Audit hardening for 0.2.0 - #5
Merged
Merged
Conversation
- Bump TOOLROUTE_VERSION to 0.2.0 to match package.json; the runtime routerVersion diagnostic was mislabelling every violation as 0.1.0. - Add a unit test asserting TOOLROUTE_VERSION equals package.json#version (read via fs) so a release can no longer let the const drift, and pin the existing router.test.ts assertion to the const. - Set removeNodeProtocol: false in tsup so dist keeps node: import prefixes; the previous build rewrote node:module to bare module and broke Cloudflare Workers nodejs_compat. - Run pnpm smoke in CI after build (dist-tarball consumer test). - Use the canonical git+https repository URL in package.json. - Document two known limitations in the README: one router instance per concurrent run (shared state.prev cross-contaminates the guard) and entry tools requiring a non-empty nextAllowed. - Add a CHANGELOG Unreleased section and correct the stale 37->40 test count in COMPATIBILITY.md.
- Generate the version badge from the root package.json via sync-content.mjs (writes src/lib/generated/version.js) and import it in Header.svelte and the landing hero, mirroring the sibling tapedeck site. Fix the stale 37->40 test count. - Add the 0.2.0 entry to the changelog page (ported from CHANGELOG.md). - Add the 6.0.193 / 0.2.0 weekly-cron row to the compatibility table. - Remove the stray "toolroute@0.1.0" fragment glued to prose on the no-playground-in-v1 decision page. - Commit the generated static/og.png (build:og output) referenced by the og:image meta tag, which previously only had og.svg. - Refresh routerVersion example output strings from toolroute@0.1.0 to 0.2.0 across the api, docs, decisions, hero, and before-after pages (historical 0.1.0 changelog/compatibility rows left intact).
Deploying toolroute with
|
| Latest commit: |
b2abf35
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://3f70904f.toolroute.pages.dev |
| Branch Preview URL: | https://fix-audit-0-2-0-hardening.toolroute.pages.dev |
nkwib
added a commit
that referenced
this pull request
Jun 10, 2026
Patch release with the audit-hardening fixes (PR #5): runtime routerVersion now reports the correct package version, dist preserves node: import prefixes for Cloudflare Workers, smoke wired into CI, and two known limitations documented in the README.
nkwib
added a commit
that referenced
this pull request
Jun 22, 2026
Patch release with the audit-hardening fixes (PR #5): runtime routerVersion now reports the correct package version, dist preserves node: import prefixes for Cloudflare Workers, smoke wired into CI, and two known limitations documented in the README.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardening pass from the 0.2.0 audit. No public API changes.
Fixes
src/version.tsstill exportedTOOLROUTE_VERSION = '0.1.0'while the package shipped as0.2.0, so every runtimerouterVersiondiagnostic mislabelled the version. Bumped to'0.2.0'and addedtest/version.test.ts, which readspackage.jsonviafsand asserts the const matches it so a future release cannot let it drift. The existingrouter.test.tsassertion is now pinned to the const too.node:prefix stripping (high). AddedremoveNodeProtocol: falsetotsup.config.ts. The previous build rewrotenode:moduleto baremodule, which breaks Cloudflare Workersnodejs_compat. Verified the rebuiltdist/index.jsanddist/index.cjsboth keepnode:module.pnpm smokestep after build in.github/workflows/ci.yml(the dist-tarball consumer test).package.jsonviasync-content.mjs(src/lib/generated/version.js) and imported inHeader.svelteand the landing hero, mirroring the sibling tapedeck site; corrected the37->40test count.0.2.0changelog entry (ported fromCHANGELOG.md).6.0.193 / 0.2.0weekly-cron row to the compatibility table.toolroute@0.1.0fragment glued to prose on the no-playground-in-v1 decision page.static/og.png(thebuild:ogoutput) referenced byog:image, which previously had onlyog.svg.routerVersionexample output strings fromtoolroute@0.1.0to0.2.0across the api, docs, decisions, hero, and before-after pages. Historical0.1.0changelog/compatibility rows were left intact.state.prevso concurrent runs sharingrouter.toolscross-contaminate the guard (use one router per run, orreset()between sequential runs); and entry tools are those with a non-emptynextAllowed, so a terminal tool can never be the first call (by design).package.json#repository.url->git+https://github.com/nkwib/toolroute.git.Verification
All run on this branch:
pnpm typecheck— pass.pnpm test— 41 tests pass (added the version test).pnpm build— pass.pnpm smoke— PASS; consumer reportsrouterVersion=toolroute@0.2.0+ai-sdk@6.0.200and the guard fires.grep -E "from ['\"]module['\"]" dist/index.js dist/index.cjs— no matches; both files importnode:module.pnpm install --frozen-lockfile+pnpm build:og+pnpm build— pass; builtindex.htmlshowsv0.2.0and referencesog.png.