@adobe/aem-cli 16.14.0 → 16.15.1

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [16.15.1](https://github.com/adobe/helix-cli/compare/v16.15.0...v16.15.1) (2025-09-22)
+
+
+### Bug Fixes
+
+* inject hlx:proxyUrl meta tag for 401 and 403 HTML responses ([ff4f2e8](https://github.com/adobe/helix-cli/commit/ff4f2e84e897676141601fccb165d678715b3ac8)), closes [#2414](https://github.com/adobe/helix-cli/issues/2414)
+
+# [16.15.0](https://github.com/adobe/helix-cli/compare/v16.14.0...v16.15.0) (2025-09-22)
+
+
+### Features
+
+* enable auto-reload for static HTML resources (fixes [#2400](https://github.com/adobe/helix-cli/issues/2400)) ([0866ede](https://github.com/adobe/helix-cli/commit/0866edea1579d6e1c207d756e5ee9dbe266a5e6c))
+* **git-utils:** add DNS-valid tag filtering in getBranch ([fd367c4](https://github.com/adobe/helix-cli/commit/fd367c421187cf75263b32bdc5e83a886f29ef9a))
+* **git-utils:** enhance DNS name validation with stricter rules and length checks ([9702a63](https://github.com/adobe/helix-cli/commit/9702a63a26949d8dce135a17192b6801508d848c))
+
 # [16.14.0](https://github.com/adobe/helix-cli/compare/v16.13.2...v16.14.0) (2025-09-19)
 
 

package/README.md

@@ -212,6 +212,8 @@ These proxies use a private certificate authority (CA) to sign the certificates
 servers they intercept. To make Node.js trust the server certificate, you need to add
 the CA certificate to the list of trusted CAs.
 
+### Option 1: Using IT-provided CA certificate
+
 The CA certificate is typically provided by your IT department. You can ask them for
 the CA certificate and save it to a file, e.g. `my-ca.crt`.
 
@@ -223,7 +225,29 @@ export NODE_EXTRA_CA_CERTS=my-ca.crt
 aem up
 ```
 
-This will make Node.js trust the server certificate and `aem up` should work.
+### Option 2: Extracting certificate from browser
+
+If you don't have access to the CA certificate from your IT department, you can extract it directly
+from your browser:
+
+1. Access the AEM admin URL in your browser (e.g., `https://admin.hlx.page/sidekick/owner-name/repo-name/github-branch-name/config.json`)
+2. Click on the padlock icon in the address bar and view the certificate details
+3. Export the certificate chain as a Base64 encoded `.pem` file
+4. Save it to a directory (e.g., `certs/hlx.page.pem`)
+5. Set the environment variable and run aem:
+
+```bash
+export NODE_EXTRA_CA_CERTS=./certs/hlx.page.pem
+aem up
+```
+
+On Windows, use `set` instead of `export`:
+```cmd
+set NODE_EXTRA_CA_CERTS=./certs/hlx.page.pem
+aem up
+```
+
+Either approach will make Node.js trust the server certificate and `aem up` should work.
 
 ## `npm install` fails with `File exists: /opt/homebrew/bin/hlx`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adobe/aem-cli",
-  "version": "16.14.0",
+  "version": "16.15.1",
   "description": "AEM CLI",
   "main": "index.js",
   "type": "module",

package/src/git-utils.js

@@ -135,6 +135,28 @@ export default class GitUtils {
     return false;
   }
 
+  /**
+   * Checks if a name is valid for use in a DNS subdomain.
+   * DNS labels must:
+   * - Be between 1 and 63 characters long
+   * - Contain only alphanumeric characters and hyphens
+   * - Not start or end with a hyphen
+   * - Not contain dots or other special characters
+   * @param {string} name the name to validate
+   * @returns {boolean} true if valid for DNS
+   */
+  static isValidDNSName(name) {
+    // Check length (DNS labels must be 1-63 characters)
+    if (!name || name.length > 63) {
+      return false;
+    }
+
+    // DNS labels can only contain alphanumeric characters and hyphens
+    // They cannot start or end with hyphens
+    // They cannot contain dots or other special characters
+    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$/.test(name);
+  }
+
   /**
    * Returns the name of the current branch. If `HEAD` is at a tag, the name of the tag
    * will be returned instead, if head is at a commit, fallback will be returned.
@@ -178,7 +200,11 @@ export default class GitUtils {
         ? await git.resolveRef({ fs, dir, ref: obj.object.object }) // annotated tag
         : oid; // lightweight tag
       if (commitSha === rev) {
-        return tag;
+        // Only return tags that are valid for DNS names
+        // Skip tags containing dots or other invalid characters
+        if (GitUtils.isValidDNSName(tag)) {
+          return tag;
+        }
       }
     }
 

package/src/server/HelixServer.js

@@ -13,7 +13,7 @@ import crypto from 'crypto';
 import express from 'express';
 import { promisify } from 'util';
 import path from 'path';
-import { lstat } from 'fs/promises';
+import { lstat, readFile } from 'fs/promises';
 import compression from 'compression';
 import utils from './utils.js';
 import RequestContext from './RequestContext.js';
@@ -270,16 +270,32 @@ export class HelixServer extends BaseServer {
 
     // try to serve static
     try {
-      await sendFile(filePath, {
-        dotfiles: 'allow',
-        headers: {
+      // Check if it's an HTML file and live reload is enabled
+      if (liveReload && filePath.endsWith('.html')) {
+        // Read the HTML file and inject the livereload script
+        let htmlContent = await readFile(filePath, 'utf-8');
+        htmlContent = utils.injectLiveReloadScript(htmlContent, this);
+
+        res.set({
+          'content-type': 'text/html; charset=utf-8',
           'access-control-allow-origin': '*',
-        },
-      });
-      if (liveReload) {
+        });
+        res.send(htmlContent);
         liveReload.registerFile(ctx.requestId, filePath);
+        log.debug(`${pfx}served local HTML file with livereload: ${filePath}`);
+      } else {
+        // Serve other files normally
+        await sendFile(filePath, {
+          dotfiles: 'allow',
+          headers: {
+            'access-control-allow-origin': '*',
+          },
+        });
+        if (liveReload) {
+          liveReload.registerFile(ctx.requestId, filePath);
+        }
+        log.debug(`${pfx}served local file ${filePath}`);
       }
-      log.debug(`${pfx}served local file ${filePath}`);
       return;
     } catch (e) {
       log.debug(`${pfx}unable to deliver local file ${ctx.path} - ${e.stack || e}`);

package/src/server/utils.js

@@ -325,6 +325,7 @@ window.LiveReloadOptions = {
     }
 
     const isHTML = ret.status === 200 && contentType.indexOf('text/html') === 0;
+    const isHTMLWithAuthError = (ret.status === 401 || ret.status === 403) && contentType.indexOf('text/html') === 0;
     const livereload = isHTML && opts.injectLiveReload;
     const replaceHead = isHTML && opts.headHtml;
     const doIndex = isHTML && opts.indexer && url.indexOf('.plain.html') < 0;
@@ -380,6 +381,24 @@ window.LiveReloadOptions = {
         .send(textBody);
       return;
     }
+    if (isHTMLWithAuthError) {
+      // Handle HTML responses with 401/403 status - inject meta tag
+      let textBody = await ret.text();
+      if (ctx.log.level === 'silly') {
+        ctx.log.trace(textBody);
+        ctx.log.trace(`[${id}] <<<--------------------------`);
+      }
+      textBody = utils.injectMeta(textBody, {
+        'hlx:proxyUrl': url,
+      });
+
+      res
+        .set(respHeaders)
+        .status(ret.status)
+        .send(textBody);
+      return;
+    }
+
     if (ret.status === 401 || ret.status === 403) {
       const reqHeaders = req.headers;
       if (opts.autoLogin && opts.loginPath