Release 0.10.0: it finds your site - #32
Conversation
… each - The registry recognises Qwik, SolidStart, TanStack Start, Analog, Vue CLI, Parcel, Rsbuild, Rspack, Ember, Hexo, MkDocs, Sphinx, mdBook, Zola, Quarto and Pelican, and Drupal, Statamic, Ghost and Shopify themes, which are never started. Hugo is also found through config/_default/. Zola is told from Hugo by what config.toml says. - detectFramework says why it recognised a framework and where the output directory came from, for `eaa-kit detect`. - The package manager comes from corepack's packageManager field first, then a lockfile, including Bun's text bun.lock, deno.lock and package-lock.json, searched up to the repository root so an app in a monorepo finds the workspace's lockfile. Deno runs scripts as tasks. - storybook-static/ is never audited as part of the site. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
A plain `next build` writes no HTML this tool can audit as files, so the project was built, started and crawled from its home page, which finds what the navigation links to rather than the site. - The build's manifests (prerender, routes, app paths, pages) are read for every page it has, and the crawl is seeded from them, so a page nothing links to is audited. Report discovery is "manifest". - basePath, the default locale's unprefixed paths, and trailingSlash are respected; API routes, error pages and metadata files are left out. - A dynamic route with no prerendered pages is named as not audited rather than silently missed. - A standalone build is served by its server.js when its static files are in place; otherwise `next start`, never `next dev`. - Servers are offered a free port through PORT, the announced URL is read through colour codes and 0.0.0.0, and more framework ports are probed. The fixtures are the manifests of real Next.js 16 builds, with the preview keys redacted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
…passed - Run from the root of a pnpm, yarn or npm workspace, or a Turborepo, Nx or Lerna repository, the audit finds the packages that are sites. One site is audited as though the command ran inside it; several are listed with the command for each. `init` asks which site and writes the config there, and refuses to guess when there is nobody to ask. - A page with nothing a visitor could perceive before a script runs, such as a Vite build's empty div#root, is set aside and named as not audited, since the browserless engine would report it clean. A build holding only a shell stops with the command to audit it in a browser. --browser runs the script and audits it as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
`eaa-kit detect [dir]` says what an audit here would do and the evidence for each part of it: the framework and what identified it, the package manager and why, the build output or what would be built or started, a Next.js build's page count and its unlisted dynamic routes, a monorepo's sites. It builds, starts and writes nothing. `--json` prints the same as data. tests/fixtures/stacks holds one project layout per kind of stack, each with the answer detect must give in expected.json, and the suite checks every one. Generators that are not npm packages carry their own build command, so a Hugo or MkDocs project with no build yet is told what to run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
One screen with everything this tool needs to work in a project, each problem followed by the command that fixes it: - the Node.js version, against the engines range; - the project's package manager, and whether it is installed; - what detection makes of the site; - the config, and whether it parses; - a GitHub, GitLab or Bitbucket pipeline that runs eaa-kit; - the baseline, and entries in it that have expired; - Playwright and Chromium, for the optional --browser. Exit 2 only for what stops an audit from running; a missing config, CI file or baseline is advice. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
… starter Next.js (on Linux, macOS and Windows), Astro, SvelteKit, Nuxt, Docusaurus and a Vite app (in a browser, since it is an app shell) are scaffolded from their official starters at pinned majors, installed, and audited with no directory, so detection decides. Exit 2 or no pages fails the job. Every scaffold command was checked to run without a terminal, and the audits were run against the same starters before this was committed. Progress messages name the real command a server is started with. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
Docs for detection, detect and doctor, the builder table, the changelog, the version, the Action pins, the examples and the roadmap status. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
Windows has no process groups, and killing the cmd.exe that ran the project's start script left the Node server it spawned running. On CI that left the temporary project directory locked (EBUSY) and orphaned servers behind; on a user's machine the server outlived the audit. taskkill /T /F takes the tree down. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
|
Generated by Claude Code |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e9230e25d6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| pnpm: 'pnpm install --frozen-lockfile', | ||
| yarn: 'yarn install --frozen-lockfile', | ||
| bun: 'bun install --frozen-lockfile', | ||
| deno: 'deno install --frozen', | ||
| }[manager] |
There was a problem hiding this comment.
deno install --frozen
When Deno is selected as the package manager, init supplies this as the action’s install-command, and the composite action executes it before the build (action.yml:164-174). deno install installs a named script/executable rather than project dependencies; without its required command, deno install --frozen exits nonzero, so every generated Deno workflow stops before deno task build or the audit. Omit this install step or generate a valid Deno cache command instead.
Useful? React with 👍 / 👎.
| if (manager === 'bun') setup.push(' - uses: oven-sh/setup-bun@v2') | ||
| if (manager === 'deno') setup.push(' - uses: denoland/setup-deno@v2') |
There was a problem hiding this comment.
Native Deno sites commonly have deno.json and deno.lock but no package.json. workflowFor sets manager to undefined whenever readPackageJson returns undefined (line 65), so this new Deno setup branch and the deno task build branch are both skipped; init consequently writes a workflow that neither installs Deno nor builds the site before auditing it. Detect the manager independently of package.json and read Deno tasks for this project shape.
Useful? React with 👍 / 👎.
| if (seeded.length > 0) { | ||
| discovery = 'manifest' | ||
| for (const url of seeded) enqueue(url, 0) |
There was a problem hiding this comment.
When both sources exist—for example, an automatically served Next app with a sitemap larger than --max-pages—the sitemap URLs have already been enqueued at line 466 before these manifest seeds are added. The page limit then drains sitemap entries first and can leave manifest-only routes unrequested, defeating the stated Next manifest coverage while the report still labels discovery as manifest. Enqueue or otherwise prioritize seeds ahead of sitemap URLs.
Useful? React with 👍 / 👎.
| return [...block.matchAll(/^[ \t]*-[ \t]*['"]?([^'"\n#]+?)['"]?[ \t]*(?:#.*)?$/gm)] | ||
| .map((match) => match[1] ?? '') | ||
| .filter((entry) => entry !== '' && !entry.startsWith('!')) |
There was a problem hiding this comment.
For a workspace such as packages: ['apps/*', '!apps/legacy'], this drops the negated pattern and findWorkspaceSites subsequently glob-matches apps/legacy/package.json anyway. If that excluded package has a recognized framework, it is presented as an auditable site and can turn a one-site automatic audit into a misleading choose-site prompt. Preserve negated entries as glob ignores when scanning manifests.
Useful? React with 👍 / 👎.
…ace exclusions Four findings from the review of #32: - init no longer gives a Deno project `deno install --frozen` as its install command, which is not a dependency install on every Deno version and stopped the workflow at its first step. Deno gets no install step; `deno task` fetches what the build needs. - A Deno project with no package.json gets a workflow that sets up Deno and runs `deno task build`, read from deno.json or deno.jsonc. A Deno config marks the project as Deno even before it has a lockfile. - A Next.js build's own page list is queued ahead of the sitemap, so a --max-pages limit cannot run out on sitemap entries first. - Exclusions in pnpm-workspace.yaml and package.json workspaces (`!apps/legacy`) are applied, so an excluded package is not offered as a site. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
2 participants
The 0.10.0 step of the 1.0 plan in ROADMAP.md. The commits are in order, and each one passes lint, typecheck and the tests on its own.
What changed
next starton a free port.discoveryis"manifest".basePath, i18n andtrailingSlashare respected.server.js.next devis never used.packageManagerfield is read first, then the lockfile:bun.lock,deno.lockandpackage-lock.jsonare now recognised. The lockfile is looked for up to the repository root. Deno scripts run as tasks.initasks which site to set up.--browser.storybook-static/is never audited.eaa-kit detect [--json]says what an audit would do and why. It builds and starts nothing.eaa-kit doctorchecks Node, the package manager, the site, the config, the CI pipeline, the baseline and Playwright/Chromium on one screen. Each problem comes with the command that fixes it.tests/fixtures/stacks/has 14 stack fixtures, each with anexpected.jsonthatdetectmust match.soak.ymlruns nightly. It scaffolds Next.js (on all 3 operating systems), Astro, SvelteKit, Nuxt, Docusaurus and Vite from their official starters, then audits each with no directory.Verification
pnpm lint,pnpm typecheck,pnpm smokeandpnpm release:checkpass.pnpm test: 1,525 tests pass.test:packagedfails its 3 real-Chromium checks for the same reason.End to end with the built CLI. Each starter was scaffolded and installed for real, then run through
eaa-kit auditwith no directory:basePath: '/docs': all 5 pages, including one nothing links to, with/docs/user/[id]reported as not audited.Scaffolds. Every scaffold command in
soak.ymlwas run with stdin closed and needs no terminal.pnpm benchis at or below the 0.9.0 baseline:Report format
completeness.discoverygains the value"manifest".schemaVersionstays 2 because nothing was removed or renamed. This is noted in the CHANGELOG and in docs/reports.md.🤖 Generated with Claude Code
https://claude.ai/code/session_013BXnvSeRtgZoTXe4j753gM
Generated by Claude Code