Release 1.0.0-beta.30 (from d85811b)

verify-static: a long attribute value or a link out of the site no longer crashes the identity proof.

Author: iOSDevSK

.claude-plugin/marketplace.json

@@ -14,7 +14,7 @@
       "source": "./",
       "displayName": "html2wp — HTML to WordPress",
       "description": "BETA. Convert a static HTML site into a standalone WordPress block theme, verified against the original at three viewport widths — and reviewed by you before handover. The conversion runs through a verified Astro 5 build, so the Astro project is a real output too — compared pixel by pixel against the source before anything WordPress-shaped is generated.",
-      "version": "1.0.0-beta.29",
+      "version": "1.0.0-beta.30",
       "author": {
         "name": "BELNEM s.r.o.",
         "email": "hello@html2wp.dev",

.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "html2wp",
   "displayName": "html2wp — HTML to WordPress",
   "description": "BETA. Convert a static HTML site — or anything that builds to one (Lovable, Bolt, v0, Next export) — into a standalone WordPress block theme: verified pixel by pixel, pages, blog, forms, menus, SEO and redirects, with no plugin required and verification gates at every stage. Every conversion ends in your own page-by-page review; the gates catch most fidelity drift, not all of it.",
-  "version": "1.0.0-beta.29",
+  "version": "1.0.0-beta.30",
   "author": {
     "name": "BELNEM s.r.o.",
     "email": "hello@html2wp.dev",

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "html2wp",
-  "version": "1.0.0-beta.29",
+  "version": "1.0.0-beta.30",
   "description": "Convert static HTML or buildable web projects into verified, editable WordPress block themes.",
   "author": {
     "name": "BELNEM s.r.o.",

VERSION

@@ -1 +1 @@
-1.0.0-beta.29
+1.0.0-beta.30

skills/html2wp/VERSION

@@ -1 +1 @@
-1.0.0-beta.29
+1.0.0-beta.30

skills/html2wp/assets/scripts/test-verify-static-identity.py

@@ -103,6 +103,31 @@ def test_a_path_only_a_script_names_counts(self):
         self.assertNotIn('identicalByHash', report['pages']['index.html'])
         self.assertIn('diffRatio', report['pages']['index.html']['desktop'])
 
+    def test_an_attribute_value_longer_than_a_file_name_is_no_file(self):
+        # Every whole attribute value is a candidate path. An SVG path or a
+        # style-like data-* value over 255 bytes is a name no file system
+        # holds: a 404 on both sides alike, not a crash of the whole gate.
+        d = 'M0,0' + 'L1.25,2.5' * 60
+        offsets = '; '.join(f'--offset-{side}: 24px' for side in ('top', 'right', 'bottom', 'left') * 6)
+        extra = f'<svg width="10" height="10"><path d="{d}"/></svg><section data-offsets="{offsets};"></section>'
+        for tree in (self.orig, self.dist):
+            (tree / 'index.html').write_text(PAGE.format(t='Home', link='about.html', extra=extra))
+        report, run = self.gate()
+        self.assertTrue(report['passed'], run.stdout + run.stderr)
+        self.assertEqual(self.proven(report), ['about.html', 'index.html'])
+
+    def test_a_file_linked_out_of_the_tree_disables_the_proof(self):
+        # The gate's server refuses a link out of the site, so nothing is
+        # known about its bytes: every page is rasterised, nothing crashes.
+        outside = Path(self.temp.name) / 'outside.css'
+        outside.write_text(CSS)
+        for tree in (self.orig, self.dist):
+            (tree / 'css/linked.css').symlink_to(outside)
+        report, run = self.gate()
+        self.assertEqual(self.proven(report), [], run.stdout + run.stderr)
+        self.assertIn('css/linked.css', report['identity']['disabled'])
+        self.assertTrue(report['passed'])
+
     def test_an_original_remote_run_is_never_proven(self):
         (self.out.parent / 'remote.json').write_text(json.dumps({'localized': [{'url': 'https://img.example/a.png', 'finalUrl': 'https://img.example/a.png'}]}))
         report, _ = self.gate('--original-remote', str(self.out.parent / 'remote.json'))

skills/html2wp/assets/scripts/verify-static.py

@@ -508,15 +508,18 @@ def _resolve(candidate, base):
 
 def _file(root, rel, cache):
     """(sha256, text or None) of `rel` as the gate's server would hand it to
-    the browser (a directory is its index.html; a refused path is a 404), or
-    None. Only a file the scan reads again keeps its text."""
+    the browser (a directory is its index.html; a refused path, or a name no
+    file system can hold, is a 404), or None. Only a file the scan reads
+    again keeps its text."""
     key = (root, rel)
     if key not in cache:
         target = root / rel
-        if target.is_dir():
-            target = target / "index.html"
         found = None
         try:
+            # Candidates include whole attribute values (an SVG path, a long
+            # alt): stat() of such a name raises ENAMETOOLONG, not False.
+            if target.is_dir():
+                target = target / "index.html"
             if (target.is_file() and target.resolve().is_relative_to(root)
                     and not refuse_request_path("/" + target.relative_to(root).as_posix(), root)):
                 data = target.read_bytes()
@@ -582,8 +585,11 @@ def servable(root):
         return {rel for rel in (p.relative_to(root).as_posix() for p in root.rglob("*") if p.is_file())
                 if not refuse_request_path("/" + rel, root)}
     orig, dist = servable(ORIG), servable(DIST)
+    def digest(root, rel):
+        found = _file(root, rel, cache)   # None: unreadable, or a link out of the tree
+        return found[0] if found else None
     differing = sorted(rel for rel in orig & dist if Path(rel).suffix.lower() not in (".html", ".htm")
-                       and _file(ORIG, rel, cache)[0] != _file(DIST, rel, cache)[0])
+                       and (digest(ORIG, rel) is None or digest(ORIG, rel) != digest(DIST, rel)))
     summary["distOnlyFiles"] = len(dist - orig)
     if differing:
         summary["disabled"] = "files differ between the two sides: " + ", ".join(differing[:5])