@plinth-music/cli 0.23.1 → 0.23.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +47 -0
- package/dist/build-stamp.json +2 -2
- package/dist/cli.js +687 -437
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -2,6 +2,53 @@
|
|
|
2
2
|
|
|
3
3
|
Notable changes to `@plinth-music/cli`. Grouped by what a user notices, not by PR.
|
|
4
4
|
|
|
5
|
+
## 0.23.2 - 2026-10-04
|
|
6
|
+
|
|
7
|
+
Two code PRs since `0.23.1` (`v0.23.1..ea615a2`: #217, #218; #215, #216 and #219 docs).
|
|
8
|
+
A patch: fixes only, no new command or sync surface.
|
|
9
|
+
|
|
10
|
+
⚠️ **Text from Plinth can no longer run as code on your laptop** (#218). A document,
|
|
11
|
+
artist, project or task body that opened with a `---js` or `---javascript` block was
|
|
12
|
+
executed by the daemon of every member who pulled it, because the frontmatter library
|
|
13
|
+
the CLI uses evaluates JavaScript frontmatter. The daemon now refuses that engine
|
|
14
|
+
everywhere in the process and never reads a body as frontmatter when it writes a file,
|
|
15
|
+
so such a body lands in the mirror as plain text. This is the laptop half of a security
|
|
16
|
+
fix whose server half is already live: it protects a machine only once that machine
|
|
17
|
+
runs this version.
|
|
18
|
+
|
|
19
|
+
⚠️ **One save that removes most of a large file is now held for `plinth confirm`**
|
|
20
|
+
(#217). A single save that keeps at most half of a file and removes at least 5,000
|
|
21
|
+
characters of body (100 KB under `files/`) is held on its own, the way a large batch
|
|
22
|
+
already was. Before, a 139,194-character roster file was cut to 7,554 characters and
|
|
23
|
+
synced unheld. Small single edits and deletes still sync straight through.
|
|
24
|
+
|
|
25
|
+
⚠️ **A file whose frontmatter cannot be read is held and said, never sent mangled**
|
|
26
|
+
(#217). Before, the first save stayed on the laptop while `plinth status` reported
|
|
27
|
+
every write synced, and the next change sent the whole raw file to Plinth as the body
|
|
28
|
+
with its fields emptied. Now nothing is sent, `plinth status` lists it under Rejected
|
|
29
|
+
with the fix, and the record clears when the file is fixed, moved or deleted. One
|
|
30
|
+
broken file no longer stops the daemon starting.
|
|
31
|
+
|
|
32
|
+
**A body that opens with `---` is no longer corrupted on pull** (#218). Any such file
|
|
33
|
+
is rewritten correctly once, on the first pull after updating. Every other file is
|
|
34
|
+
written byte for byte as before.
|
|
35
|
+
|
|
36
|
+
**Extracted texts stuck as "local edits" heal on their own** (#217). A file under
|
|
37
|
+
`views/extracted/` that the daemon had re-rendered itself was reported as a member's
|
|
38
|
+
edit. It is now recognised as the daemon's own and repaired on the next pass.
|
|
39
|
+
|
|
40
|
+
**What is not proven.**
|
|
41
|
+
|
|
42
|
+
- The code-execution hole was reproduced locally only, never against production. The
|
|
43
|
+
fix is covered by tests that drive the pull for every entity type that carries a
|
|
44
|
+
body (forced red on the previous code: 28 of 31 fail) and by a spawned built binary.
|
|
45
|
+
- #217 was driven live on the test workspace on a build one review round older than
|
|
46
|
+
the merged code.
|
|
47
|
+
- Two saves under about a second apart can still be overwritten by the daemon's own
|
|
48
|
+
earlier push. Not fixed here; it belongs to the Sync Conflicts work.
|
|
49
|
+
- A thread file whose frontmatter cannot be read still makes the pull fail loudly,
|
|
50
|
+
rather than being held.
|
|
51
|
+
|
|
5
52
|
## 0.23.1 - 2026-09-29
|
|
6
53
|
|
|
7
54
|
Two code PRs since `0.23.0` (`v0.23.0..0dd34dc`: #212, #213; #209, #210 and #211 docs).
|
package/dist/build-stamp.json
CHANGED