Release v0.8.12 - Auto-Install Hardening and GitHub Pages Fix#176
Merged
Conversation
When base is not explicitly set and url has a non-root pathname (e.g. https://user.github.io/repo), derive base from the URL so the <base href> tag points at the subpath. Fixes the 404 regression for GitHub Pages project sites introduced in 0.8.10. - Slash-agnostic: 'repo', '/repo', '/repo/' all normalise to '/repo/' - Auto-derivation is the default; explicit base wins when set - Root deployments (subdomain) stay at '/' — no false-positive - One-line info message when base is auto-derived - Users no longer need to think about 'base' as a config option Verified: 22/22 asset-base-url tests pass. End-to-end test with the exact #175 config produces <base href="/some-project/">.
Three changes that make the auto-install path more robust and secure:
1. Shared runtime-deps module (packages/api/src/runtime-deps.ts):
- Replaces execSync(`pnpm add ${pkg}`) shell-string with
spawn(pm, args, { shell: false }) — CWE-78 fix
- Strict regex validator: only @docmd/(plugin|template|engine)-*
names pass, with registry lookup as defence-in-depth
- Slash-agnostic: handles Windows .cmd shims via conditional shell
- Idempotent TUI status reporter for dev-server rebuilds
2. Engine auto-install (packages/api/src/engine.ts):
- loadEngine('rust') now auto-installs @docmd/engine-rust if missing
- Falls back to JS if install fails or binary isn't usable
- loadEngine('js') auto-installs @docmd/engine-js as last resort
3. Corrected core dependency manifest (packages/core/package.json):
- Removed @docmd/plugin-pwa from direct deps (was never in
CORE_PLUGINS, every npm install pulled it unnecessarily)
Both hooks.ts and engine.ts consume the same shared module — one
install behaviour, applied everywhere. 51 new test assertions in
tests/cli-contracts/runtime-deps.test.js covering the validator,
registry, install refusal paths, and static source checks.
Verified: 594/594 runner tests pass, 143/143 feature tests pass,
#175 end-to-end test still produces correct <base href>.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
v0.8.12 Release
What's included
fix([Bug]: All assets are 404 when deployed to github pages #175): auto-derive base from URL pathname — GitHub Pages project sites no longer 404 on all assets. docmd derives the deployment subpath from
urlautomatically. No manualbaseconfig needed.feat: hardened auto-install pipeline (CWE-78) — replaces
execSync(pnpm add ${pkg})shell-string withspawn(pm, args, { shell: false })+ strict regex validator + registry re-check. Sharedruntime-deps.tsmodule consumed by bothhooks.tsandengine.ts.feat: engine auto-install —
loadEngine('rust')andloadEngine('js')now auto-install missing engine packages before falling back.fix: removed @docmd/plugin-pwa from core deps — was never in CORE_PLUGINS but every
npm install @docmd/corepulled it in. Now installs on demand only.Version bump to 0.8.12 across all packages.
Test results
<base href="/some-project/">confirmed correct<base href="/">confirmed unchangedNot included (stays on dev-0.9.0)
isMonorepoContext)tools/simulate-consumer.mjs)Breaking changes
None. Existing configs, plugins, and CI pipelines work unchanged.