zeekayandHanzo Dev
efd925d977
dist/index.html was a polyglot — `#!/bin/sh`, a `<<\EOF` heredoc swallowing the whole document, the installer after the closing EOF. Both halves ran. The browser half was never honest, and could not be made honest. Anything before <!DOCTYPE html> that is not whitespace or a comment puts the document in quirks mode. Chromium, at 390 and 1280: compatMode BackCompat; document.head.children.length === 1, with all fifteen head elements — title, icons, viewport, description, every og: and twitter: tag — parsed into <body> where they do nothing; and "#!/bin/sh <<\EOF" as the first text node of the page, first string in body.innerText, pushing <main> down 24px. Proven by re-serving the identical live bytes with the 17-byte prefix stripped: BackCompat -> CSS1Compat, head.children 1 -> 15, at both widths. No arrangement of those bytes avoids it. Only whitespace and comments may precede a DOCTYPE; an HTML comment opens with `<!`, which a shell reads as a redirect from a file named `!--`, so a POSIX script cannot start there at all. The trick was unfixable, not unlucky. So the two resources become two files and `/` chooses between them by Accept, which is what HTTP has for this. worker.js is the whole rule: text/html gets dist/page.html, anything else — curl, wget, the /cli /mcp /dev shims that re-exec `curl -fsSL https://hanzo.sh` — gets dist/install.sh. `/` carries vary: accept and cache-control: no-store, because Cloudflare honours Vary only on Accept-Encoding and a shared cache holding one representation for the other kind of client breaks either the page or the install command. scripts/postbuild.js replaces the polyglot rewrite: it moves the document off index.html (Static Assets serve an exact match BEFORE the Worker runs, so a file at that name would hand curl the HTML) and writes /install from install.sh, so the alias is one file in git instead of 12,746 duplicated bytes. wrangler.toml: routes moves ABOVE [assets]. TOML puts every key after a table header inside that table, so it was parsing as assets.routes and wrangler dropped it with a warning — the custom domain survived only because it was attached out of band. html_handling and not_found_handling are "none": exact match or the Worker, nothing silently rewritten, a mistyped path still 404s. The deploy gate now checks both representations against the live URL, plus a 200 for every path the head declares — the check that would have caught og-image.svg. Verified against the real runtime before pushing: wrangler dev --local, curl gets install.sh byte-for-byte, a browser gets page.html with <!DOCTYPE html> at byte 0, `sh -n -c "$(curl -fsSL /)"` parses under dash and bash, and /index.html /nonexistent-xyz /some/deep/path still 404. Co-authored-by: Hanzo Dev <[email protected]>
85 lines
2.7 KiB
JSON
85 lines
2.7 KiB
JSON
{
|
|
"name": "hanzo-sh",
|
|
"private": true,
|
|
"version": "1.0.0",
|
|
"type": "module",
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "vite build && node scripts/postbuild.js",
|
|
"build:dev": "vite build --mode development",
|
|
"lint": "eslint .",
|
|
"preview": "vite preview"
|
|
},
|
|
"dependencies": {
|
|
"@hookform/resolvers": "^3.9.0",
|
|
"@radix-ui/react-accordion": "^1.2.0",
|
|
"@radix-ui/react-alert-dialog": "^1.1.1",
|
|
"@radix-ui/react-aspect-ratio": "^1.1.0",
|
|
"@radix-ui/react-avatar": "^1.1.0",
|
|
"@radix-ui/react-checkbox": "^1.1.1",
|
|
"@radix-ui/react-collapsible": "^1.1.0",
|
|
"@radix-ui/react-context-menu": "^2.2.1",
|
|
"@radix-ui/react-dialog": "^1.1.1",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.1",
|
|
"@radix-ui/react-hover-card": "^1.1.1",
|
|
"@radix-ui/react-label": "^2.1.0",
|
|
"@radix-ui/react-menubar": "^1.1.1",
|
|
"@radix-ui/react-navigation-menu": "^1.2.0",
|
|
"@radix-ui/react-popover": "^1.1.1",
|
|
"@radix-ui/react-progress": "^1.1.0",
|
|
"@radix-ui/react-radio-group": "^1.2.0",
|
|
"@radix-ui/react-scroll-area": "^1.1.0",
|
|
"@radix-ui/react-select": "^2.1.1",
|
|
"@radix-ui/react-separator": "^1.1.0",
|
|
"@radix-ui/react-slider": "^1.2.0",
|
|
"@radix-ui/react-slot": "^1.1.0",
|
|
"@radix-ui/react-switch": "^1.1.0",
|
|
"@radix-ui/react-tabs": "^1.1.0",
|
|
"@radix-ui/react-toast": "^1.2.1",
|
|
"@radix-ui/react-toggle": "^1.1.0",
|
|
"@radix-ui/react-toggle-group": "^1.1.0",
|
|
"@radix-ui/react-tooltip": "^1.1.2",
|
|
"@tanstack/react-query": "^5.56.2",
|
|
"class-variance-authority": "^0.7.0",
|
|
"clsx": "^2.1.1",
|
|
"cmdk": "^1.0.0",
|
|
"date-fns": "^3.6.0",
|
|
"embla-carousel-react": "^8.3.0",
|
|
"input-otp": "^1.2.4",
|
|
"lucide-react": "^0.451.0",
|
|
"next-themes": "^0.3.0",
|
|
"react": "^19.0.0",
|
|
"react-day-picker": "^8.10.1",
|
|
"react-dom": "^19.0.0",
|
|
"react-hook-form": "^7.53.0",
|
|
"react-resizable-panels": "^2.1.3",
|
|
"react-router-dom": "^6.26.2",
|
|
"react-syntax-highlighter": "^15.6.1",
|
|
"recharts": "^2.12.7",
|
|
"sonner": "^1.5.0",
|
|
"tailwind-merge": "^2.5.2",
|
|
"tailwindcss-animate": "^1.0.7",
|
|
"vaul": "^0.9.3",
|
|
"zod": "^3.23.8"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^9.9.0",
|
|
"@tailwindcss/postcss": "^4.0.17",
|
|
"@tailwindcss/typography": "^0.5.15",
|
|
"@types/node": "^22.5.5",
|
|
"@types/react": "^19.0.0",
|
|
"@types/react-dom": "^19.0.0",
|
|
"@vitejs/plugin-react-swc": "^3.5.0",
|
|
"autoprefixer": "^10.4.20",
|
|
"eslint": "^9.9.0",
|
|
"eslint-plugin-react-hooks": "^5.1.0-rc.0",
|
|
"eslint-plugin-react-refresh": "^0.4.9",
|
|
"globals": "^15.9.0",
|
|
"postcss": "^8.4.47",
|
|
"tailwindcss": "^4.0.17",
|
|
"typescript": "^5.5.3",
|
|
"typescript-eslint": "^8.0.1",
|
|
"vite": "^5.4.1"
|
|
}
|
|
}
|