Skip to content

docs(contributing): SKILL.md's port-8080 strictPort claim is false outside a Lovable sandbox#7630

Merged
JSONbored merged 1 commit into
mainfrom
claude/fix-port-8080-doc
Jul 21, 2026
Merged

docs(contributing): SKILL.md's port-8080 strictPort claim is false outside a Lovable sandbox#7630
JSONbored merged 1 commit into
mainfrom
claude/fix-port-8080-doc

Conversation

@JSONbored

Copy link
Copy Markdown
Owner

Closes #7628

Summary

  • SKILL.md claimed Vite "forces port 8080 regardless of what you request" — false outside a Lovable
    sandbox (strictPort: true is gated on isSandbox). Reproduced directly: an occupied 8080 silently
    shifts to 8081 with no error. Corrects the doc to describe the actual best-effort behavior and tells
    the reader to check the server's real Local: URL instead of assuming the port.

Scope

  • The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
  • This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
  • This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
  • I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

  • git diff --check
  • npm run actionlint
  • npm run typecheck
  • npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
  • npm run test:workers
  • npm run build:mcp
  • npm run test:mcp-pack
  • npm run ui:openapi:check
  • npm run ui:lint
  • npm run ui:typecheck
  • npm run ui:build
  • npm audit --audit-level=moderate
  • New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

  • Pure documentation change under .claude/, not a code change — no test coverage applies. Verified via
    direct reproduction (ran the dev server with port 8080 pre-occupied and observed the actual, undocumented
    fallback behavior) rather than a new test.

Safety

  • No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
  • Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
  • Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
  • API/OpenAPI/MCP behavior is updated and tested where needed.
  • UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
  • Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
  • Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — documentation-only change.

Notes

SKILL.md claimed "Vite forces port 8080 regardless of what you
request." False outside a Lovable sandbox: strictPort: true in
@lovable.dev/vite-tanstack-config is gated on isSandbox -- on a
normal contributor machine, CI runner, or AI-agent worktree, port
8080 is a plain default with no strictPort, so an occupied 8080
silently shifts to the next free port with only one easy-to-miss
console line and no error.

Reproduced directly: ran the dev server with 8080 already occupied,
got "Port 8080 is in use, trying another one..." then a server on
8081, no sandbox warning. Exactly the failure mode the doc itself
warns about ("preview_screenshot-style tooling just hangs waiting for
the server"), except the doc framed the port as guaranteed instead of
best-effort -- misleading guidance for the exact audience (AI agents
following it literally) most likely to hardcode the port without
reading the startup log.

Corrects the doc to describe the actual behavior and tells the reader
to check the server's real Local: URL instead of assuming 8080.

Closes #7628
@superagent-security

Copy link
Copy Markdown
Contributor

Superagent didn't find any vulnerabilities or security issues in this PR.

@JSONbored JSONbored self-assigned this Jul 21, 2026
@JSONbored
JSONbored merged commit bff3da5 into main Jul 21, 2026
10 checks passed
@JSONbored
JSONbored deleted the claude/fix-port-8080-doc branch July 21, 2026 05:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

docs(contributing): SKILL.md's port-8080 strictPort claim is false outside a Lovable sandbox

1 participant