Repository navigation
docs: turn the docs home into task paths, fix the Docus 5 config - #75
Merged
Merged
Conversation
Diagnoses the current dashboard, auth, source-control and deployment problems, proposes the supastarter-style workspace layout, and records the maintainer's answers on layout, ESM, licensing, billing, forges and deployment targets.
Pins Better Auth, nuxt-better-auth, Vue, UnoCSS, Vitest, Vue testing, Postgres/Drizzle, Stripe, taste, modern CSS, code review, GitHub Actions, Dockerfile, Cloudflare and anti-slop skills to their source commits.
agent, runner, models, config and shared now live in packages/core/*. Their npm names are unchanged, so imports stay identical; only relative tooling paths, TypeScript project references, the workspace globs and the documentation that names their directories change.
The deployable app becomes @code-zero/web in apps/web, matching the v2 layout. Paths, the Turborepo task key, the Dockerfile, the CD workflow, the Vercel build command, i18n tooling globs and the docs follow. The September dashboard plan moves to docs/plans unchanged.
The shared tsdown configuration drops the CommonJS output and validates with attw's esm-only profile. Package exports keep a single types and default condition. forges, the next source-control client, ships no CJS build, and every consumer is a Node 24 process or a Vite/Nitro build.
packages/ui owns the colour tokens, focus and accessibility media queries (tokens.css), the brand theme, the RTL and a11y dev presets and a defineCodeZeroUno factory. apps/web and apps/marketing drop their copies and keep only their density shortcuts and page backgrounds. DESIGN.md records the rules a UI change must respect. The marketing site renders identically in both schemes; the dashboard gains the reduced-motion rule the marketing site already had.
Four edges in the better-auth@1.6.26 subgraph named peer-qualified ids truncated one level (prisma@7.9.1 instead of prisma@7.9.1(better-sqlite3@12.11.1)), and one unctx edge named an unplugin variant with no snapshot. aube hashes the id as written, so a clean aube ci linked node_modules/.aube/@better-auth+drizzle-adapter* /node_modules/drizzle-orm (and unctx's unplugin) at virtual-store directories it never creates, and the web Nitro build failed with ENOENT. Repointed the five edges at the snapshots already in the lockfile. A clean aube ci now reproduces the file byte for byte and leaves no dangling links.
@nuxt/test-utils boots the whole app in a beforeAll hook before the first spec of each worker. On a cold cache or a loaded machine that boot outlasts Vitest's default 10 s hook timeout and fails whole files before any assertion runs. Raise hookTimeout to 60 s for the nuxt projects of apps/web and apps/marketing.
packages/forge (@code-zero/forge) builds the source-control boundary on the forges library for GitHub, GitLab, Gitea, Forgejo, Bitbucket Cloud and Azure DevOps: connections and a registry, FORGES_* environment parsing, signed webhook ingestion into review and issue events, open change-request discovery, status publication with explicit degradation, progress, evidence and issue-validation comments, and issue-to-PR. Every delivery is untrusted: bad signatures and malformed payloads are typed rejections, library errors are redacted against the connection's credentials, and issue events start nothing unless policy opts in. Tests run against forges' in-memory fake and signed fixtures, with no network. Nothing imports the package yet; packages/source-control stays until packages/api and apps/web are rewired.
The github-actions-generator skill vendors sample action.yml templates under .agents/skills. zizmor scanned the whole checkout and failed the pull request on template-injection findings in that sample code, which nothing ever runs. Point it at .github, where every workflow and action of this repository lives.
connectionsFromEnvironment() builds factories from an arbitrary environment object, but the registry only recorded credentials for connections it built itself. When that object was not process.env, a token matching no known secret pattern passed redaction untouched into outgoing comments and ForgeRequestError messages. Prepared connections now carry the credential values of their variable set, PEM keys in both escaped and real-newline form, and the registry registers them like any other connection. Regression tests use an opaque token absent from process.env and fail without the fix.
The home repeated the marketing pitch. It now opens on starting with a read-only review and links straight to installation, self-hosting, the CLI and the API, then to repository configuration, safety and architecture. app.config.ts moves to the Docus 5 shape: header, seo and github at the top level. Before, the site title fell back to the package name and edit links missed the apps/docs root. Prose gets a longer line height, code blocks scroll inside the article, previous/next links keep square corners, and header controls and sidebar links are 44 px on small screens.
|
Note The title starts with
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…ceiling With `execution.max_network` below `full` and no deployment sandbox, a repository choosing `isolation: local` ran on the host network: `LocalRunner` carries the policy without enforcing it, and a hosted provider may hand back a runner wider than the lease asked for. The ceiling was a label, not a limit. `runTask` now checks the runner it actually built: under a ceiling below `full` the run executes only when the runner is isolated and its network is no wider than the run's effective policy (the repository's own, narrowed to the ceiling), so a run that must have `none` gets exactly `none`. A RunnerPool lease is released before refusing, and the task is recorded as `failed` with the redacted reason, on the same terms as `ISOLATION_UNAVAILABLE`. The settings page hint (EN/IT) and the deployment-settings guide now say that a ceiling below Full needs the container sandbox or a hosted sandbox, and that local runs are refused.
`AUTH_ENABLE_MAGIC_LINK=true` or `AUTH_ENABLE_TWO_FACTOR_EMAIL_OTP=true` stopped the dashboard at startup: `packages/auth` refuses either flag without its delivery callback, and the app supplied neither `sendMagicLinkEmail` nor `sendTwoFactorOtpEmail`. `packages/mail` gains two templates, `magicLink` (the sign-in link, named to no account) and `twoFactorOtp` (the code printed once as text, never inside a link), registered beside the existing four with the compiled artifact re-rendered. The app's delivery bindings move out of `server/auth.config.ts` into `server/utils/auth-mail.ts`, which now wires every callback a policy flag can require, so turning on an email sign-in option is a configuration change rather than a startup error. Neither the link nor the code is ever logged.
A password sign-in on an account with two-factor authentication answered with `twoFactorRedirect: true` and nothing happened: the sign-in page showed a success it could not act on, and no page existed to take the code, so the sign-in could never finish. `app/auth.config.ts` passes `onTwoFactorRedirect` to `twoFactorClient()`, which navigates to the new `/two-factor` page (auth layout, guest-only like `/login`). The page takes the authenticator code in a numeric `one-time-code` field, switches to a backup code, and, when `/api/capabilities` reports mailed codes, sends one and verifies it; it offers to trust the device, refreshes the session and opens the dashboard on success, keeps a rejected code on the page with a `role="alert"` message through `useAuthErrorMessage`, and links back to sign-in. Copy is in the `auth` namespace (EN/IT) with the schema regenerated.
Signing in to approve a CLI request starts at /login?redirect=/device?…, but the two-factor hook opened /two-factor without it and a verified code always went to /. The visitor ended up signed in on the dashboard while the CLI kept waiting. The hook now carries the return address to the challenge page, which goes back there after verification and keeps it on its link back to sign-in. The address comes from the URL, so only a path on this app is accepted: no //host or /\host, no control characters, and not another sign-in page. The method switch also stayed enabled while a code was being checked. Switching changed which action the page read its pending state from, so it re-enabled submission and dropped the first check's answer. Pending now covers all four actions, and switching or mailing a code is disabled until the running check answers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related to #5. A presentation pass on the documentation site, on top of #71.
app.config.tsmoves to the Docus 5 shape (header,seoandgithubat the top level). Before, Docus fell back to the package name@code-zero/docsfor the title and built edit links without theapps/docsroot.Why
The old home repeated the marketing pitch, so someone looking for the install command had to scroll past a feature catalogue. The broken site title and edit links were a Docus 5 config mismatch.
Verification
aube run check:repoaube run lint:ciaube run typecheckaube testaube run buildSafety and compatibility
observemode as read-only, or explained the policy change above.Docs site only. The canonical references in
docs/*.mdare untouched.Agent context
Reviewer notes
No identified issues block merging this documentation-only change.Reviews (4) · Last reviewed commit: "Merge branch 'feat/v2-foundation' into f..." · Reviewed by Greptile