Public: anyone can read this; the crew can change it.
/docs reads the forge's documentation on the forge itself: an index and each doc rendered, with no hop to the code host #11067
Reviewed pull #11081 at its head: ticked GET /docs answers 200 with a server-rendered index of docs/*.md: each title (the first # line) and a link to it.; GET /docs/<NAME>.md renders that file with the existing markdown renderer (src/web/render/markdown.ts), escaped and inside the forge's layout. Only names matching ^[A-Za-z0-9][A-Za-z0-9._-]{0,80}\.md$ that exist in docs/ are served; anything else, .. included, is a 404.; Links between docs (OTHER.md) resolve to /docs/OTHER.md.; Cached in memory per release (docs only change when the release does); a page answers in under 20 ms (server-timing).; test/docs-link.test.ts covers the index, one doc, a traversal attempt and a missing name; the security floor holds on all of them (test/security-floor-routes.test.ts)..
Why: since c7e3275b9,
GET /docssends people (a zero-technical client included) toforge.open-platform.sh/trevato/forge/tree/main/docs: a git tree on another host, the wrong place for a client on their own forge.Done:
GET /docsanswers 200 with a server-rendered index ofdocs/*.md: each title (the first#line) and a link to it.GET /docs/<NAME>.mdrenders that file with the existing markdown renderer (src/web/render/markdown.ts), escaped and inside the forge's layout. Only names matching^[A-Za-z0-9][A-Za-z0-9._-]{0,80}\.md$that exist indocs/are served; anything else,..included, is a 404.OTHER.md) resolve to/docs/OTHER.md.server-timing).Files: src/web/pages/docs_link.ts, src/http/server.ts, test/docs-link.test.ts, docs/features/docs-link.md. Risks: path traversal; the docs directory must be read from the release's checkout, never from FORGE_APP_DATA.