@webship.co/workspace 1.0.2 → 1.0.4

package/core/docs/releases.md

@@ -1,6 +1,6 @@
 # Releases
 
-Every package is versioned together: `@webship.co/workspace` (the core) and every `@webship.co/workspace-<name>`. Versions so far: 1.0.0-alpha1 (the first publish), 1.0.0-beta1, 1.0.0-beta2, 1.0.0-rc1, 1.0.0, 1.0.1 (the core and the git, ide and graph plugins only), 1.0.2.
+Every package is versioned together: `@webship.co/workspace` (the core) and every `@webship.co/workspace-<name>`. Versions so far: 1.0.0-alpha1 (the first publish), 1.0.0-beta1, 1.0.0-beta2, 1.0.0-rc1, 1.0.0, 1.0.1 (the core and the git, ide and graph plugins only), 1.0.2, 1.0.3 and 1.0.4 (the core only).
 
 ## How a change lands
 

package/core/scripts/functions/fun-build-distribution.sh

@@ -117,15 +117,6 @@ function build_distribution() {
     fi
   fi
 
-  # A failed create-project (an upstream patch that no longer applies, a yanked tag) has to stop
-  # the build here. Every step below assumes a real vendor/autoload.php, so carrying on used to
-  # mean "installing" nothing and then announcing success.
-  if ! ddev composer create-project ${distribution_project_template}:${site_version} . --no-interaction ; then
-    echo "composer create-project failed for ${distribution_project_template}:${site_version} — aborting, nothing was installed." ;
-    cd ${WORKSPACE_ROOT}/${doc_name};
-    return 1 ;
-  fi
-
   # Some project templates ship their own .ddev config that
   # changes the docroot/database/webimage packages after our initial ddev
   # config. Re-align: keep the database type we already provisioned, drop

package/core/scripts/functions/fun-build-webships.sh

@@ -55,6 +55,10 @@ function webships_create_project() {
   # Keep the API site templates as recipes, the way the project template does:
   # the installer finds them in recipes/ without Composer unpacking them.
   ddev composer config --json --merge extra.drupal-recipe-unpack.ignore '["drupal/webships_starter", "drupal/webapi_starter"]' ;
+  # The project template ships its own .ddev/config.yaml, which pins an older Node.js:
+  # re-align to the workspace's Node.js (24, like Drupal core) and restart on it.
+  ddev config --nodejs-version=$(ddev_nodejs_version) --webimage-extra-packages="" ;
+  ddev restart ;
 }
 
 # The shared steps after a successful install.

package/core/scripts/functions/fun-default-settings.sh

@@ -14,7 +14,8 @@ function set_default_settings() {
 
   if [ -f "${settings_file}" ]; then
     # Fixed, not a setting: it has to match the config/sync created above.
-    if ! grep -q "config_sync_directory" "${settings_file}" ; then
+    # An active assignment only: default.settings.php carries the same line commented out.
+    if ! grep -qE "^[[:space:]]*\\\$settings\['config_sync_directory'\]" "${settings_file}" ; then
       # Defaulted here rather than asked for in the settings: ../config/sync is the Drupal
       # convention and the folder created just above. Setting config_sync_directory in
       # settings.yml still overrides it.

package/core/scripts/functions/fun-testing.sh

@@ -62,12 +62,16 @@ function testing_write_browser_libs_build() {
 # they survive `ddev restart` — installed by the workspace testing tooling.
 # Playwright resolves the package names for this Debian release itself; the apt
 # list is the fallback for a build with no network access to npm.
-RUN npx --yes playwright@1.56 install-deps chromium || \
+# The third-party PHP repository of the web image is set aside while apt runs: an expired key
+# there would fail the whole image build, and chromium's libraries are Debian's own.
+RUN mkdir -p /tmp/apt-off && (mv /etc/apt/sources.list.d/php.list /tmp/apt-off/ 2>/dev/null || true) && \
+    (npx --yes playwright@1.56 install-deps chromium || \
     (apt-get update && apt-get install -y --no-install-recommends \
       libnspr4 libnss3 libdbus-1-3 libatk1.0-0t64 libatk-bridge2.0-0t64 libcups2t64 \
       libdrm2 libatspi2.0-0t64 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 \
-      libgbm1 libxkbcommon0 libasound2t64 libpango-1.0-0 libcairo2 fonts-liberation \
-      && rm -rf /var/lib/apt/lists/*)
+      libgbm1 libxkbcommon0 libasound2t64 libpango-1.0-0 libcairo2 fonts-liberation)) ; \
+    status=$? ; (mv /tmp/apt-off/php.list /etc/apt/sources.list.d/ 2>/dev/null || true) ; \
+    rm -rf /var/lib/apt/lists/* ; exit $status
 DOCKERFILE
 }
 
@@ -179,7 +183,6 @@ function testing_configure() {
     echo "";
     echo "Installing the JS dependencies and the chromium browser.";
     ddev ${runner} install || true ;
-    testing_write_browser_libs_build "${project_path}" ;
     testing_ensure_browser_libs "${project_path}" || true ;
     testing_install_browsers || true ;
   fi
@@ -255,6 +258,7 @@ function testing_run() {
   [ "${HEADED}" == 'yes' ] && env_prefix="${env_prefix} HEADLESS=false";
   local cucumber="node ./node_modules/@cucumber/cucumber/bin/cucumber.js --config cucumber.js";
   local filter="";
+  local run_log; run_log=$(mktemp);
   # Narrowing to one feature is an ENV var here, not a positional argument: these projects'
   # cucumber.js sets `paths: [process.env.FEATURES || 'tests/features/**/*.feature']`, and a config
   # `paths` wins over the path you type — passing it positionally silently ran all 275 scenarios.
@@ -262,7 +266,7 @@ function testing_run() {
   if [ ! "${TESTING_PATH}" == '_none_' ] ; then
     local features="${TESTING_PATH}";
     case "${features}" in
-      *.feature|*'*'*) : ;;
+      *.feature|*.feature:[0-9]*|*'*'*) : ;;
       *) features="${features%/}/**/*.feature" ;;
     esac
     env_prefix="${env_prefix} FEATURES=\"${features}\"";
@@ -277,8 +281,14 @@ function testing_run() {
 
   if [ -n "${filter}" ] ; then
     echo "  ddev exec ${env_prefix} ${cucumber} ${filter}";
-    ddev exec "${env_prefix} ${cucumber} ${filter}" ;
-    status=$? ;
+    ddev exec "${env_prefix} ${cucumber} ${filter}" 2>&1 | tee "${run_log}" ;
+    status=${PIPESTATUS[0]} ;
+    # A run that matched nothing exits 0 too: a wrong --path or tag expression must not read as green.
+    if grep -qE '^0 scenarios' "${run_log}" ; then
+      echo "  No scenario ran: check the --path or --tags you gave." ;
+      status=3 ;
+    fi
+    rm -f "${run_log}" ;
   else
     script="test:${BROWSER}";
     echo "  ddev ${runner} run ${script}";
@@ -320,10 +330,10 @@ function testing_run() {
 function testing_command() {
   # --configure is the default, so it is only meaningful as a word — except together with --run,
   # where "set it up and then run it" is a real thing to ask for and used to lose the setup half.
-  if [ "${CONFIGURE}" == 'yes' ] || [ ! "${RUN}" == 'yes' ] ; then
+  if [ "${CONFIGURE}" == 'yes' ] || { [ ! "${RUN}" == 'yes' ] && [ ! "${DRY_RUN}" == 'yes' ] ; } ; then
     testing_configure || return 1 ;
   fi
-  if [ "${RUN}" == 'yes' ] ; then
+  if [ "${RUN}" == 'yes' ] || [ "${DRY_RUN}" == 'yes' ] ; then
     testing_run ;
   fi
 }

package/core/workspace-app/docs/README.md

@@ -247,6 +247,7 @@ Some releases change the container image; the notes say so, and then
 | the hard rules and the operational traps | `docs/workspace-tips-and-rules.md` |
 | what changed, dated | `worklogs/` |
 
-Every picture in `screenshots/` is used by one of these guides or the top `README.md`, and all of them
-were taken on 22 October 2026 at 1920×1080, in light mode (the README's dark copies aside). A pull
-request carries its own pictures on its branch.
+The pictures in `screenshots/` are used by these guides; `assistant/` and `readme/` hold spare ones of
+the assistant's avatar and of the pages in light and dark. All of them were taken on 13 November 2026
+on a Webship Workspace with demo content, at 1920×1080 (the home page is taller, to show every card),
+in light mode unless the name says dark. A pull request carries its own pictures on its branch.

package/core/workspace-app/docs/USER-GUIDE.md

@@ -399,7 +399,7 @@ Claude ends the way it would if you typed it, and the conversation is kept. When
 project or folder that has one, the same menu offers **Resume Claude Code**, which resumes the last conversation
 with `claude --resume` in that folder.
 
-![The SCREENS menu on a card: its sessions, Resume Claude Code, New screen here and Claude Code here](screenshots/screens-menu.png)
+![The SCREENS menu on a card: its session, New screen here, Claude Code here and All screens](screenshots/screens-menu.png)
 
 ### Watch something long
 
@@ -459,7 +459,7 @@ Pick the **Provider** first: OpenAI, Google Gemini, xAI, Stability AI or Claude
 quality fields change with it. A provider with no key on this machine is listed but greyed out, with the key
 to set (`ai_providers.<provider>.api_key` in `core/config/settings.yml`).
 
-![The provider select: the ones without a key say which key to set](screenshots/images/providers.png)
+![Generate with AI: the form, with Claude Code CLI as the provider](screenshots/images/providers.png)
 
 **Claude Code** needs no key: it uses your own Claude Code login, so there is no API charge. It cannot paint
 a photo, so it draws a flat illustration as an SVG, and the dashboard turns it into a PNG as well; you keep

package/core/workspace-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspace-dashboard",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "The Webship Workspace dashboard: a lean core (workspaces, builders, settings, the assistant shell, the plugin system) that every feature joins as a @webship.co/workspace-<name> plugin — required with npm, then activated, installed and configured.",
   "license": "ISC",
   "main": "server.js",

package/core/workspace-app/server.js

@@ -7875,7 +7875,7 @@ Summarise what you changed and how to verify it`,
           // An SVG is a document that can carry script; shown on its own it runs none.
           ...(type === 'image/svg+xml' ? { 'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; sandbox" } : {}),
         });
-        return fs.createReadStream(file).pipe(res);
+        return fs.createReadStream(real).pipe(res);
       }
       const argsMatch = pathname.match(/^\/fragments\/([a-z0-9_-]+)\/builder-args$/);
       if (argsMatch && isValidWorkspace(argsMatch[1])) {

package/core/workspace-app/tests/unit/files-route-stream.test.js

@@ -0,0 +1,16 @@
+// The /files/<workspace>/<path> route resolves the file to `real` and must stream that. It streamed
+// `file`, a name the route never defines, so every plain (non-range) request sent headers and no body.
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const path = require('path');
+
+test('the files route streams the file it resolved', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', '..', 'server.js'), 'utf8');
+  const start = src.indexOf('filesBrowser.realFileIn(workspaceDir(fileMatch[1]), name)');
+  assert.ok(start > 0, 'the files route was not found');
+  const route = src.slice(start, src.indexOf('builder-args', start));
+  const streams = [...route.matchAll(/fs\.createReadStream\((\w+)/g)].map((m) => m[1]);
+  assert.ok(streams.length >= 2, 'expected the range branch and the whole-file branch');
+  for (const name of streams) assert.strictEqual(name, 'real', `the route streams "${name}", which it does not define`);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webship.co/workspace",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Webship Workspace: a container-based development workspace with a web dashboard. The core ships empty; workspace folders, hosting providers, git forges, container runtimes and features are @webship.co/workspace-<name> plugins you add one at a time.",
   "license": "GPL-2.0-or-later",
   "repository": {