tosijs-ui 1.9.3 → 1.9.5

package/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog
 
+## 1.9.5
+
+**`localize()` no longer destroys literal `#`** (#55, reported by snowfox).
+
+`#` separates a string from a context annotation (`Okay#confirm`) and every `#` was
+stripped, so any literal one was lost: `'C# Tutorial'` became `'C'`, `'Issue #42'` became
+`'Issue '`, and `'#hashtag'` became `''` — an empty string, which renders as a blank label
+rather than an obvious error.
+
+An annotation is a **suffix identifier**, so only a `#` that looks like one is treated as
+one — immediately preceded by a non-space, followed by letters/digits/`_`/`-`, at the end
+of the string:
+
+| string | read as |
+| --- | --- |
+| `Okay#confirm` | annotation |
+| `C# Tutorial` | literal — space after |
+| `Issue #42` | literal — space before |
+| `#hashtag` | literal — nothing before |
+| `C#` | literal — no annotation after |
+
+No author action and no data migration; every documented annotation form is unchanged.
+Escape with `\#` for a literal that genuinely looks like an annotation (`tag\#42`).
+
+**The worse half:** annotations were stripped from the *translated value* too, so a
+translation containing `#` was truncated **even when the source string had none** —
+`'Sharp'` → `'Dièse #1'` came back as `'Dièse '`. A translator writing an ordinary string
+had it silently cut, with nothing in the source to hint why. Translations are no longer
+scanned for annotations at all: an annotation belongs to the lookup key, not to the text
+it resolves to.
+
+### Also
+
+- **`brace-expansion` pinned to `>=5.0.9`** (GHSA-rgw5-rvv9-x895, HIGH, DoS-only). A
+  follow-up advisory against a package already pinned at `>=5.0.8` for the previous one —
+  the new advisory covers `<5.0.9`. The audit gate blocked the build on it, which is the
+  case a one-time fix misses and a gate does not.
+
+## 1.9.4
+
+**The dev server now uses your own installed `haltija`** (#48, reported by tosijs-3d).
+
+It spawned its own channel via `bunx haltija@^1.6.1` and ignored the project's dependency
+entirely — and because **bunx caches the resolution**, a range that resolves forward never
+*re*-resolves once its cache key exists. So an adopter who bumped `haltija` to `^1.11.2`
+for a fix, restarted, and still didn't have the fix was running a cached 1.11.0: new
+enough to look current, old enough to lack it. `hj where` reports the *spawned* server, so
+the version indicator agreed with them.
+
+- Your `node_modules/.bin/haltija` is preferred when present. `HALTIJA_VERSION` still
+  overrides everything.
+- The fallback floor moves `^1.6.1` → `^1.11.2`. Its practical job is to make bunx
+  re-resolve, not to express a minimum — a stale cache key was half the bug.
+- **Both spawn sites now print which channel they used and where it came from** —
+  `1.11.2 (this project's dependency)`, `haltija@^1.11.2 (bunx)`,
+  `haltija@beta (HALTIJA_VERSION)`. The failure was never that a wrong version ran; it
+  was that nothing said so.
+
+If you were working around this with `HALTIJA_VERSION`, you can drop it.
+
 ## 1.9.3
 
 Two adopter-reported fixes, both with the diagnosis largely done by the reporter.

package/dist/doc-system/site/dev-server.d.ts

@@ -3,6 +3,10 @@ import { isLoopbackAddressForAuth as isLoopbackAddress } from './dev-auth.js';
 declare global {
     var Bun: any;
 }
+export declare function resolveHaltijaChannel(cwd?: string, env?: Record<string, string | undefined>): {
+    argv: string[];
+    describe: string;
+};
 /**
  * Resolve the idle-exit timeout to milliseconds (0 = disabled).
  *

package/dist/doc-system/site/dev-server.js

@@ -8,7 +8,7 @@ headless browser through the inline doc tests and exits with their pass/fail.
 Build-time only (Bun APIs). Never import this from browser code.
 */
 import * as path from 'path';
-import { statSync } from 'fs';
+import { statSync, existsSync, readFileSync } from 'fs';
 import { tmpdir } from 'os';
 import { $, spawn } from 'bun';
 import { buildSite } from './orchestrator.js';
@@ -45,15 +45,62 @@ const DEFAULT_IDLE_HOURS = 8;
  *     test lane below can trust an exit code instead of racing to a timeout.
  */
 /*
-^1.6.1 — the first version reporting `ready` (haltija#11), which is what lets the lane
-tell "server up" from "there is a tab to drive".
+The FALLBACK channel, used only when the project has no haltija of its own.
 
-The previous floor said ^1.5.5 and cited the teardown fix landing there. **1.5.5 was never
-published** — the published line goes 1.5.4 → 1.6.0 — so that floor named a version that
-does not exist and silently resolved to whatever 1.6+ shipped. A pin whose justification
-cannot be checked is not a pin.
+`^1.11.2` because that is where the agent-facing fixes people upgrade for currently live;
+the floor's practical job is to make bunx re-resolve rather than to express a minimum. The
+floor before this was `^1.6.1`, and an adopter with `haltija@^1.11.2` in their own
+devDependencies still got **1.11.0** — new enough to look current, old enough to lack the
+fix they had just upgraded for (tosijs-ui#48).
+
+Two things conspired, and the second is the nasty one:
+
+  - we spawned our own channel and ignored theirs entirely, and
+  - **`bunx` caches the resolution**, so a range that resolves forward does not RE-resolve
+    once its cache key is populated. `^1.6.1` froze at whatever satisfied it first.
+
+That is the stale-but-satisfying-cache hazard this project filed against haltija (#11) and
+then shipped an instance of. A range is not a pin, and a cached range is not even a range.
+
+`resolveHaltijaChannel()` below prefers the project's own installed haltija, so the version
+is something an adopter controls with the tool they already use. `HALTIJA_VERSION` still
+overrides everything.
+*/
+const HALTIJA_PKG = process.env.HALTIJA_VERSION ?? 'haltija@^1.11.2';
+/*
+Which haltija do we actually run, and can we say so out loud?
+
+Prefer the one in the project's own node_modules. An adopter who bumps their haltija
+devDependency to get a fix expects that to be the haltija they get; anything else makes
+the upgrade look like it did nothing — with `hj where` agreeing, since it reports the
+SPAWNED server's version and therefore looks authoritative.
+
+Returns the argv prefix plus a human description, because an invisible divergence is the
+whole bug: one startup line naming the channel and where it came from turns "the fix
+doesn't work" into "oh, it's running a different one".
 */
-const HALTIJA_PKG = process.env.HALTIJA_VERSION ?? 'haltija@^1.6.1';
+export function resolveHaltijaChannel(cwd = process.cwd(), env = process.env) {
+    // An explicit override always wins, and is worth saying so.
+    if (env.HALTIJA_VERSION) {
+        return {
+            argv: ['bunx', env.HALTIJA_VERSION],
+            describe: `${env.HALTIJA_VERSION} (HALTIJA_VERSION)`,
+        };
+    }
+    const local = `${cwd}/node_modules/.bin/haltija`;
+    if (existsSync(local)) {
+        let version = 'unknown version';
+        try {
+            version =
+                JSON.parse(readFileSync(`${cwd}/node_modules/haltija/package.json`, 'utf8')).version ?? version;
+        }
+        catch {
+            /* installed but unreadable manifest — still prefer it, just unnamed */
+        }
+        return { argv: [local], describe: `${version} (this project's dependency)` };
+    }
+    return { argv: ['bunx', HALTIJA_PKG], describe: `${HALTIJA_PKG} (bunx)` };
+}
 /**
  * Resolve the idle-exit timeout to milliseconds (0 = disabled).
  *
@@ -256,8 +303,11 @@ async function ensureHaltijaChannel(port) {
         // HTTPS dev page has no mixed-content), while the `hj` CLI drives over its
         // default HTTP 8700 — one server, both transports, shared state. HTTPS cert
         // is mkcert-trusted. Output quiet so it doesn't drown the dev log.
-        // Version comes from HALTIJA_PKG — a pinned range, not `@latest`; see above.
-        spawn(['bunx', HALTIJA_PKG, '--server', '--both'], {
+        const channel = resolveHaltijaChannel();
+        // Name the channel: an adopter who upgraded their own haltija and got ours instead
+        // sees the divergence here rather than concluding the fix does not work (#48).
+        console.log(`haltija channel: ${channel.describe}`);
+        spawn([...channel.argv, '--server', '--both'], {
             stdout: 'ignore',
             stderr: 'ignore',
         });
@@ -1326,8 +1376,9 @@ export async function devServer(config, opts = {}) {
         (tosijs-ui#18, #21.)
         */
         const portFile = `${tmpdir()}/tosijs-haltija-${process.pid}.json`;
-        console.log('Starting a private haltija…');
-        const haltija = spawn(['bunx', HALTIJA_PKG, '--private', '--port-file', portFile], {
+        const channel = resolveHaltijaChannel();
+        console.log(`Starting a private haltija… (${channel.describe})`);
+        const haltija = spawn([...channel.argv, '--private', '--port-file', portFile], {
             // stdout/stderr are NOT inherited: `bunx haltija` launches Electron as a
             // grandchild, and killing the bunx wrapper does not kill it. An orphan holding
             // our inherited stdout keeps the pipe open forever, so the command looks hung
@@ -1351,7 +1402,7 @@ export async function devServer(config, opts = {}) {
         }
         if (!hjPort) {
             console.error(`haltija did not report a private port within 30s (${portFile}).\n` +
-                `  Is \`bunx ${HALTIJA_PKG}\` able to run? Try it by hand.`);
+                `  Is \`${channel.argv.join(' ')}\` able to run? Try it by hand.`);
             await stopHaltija();
             shutdown(1);
         }