Shoalrun documentation framework
For agents
Start with https://www.shoalrun.com/llms.txt for the documentation index, then read the Markdown pages it links. Skip to article. Documentation index. Read this page as Markdown.
Changelog entry

Safer content exports and package validation

Safer exports, output paths, and dependencies.

Version 0.1.0-alpha.7
Read as Markdown

CLI 0.1.0-alpha.7 is published in the private package registry. This release hardens portable content exports and package validation. The export manifest remains at schema version 1.

Pages sharing a website route retain their own local images and document links in exported HTML and Markdown. The same identity handling applies to cards, related reading, cookbook choices, deprecation notices, and changelog notices.

The help-drawer example moves keyboard focus into opened content, follows scoped anchors, and restores focus to its launcher when closed with Escape.

Reject unsafe output paths

The manifest schema rejects traversal segments, empty path segments, and unsafe export mount paths. Output writes reject unsafe artifact paths and duplicate route aliases before writing. Aliases of a parent directory share the same output lock.

Compatibility: Choose a real directory as the build or export destination. Symlinked output destinations are now rejected; parent-directory symlinks remain supported.

Update security dependencies

MCP server and client dependencies move to 2.3.0, Zod to 4.6.6, and KaTeX to 0.18.2. MCP tool arguments are limited to 1,024 elements before schema validation. HTTP requests retain the 64 KiB body limit and a separate server instance for each request.

MCP updates address advisories for MCP connection isolation, MCP input validation, MCP bearer-token audience checks. Other updates address Zod collection validation and KaTeX inherited settings.

Validate the installed package

Package checks enforce an explicit file inventory and exercise the installed help drawer in a browser. Validation for this release passed 723 framework tests, all five packaged skill checks, and clean installations of the minimal and API-documentation starters. The dependency audit reported no vulnerabilities at validation time.

Full test runs limit concurrency to four files. Rebuild tests wait for complete server events, and skill validation reports missing Python prerequisites once with setup instructions.

This remains an alpha release. Package publication and documentation-site deployment are separate actions; publishing the CLI does not upgrade an existing site automatically.