Repository navigation
patch explainer: patched pages embed a relative path to the deleted temp patched-draft.json (user name on Windows, not reproducible) #1085
Description
What happens
archify patch explainer writes a patched page whose embedded prepared bundle carries inputPath pointing at the temporary patched-draft.json that commandPatch creates and then deletes. The path is stored relative to the output page, so for a page saved outside the temp directory it climbs to the OS temp folder, which on Windows includes the user's profile name. A page delivered without patching carries only sourcePath.
Side effects:
- the patched page publishes the author's local user name and temp directory layout;
- the temp directory name is random, so patching the same page with the same replacement twice gives different bytes (the bundle digest covers
inputPath).
Reproduced on v3.2.0 (main 25cf370 has the same commandPatch). Windows 11, Node 24.
Minimal repro
In a project directory outside the temp folder, with any formal explainer draft (here branches.archify.md, one panel {#q}):
node archify/bin/archify.mjs deliver explainer branches.archify.md page.html --quality standard
printf '## How does a release branch? {#q}\n\nIt branches on the build result.\n' > repl.md
node archify/bin/archify.mjs patch explainer page.html q repl.md patched.html
The archify-explainer-prepared payload of page.html has "sourcePath":"branches.archify.md". The one in patched.html has the same sourcePath plus:
"inputPath":"..\\..\\..\\..\\..\\..\\Users\\<user>\\AppData\\Local\\Temp\\archify-explainer-patch-0zV7G0\\patched-draft.json"
Expected
The patched page's bundle has the same shape as a delivered page: bound to the original draft (sourcePath), with no reference to the temporary file, so patching is reproducible and publishes no local paths.
Cause
archify/bin/archify.mjs:5333-5334 (commandPatch): the bundle is rebound with inputPath set to the temporary patched-draft.json so that the child deliver accepts it (readPreparedBundle compares bundle.inputPath || bundle.sourcePath with the delivered input). That binding is then written into the page as is. Dropping inputPath (and recomputing the digest) before the page is written, or letting the child accept a bundle bound to the original draft, avoids it.
🤖 Generated with Claude Code
Activity
fix(explainer): patched pages keep the original draft binding (UPSTRE…
BlueboxC commentedon Oct 24, 2026
Reproduced on our Archify 3.2.0-based fork at
897cbbf04351bfc75749544cc50eadedfb1e9521. Fixed, packaged and installed in 8b1b702.The fix excludes the execution-only
inputPathat page serialization and recomputes the published bundle digest. The private temporary-input binding, source identity, byte/digest checks and resource validation remain in place. It also handles pages without a usable original directory without mutating the private bundle.Verified:
Reproduction tests:
node --test test/explainer-patch.test.mjs test/explainer-renderer.test.mjs test/explainer-input-publication.test.mjs.Existing user HTML is not rewritten. These are local automated results; no human visual review, native Windows qualification or upstream merge approval is implied. No final-head remote CI ran on the fork branch.
BlueboxC
tt-a1i commentedon Oct 25, 2026
Completed on
devthrough #1090, integrated by #1102 at commit 10b4dd5. Original contribution history is retained.Published patched pages omit the private temporary input binding while preserving original origins and recomputing the bundle digest.
The exact integrated candidate 98efbfc passed CI run 40177166414: 19 successful jobs, no failures, two deployment-only skips. Closing as completed in the development branch; this does not announce a release or a live installation.