[dependabot]

Bumps the cloudhal group with 12 updates:

Package	From	To
@cloudhal/astro-renderer	0.6.2	0.6.5
@cloudhal/cli	0.6.2	0.6.5
@cloudhal/core-ts	0.6.2	0.6.5
@cloudhal/cloudflare	0.6.2	0.6.5
@cloudhal/agent-runtime	0.6.2	0.6.5
@cloudhal/analytics	0.6.2	0.6.5
@cloudhal/api	0.6.2	0.6.5
@cloudhal/comments	0.6.2	0.6.5
@cloudhal/core-contracts	0.6.2	0.6.5
@cloudhal/mcp-server	0.6.2	0.6.5
@cloudhal/schedules	0.6.2	0.6.5
@cloudhal/storage	0.6.2	0.6.5

Updates @cloudhal/astro-renderer from 0.6.2 to 0.6.5

Release notes

Sourced from @​cloudhal/astro-renderer's releases.

Cloudhal 0.6.5

All @cloudhal/* packages and create-cloudhal at 0.6.5.

Changes

• Cloudhal's own rate-limit counters move out of Better Auth's rateLimit table into rate_limits (migration 0030_rate_limits, #168). This covers the hourly cap of 3 reset mails per address, the per-minute buckets of the public token endpoints and each agent key's window. Better Auth prunes rateLimit by its own 60 s window, so the hourly reset-mail cap used to restart about a minute after any sign-in from the same address. Each hit counts in one statement (an upsert with RETURNING). Because the keys come from client addresses and submitted email addresses, about one hit in 32 also deletes up to 500 expired counters through an expires_at index. The migration deletes the old cloudhal: rows from rateLimit, so each counter starts over once at upgrade.

• Slug and name trims run in one linear pass instead of /^-+|-+$/g (CodeQL js/polynomial-redos, #168). This covers slugify, foldName and slugifyFilename in core-ts (the new trimChar is exported from @cloudhal/core-ts/names), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one - first. These inputs were quadratic and are linear now: analytics' datasetName on a long run of _ inside a deployment name; json-render component keys in fromJsonRender (./interop); trailing whitespace in directive blocks and on comment lines; trailing / in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new trimEndChar is exported from @cloudhal/core-ts/names too.

  Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot.

• Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged.

  • Unauthenticated password-reset request. POST /api/password-reset/request (and invite creation) checks the address length before anything else, and the address check no longer backtracks: a@ followed by many dots used to cost seconds of CPU per request. Public token endpoints (/api/password-reset/*, invite acceptance) refuse a JSON body over 64 KiB with 413 payload_too_large, whether or not it declares a content-length.
  • core-ts. Redirect path normalising and matching (on every site request): normalisePath, joinTarget, and ancestorPaths, which no longer lists ancestors that no redirect can match: those longer than a from may be (1024 code points) or holding //. Directive lines in search text keep their braces on one line, so a directive whose {…} spans a lone \r is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, url(…) references (about cubic on url( followed by spaces) and width/height lengths (new css-scan.ts).
  • schedules. The feed check's CDATA, element and <enclosure>/<media:content> url scans, and urlPath.
  • agent-runtime. SKILL.md frontmatter lines (a line of spaces was quadratic).
  • Studio (in @cloudhal/cli): the markdown body editor's trailing-newline trims.

• Status page fixes after RFC-0043 PR 1 (#167). The Site Worker no longer turns a 5xx the renderer or the theme answers on purpose into the error page: the starter's own not-published 503 for a request that reaches Astro (a POST, say) passes unchanged and logs nothing; only Astro's own 500 page (HTML, or its empty fallback when no 500 page renders) and thrown errors become the error page. A theme page that throws now gets that page with a reference and a cloudhal: request failed log line: the blog starter's catch-all route rethrows when Astro renders it as the error route, instead of answering its own 404 for the page's path (theme copies made from an earlier starter can add the same two lines at the top of [...path].astro). A store that cannot be read before rendering answers 503 unavailable with Retry-After: 300, as /__cloudhal/health reports it, instead of a 500; so does a multi-site Worker whose hostname map cannot be read (health 503 { ok: false }, pages the English unavailable page). The error page uses the site's language and name when the request has already read the site, taken from the published snapshot (an unpublished rename never shows). An invalid preview token on a feed, sitemap, llms.txt or JSON path answers 410 instead of the published content, and no response says why a token failed any more (x-cloudhal-preview-error is now always invalid).

• MCP OAuth step-up follow-ups (RFC-0044 phase 1, #168). These stay latent until phase 2 gives connections a grantId. A policy denial for missing scopes now carries missing, the required scopes that neither the caller's scopes nor an own variant satisfy. The new stepUpScopes(policy, principal, tool, args) turns that into the scopes a token should ask for, using the same rules as the handler: a propose call's proposeScopes, the own variant the member's role holds (content:write:own for an Author, content:draft:own for a Contributor, site:publish:own for an Author's publish) and the member's role on the call's site (RFC-0034 A2), capped by their installation role as consent caps a token (an installation Contributor who is an Editor on one site is asked for content:draft:own there). A call that would still be denied with those scopes, such as a write in plan mode or a tool outside the declared skill, is not challenged. The /mcp step-up 403 asks for exactly that set and now leaves an audit row, like other denials. createApi throws when mcp.oauth.resource is not the public URL of /mcp. A playground refuses both OAuth protected-resource documents (403 {error: "playground", block: "mcp"}), as its route table already said.

Upgrade

npm install @cloudhal/cli@0.6.5 @cloudhal/core-ts@0.6.5 @cloudhal/astro-renderer@0.6.5 @cloudhal/cloudflare@0.6.5
npx cloudhal deploy

Docs: https://cloudhal.dev/docs/start/installation#upgrading

Cloudhal 0.6.4

All @cloudhal/* packages and create-cloudhal at 0.6.4.

Changes

• Status pages (RFC-0043 §1, #117). A site that cannot show its pages answers with one small, translated, self-contained page instead of plain text: not-published (503, Retry-After: 3600, noindex) before the first publish, preview-expired (410) for a preview link that does not verify, unavailable (503) for a Worker that serves no site, and error (500, with the cf-ray as a reference) when a render fails. The Site Worker answers them before Astro runs, every one no-store with its own CSP; GET /__cloudhal/health answers { "ok": true, "state": "published" | "not-published" } in the admin's /api/health shape. The page is in the request's locale (host or path prefix, then the site default, then English) for every language Studio speaks, right to left where needed, through the same pnpm i18n:export/import flow as Studio's catalogs. A theme may restyle it with an optional statusPage export in src/theme.ts (@cloudhal/astro-renderer/status-page), which falls back to the built-in page on a throw, a slow answer or an oversized document and never runs for error; cloudhal dev draws each state at /__cloudhal/status/<state>. The blog starter's routes use statusPage/statusPlain as their own fallback. Behaviour change: an invalid or expired preview link now answers 410 instead of silently showing the published page.

• Security (self-hosting, #165). In 0.6.3 a self-hosted cloudhal studio (the Docker image included) exposed to a network before its first sign-up could be claimed by whoever reached it first: the first account to sign up became the Owner, and nothing on the Node path asked for the setup token the Cloudflare deployment already requires. If you run 0.6.3 beyond localhost, upgrade and check that the Owner account is yours. In 0.6.4:

  • A setup token for the first account. While nobody has an account, cloudhal studio requires the one-time token from CLOUDHAL_SETUP_TOKEN (32 characters or more, letters, digits and - . _ ~ only, e.g. openssl rand -hex 32; a shorter or other value stops the start) or, when that is unset, one it generates at start and prints as a …/login#setup=<token> link to its output (read it from the container's logs: docker compose logs cloudhal). Sign-up without the token is refused; once the Owner exists the link is no longer printed. An operator's own token is never printed.
  • Sign-in from the address browsers actually use. With --host beyond loopback and no --base-url, Better Auth refused every sign-up, sign-in and sign-out with 403 INVALID_ORIGIN because only http://localhost:<port> was trusted. Without a public origin Studio now also trusts the origin each request was made to, as the API's own CSRF check does (on a loopback --host only when that origin is localhost, 127.0.0.1 or [::1], so a DNS name rebound to the machine is not trusted); with --base-url set, that origin alone (plus CLOUDHAL_TRUSTED_ORIGINS) may sign in. --base-url is the origin browsers open Studio at: required behind a reverse proxy and recommended whenever --host is not loopback; a start without it beyond loopback prints a one-line warning.
  • --no-auth stays on this machine. It is refused unless --host is loopback (127.0.0.1, the default, or ::1) and --behind-proxy is off.
  • Rate limits count the real client. The public token endpoints (invites, password resets) and Better Auth's own limits keyed on X-Forwarded-For / CF-Connecting-IP as the client sent them. serveNode now derives the client's address itself: the socket's, or with trustProxy the last X-Forwarded-For hop, which the proxy appended; the API (ApiDeps.clientAddressHeader) and Better Auth (AuthOptions.clientAddressHeader) read only that value on Node, while Workers keep CF-Connecting-IP. Sessions record that address too, and Better Auth's own limits (sign-in and sign-up: 3 per 10 s per address) now apply on Node as on Workers, stored in the project's SQLite; before they were on only under NODE_ENV=production.
  • Behind a trusted proxy, forwardedUrl takes the last value of X-Forwarded-Proto / X-Forwarded-Host, the one the proxy added, not the first, which a client can send.
  • --base-url is also the origin of invite and password-reset links (ApiDeps.studioOrigin).
  • Studio's setup banner no longer names only cloudhal deploy: it speaks of the setup link printed when Cloudhal started or was deployed (other languages are AI drafts awaiting review).
  • Studio's login page reads #setup=<token> without form decoding, so an operator's own token containing + (from openssl rand -base64, for a Cloudflare deployment too) is no longer turned into a space and refused.
  • --behind-proxy needs --base-url. cloudhal studio refuses to start with --behind-proxy / CLOUDHAL_BEHIND_PROXY=1 and no --base-url / CLOUDHAL_BASE_URL. Behind a proxy the public origin is known, and as Better Auth's base URL it makes session cookies Secure (__Secure- prefix) on https and is the one origin sign-in accepts. In 0.6.3 that combination could not sign in at all, so no working setup breaks.
  • --init-if-empty stages the scaffold in .cloudhal-init inside the folder and moves it into place with cloudhal.json last, so a container stopped during its first start no longer crash-loops on "is not empty": the next start redoes the scaffold when the staged cloudhal.json is missing, cut off or names no site, and finishes it otherwise. A fresh ext4 volume whose only entry is lost+found counts as empty.
  • A bare --host means 0.0.0.0, every IPv4 address; pass --host :: for IPv6 as well. The help says so.

  New in @cloudhal/api: CLIENT_ADDRESS_HEADER, clientAddress and inboundRequest in @cloudhal/api/node; trustedOriginsWithOwn (with loopbackOnly) and AuthOptions.trustedOrigins as a function in @cloudhal/api/auth; createAuthFor takes setupToken, trustRequestOrigin and originCheck. studio() returns setup (the link, while nobody has an account) and warnings.

... (truncated)

Changelog

Sourced from @​cloudhal/astro-renderer's changelog.

0.6.5

Patch Changes

• b0ebd95: Slug and name trims run in one linear pass instead of /^-+|-+$/g (CodeQL js/polynomial-redos, #168). This covers slugify, foldName and slugifyFilename in core-ts (the new trimChar is exported from @cloudhal/core-ts/names), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one - first. These inputs were quadratic and are linear now: analytics' datasetName on a long run of _ inside a deployment name; json-render component keys in fromJsonRender (./interop); trailing whitespace in directive blocks and on comment lines; trailing / in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new trimEndChar is exported from @cloudhal/core-ts/names too.

  Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot.

• f4a1ee3: Status page fixes after RFC-0043 PR 1 (#167). The Site Worker no longer turns a 5xx the renderer or the theme answers on purpose into the error page: the starter's own not-published 503 for a request that reaches Astro (a POST, say) passes unchanged and logs nothing; only Astro's own 500 page (HTML, or its empty fallback when no 500 page renders) and thrown errors become the error page. A theme page that throws now gets that page with a reference and a cloudhal: request failed log line: the blog starter's catch-all route rethrows when Astro renders it as the error route, instead of answering its own 404 for the page's path (theme copies made from an earlier starter can add the same two lines at the top of [...path].astro). A store that cannot be read before rendering answers 503 unavailable with Retry-After: 300, as /__cloudhal/health reports it, instead of a 500; so does a multi-site Worker whose hostname map cannot be read (health 503 { ok: false }, pages the English unavailable page). The error page uses the site's language and name when the request has already read the site, taken from the published snapshot (an unpublished rename never shows). An invalid preview token on a feed, sitemap, llms.txt or JSON path answers 410 instead of the published content, and no response says why a token failed any more (x-cloudhal-preview-error is now always invalid).

• Updated dependencies [b0ebd95]

• Updated dependencies [b0ebd95]

• Updated dependencies [c15218e]

  • @​cloudhal/core-ts@​0.6.5
  • @​cloudhal/analytics@​0.6.5
  • @​cloudhal/comments@​0.6.5
  • @​cloudhal/storage@​0.6.5
  • @​cloudhal/core-contracts@​0.6.5

0.6.4

Patch Changes

• b073595: Status pages (RFC-0043 §1, #117). A site that cannot show its pages answers with one small, translated, self-contained page instead of plain text: not-published (503, Retry-After: 3600, noindex) before the first publish, preview-expired (410) for a preview link that does not verify, unavailable (503) for a Worker that serves no site, and error (500, with the cf-ray as a reference) when a render fails. The Site Worker answers them before Astro runs, every one no-store with its own CSP; GET /__cloudhal/health answers { "ok": true, "state": "published" | "not-published" } in the admin's /api/health shape. The page is in the request's locale (host or path prefix, then the site default, then English) for every language Studio speaks, right to left where needed, through the same pnpm i18n:export/import flow as Studio's catalogs. A theme may restyle it with an optional statusPage export in src/theme.ts (@cloudhal/astro-renderer/status-page), which falls back to the built-in page on a throw, a slow answer or an oversized document and never runs for error; cloudhal dev draws each state at /__cloudhal/status/<state>. The blog starter's routes use statusPage/statusPlain as their own fallback. Behaviour change: an invalid or expired preview link now answers 410 instead of silently showing the published page.
• @​cloudhal/analytics@​0.6.4
  • @​cloudhal/comments@​0.6.4
  • @​cloudhal/core-contracts@​0.6.4
  • @​cloudhal/core-ts@​0.6.4
  • @​cloudhal/storage@​0.6.4

0.6.3

Patch Changes

• 1dd79c2: Dependency updates from the November 2026 Dependabot sweep. @cloudhal/astro-renderer, @cloudhal/cli and @cloudhal/cloudflare use wrangler 4.152.0 (its createTestHarness runs Miniflare 5.20261019.2-beta, and wrangler deploy uploads source maps by default since 4.150). The Studio shipped in @cloudhal/cli is built with Tiptap 3.32.0 and @codemirror/language 6.13.1. The Rust crate validates with jsonschema 0.60.2, and the monorepo lints and formats with Biome 2.6.2 (Markdown and YAML formatting stay off).
• 7dddd88: @cloudhal/astro-renderer, @cloudhal/cli and @cloudhal/cloudflare use wrangler 4.158.0, and @cloudhal/astro-renderer uses @astrojs/cloudflare 14.4.4, which brings @cloudflare/vite-plugin 1.67 (its peer range is wrangler ^4.156.1, so the two move together). @astrojs/cloudflare 14.4 needs Astro 7.4, so projects move to Astro 7.4.7: the blog starter asks for it, and the astro peer range of @cloudhal/astro-renderer and @cloudhal/cli is now ^7.4.0 (was ^7.3.0). The blog starter asks for wrangler ^4.158.0.
• @​cloudhal/analytics@​0.6.3
  • @​cloudhal/comments@​0.6.3
  • @​cloudhal/core-contracts@​0.6.3
  • @​cloudhal/core-ts@​0.6.3
  • @​cloudhal/storage@​0.6.3

Commits

• e30788c chore(release): version packages
• f137899 fix: review round 2 for #168 (rate-limit pruning, step-up loops, ReDoS)
• b0ebd95 fix: review follow-ups for 0.6.5 (#168)
• 0c1946f fix(astro-renderer): error-page site off the request path, wiring tests (#167...
• 631a6e4 fix(astro-renderer): theme crashes, published site name, host lookup failure ...
• f4a1ee3 fix(astro-renderer): status-page fixes after RFC-0043 PR 1 (#167)
• 7e4e0d4 chore(release): version packages
• 7b61d6f Merge pull request #162 from cloudhal-dev/feat/status-pages
• 30b39f9 fix(renderer): trim trailing slashes without a backtracking regex
• 97dbd49 chore(release): version packages
• Additional commits viewable in compare view

Updates @cloudhal/cli from 0.6.2 to 0.6.5

Release notes

Sourced from @​cloudhal/cli's releases.

Cloudhal 0.6.5

All @cloudhal/* packages and create-cloudhal at 0.6.5.

Changes

• Cloudhal's own rate-limit counters move out of Better Auth's rateLimit table into rate_limits (migration 0030_rate_limits, #168). This covers the hourly cap of 3 reset mails per address, the per-minute buckets of the public token endpoints and each agent key's window. Better Auth prunes rateLimit by its own 60 s window, so the hourly reset-mail cap used to restart about a minute after any sign-in from the same address. Each hit counts in one statement (an upsert with RETURNING). Because the keys come from client addresses and submitted email addresses, about one hit in 32 also deletes up to 500 expired counters through an expires_at index. The migration deletes the old cloudhal: rows from rateLimit, so each counter starts over once at upgrade.

• Slug and name trims run in one linear pass instead of /^-+|-+$/g (CodeQL js/polynomial-redos, #168). This covers slugify, foldName and slugifyFilename in core-ts (the new trimChar is exported from @cloudhal/core-ts/names), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one - first. These inputs were quadratic and are linear now: analytics' datasetName on a long run of _ inside a deployment name; json-render component keys in fromJsonRender (./interop); trailing whitespace in directive blocks and on comment lines; trailing / in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new trimEndChar is exported from @cloudhal/core-ts/names too.

  Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot.

• Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged.

  • Unauthenticated password-reset request. POST /api/password-reset/request (and invite creation) checks the address length before anything else, and the address check no longer backtracks: a@ followed by many dots used to cost seconds of CPU per request. Public token endpoints (/api/password-reset/*, invite acceptance) refuse a JSON body over 64 KiB with 413 payload_too_large, whether or not it declares a content-length.
  • core-ts. Redirect path normalising and matching (on every site request): normalisePath, joinTarget, and ancestorPaths, which no longer lists ancestors that no redirect can match: those longer than a from may be (1024 code points) or holding //. Directive lines in search text keep their braces on one line, so a directive whose {…} spans a lone \r is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, url(…) references (about cubic on url( followed by spaces) and width/height lengths (new css-scan.ts).
  • schedules. The feed check's CDATA, element and <enclosure>/<media:content> url scans, and urlPath.
  • agent-runtime. SKILL.md frontmatter lines (a line of spaces was quadratic).
  • Studio (in @cloudhal/cli): the markdown body editor's trailing-newline trims.

• Status page fixes after RFC-0043 PR 1 (#167). The Site Worker no longer turns a 5xx the renderer or the theme answers on purpose into the error page: the starter's own not-published 503 for a request that reaches Astro (a POST, say) passes unchanged and logs nothing; only Astro's own 500 page (HTML, or its empty fallback when no 500 page renders) and thrown errors become the error page. A theme page that throws now gets that page with a reference and a cloudhal: request failed log line: the blog starter's catch-all route rethrows when Astro renders it as the error route, instead of answering its own 404 for the page's path (theme copies made from an earlier starter can add the same two lines at the top of [...path].astro). A store that cannot be read before rendering answers 503 unavailable with Retry-After: 300, as /__cloudhal/health reports it, instead of a 500; so does a multi-site Worker whose hostname map cannot be read (health 503 { ok: false }, pages the English unavailable page). The error page uses the site's language and name when the request has already read the site, taken from the published snapshot (an unpublished rename never shows). An invalid preview token on a feed, sitemap, llms.txt or JSON path answers 410 instead of the published content, and no response says why a token failed any more (x-cloudhal-preview-error is now always invalid).

• MCP OAuth step-up follow-ups (RFC-0044 phase 1, #168). These stay latent until phase 2 gives connections a grantId. A policy denial for missing scopes now carries missing, the required scopes that neither the caller's scopes nor an own variant satisfy. The new stepUpScopes(policy, principal, tool, args) turns that into the scopes a token should ask for, using the same rules as the handler: a propose call's proposeScopes, the own variant the member's role holds (content:write:own for an Author, content:draft:own for a Contributor, site:publish:own for an Author's publish) and the member's role on the call's site (RFC-0034 A2), capped by their installation role as consent caps a token (an installation Contributor who is an Editor on one site is asked for content:draft:own there). A call that would still be denied with those scopes, such as a write in plan mode or a tool outside the declared skill, is not challenged. The /mcp step-up 403 asks for exactly that set and now leaves an audit row, like other denials. createApi throws when mcp.oauth.resource is not the public URL of /mcp. A playground refuses both OAuth protected-resource documents (403 {error: "playground", block: "mcp"}), as its route table already said.

Upgrade

npm install @cloudhal/cli@0.6.5 @cloudhal/core-ts@0.6.5 @cloudhal/astro-renderer@0.6.5 @cloudhal/cloudflare@0.6.5
npx cloudhal deploy

Docs: https://cloudhal.dev/docs/start/installation#upgrading

Cloudhal 0.6.4

All @cloudhal/* packages and create-cloudhal at 0.6.4.

Changes

• Status pages (RFC-0043 §1, #117). A site that cannot show its pages answers with one small, translated, self-contained page instead of plain text: not-published (503, Retry-After: 3600, noindex) before the first publish, preview-expired (410) for a preview link that does not verify, unavailable (503) for a Worker that serves no site, and error (500, with the cf-ray as a reference) when a render fails. The Site Worker answers them before Astro runs, every one no-store with its own CSP; GET /__cloudhal/health answers { "ok": true, "state": "published" | "not-published" } in the admin's /api/health shape. The page is in the request's locale (host or path prefix, then the site default, then English) for every language Studio speaks, right to left where needed, through the same pnpm i18n:export/import flow as Studio's catalogs. A theme may restyle it with an optional statusPage export in src/theme.ts (@cloudhal/astro-renderer/status-page), which falls back to the built-in page on a throw, a slow answer or an oversized document and never runs for error; cloudhal dev draws each state at /__cloudhal/status/<state>. The blog starter's routes use statusPage/statusPlain as their own fallback. Behaviour change: an invalid or expired preview link now answers 410 instead of silently showing the published page.

• Security (self-hosting, #165). In 0.6.3 a self-hosted cloudhal studio (the Docker image included) exposed to a network before its first sign-up could be claimed by whoever reached it first: the first account to sign up became the Owner, and nothing on the Node path asked for the setup token the Cloudflare deployment already requires. If you run 0.6.3 beyond localhost, upgrade and check that the Owner account is yours. In 0.6.4:

  • A setup token for the first account. While nobody has an account, cloudhal studio requires the one-time token from CLOUDHAL_SETUP_TOKEN (32 characters or more, letters, digits and - . _ ~ only, e.g. openssl rand -hex 32; a shorter or other value stops the start) or, when that is unset, one it generates at start and prints as a …/login#setup=<token> link to its output (read it from the container's logs: docker compose logs cloudhal). Sign-up without the token is refused; once the Owner exists the link is no longer printed. An operator's own token is never printed.
  • Sign-in from the address browsers actually use. With --host beyond loopback and no --base-url, Better Auth refused every sign-up, sign-in and sign-out with 403 INVALID_ORIGIN because only http://localhost:<port> was trusted. Without a public origin Studio now also trusts the origin each request was made to, as the API's own CSRF check does (on a loopback --host only when that origin is localhost, 127.0.0.1 or [::1], so a DNS name rebound to the machine is not trusted); with --base-url set, that origin alone (plus CLOUDHAL_TRUSTED_ORIGINS) may sign in. --base-url is the origin browsers open Studio at: required behind a reverse proxy and recommended whenever --host is not loopback; a start without it beyond loopback prints a one-line warning.
  • --no-auth stays on this machine. It is refused unless --host is loopback (127.0.0.1, the default, or ::1) and --behind-proxy is off.
  • Rate limits count the real client. The public token endpoints (invites, password resets) and Better Auth's own limits keyed on X-Forwarded-For / CF-Connecting-IP as the client sent them. serveNode now derives the client's address itself: the socket's, or with trustProxy the last X-Forwarded-For hop, which the proxy appended; the API (ApiDeps.clientAddressHeader) and Better Auth (AuthOptions.clientAddressHeader) read only that value on Node, while Workers keep CF-Connecting-IP. Sessions record that address too, and Better Auth's own limits (sign-in and sign-up: 3 per 10 s per address) now apply on Node as on Workers, stored in the project's SQLite; before they were on only under NODE_ENV=production.
  • Behind a trusted proxy, forwardedUrl takes the last value of X-Forwarded-Proto / X-Forwarded-Host, the one the proxy added, not the first, which a client can send.
  • --base-url is also the origin of invite and password-reset links (ApiDeps.studioOrigin).
  • Studio's setup banner no longer names only cloudhal deploy: it speaks of the setup link printed when Cloudhal started or was deployed (other languages are AI drafts awaiting review).
  • Studio's login page reads #setup=<token> without form decoding, so an operator's own token containing + (from openssl rand -base64, for a Cloudflare deployment too) is no longer turned into a space and refused.
  • --behind-proxy needs --base-url. cloudhal studio refuses to start with --behind-proxy / CLOUDHAL_BEHIND_PROXY=1 and no --base-url / CLOUDHAL_BASE_URL. Behind a proxy the public origin is known, and as Better Auth's base URL it makes session cookies Secure (__Secure- prefix) on https and is the one origin sign-in accepts. In 0.6.3 that combination could not sign in at all, so no working setup breaks.
  • --init-if-empty stages the scaffold in .cloudhal-init inside the folder and moves it into place with cloudhal.json last, so a container stopped during its first start no longer crash-loops on "is not empty": the next start redoes the scaffold when the staged cloudhal.json is missing, cut off or names no site, and finishes it otherwise. A fresh ext4 volume whose only entry is lost+found counts as empty.
  • A bare --host means 0.0.0.0, every IPv4 address; pass --host :: for IPv6 as well. The help says so.

  New in @cloudhal/api: CLIENT_ADDRESS_HEADER, clientAddress and inboundRequest in @cloudhal/api/node; trustedOriginsWithOwn (with loopbackOnly) and AuthOptions.trustedOrigins as a function in @cloudhal/api/auth; createAuthFor takes setupToken, trustRequestOrigin and originCheck. studio() returns setup (the link, while nobody has an account) and warnings.

... (truncated)

Changelog

Sourced from @​cloudhal/cli's changelog.

0.6.5

Patch Changes

• b0ebd95: Slug and name trims run in one linear pass instead of /^-+|-+$/g (CodeQL js/polynomial-redos, #168). This covers slugify, foldName and slugifyFilename in core-ts (the new trimChar is exported from @cloudhal/core-ts/names), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one - first. These inputs were quadratic and are linear now: analytics' datasetName on a long run of _ inside a deployment name; json-render component keys in fromJsonRender (./interop); trailing whitespace in directive blocks and on comment lines; trailing / in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new trimEndChar is exported from @cloudhal/core-ts/names too.

  Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot.

• c15218e: Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged.

  • Unauthenticated password-reset request. POST /api/password-reset/request (and invite creation) checks the address length before anything else, and the address check no longer backtracks: a@ followed by many dots used to cost seconds of CPU per request. Public token endpoints (/api/password-reset/*, invite acceptance) refuse a JSON body over 64 KiB with 413 payload_too_large, whether or not it declares a content-length.
  • core-ts. Redirect path normalising and matching (on every site request): normalisePath, joinTarget, and ancestorPaths, which no longer lists ancestors that no redirect can match: those longer than a from may be (1024 code points) or holding //. Directive lines in search text keep their braces on one line, so a directive whose {…} spans a lone \r is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, url(…) references (about cubic on url( followed by spaces) and width/height lengths (new css-scan.ts).
  • schedules. The feed check's CDATA, element and <enclosure>/<media:content> url scans, and urlPath.
  • agent-runtime. SKILL.md frontmatter lines (a line of spaces was quadratic).
  • Studio (in @cloudhal/cli): the markdown body editor's trailing-newline trims.

• Updated dependencies [b0ebd95]

• Updated dependencies [b0ebd95]

• Updated dependencies [b0ebd95]

• Updated dependencies [c15218e]

  • @​cloudhal/core-ts@​0.6.5
  • @​cloudhal/analytics@​0.6.5
  • @​cloudhal/comments@​0.6.5
  • @​cloudhal/agent-runtime@​0.6.5
  • @​cloudhal/api@​0.6.5
  • @​cloudhal/storage@​0.6.5
  • @​cloudhal/schedules@​0.6.5
  • @​cloudhal/cloudflare@​0.6.5
  • @​cloudhal/mcp-server@​0.6.5
  • @​cloudhal/core-contracts@​0.6.5

0.6.4

Patch Changes

• 471087a: Security (self-hosting, #165). In 0.6.3 a self-hosted cloudhal studio (the Docker image included) exposed to a network before its first sign-up could be claimed by whoever reached it first: the first account to sign up became the Owner, and nothing on the Node path asked for the setup token the Cloudflare deployment already requires. If you run 0.6.3 beyond localhost, upgrade and check that the Owner account is yours. In 0.6.4:

  • A setup token for the first account. While nobody has an account, cloudhal studio requires the one-time token from CLOUDHAL_SETUP_TOKEN (32 characters or more, letters, digits and - . _ ~ only, e.g. openssl rand -hex 32; a shorter or other value stops the start) or, when that is unset, one it generates at start and prints as a …/login#setup=<token> link to its output (read it from the container's logs: docker compose logs cloudhal). Sign-up without the token is refused; once the Owner exists the link is no longer printed. An operator's own token is never printed.
  • Sign-in from the address browsers actually use. With --host beyond loopback and no --base-url, Better Auth refused every sign-up, sign-in and sign-out with 403 INVALID_ORIGIN because only http://localhost:<port> was trusted. Without a public origin Studio now also trusts the origin each request was made to, as the API's own CSRF check does (on a loopback --host only when that origin is localhost, 127.0.0.1 or [::1], so a DNS name rebound to the machine is not trusted); with --base-url set, that origin alone (plus CLOUDHAL_TRUSTED_ORIGINS) may sign in. --base-url is the origin browsers open Studio at: required behind a reverse proxy and recommended whenever --host is not loopback; a start without it beyond loopback prints a one-line warning.
  • --no-auth stays on this machine. It is refused unless --host is loopback (127.0.0.1, the default, or ::1) and --behind-proxy is off.
  • Rate limits count the real client. The public token endpoints (invites, password resets) and Better Auth's own limits keyed on X-Forwarded-For / CF-Connecting-IP as the client sent them. serveNode now derives the client's address itself: the socket's, or with trustProxy the last X-Forwarded-For hop, which the proxy appended; the API (ApiDeps.clientAddressHeader) and Better Auth (AuthOptions.clientAddressHeader) read only that value on Node, while Workers keep CF-Connecting-IP. Sessions record that address too, and Better Auth's own limits (sign-in and sign-up: 3 per 10 s per address) now apply on Node as on Workers, stored in the project's SQLite; before they were on only under NODE_ENV=production.
  • Behind a trusted proxy, forwardedUrl takes the last value of X-Forwarded-Proto / X-Forwarded-Host, the one the proxy added, not the first, which a client can send.
  • --base-url is also the origin of invite and password-reset links (ApiDeps.studioOrigin).
  • Studio's setup banner no longer names only cloudhal deploy: it speaks of the setup link printed when Cloudhal started or was deployed (other languages are AI drafts awaiting review).
  • Studio's login page reads #setup=<token> without form decoding, so an operator's own token containing + (from openssl rand -base64, for a Cloudflare deployment too) is no longer turned into a space and refused.
  • --behind-proxy needs --base-url. cloudhal studio refuses to start with --behind-proxy / CLOUDHAL_BEHIND_PROXY=1 and no --base-url / CLOUDHAL_BASE_URL. Behind a proxy the public origin is known, and as Better Auth's base URL it makes session cookies Secure (__Secure- prefix) on https and is the one origin sign-in accepts. In 0.6.3 that combination could not sign in at all, so no working setup breaks.
  • --init-if-empty stages the scaffold in .cloudhal-init inside the folder and moves it into place with cloudhal.json last, so a container stopped during its first start no longer crash-loops on "is not empty": the next start redoes the scaffold when the staged cloudhal.json is missing, cut off or names no site, and finishes it otherwise. A fresh ext4 volume whose only entry is lost+found counts as empty.
  • A bare --host means 0.0.0.0, every IPv4 address; pass --host :: for IPv6 as well. The help says so.

  New in @cloudhal/api: CLIENT_ADDRESS_HEADER, clientAddress and inboundRequest in @cloudhal/api/node; trustedOriginsWithOwn (with loopbackOnly) and AuthOptions.trustedOrigins as a function in @cloudhal/api/auth; createAuthFor takes setupToken, trustRequestOrigin and originCheck. studio() returns setup (the link, while nobody has an account) and warnings.

• b073595: Status pages (RFC-0043 §1, #117). A site that cannot show its pages answers with one small, translated, self-contained page instead of plain text: not-published (503, Retry-After: 3600, noindex) before the first publish, preview-expired (410) for a preview link that does not verify, unavailable (503) for a Worker that serves no site, and error (500, with the cf-ray as a reference) when a render fails. The Site Worker answers them before Astro runs, every one no-store with its own CSP; GET /__cloudhal/health answers { "ok": true, "state": "published" | "not-published" } in the admin's /api/health shape. The page is in the request's locale (host or path prefix, then the site default, then English) for every language Studio speaks, right to left where needed, through the same pnpm i18n:export/import flow as Studio's catalogs. A theme may restyle it with an optional statusPage export in src/theme.ts (@cloudhal/astro-renderer/status-page), which falls back to the built-in page on a throw, a slow answer or an oversized document and never runs for error; cloudhal dev draws each state at /__cloudhal/status/<state>. The blog starter's routes use statusPage/statusPlain as their own fallback. Behaviour change: an invalid or expired preview link now answers 410 instead of silently showing the published page.

• Updated dependencies [471087a]

... (truncated)

Commits

• e30788c chore(release): version packages
• b0ebd95 fix: review follow-ups for 0.6.5 (#168)
• 0c1946f fix(astro-renderer): error-page site off the request path, wiring tests (#167...
• 631a6e4 fix(astro-renderer): theme crashes, published site name, host lookup failure ...
• f4a1ee3 fix(astro-renderer): status-page fixes after RFC-0043 PR 1 (#167)
• 7e4e0d4 chore(release): version packages
• d036754 fix(cli,api): review follow-ups for the self-host hardening (#165)
• 471087a fix(cli,api): self-host auth hardening (#165)
• 3fd5647 ci(release): template sync by hand when the GitHub App is missing
• 7b61d6f Merge pull request #162 from cloudhal-dev/feat/status-pages
• Additional commits viewable in compare view

Updates @cloudhal/core-ts from 0.6.2 to 0.6.5

Release notes

Sourced from @​cloudhal/core-ts's releases.

Cloudhal 0.6.5

All @cloudhal/* packages and create-cloudhal at 0.6.5.

Changes

• Cloudhal's own rate-limit counters move out of Better Auth's rateLimit table into rate_limits (migration 0030_rate_limits, #168). This covers the hourly cap of 3 reset mails per address, the per-minute buckets of the public token endpoints and each agent key's window. Better Auth prunes rateLimit by its own 60 s window, so the hourly reset-mail cap used to restart about a minute after any sign-in from the same address. Each hit counts in one statement (an upsert with RETURNING). Because the keys come from client addresses and submitted email addresses, about one hit in 32 also deletes up to 500 expired counters through an expires_at index. The migration deletes the old cloudhal: rows from rateLimit, so each counter starts over once at upgrade.

• Slug and name trims run in one linear pass instead of /^-+|-+$/g (CodeQL js/polynomial-redos, #168). This covers slugify, foldName and slugifyFilename in core-ts (the new trimChar is exported from @cloudhal/core-ts/names), heading ids in astro-renderer, and Studio's option, media and entry slugs. Results are unchanged. These trims were already linear in practice, because a run of other characters was collapsed to one - first. These inputs were quadratic and are linear now: analytics' datasetName on a long run of _ inside a deployment name; json-render component keys in fromJsonRender (./interop); trailing whitespace in directive blocks and on comment lines; trailing / in request paths (the playground guard and route matching in api, analytics paths, the renderer's link localizing and redirect splats, the docs Worker). The new trimEndChar is exported from @cloudhal/core-ts/names too.

  Also in 0.6.3, with no changeset at the time (#161): Studio's "Not published" badges and its "unknown" scheduler state show their status dot again. They used a Badge variant without a dot colour and rendered no dot.

• Second ReDoS sweep (#174). Input that made a regex backtrack is now handled in linear time; results are unchanged.

  • Unauthenticated password-reset request. POST /api/password-reset/request (and invite creation) checks the address length before anything else, and the address check no longer backtracks: a@ followed by many dots used to cost seconds of CPU per request. Public token endpoints (/api/password-reset/*, invite acceptance) refuse a JSON body over 64 KiB with 413 payload_too_large, whether or not it declares a content-length.
  • core-ts. Redirect path normalising and matching (on every site request): normalisePath, joinTarget, and ancestorPaths, which no longer lists ancestors that no redirect can match: those longer than a from may be (1024 code points) or holding //. Directive lines in search text keep their braces on one line, so a directive whose {…} spans a lone \r is no longer read as one. Search text built at publish time: fenced code, links, images and tags. SVG upload checks: CSS comments, url(…) references (about cubic on url( followed by spaces) and width/height lengths (new css-scan.ts).
  • schedules. The feed check's CDATA, element and <enclosure>/<media:content> url scans, and urlPath.
  • agent-runtime. SKILL.md frontmatter lines (a line of spaces was quadratic).
  • Studio (in @cloudhal/cli): the markdown body editor's trailing-newline trims.

• Status page fixes after RFC-0043 PR 1 (#167). The Site Worker no longer turns a 5xx the renderer or the theme answers on purpose into the error page: the starter's own not-published 503 for a request that reaches Astro (a POST, say) passes unchanged and logs nothing; only Astro's own 500 page (HTML, or its empty fallback when no 500 page renders) and thrown errors become the error page. A theme page that throws now gets that page with a reference and a cloudhal: request failed log line: the blog starter's catch-all route rethrows when Astro renders it as the err...

  Description has been truncated