@webship.co/workspace 1.0.3 → 1.0.4

package/core/docs/releases.md

@@ -1,6 +1,6 @@
 # Releases
 
-Every package is versioned together: `@webship.co/workspace` (the core) and every `@webship.co/workspace-<name>`. Versions so far: 1.0.0-alpha1 (the first publish), 1.0.0-beta1, 1.0.0-beta2, 1.0.0-rc1, 1.0.0, 1.0.1 (the core and the git, ide and graph plugins only), 1.0.2, 1.0.3 (the core only).
+Every package is versioned together: `@webship.co/workspace` (the core) and every `@webship.co/workspace-<name>`. Versions so far: 1.0.0-alpha1 (the first publish), 1.0.0-beta1, 1.0.0-beta2, 1.0.0-rc1, 1.0.0, 1.0.1 (the core and the git, ide and graph plugins only), 1.0.2, 1.0.3 and 1.0.4 (the core only).
 
 ## How a change lands
 

package/core/workspace-app/docs/README.md

@@ -247,6 +247,7 @@ Some releases change the container image; the notes say so, and then
 | the hard rules and the operational traps | `docs/workspace-tips-and-rules.md` |
 | what changed, dated | `worklogs/` |
 
-Every picture in `screenshots/` is used by one of these guides or the top `README.md`, and all of them
-were taken on 22 October 2026 at 1920×1080, in light mode (the README's dark copies aside). A pull
-request carries its own pictures on its branch.
+The pictures in `screenshots/` are used by these guides; `assistant/` and `readme/` hold spare ones of
+the assistant's avatar and of the pages in light and dark. All of them were taken on 13 November 2026
+on a Webship Workspace with demo content, at 1920×1080 (the home page is taller, to show every card),
+in light mode unless the name says dark. A pull request carries its own pictures on its branch.

package/core/workspace-app/docs/USER-GUIDE.md

@@ -399,7 +399,7 @@ Claude ends the way it would if you typed it, and the conversation is kept. When
 project or folder that has one, the same menu offers **Resume Claude Code**, which resumes the last conversation
 with `claude --resume` in that folder.
 
-![The SCREENS menu on a card: its sessions, Resume Claude Code, New screen here and Claude Code here](screenshots/screens-menu.png)
+![The SCREENS menu on a card: its session, New screen here, Claude Code here and All screens](screenshots/screens-menu.png)
 
 ### Watch something long
 
@@ -459,7 +459,7 @@ Pick the **Provider** first: OpenAI, Google Gemini, xAI, Stability AI or Claude
 quality fields change with it. A provider with no key on this machine is listed but greyed out, with the key
 to set (`ai_providers.<provider>.api_key` in `core/config/settings.yml`).
 
-![The provider select: the ones without a key say which key to set](screenshots/images/providers.png)
+![Generate with AI: the form, with Claude Code CLI as the provider](screenshots/images/providers.png)
 
 **Claude Code** needs no key: it uses your own Claude Code login, so there is no API charge. It cannot paint
 a photo, so it draws a flat illustration as an SVG, and the dashboard turns it into a PNG as well; you keep

package/core/workspace-app/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspace-dashboard",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "The Webship Workspace dashboard: a lean core (workspaces, builders, settings, the assistant shell, the plugin system) that every feature joins as a @webship.co/workspace-<name> plugin — required with npm, then activated, installed and configured.",
   "license": "ISC",
   "main": "server.js",

package/core/workspace-app/server.js

@@ -7875,7 +7875,7 @@ Summarise what you changed and how to verify it`,
           // An SVG is a document that can carry script; shown on its own it runs none.
           ...(type === 'image/svg+xml' ? { 'Content-Security-Policy': "default-src 'none'; style-src 'unsafe-inline'; sandbox" } : {}),
         });
-        return fs.createReadStream(file).pipe(res);
+        return fs.createReadStream(real).pipe(res);
       }
       const argsMatch = pathname.match(/^\/fragments\/([a-z0-9_-]+)\/builder-args$/);
       if (argsMatch && isValidWorkspace(argsMatch[1])) {

package/core/workspace-app/tests/unit/files-route-stream.test.js

@@ -0,0 +1,16 @@
+// The /files/<workspace>/<path> route resolves the file to `real` and must stream that. It streamed
+// `file`, a name the route never defines, so every plain (non-range) request sent headers and no body.
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const path = require('path');
+
+test('the files route streams the file it resolved', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', '..', 'server.js'), 'utf8');
+  const start = src.indexOf('filesBrowser.realFileIn(workspaceDir(fileMatch[1]), name)');
+  assert.ok(start > 0, 'the files route was not found');
+  const route = src.slice(start, src.indexOf('builder-args', start));
+  const streams = [...route.matchAll(/fs\.createReadStream\((\w+)/g)].map((m) => m[1]);
+  assert.ok(streams.length >= 2, 'expected the range branch and the whole-file branch');
+  for (const name of streams) assert.strictEqual(name, 'real', `the route streams "${name}", which it does not define`);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webship.co/workspace",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Webship Workspace: a container-based development workspace with a web dashboard. The core ships empty; workspace folders, hosting providers, git forges, container runtimes and features are @webship.co/workspace-<name> plugins you add one at a time.",
   "license": "GPL-2.0-or-later",
   "repository": {