hono-svelte 0.4.0 → 0.4.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.4.1
+
+- Fix `hono-svelte init` refusing every file on Windows: `isSafeAppPath()`
+  now normalizes `\` vs `/` and compares case-insensitively on win32
+  (path traversal still blocked).
+- Fix `bin` path without `./` prefix — npm was silently stripping the CLI
+  from the published tarball.
+
 ## 0.4.0
 
 - **Typed `c.render` entries (opt-in)**: `pages({ dts })` writes a `.d.ts` file

package/dist/scaffold.js

@@ -101,7 +101,17 @@ export function checkAppLink(appRoot) {
     return null;
 }
 export function isSafeAppPath(appRoot, target) {
+    // NOTE: compare case-insensitively on Windows (C:\Users vs c:\users) and
+    // accept both separators. `join("C:\\x", "src/a")` yields backslashes,
+    // so checking `startsWith(root + "/")` always failed on win32 and `init`
+    // refused every file.
     const root = resolve(appRoot);
     const abs = isAbsolute(target) ? target : resolve(root, target);
-    return abs === root || abs.startsWith(root + "/");
+    const norm = (p) => p.replace(/\\/g, "/");
+    const lower = (p) => (process.platform === "win32" ? p.toLowerCase() : p);
+    const nRoot = lower(norm(root));
+    const nAbs = lower(norm(abs));
+    // Exact root itself is not a writable file, but treat as safe for symmetry
+    // with the old check; callers only pass file paths.
+    return nAbs === nRoot || nAbs.startsWith(nRoot + "/");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono-svelte",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "Server-side shell + multi-entry Svelte pages for Hono apps",
   "type": "module",
   "bin": {