Skip to content

fix: narrow launch-safety private path checks #8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
koltregaskes wants to merge 5 commits into from
Closed

fix: narrow launch-safety private path checks #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
58db456
fix: remove Stack Scout local path coupling
koltregaskes Jun 4, 2026
3ffb111
fix: narrow launch-safety private path checks
koltregaskes Jun 6, 2026
52fed77
fix: refresh service worker cache during build
koltregaskes Jun 6, 2026
64558b5
Revert "fix: refresh service worker cache during build"
koltregaskes Jun 6, 2026
4caee1e
fix: refresh service worker cache during build
koltregaskes Jun 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .env.example
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# Optional local-only export targets.
# Leave unset in public CI and ordinary GitHub Pages builds.
STACKSCOUT_PRIVATE_EXPORT_DIR=
STACKSCOUT_PRIVATE_EXPORT_FILE=
STACKSCOUT_PRIVATE_STATUS_DIR=
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,8 @@ planning-local/
.local-notes/

# Local screenshots and scratch files
.serve.log
.serve.err.log
tmp-*.png
tmp-*.jpg
tmp-*.jpeg
Expand Down
10 changes: 5 additions & 5 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,12 @@

`stackscout` builds **Stack Scout**, the public-facing tools destination for curated builder tools, services, APIs, MCPs, and CLIs.

This repo remains the GitHub Pages implementation base, but the visible product is no longer a simple internal "Tools Hub" brochure. The private operational console stays separate in `W:\Repos\_local\surfaces\tools-hub-local`.
This repo remains the GitHub Pages implementation base, but the visible product is no longer a simple internal "Tools Hub" brochure. The private operational console stays outside this public repo.

## Public vs private

- This repo is public-facing only.
- The local launcher, manager inbox, review evidence, session state, and leak-check operations belong in `tools-hub-local`.
- Local launchers, operations state, and review artefacts belong in the private local surface, not this repo.
- Public content must stay safe for GitHub Pages and public browsing.
- Do not rely on `.gitignore` alone to protect private data. Public output is generated from an allowlisted shared source layer.

Expand All @@ -23,7 +23,7 @@ These source files drive:

- public manifests in `data/`
- generated static pages across the public site
- a private preview export written to `W:\Repos\_local\surfaces\tools-hub-local\data\stackscout-publishing.json`
- an optional private preview export when `STACKSCOUT_PRIVATE_EXPORT_DIR` or `STACKSCOUT_PRIVATE_EXPORT_FILE` is set locally

## Build

Expand Down Expand Up @@ -68,9 +68,9 @@ Before a public refresh, bump `CACHE_NAME` in `service-worker.js` when generated
npm run refresh:site
```

This runs the site build, runs checks, and writes private refresh status to `W:\Repos\_local\surfaces\tools-hub-local\data\stackscout-refresh-status.json`.
This runs the site build, runs checks, and optionally writes private refresh status when `STACKSCOUT_PRIVATE_STATUS_DIR` is set locally.

For unattended Windows refreshes without visible terminal focus theft, use the local-only launcher at `W:\Repos\_My Tools\LOCAL-ONLY\stackscout-refresh\run-stackscout-refresh.cmd`.
For unattended Windows refreshes without visible terminal focus theft, use a local-only launcher outside this public repo and set the optional private export/status environment variables there.

## Site structure

Expand Down
2 changes: 1 addition & 1 deletion catalog/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -676,7 +676,7 @@ <h3>SyncPad</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion categories/apis/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ <h3>Anthropic API</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion categories/clis/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ <h3>Wrangler</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion categories/desktop-apps/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ <h3>SyncPad</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion categories/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -228,7 +228,7 @@ <h3>Desktop Apps</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion categories/mcps/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ <h3>Playwright MCP</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion categories/web-apps/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,7 +209,7 @@ <h3>Strudel Studio</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion categories/web-services/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ <h3>Make</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion categories/websites/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ <h3>Hugging Face</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion collections/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ <h3>From the Stack Scout Lab</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../pwa.js"></script>
Expand Down
4 changes: 2 additions & 2 deletions data/categories-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"title": "Stack Scout // Categories",
"generatedAt": "2026-05-25",
"updatedAt": "2026-05-25",
"generatedAt": "2026-06-06",
"updatedAt": "2026-06-06",
"categories": [
{
"slug": "websites",
Expand Down
4 changes: 2 additions & 2 deletions data/collections-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"title": "Stack Scout // Collections",
"generatedAt": "2026-05-25",
"updatedAt": "2026-05-25",
"generatedAt": "2026-06-06",
"updatedAt": "2026-06-06",
"collections": [
{
"slug": "creator-stack",
Expand Down
4 changes: 2 additions & 2 deletions data/methodology-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"title": "Stack Scout // Methodology",
"generatedAt": "2026-05-25",
"updatedAt": "2026-05-25",
"generatedAt": "2026-06-06",
"updatedAt": "2026-06-06",
"thesis": "Stack Scout is a public guide, not a benchmark lab. We badge selectively, update from official sources where possible, and avoid pretending every fast-moving tool deserves a fixed numeric score.",
"principles": [
{
Expand Down
2 changes: 1 addition & 1 deletion data/page-registry.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"title": "Stack Scout // Page Registry",
"generatedAt": "2026-05-25",
"generatedAt": "2026-06-06",
"pages": [
{
"key": "home",
Expand Down
4 changes: 2 additions & 2 deletions data/radar-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"title": "Stack Scout // Radar",
"generatedAt": "2026-05-25",
"updatedAt": "2026-05-25",
"generatedAt": "2026-06-06",
"updatedAt": "2026-06-06",
"items": [
{
"title": "Azure MCP Server",
Expand Down
4 changes: 2 additions & 2 deletions data/tools-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"title": "Stack Scout // Tools Manifest",
"generatedAt": "2026-05-25",
"updatedAt": "2026-05-25",
"generatedAt": "2026-06-06",
"updatedAt": "2026-06-06",
"summary": "Public-safe catalog for Stack Scout.",
"counts": {
"total": 14,
Expand Down
4 changes: 2 additions & 2 deletions data/updates-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
{
"title": "Stack Scout // Updates",
"generatedAt": "2026-05-25",
"updatedAt": "2026-05-25",
"generatedAt": "2026-06-06",
"updatedAt": "2026-06-06",
"summary": "Public-safe activity stream seeded from official or first-party sources.",
"items": [
{
Expand Down
2 changes: 1 addition & 1 deletion index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -833,7 +833,7 @@ <h3>From the Stack Scout Lab</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="./pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion method/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,7 +201,7 @@ <h2>Verdict language</h2>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../pwa.js"></script>
Expand Down
2 changes: 1 addition & 1 deletion radar/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,7 @@ <h3>GitHub skills ecosystem</h3>
</div>
<div class="site-footer__meta">
<p><span class="live-dot" aria-hidden="true"></span><span id="utcClock">Live UTC</span></p>
<p>Updated 25 May 2026 from the Stack Scout shared source layer.</p>
<p>Updated 6 Jun 2026 from the Stack Scout shared source layer.</p>
</div>
</footer>
<script src="../pwa.js"></script>
Expand Down
40 changes: 25 additions & 15 deletions scripts/build-stackscout.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,6 @@ const path = require('path')
const ROOT_DIR = path.resolve(__dirname, '..')
const SOURCE_DIR = path.join(ROOT_DIR, 'content', 'stackscout')
const DATA_DIR = path.join(ROOT_DIR, 'data')
const PRIVATE_PREVIEW_EXPORT_CANDIDATES = [
'W:\\Repos\\_local\\surfaces\\tools-hub-local\\data\\stackscout-publishing.json',
'\\\\nas_storage_1\\Workspaces\\Repos\\_local\\surfaces\\tools-hub-local\\data\\stackscout-publishing.json',
]
const BUILD_NOW = new Date()
const GENERATED_AT = BUILD_NOW.toISOString().slice(0, 10)
const GENERATED_AT_ISO = BUILD_NOW.toISOString()
Expand Down Expand Up @@ -54,17 +50,16 @@ function writeExternalJson(absolutePath, value) {
fs.writeFileSync(absolutePath, `${JSON.stringify(value, null, 2)}\n`, 'utf8')
}

function resolveWritableExternalPath(candidates) {
for (const candidate of candidates) {
try {
ensureParent(candidate)
return candidate
} catch (error) {
continue
}
function resolvePrivatePreviewExportPath() {
if (process.env.STACKSCOUT_PRIVATE_EXPORT_FILE) {
return path.resolve(process.env.STACKSCOUT_PRIVATE_EXPORT_FILE)
}

throw new Error(`Unable to resolve writable external path from candidates: ${candidates.join(', ')}`)
if (process.env.STACKSCOUT_PRIVATE_EXPORT_DIR) {
return path.join(path.resolve(process.env.STACKSCOUT_PRIVATE_EXPORT_DIR), 'stackscout-publishing.json')
}

return null
}

function escapeHtml(value) {
Expand Down Expand Up @@ -1278,9 +1273,23 @@ ${routes.map((route) => ` <url><loc>${PUBLIC_BASE_URL}${route}</loc></url>`).jo
`
}

function updateServiceWorkerCacheName() {
const serviceWorkerPath = 'service-worker.js'
const current = fs.readFileSync(path.join(ROOT_DIR, serviceWorkerPath), 'utf8')
const next = current.replace(
/const CACHE_NAME = ['"]stackscout-\d{4}-\d{2}-\d{2}['"]/,
`const CACHE_NAME = 'stackscout-${GENERATED_AT}'`,
)

if (next === current) {
throw new Error('service-worker.js cache name was not updated; expected stackscout-YYYY-MM-DD declaration.')
}

writeFile(serviceWorkerPath, next)
}

function main() {
const privatePreviewExport =
process.platform === 'win32' ? resolveWritableExternalPath(PRIVATE_PREVIEW_EXPORT_CANDIDATES) : null
const privatePreviewExport = resolvePrivatePreviewExportPath()
const site = readJson('site-source.json')
const tools = readJson('tools-source.json')
const updates = readJson('updates-source.json').sort((a, b) => b.publishedAt.localeCompare(a.publishedAt))
Expand Down Expand Up @@ -1339,6 +1348,7 @@ function main() {
]

writeFile('sitemap.xml', buildSitemap(sitemapRoutes))
updateServiceWorkerCacheName()
console.log(
`Stack Scout build complete. Generated ${tools.length} tool pages, ${categories.length} category pages, and ${updates.length} updates.`,
)
Expand Down
40 changes: 21 additions & 19 deletions scripts/refresh-stackscout.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,29 +6,24 @@ param(
$ErrorActionPreference = 'Stop'

$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot '..')).Path
$privateDataDirCandidates = @(
'W:\Repos\_local\surfaces\tools-hub-local\data',
'\\nas_storage_1\Workspaces\Repos\_local\surfaces\tools-hub-local\data'
)
$privateDataDir = $null
foreach ($candidate in $privateDataDirCandidates) {
try {
if (-not (Test-Path $candidate)) {
New-Item -ItemType Directory -Path $candidate -Force | Out-Null
}
$privateDataDirInput = if ($env:STACKSCOUT_PRIVATE_STATUS_DIR) {
$env:STACKSCOUT_PRIVATE_STATUS_DIR
} elseif ($env:STACKSCOUT_PRIVATE_EXPORT_DIR) {
$env:STACKSCOUT_PRIVATE_EXPORT_DIR
} else {
$null
}

$privateDataDir = (Resolve-Path $candidate).Path
break
} catch {
continue
$privateDataDir = $null
if ($privateDataDirInput) {
if (-not (Test-Path $privateDataDirInput)) {
New-Item -ItemType Directory -Path $privateDataDirInput -Force | Out-Null
}
}

if (-not $privateDataDir) {
throw 'Unable to resolve a writable private data directory for Stack Scout refresh status.'
$privateDataDir = (Resolve-Path $privateDataDirInput).Path
}

$statusFile = Join-Path $privateDataDir 'stackscout-refresh-status.json'
$statusFile = if ($privateDataDir) { Join-Path $privateDataDir 'stackscout-refresh-status.json' } else { $null }
$toolsManifestFile = Join-Path $repoRoot 'data\tools-manifest.json'
$updatesManifestFile = Join-Path $repoRoot 'data\updates-manifest.json'
$categoriesManifestFile = Join-Path $repoRoot 'data\categories-manifest.json'
Expand All @@ -38,10 +33,13 @@ $durationStopwatch = [System.Diagnostics.Stopwatch]::StartNew()

function Read-JsonFile {
param(
[Parameter(Mandatory = $true)]
[string]$Path
)

if (-not $Path) {
return $null
}

if (-not (Test-Path $Path)) {
return $null
}
Expand Down Expand Up @@ -82,6 +80,10 @@ function Write-RefreshStatus {
$payload[$entry.Key] = $entry.Value
}

if (-not $statusFile) {
return
}

$directory = Split-Path -Parent $statusFile
if (-not (Test-Path $directory)) {
New-Item -ItemType Directory -Path $directory -Force | Out-Null
Expand Down
7 changes: 4 additions & 3 deletions scripts/verify-launch-safety.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,9 +45,10 @@ const REQUIRED_PUBLIC_FILES = [
]
const TEXT_EXTENSIONS = new Set(['.css', '.html', '.js', '.json', '.svg', '.txt', '.xml'])
const PRIVATE_PATTERNS = [
{ label: 'Windows drive path', pattern: /\b[A-Z]:[\\/][^\s"'<>)]*/i },
{ label: 'UNC path', pattern: /\\\\[A-Za-z0-9._-]+[\\/][^\s"'<>)]*/i },
{ label: 'local-only surface marker', pattern: /\b(?:tools-hub-local|LOCAL-ONLY|_local)\b/i },
{ label: 'Kol Windows user path', pattern: /\b[A-Z]:[\\/]Users[\\/](?:koltregaskes|kolin)[\\/][^\s"'<>)]*/i },
{ label: 'W drive estate path', pattern: /\bW:[\\/][^\s"'<>)]*/i },
{ label: 'estate UNC path', pattern: /\\\\(?:\?\\)?(?:nas_storage_1|MINI-PC|localhost|127\.0\.0\.1)[\\/][^\s"'<>)]*/i },
{ label: 'local-only surface marker', pattern: /\b(?:tools-hub-local|LOCAL-ONLY|_local)\b/ },

@coderabbitai coderabbitai Bot Jun 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Search for lowercase 'local-only' in public output that might be missed by the case-sensitive pattern

rg -n --type html --type js --type json -g '!verify-launch-safety.js' '\blocal-only\b'

Repository: koltregaskes/stackscout

Length of output: 49

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 1) Inspect the exact PRIVATE_PATTERNS entries + where assertNoPrivateLeaks applies them.
sed -n '1,120p' scripts/verify-launch-safety.js | cat -n
sed -n '120,220p' scripts/verify-launch-safety.js | cat -n

# 2) Repo-wide occurrences of the marker variants (not just html/js/json)
rg -n --hidden --no-ignore-vcs --glob '!.git/*' '\b(local-only|LOCAL-ONLY|_local)\b' . || true

# 3) Also check for just "tools-hub-local" and "LOCAL-ONLY" as plain strings (case-sensitive)
rg -n --hidden --no-ignore-vcs --glob '!.git/*' 'tools-hub-local|LOCAL-ONLY|_local' . || true

Repository: koltregaskes/stackscout

Length of output: 8923

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# 1) Extract CACHE_NAME and index.html "Updated" date (what assertServiceWorkerFreshness compares)
echo "== service-worker.js CACHE_NAME =="
rg -n "const CACHE_NAME" service-worker.js
cache_name="$(rg -o "const CACHE_NAME = ['\"]([^'\"]+)['\"]" service-worker.js | sed -E "s/.*='([^']+)'.*/\1/" | head -n1)"
echo "CACHE_NAME=$cache_name"

echo
echo "== index.html Updated date string =="
updated_line="$(rg -n "Updated ([0-9]{1,2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ([0-9]{4})" index.html | head -n1 || true)"
echo "$updated_line"

# Parse into YYYY-MM-DD using same mapping as script (quick inline)
python3 - <<'PY'
import re, pathlib
text = pathlib.Path("index.html").read_text(encoding="utf-8", errors="ignore")
m = re.search(r"Updated\s+([0-9]{1,2})\s+(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+([0-9]{4})", text)
month_map={"Jan":"01","Feb":"02","Mar":"03","Apr":"04","May":"05","Jun":"06","Jul":"07","Aug":"08","Sep":"09","Oct":"10","Nov":"11","Dec":"12"}
if not m:
    print("ISSUE_DATE=auto-today (no match)")
else:
    day=int(m.group(1))
    issue=f"{m.group(3)}-{month_map[m.group(2)]}-{day:02d}"
    print("ISSUE_DATE="+issue)
PY

# 2) Search only in paths that are scanned by collectPublicTextFiles():
# PUBLIC_ENTRIES = index.html, catalog, categories, collections, data, method, radar, tools, updates, app.js, pwa.js, service-worker.js, manifest.json, styles.css, sitemap.xml, icon.svg
# TEXT_EXTENSIONS = .css .html .js .json .svg .txt .xml

echo
echo "== Markers in scanned public text files (local-only / LOCAL-ONLY / tools-hub-local / _local) =="
rg -n --hidden --no-ignore-vcs \
  -g '*.css' -g '*.html' -g '*.js' -g '*.json' -g '*.svg' -g '*.txt' -g '*.xml' \
  -e '\b(local-only|LOCAL-ONLY|tools-hub-local|_local)\b' \
  index.html catalog categories collections data method radar tools updates \
  app.js pwa.js service-worker.js manifest.json styles.css sitemap.xml icon.svg || true

Repository: koltregaskes/stackscout

Length of output: 438

🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n --hidden --no-ignore-vcs --glob '!.git/*' \
  '\b(local-only|LOCAL-ONLY|tools-hub-local|_local)\b' . \
  || true

Repository: koltregaskes/stackscout

Length of output: 743

Fix case-sensitive local-only marker detection in PRIVATE_PATTERNS

scripts/verify-launch-safety.js uses a case-sensitive regex for the “local-only surface marker” (/\b(?:tools-hub-local|LOCAL-ONLY|_local)\b/), so it will not match lowercase local-only. Current public output doesn’t contain these marker strings, but this gap could allow a local-only leak through if it ever appears. Include the lowercase variant (or add an /i flag) to make detection consistent.

Also, the CACHE_NAME vs index.html “Updated …” date mismatch claim doesn’t apply to the checked-in files here (stackscout-2026-06-04 vs Updated 4 Jun 2026 → 2026-06-04).

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/verify-launch-safety.js` at line 51, The regex in PRIVATE_PATTERNS
for the "local-only surface marker" is case-sensitive and misses the lowercase
"local-only"; update the PRIVATE_PATTERNS entry (the object with label
'local-only surface marker') to either include the lowercase variant (e.g., add
'local-only' to the alternation) or apply the case-insensitive /i flag so it
matches all case forms, and then remove or correct the accompanying
comment/assertion about a CACHE_NAME vs index.html "Updated …" date mismatch
(referencing CACHE_NAME and the 'index.html' Updated line) so it reflects the
actual checked-in filenames/dates or drops the incorrect claim.

{ label: 'private operations wording', pattern: /\b(?:manager inbox|review evidence|session state)\b/i },
]
const REQUIRED_GITIGNORE_PATTERNS = ['.env', '.env.*', '*.local.md', '.local/', 'local-hub/']
Expand Down
2 changes: 1 addition & 1 deletion service-worker.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
const CACHE_NAME = 'stackscout-2026-05-25'
const CACHE_NAME = 'stackscout-2026-06-06'
const APP_SHELL = [
'',
'index.html',
Expand Down
Loading