@farming-labs/docs 0.2.131 → 0.2.132

package/dist/agent-evals.mjs

@@ -1,3 +1,4 @@
+import { toPublicDocsSourcePath } from "./public-source-path.mjs";
 import { upsertPageAgentContractMarkdown } from "./agent-contract.mjs";
 import { findDocsMarkdownSection, stripDocsGeneratedAgentContractMarkers } from "./markdown-sections.mjs";
 import { digestDocsRetrievalContent } from "./retrieval-digest.mjs";
@@ -571,7 +572,7 @@ function hydrateDocsEvaluationSearchSource(result, index, pagesByUrl, contentMod
 		url,
 		section: pageSection?.title ?? result.section,
 		anchor: pageSection?.anchor ?? anchor,
-		sourcePath: page?.sourcePath,
+		sourcePath: toPublicDocsSourcePath(page?.sourcePath),
 		lastModified: result.source?.lastModified ?? page?.lastModified,
 		locale: scope?.locale[0] ?? provenanceScope?.locale?.[0],
 		framework: scope?.framework[0] ?? provenanceScope?.framework?.[0],

package/dist/api-reference.mjs

@@ -590,7 +590,7 @@ function buildApiReferenceOpenApiDocument(config, options) {
 			if (overlays.some((overlay) => !isLocalSpecSource(overlay))) throw new Error("Remote OpenAPI overlays require the async API reference builder.");
 			return normalizeConfiguredOpenApiDocument(readLocalOpenApiDocument(specUrl, options.rootDir, overlays), config, options.baseUrl, specUrl, selectedVersion);
 		} catch (error) {
-			return buildUnavailableOpenApiDocument(config, `Unable to load the configured OpenAPI document. ${error instanceof Error ? error.message : "Unknown error"}`);
+			return buildUnavailableOpenApiDocument(config, `Unable to load the configured OpenAPI document. ${redactProjectRoot(error instanceof Error ? error.message : "Unknown error", options.rootDir)}`);
 		}
 		return buildUnavailableOpenApiDocument(config, `Remote OpenAPI specs require the async API reference builder. Use the framework route helper or buildApiReferenceOpenApiDocumentAsync().`);
 	}
@@ -601,9 +601,18 @@ async function buildApiReferenceOpenApiDocumentAsync(config, options) {
 	try {
 		return await loadApiReferenceOpenApiDocumentAsync(config, options);
 	} catch (error) {
-		return buildUnavailableOpenApiDocument(config, `Unable to load the configured OpenAPI document. ${error instanceof Error ? error.message : "Unknown error"}`);
+		return buildUnavailableOpenApiDocument(config, `Unable to load the configured OpenAPI document. ${redactProjectRoot(error instanceof Error ? error.message : "Unknown error", options.rootDir)}`);
 	}
 }
+function redactProjectRoot(message, rootDir = process.cwd()) {
+	const roots = new Set([resolve(rootDir)]);
+	try {
+		roots.add(realpathSync(resolve(rootDir)));
+	} catch {}
+	let redacted = message;
+	for (const root of [...roots].sort((left, right) => right.length - left.length)) redacted = redacted.split(`${root}${sep}`).join("").split(root).join(".");
+	return redacted;
+}
 /**
 * Load the resolved OpenAPI document without replacing diagnostics with an unavailable schema.
 * This is used by CLI health checks that need the original parsing, reference, and overlay error.

package/dist/mcp.mjs

@@ -1,6 +1,7 @@
 import { filterDocsPagesByAccess } from "./access.mjs";
 import { createDocsAgentTraceContext, createDocsAgentTraceId, emitDocsAgentTraceEvent, emitDocsAnalyticsEvent } from "./analytics.mjs";
 import { toDocsMarkdownUrl } from "./urls.mjs";
+import { toPublicDocsSourcePath } from "./public-source-path.mjs";
 import { buildDocsOkfBundle, normalizeDocsOkfTrustMetadataInput, resolveDocsOkfConfig } from "./okf.mjs";
 import { isDocsMcpOAuthScopeToken, isDocsMcpProtectedResourceMetadataPath, isDocsMcpResourcePath, normalizeDocsMcpAuthorizationServerUrls, normalizeDocsMcpEndpointPath, resolveDocsMcpProtectedResourceMetadataLocation, resolveDocsMcpResourceLocation } from "./mcp-auth.mjs";
 import { hasStructuredPageAgentContract, normalizePageAgentFrontmatter, renderPageAgentContractMarkdown, upsertPageAgentContractMarkdown } from "./agent-contract.mjs";
@@ -4276,7 +4277,7 @@ async function createDocsMcpServer(options) {
 					url: page.url,
 					title: page.title,
 					...page.description ? { description: page.description } : {},
-					...page.sourcePath ? { sourcePath: page.sourcePath } : {},
+					...toPublicDocsSourcePath(page.sourcePath) ? { sourcePath: toPublicDocsSourcePath(page.sourcePath) } : {},
 					...page.lastModified ? { lastModified: page.lastModified } : {}
 				},
 				contract
@@ -6405,7 +6406,7 @@ function toDocsListPageSummary(page) {
 		description: page.description,
 		agent: toAgentContractSummary(page.agent),
 		icon: page.icon,
-		sourcePath: page.sourcePath,
+		sourcePath: toPublicDocsSourcePath(page.sourcePath),
 		lastModified: page.lastModified
 	};
 }
@@ -6703,7 +6704,7 @@ function extractDocsMcpCodeExamples(page) {
 					url: page.url,
 					title: page.title,
 					description: page.description,
-					sourcePath: page.sourcePath,
+					sourcePath: toPublicDocsSourcePath(page.sourcePath),
 					lastModified: page.lastModified
 				},
 				language: parsed.language,
@@ -6777,7 +6778,7 @@ function getCodeExampleSearchText(example) {
 		example.page.url,
 		example.page.title,
 		example.page.description,
-		example.page.sourcePath,
+		toPublicDocsSourcePath(example.page.sourcePath),
 		example.language,
 		example.title,
 		example.framework,
@@ -6885,7 +6886,7 @@ function toStructuredDocsMcpPage(page) {
 		description: page.description,
 		related: page.related,
 		icon: page.icon,
-		sourcePath: page.sourcePath,
+		sourcePath: toPublicDocsSourcePath(page.sourcePath),
 		lastModified: page.lastModified,
 		locale: page.locale,
 		framework: page.framework,
@@ -7079,7 +7080,7 @@ async function buildDocsMcpContext(options) {
 			url: sourceUrl,
 			section: selectedSection?.title,
 			anchor,
-			sourcePath: page.sourcePath,
+			sourcePath: toPublicDocsSourcePath(page.sourcePath),
 			lastModified: result.source?.lastModified ?? page.lastModified,
 			locale: scope.locale,
 			framework: scope.framework,

package/dist/okf.mjs

@@ -1,3 +1,5 @@
+import { toPublicDocsSourcePath } from "./public-source-path.mjs";
+
 //#region src/okf.ts
 const DOCS_OKF_VERSION = "0.2";
 const DOCS_OKF_BUNDLE_FORMAT = "open-knowledge-format.v0.2";
@@ -102,12 +104,15 @@ function resolveDocsOkfTrustMetadata(page, value, now = /* @__PURE__ */ new Date
 		at: bestTimestamp ?? "1970-01-01T00:00:00.000Z"
 	};
 	const sources = [...authored.sources ?? config.sources ?? []];
-	if (sources.length === 0) sources.push({
-		resource: page.canonicalUrl ?? page.url,
-		...page.sourcePath ? { id: page.sourcePath } : {},
-		title: page.title,
-		...bestTimestamp ? { last_modified: bestTimestamp } : {}
-	});
+	if (sources.length === 0) {
+		const sourcePath = toPublicDocsSourcePath(page.sourcePath);
+		sources.push({
+			resource: page.canonicalUrl ?? page.url,
+			...sourcePath ? { id: sourcePath } : {},
+			title: page.title,
+			...bestTimestamp ? { last_modified: bestTimestamp } : {}
+		});
+	}
 	const verified = [...authored.verified ?? config.verified ?? []];
 	const staleAfter = authored.stale_after ?? config.stale_after ?? (config.staleAfterDays && bestTimestamp ? addDays(bestTimestamp, config.staleAfterDays) : void 0);
 	return {
@@ -123,7 +128,7 @@ function resolveDocsOkfTrustMetadata(page, value, now = /* @__PURE__ */ new Date
 function buildDocsOkfBundle(pages, value) {
 	const config = resolveDocsOkfConfig(value);
 	const documents = pages.map((page) => ({
-		id: page.sourcePath ?? page.url,
+		id: toPublicDocsSourcePath(page.sourcePath) ?? page.url,
 		url: page.canonicalUrl ?? page.url,
 		title: page.title,
 		...page.content ? { content: page.content } : {},

package/dist/public-source-path.mjs

@@ -0,0 +1,17 @@
+//#region src/public-source-path.ts
+/**
+* A page's `sourcePath` is whatever the loading server used to read the file.
+* Absolute filesystem paths (`/var/task/...`, `C:\...`, UNC shares, `file:` URLs)
+* and paths that climb out of the content tree describe the deployment rather
+* than the docs, so agent-facing output only keeps content-relative paths.
+*/
+const NON_PUBLIC_SOURCE_PATH = /^(?:[\\/]|[a-z]:(?:[\\/]|$)|file:|\.\.(?:[\\/]|$))/i;
+function toPublicDocsSourcePath(value) {
+	if (typeof value !== "string") return void 0;
+	const normalized = value.trim().replace(/\\/g, "/").replace(/^\.\/+/, "");
+	if (!normalized || NON_PUBLIC_SOURCE_PATH.test(normalized)) return void 0;
+	return normalized;
+}
+
+//#endregion
+export { toPublicDocsSourcePath };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@farming-labs/docs",
-  "version": "0.2.131",
+  "version": "0.2.132",
   "description": "Modern, flexible MDX-based docs framework — core types, config, and CLI",
   "keywords": [
     "docs",