Repository navigation
Production hardening pass - #1
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 05afbe7fb8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "type":"object","additionalProperties":false,"required":["name","sourceUrl"], | ||
| "properties": { | ||
| "name":{"type":"string","minLength":1,"maxLength":300}, | ||
| "sourceUrl":{"type":"string","format":"uri","pattern":"^https?://"}, |
There was a problem hiding this comment.
When downstream consumers validate AppSpecs with the exported JSON Schema, this accepts https://user:pass@example.com/... because format: uri plus the ^https?:// pattern still permits URL userinfo, while the runtime validator rejects credentials. That makes schema-valid files fail the CLI later and can preserve secrets that the runtime intentionally blocks; mirror isHttpUrl here by excluding credentialed URLs.
Useful? React with 👍 / 👎.
Upgrades Reconstruct to AppSpec 0.2 with stricter validation, bounded capture, integrity verification, expanded tests, npm workspaces, CI, dependency auditing, and operational documentation.
Local verification completed successfully with the unit, policy, browser integration, build, and dependency audit checks.