feat: harden generator and generated site security - #19

Merged

luangjokaj merged 32 commits into

mainfrom

feat/generator-safety-and-security-hardening

Jul 30, 2026

Commits on Jul 29, 2026

build: verify package integrity and add generated-site smoke tests in CI
luangjokaj
committed
7dd6873
feat: harden generation safety and add the API reference index
luangjokaj
committed
af40d95
docs(templates): document generation safety and add the Space page
luangjokaj
committed
50e6fdb
fix(templates): close route-level gate bypasses and tighten SSRF checks
luangjokaj
committed
6228cdb
docs: document output safety, install caching, and API auth changes
luangjokaj
committed
6505683
fix(templates): cap inline code and kbd width to their content
luangjokaj
committed
3a87f84
chore(templates): bump posthog-js in the generated app
luangjokaj
committed
cbc03b6

Commits on Jul 30, 2026

fix: build
luangjokaj
committed
0c6ca28
fix(templates): close remaining route auth, rate-limit, and SSRF gaps
luangjokaj
committed
5216ee1
fix: make OpenAPI reload transactional and reject non-YAML frontmatter
luangjokaj
committed
66a9891
fix(a11y): give modals, tabs, and collapsible regions real semantics
luangjokaj
committed
7b2345e
refactor: split CLI entry point from the generator engine
luangjokaj
committed
d45fb3a
build: run the compile step inside pnpm test
luangjokaj
committed
314611b
docs(templates): document API auth, artifact ownership, and tab nav
luangjokaj
committed
0a982d2
docs: document RAG API auth and the artifact-manifest rename
luangjokaj
committed
9603943
fix(theme): eliminate the remaining light-mode flash on dark loads
luangjokaj
committed
e7d328a
fix(templates): focus the chat input when the assistant opens
luangjokaj
committed
6b8d952
fix(templates): revert Cherry input adoption in chat and search
luangjokaj
committed
c507bd6
refactor(templates): require cherry 0.2.12 and drop the polished shim
luangjokaj
committed
5033e43
style(templates): use text sizing and top-align the prompt icon
luangjokaj
committed
22cd9bf
chore: update dependencies
luangjokaj
committed
f0561b9
build: verify packed package installation
luangjokaj
committed
35e91f9
fix: prevent unsafe OpenAPI loading and rendering
luangjokaj
committed
8ad80a9
fix: harden generated output mutations
luangjokaj
committed
1f8f219
fix(templates): match reserved routes on segment boundaries
luangjokaj
committed
b7f8fea
fix(templates): preserve the chat close transition
luangjokaj
committed
637ec4a
fix: render OpenAPI JSON with the code component
luangjokaj
committed
ab711a9
docs(templates): update platform guides and add authentication
luangjokaj
committed
fad1f10
docs(templates): fix the horizontal Space usage example
luangjokaj
committed
81d9ec7
chore: update dependencies
luangjokaj
committed
361cd3f
fix: harden generated security boundaries
luangjokaj
committed
8cb3e06
fix(a11y): coordinate chat and search modal focus
luangjokaj
committed
2c22ce2

Navigation Menu

Uh oh!

feat: harden generator and generated site security - #19

feat: harden generator and generated site security#19
luangjokaj merged 32 commits into
mainfrom
feat/generator-safety-and-security-hardening

Commits on Jul 29, 2026

build: verify package integrity and add generated-site smoke tests in CI

feat: harden generation safety and add the API reference index

docs(templates): document generation safety and add the Space page

fix(templates): close route-level gate bypasses and tighten SSRF checks

docs: document output safety, install caching, and API auth changes

fix(templates): cap inline code and kbd width to their content

chore(templates): bump posthog-js in the generated app

Commits on Jul 30, 2026

fix: build

fix(templates): close remaining route auth, rate-limit, and SSRF gaps

fix: make OpenAPI reload transactional and reject non-YAML frontmatter

fix(a11y): give modals, tabs, and collapsible regions real semantics

refactor: split CLI entry point from the generator engine

build: run the compile step inside pnpm test

docs(templates): document API auth, artifact ownership, and tab nav

docs: document RAG API auth and the artifact-manifest rename

fix(theme): eliminate the remaining light-mode flash on dark loads

fix(templates): focus the chat input when the assistant opens

fix(templates): revert Cherry input adoption in chat and search

refactor(templates): require cherry 0.2.12 and drop the polished shim

style(templates): use text sizing and top-align the prompt icon

chore: update dependencies

build: verify packed package installation

fix: prevent unsafe OpenAPI loading and rendering

fix: harden generated output mutations

fix(templates): match reserved routes on segment boundaries

fix(templates): preserve the chat close transition

fix: render OpenAPI JSON with the code component

docs(templates): update platform guides and add authentication

docs(templates): fix the horizontal Space usage example

chore: update dependencies

fix: harden generated security boundaries

fix(a11y): coordinate chat and search modal focus