lectio.git/internal/web/templates/lookup.html, branch main offline Catholic daily readings and liturgical calendar in Go, with CLI, TUI and web clients https://git.labunix.xyz/lectio.git/atom?h=main 2026-07-23T18:46:17Z web: theme control boxes, one default version, drop search bar; traditional drops pl + all=readings-only 2026-07-23T18:46:17Z Lukasz Kasprzak lukas@labunix.xyz 2026-07-23T18:46:17Z urn:sha1:0b47572bc0addc5f59ebac3e70278ea435097565 web: HTMX server + lectio-web binary 2026-07-23T12:39:31Z Lukasz Kasprzak lukas@labunix.xyz 2026-07-23T12:39:31Z urn:sha1:4de7f7dca7485c9a6c94f6f86a53d01a974fce54 NewServer wires B1's RenderReadings/Themes/themeCSS/embedded static+ templates FS into an http.ServeMux: GET / (full page), GET /readings (HTMX reading-pane fragment), GET /lookup (bible.Lookup passage search fragment), GET /theme.css (theme stylesheet, falling back through cfg.WebTheme to the built-in default on an unknown name), GET /static/. Run listens on cfg.WebPort (0 = OS-picked free port), prints the URL, best-effort opens a browser, then serves. cmd/lectio-web is the binary entry point (config.Load -> web.Run). Fold-in from the B1 review: hardened themeCSS's name guard to an explicit ^[A-Za-z0-9_-]+$ allowlist (the old filepath.Base/ContainsAny check let ".." through), plus guard-rejection and HTML-escaping regression tests -- B2 is what makes /theme.css?name=<raw> reachable from the network, so it owns closing this out.