functions with explicit validation at browser/server boundaries.
+
+## Release changes
+
+When publishing a new build, keep the release number and cache query consistent in:
+
+- `app.js`
+- `enhancements.js`
+- `index.html`
+- `sw.js`
+- `version.json`
+- `manifest.webmanifest` when its product version text changes
+- `package.json`
+- browser module query strings such as those in `cloud-ai.js`
+
+Run `npm test` after any release-number update.
+
+## Pull request scope
+
+A good pull request explains the user-visible result, lists the browsers or devices tested, includes screenshots for layout changes, and calls out any privacy or Supabase impact. Do not combine unrelated redesigns, backend changes, and refactors in one pull request.