Repository navigation
fix: Tier-1 verified bug sweep (create-app, svelte, react/vue, mcp, context) - #347
Merged
Merged
Conversation
…add release-integrity guards - scaffold.js read version from package.json instead of hardcoded 0.14.0 (was pinning a stale release into every scaffolded app) - add template-solid to files[] so --template solid works on published installs - description now lists SolidJS; --help usage derives template list from TEMPLATES - tests assert version parity and that every offered template ships in files[]
Askable5.svelte dropped the scope prop and data-askable-scope attribute that the Svelte 4 component has, silently breaking scoped annotations for any consumer on the runes component. Restores parity and adds regression tests.
- react: re-export notification-source types (Options/Result, AskableNotification, AskableNotificationSeverity) — the hook was exported but its types were not - react & vue: re-export the region/text-selection capture Selection/State types that the capture result types reference but consumers could not name - react & vue: re-export AskableTabVisibility (used by AskableTabSourceSnapshot)
…th schema The guard only checked typeof === 'string' for capture.mode and provenance.method and ignored capture.gesture entirely, so it could accept packets the published schema rejects. Enum sets are now read from webContextPacketSchema so guard and schema cannot diverge. Adds the package's first test suite (12 tests).
… tools createAskableMcpPageBridge forwarded packets with privacy.redacted=false even when the server tools would block them — the bridge had no privacy gate at all. Adds requireRedacted to AskableMcpPageBridgeOptions and blocks unredacted packets across all three request types before forwarding, matching the server behavior.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
@askable-ui/angular
@askable-ui/context
@askable-ui/core
@askable-ui/create-app
@askable-ui/mcp
@askable-ui/qwik
@askable-ui/react
@askable-ui/react-native
@askable-ui/solid
@askable-ui/svelte
@askable-ui/vue
@askable-ui/web-component
commit: |
1 of 2 tasks
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes a cluster of verified, shipped bugs found by auditing the monorepo against
@askable-ui/core. Each was confirmed against source before fixing; every fix ships with tests. These are the highest-leverage items because several break real consumers onnpm installor silently lose data.Fixes
🔴
@askable-ui/create-app— published-tarball breakagescaffold.jshardcodedASKABLE_VERSION = '0.14.0'while the repo is0.15.0, pinning a stale release into every scaffolded app. Now derived from the package's ownversion, so it can never drift.files[]omittedtemplate-solideven though the directory exists and--template solidis offered → the Solid template was excluded from the published npm tarball and broke on install. Added.descriptionnow lists SolidJS;--helpusage derives its template list fromTEMPLATES(can't go stale).files[]— so this whole class of "ships broken" bug can't recur.🔴
@askable-ui/svelte— silent data lossAskable5.svelte(Svelte 5 runes) dropped thescopeprop anddata-askable-scopeattribute that the Svelte 4 component has, silently breaking scoped annotations for runes consumers. Restored + regression tests.🟡
@askable-ui/react+@askable-ui/vue— un-nameable public typesreactexporteduseAskableNotificationSourcebut none of its types; added them.Askable{Region,TextSelection}Capture{Selection,State}, but consumers couldn't name them — re-exported from core in both. (Note: Vue's components usedefineComponentwith inline props and have noAskableProps/AskableInspectorPropsinterfaces to export, unlike Solid — intentionally not invented here.)AskableTabVisibility(used byAskableTabSourceSnapshot).🔴
@askable-ui/mcp— privacy-gate exemptionrequireRedactedwas enforced only in the server tools, not increateAskableMcpPageBridge— the page bridge had no privacy gate and forwarded packets withprivacy.redacted === false. AddedrequireRedactedto the bridge options and gated all three request types before forwarding. (A per-field sanitizer hook is deferred as a separate additive enhancement.)🟡
@askable-ui/context— guard/schema divergenceisWebContextPacketonly checkedtypeof === 'string'forcapture.mode/provenance.methodand ignoredcapture.gesture, so it accepted packets the published JSON Schema rejects. Enum sets are now read fromwebContextPacketSchemaso guard and schema cannot diverge. Adds the package's first test suite.Test plan
npm run build --workspaces— clean across all 12 packagesnode --test— 6/6 (incl. integrity guards)🤖 Generated with Claude Code
Generated by Claude Code