@natjswenson/devlog 0.1.6 → 0.1.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/CHANGELOG.md +82 -0
  2. package/README.md +82 -40
  3. package/SECURITY.md +100 -0
  4. package/SKILL.md +42 -20
  5. package/bin/devlog.js +350 -121
  6. package/examples/react/DevLogPage.jsx +16 -1
  7. package/package.json +14 -9
  8. package/preview/App.jsx +34 -4
  9. package/preview/index.html +14 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@natjswenson/devlog",
3
- "version": "0.1.6",
3
+ "version": "0.1.8",
4
4
  "description": "Daily dev log generator — Claude Code skill + preview app for publishing git-based dev logs to your site",
5
5
  "license": "MIT",
6
6
  "author": "Nate Swenson",
@@ -29,6 +29,8 @@
29
29
  "preview/",
30
30
  "examples/",
31
31
  "SKILL.md",
32
+ "SECURITY.md",
33
+ "CHANGELOG.md",
32
34
  "config.example.json",
33
35
  "README.md",
34
36
  "LICENSE"
@@ -36,14 +38,17 @@
36
38
  "engines": {
37
39
  "node": ">=18"
38
40
  },
41
+ "scripts": {
42
+ "audit": "npm audit --audit-level=moderate"
43
+ },
39
44
  "dependencies": {
40
- "@vitejs/plugin-react": "^4.3.0",
41
- "kleur": "^4.1.5",
42
- "prompts": "^2.4.2",
43
- "react": "^18.3.0",
44
- "react-dom": "^18.3.0",
45
- "react-markdown": "^9.0.0",
46
- "remark-gfm": "^4.0.0",
47
- "vite": "^5.4.0"
45
+ "@vitejs/plugin-react": "6.0.1",
46
+ "kleur": "4.1.5",
47
+ "prompts": "2.4.2",
48
+ "react": "18.3.1",
49
+ "react-dom": "18.3.1",
50
+ "react-markdown": "9.1.0",
51
+ "remark-gfm": "4.0.1",
52
+ "vite": "8.0.10"
48
53
  }
49
54
  }
package/preview/App.jsx CHANGED
@@ -6,6 +6,7 @@ const owner = import.meta.env.VITE_DEVLOG_OWNER;
6
6
  const repo = import.meta.env.VITE_DEVLOG_REPO;
7
7
  const branch = import.meta.env.VITE_DEVLOG_BRANCH || 'main';
8
8
  const projectsRaw = import.meta.env.VITE_DEVLOG_PROJECTS;
9
+ const isDev = import.meta.env.DEV;
9
10
 
10
11
  const isDemo = !owner || !repo;
11
12
 
@@ -60,16 +61,39 @@ function NoProjectsScreen() {
60
61
  Env vars say you have a repo (<code>{owner}/{repo}</code>) but no projects.
61
62
  That's like buying a stage and forgetting to invite a band.
62
63
  </p>
63
- <p>Add at least one project to your config:</p>
64
+ <p>Add a project the easy way:</p>
65
+ <pre>npx @natjswenson/devlog add-project</pre>
66
+ <p>Or edit your config directly:</p>
64
67
  <pre>{`{
68
+ "targetRepo": "${owner}/${repo}",
69
+ "branch": "${branch}",
65
70
  "projects": [
66
- { "key": "myproject", "path": "...", "remote": "${owner}/myproject" }
71
+ { "key": "myproject", "label": "My Project", "path": "...", "remote": "${owner}/myproject" }
67
72
  ]
68
73
  }`}</pre>
74
+ <p>Then re-run <code>npx @natjswenson/devlog preview</code>.</p>
75
+ </div>
76
+ );
77
+ }
78
+
79
+ // Production builds without env vars: show a clear "setup required" screen,
80
+ // not the demo banner with broken fetches (since installDemoFetch is gated to DEV).
81
+ function SetupRequiredScreen() {
82
+ return (
83
+ <div className="empty-screen">
84
+ <h1>Setup required</h1>
85
+ <p>
86
+ This preview was built without the env vars that point it at a dev-log repo.
87
+ Set these in your hosting environment (Vercel/Netlify/Cloudflare/wherever):
88
+ </p>
89
+ <pre>{`VITE_DEVLOG_OWNER=your-github-username
90
+ VITE_DEVLOG_REPO=daily-dev-log
91
+ VITE_DEVLOG_BRANCH=main
92
+ VITE_DEVLOG_PROJECTS=[{"key":"myproject","label":"My Project"}]`}</pre>
69
93
  <p>
70
- Then run <code>npx @natjswenson/devlog preview</code> again, or set
71
- <code> VITE_DEVLOG_PROJECTS</code> directly in <code>preview/.env.local</code>.
94
+ Or, if you're trying this locally, the friendlier path is:
72
95
  </p>
96
+ <pre>npx @natjswenson/devlog init &amp;&amp; npx @natjswenson/devlog preview</pre>
73
97
  </div>
74
98
  );
75
99
  }
@@ -77,6 +101,12 @@ function NoProjectsScreen() {
77
101
  export default function App() {
78
102
  const [activeKey, setActiveKey] = useState((projects && projects[0]?.key) || DEMO_PROJECT_KEY);
79
103
 
104
+ // Production build with no env vars: show actionable setup screen
105
+ // (demo fetch override is DEV-only, so demo entries would 404 here).
106
+ if (isDemo && !isDev) {
107
+ return <SetupRequiredScreen />;
108
+ }
109
+
80
110
  if (!isDemo && !projects) {
81
111
  return <NoProjectsScreen />;
82
112
  }
package/preview/index.html CHANGED
@@ -3,6 +3,20 @@
3
3
  <head>
4
4
  <meta charset="UTF-8" />
5
5
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
6
+ <!--
7
+ Content-Security-Policy: defense-in-depth for the preview app.
8
+ - 'self' for scripts/styles (no inline JS, no eval)
9
+ - 'unsafe-inline' for styles only — required by Vite's HMR runtime in dev
10
+ and react-markdown's prismjs (none used here, but standard practice)
11
+ - connect to raw.githubusercontent.com for entry fetches; api.github.com
12
+ for any future repo metadata; demo-mode.local for the in-browser fetch
13
+ override that powers demo mode without env vars
14
+ - no objects, no frames, no plugins
15
+ Production build: replace 'unsafe-inline' with hashes/nonces if you
16
+ configure Vite to emit them.
17
+ -->
18
+ <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https://raw.githubusercontent.com https://api.github.com https://demo-mode.local; object-src 'none'; frame-src 'none'; base-uri 'self'; form-action 'none';" />
19
+ <meta name="referrer" content="no-referrer-when-downgrade" />
6
20
  <title>devlog preview</title>
7
21
  <style>
8
22
  :root {