create-zudo-doc 0.2.20 → 0.2.21

package/dist/scaffold.js

@@ -448,11 +448,11 @@ function generatePackageJson(choices) {
         // stability, multi-valued response headers (e.g. multiple Set-Cookie),
         // supplementary-plane CJK reading-time, plus CLI/server/runtime hardening
         // and render perf passes. No consumer-facing / CLI breaking change.
-        "@takazudo/zfb": "0.1.0-next.58",
-        "@takazudo/zfb-runtime": "0.1.0-next.58",
+        "@takazudo/zfb": "0.1.0-next.59",
+        "@takazudo/zfb-runtime": "0.1.0-next.59",
         // zfb-adapter-cloudflare — required for any route with `prerender = false`.
         // Pinned in lockstep with @takazudo/zfb.
-        "@takazudo/zfb-adapter-cloudflare": "0.1.0-next.58",
+        "@takazudo/zfb-adapter-cloudflare": "0.1.0-next.59",
         // @takazudo/zudo-doc — published from this monorepo via
         // .github/workflows/publish-zudo-doc.yml. The pin here is bumped in
         // lockstep by scripts/release-create-zudo-doc.sh whenever zudo-doc's
@@ -464,7 +464,7 @@ function generatePackageJson(choices) {
         // ties this pin to packages/zudo-doc's version, so the lockstep release
         // bumps both together; do not cut a create-zudo-doc release until the
         // matching @takazudo/zudo-doc version (with content.css) is on npm.
-        "@takazudo/zudo-doc": "^0.2.20",
+        "@takazudo/zudo-doc": "^0.2.21",
         // zod — used by the generated zfb.config.ts. zfb-config-gen emits
         // `import { z } from "zod"` for the content-collection schema +
         // `z.toJSONSchema(...)` conversion. Without this dep, the consumer
@@ -518,7 +518,7 @@ function generatePackageJson(choices) {
         // @takazudo/zudo-doc/integrations/doc-history which in turn imports
         // @takazudo/zudo-doc-history-server/git-history. Without this dep the
         // plugin host fails at init with ERR_MODULE_NOT_FOUND — W8A (#1739).
-        deps["@takazudo/zudo-doc-history-server"] = "^0.2.20";
+        deps["@takazudo/zudo-doc-history-server"] = "^0.2.21";
         // W7A (#1736): doc-history-plugin.mjs spawns `tsx -e <inline-script>` to
         // run the v2 runtime in a TS-aware Node subprocess; without tsx the
         // plugin's preBuild step exits with ENOENT before zfb finishes config
@@ -571,6 +571,8 @@ function generatePackageJson(choices) {
     }
     if (choices.features.includes("skillSymlinker")) {
         scripts["setup:doc-skill"] = "bash scripts/setup-doc-skill.sh";
+        scripts["setup:doc-skill-silent"] =
+            "bash scripts/setup-doc-skill.sh --silent";
     }
     const runCmd = choices.packageManager === "npm" || choices.packageManager === "bun" ? `${choices.packageManager} run` : choices.packageManager;
     // claudeSkills ships the zudo-doc-version-bump skill, whose release workflow

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-zudo-doc",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "Create a new zudo-doc documentation site",
   "license": "MIT",
   "author": "Takeshi Takatsudo",

package/templates/base/pages/lib/_doc-page-shell.tsx

@@ -215,7 +215,7 @@ export function DocPageShell(props: DocPageShellProps): JSX.Element {
       }
       tocOverride={tocOverride}
       mobileTocOverride={mobileTocOverride}
-      afterSidebar={<SidebarPrepaint />}
+      afterSidebar={<SidebarPrepaint hideSidebar={hideSidebar} />}
       footerOverride={<FooterWithDefaults lang={locale} />}
       bodyEndComponents={<DocBodyEnd />}
       enableClientRouter={settings.dynamicPageTransition}

package/templates/base/pages/lib/_sidebar-prepaint.tsx

@@ -23,23 +23,35 @@ import { Island } from "@takazudo/zfb";
 import { settings } from "@/config/settings";
 import DesktopSidebarToggle from "@/components/desktop-sidebar-toggle";
 
+/** Props for {@link SidebarPrepaint}. */
+export interface SidebarPrepaintProps {
+  /**
+   * Mirrors the page's `hide_sidebar: true` frontmatter. When true the desktop
+   * toggle is skipped — there is no visible sidebar for it to collapse.
+   */
+  hideSidebar?: boolean;
+}
+
 /**
  * The `afterSidebar` slot content shared by all four doc-route page components.
  *
  * Returns the pre-paint localStorage script + `DesktopSidebarToggle` Island
- * when `settings.sidebarToggle` is enabled; returns `undefined` when it is
- * disabled (matching the conditional the route files used inline).
+ * when `settings.sidebarToggle` is enabled AND the page actually shows a
+ * sidebar; returns `undefined` when the toggle is disabled or the page hides
+ * the sidebar (matching the conditional the route files used inline).
  */
-export function SidebarPrepaint(): JSX.Element | undefined {
-  if (!settings.sidebarToggle) return undefined;
+export function SidebarPrepaint({
+  hideSidebar,
+}: SidebarPrepaintProps): JSX.Element | undefined {
+  if (!settings.sidebarToggle || hideSidebar) return undefined;
 
   return (
     <>
       {/* Pre-paint inline script: restore persisted sidebar visibility to
           <html data-sidebar-hidden> before first paint to avoid flash.
-          Runs unconditionally when sidebarToggle is enabled; the attribute
-          is only set when localStorage says "false" so the default (visible)
-          needs no attribute and causes no layout shift. */}
+          Rendered only when the toggle is enabled and the page shows a
+          sidebar; the attribute is only set when localStorage says "false"
+          so the default (visible) needs no attribute and causes no layout shift. */}
       <script dangerouslySetInnerHTML={{
         __html: `(function(){try{if(localStorage.getItem('zudo-doc-sidebar-visible')==='false'){document.documentElement.setAttribute('data-sidebar-hidden','');}}catch(e){}})();`,
       }} />

package/templates/features/tauri/files/src-tauri/capabilities/default.json

@@ -1,10 +1,7 @@
 {
   "identifier": "default",
-  "description": "Default capabilities for the main window",
+  "description": "Default capabilities for the main window. The shipped offline reader loads the embedded dist/ via the tauri:// protocol (WebviewUrl::App), so it needs no remote-origin grant. The previous `remote.urls: http://localhost:*/**` grant was dropped (zudolab/zudo-doc#2240) so no localhost-served page can reach core:default. `cargo tauri dev` still loads http://localhost:4321, but the zudo-doc site invokes no Tauri commands, so it does not need the grant either.",
   "windows": ["main"],
-  "remote": {
-    "urls": ["http://localhost:*/**"]
-  },
   "permissions": [
     "core:default"
   ]

package/templates/features/tauri/files/src-tauri/tauri.conf.json

@@ -10,7 +10,7 @@
   "app": {
     "windows": [],
     "security": {
-      "csp": null
+      "csp": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; img-src 'self' data:; font-src 'self' data: https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; script-src 'self' 'unsafe-inline' https://esm.sh; connect-src 'self' https://esm.sh https://cdn.jsdelivr.net"
     }
   },
   "bundle": {

package/templates/features/tauriDev/files/src-tauri-dev/capabilities/default.json

@@ -1,6 +1,6 @@
 {
   "identifier": "default",
-  "description": "Default capabilities for the main window",
+  "description": "Default capabilities for the main window. TRUST NOTE (zudolab/zudo-doc#2240): Mode 2 displays an arbitrary, user-configured localhost project in this webview, and `remote.urls` grants core:default to any http://localhost:*/** origin. Combined with withGlobalTauri (required by frontend/index.html's launch-error listener + retry_launch invoke), a malicious dependency in the wrapped project would gain Tauri reach. This is an accepted trust assumption for a developer-only wrapper: only point Mode 2 at projects you trust. The grant is intentionally dev-scoped (localhost only). Narrowing it to the single configured port, or splitting the local-frontend capability from the remote-project capability, is tracked as a future hardening.",
   "windows": ["main"],
   "remote": { "urls": ["http://localhost:*/**"] },
   "permissions": ["core:default"]