Allow files in public dir

[freekh]

No description provided.

[changeset-bot]

🦋 Changeset detected

Latest commit: fd9ecb1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 7 packages

Name	Type
@valbuild/core	Patch
@valbuild/shared	Patch
@valbuild/server	Patch
@valbuild/cli	Patch
@valbuild/ui	Patch
@valbuild/next	Patch
@valbuild/react	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[Copilot]

Pull request overview

This PR broadens Val’s “managed files” location from the hard-coded /public/val subtree to any configurable /public (or /public/...) directory, updating UI, CLI, server validation/fix flows, and core remote-ref typing/parsing to match.

Changes:

• Expand files.directory configuration support from /public/val to /public or /public/... (CLI + shared config parsing).
• Update remote ref creation/parsing/validation to allow public/... paths instead of only public/val/....
• Adjust UI utilities and components to derive display names/paths correctly with the new directory rules.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
packages/ui/spa/utils/getFilenameFromRef.ts	Updates folder derivation to strip /public rather than /public/val.
packages/ui/spa/search/search.worker.ts	Updates file/image search indexing label extraction for new directory scheme.
packages/ui/spa/components/fields/ModuleGallery.tsx	Updates remote filePath typing to accept public/... paths.
packages/ui/spa/components/fields/FileField.tsx	Updates remote filePath typing to accept public/... paths.
packages/shared/src/internal/SharedValConfig.ts	Expands config schema validation for files.directory.
packages/shared/src/internal/richtext/conversion/remirrorToRichTextSource.ts	Updates remote filePath typing for richtext image uploads.
packages/server/src/createFixPatch.ts	Broadens server-side remote download validation from public/val/ to public/.
packages/server/src/checkRemoteRef.ts	Broadens remote-ref filePath validation and fix-path typing to public/....
packages/core/src/source/remote.ts	Updates RemoteRef template + createRemoteRef typing to accept public/....
packages/core/src/schema/images.ts	Makes images() options/accept optional; defaults accept to image/*.
packages/core/src/remote/splitRemoteRef.ts	Broadens splitRemoteRef parsing typing/validation to public/....
packages/core/src/initVal.ts	Expands ConfigDirectory type to /public or /public/....
packages/cli/src/utils/evalValConfigFile.ts	Updates CLI config validation to accept /public or /public/....
packages/cli/src/runValidation.ts	Broadens CLI remote upload directory enforcement to public/....
packages/cli/src/listUnusedFiles.ts	Uses evaluated val.config.* to determine the managed directory instead of assuming public/val.
packages/cli/src/cli.ts	Updates CLI help text for list-unused-files to reflect configurable directory.

Comments suppressed due to low confidence (1)

packages/core/src/remote/splitRemoteRef.ts:37

• splitRemoteRef only checks that filePath starts with public/, but it does not reject path traversal segments like public/../.... Downstream code (e.g. server-side download to path.join(projectRoot, filePath)) can be tricked into writing outside the intended directory. Reject ./.. segments in the parsed filePath.

  if (match[7].indexOf("public/") !== 0) {
    return {
      status: "error",
      error: "Invalid remote ref: " + ref,
    };
  }

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated 4 comments.