50c 3.9.2 → 4.0.0

package/lib/pre-publish.js

@@ -397,18 +397,37 @@ const EMPIRICAL_CHECKS = {
     const path = require('path');
     const findings = [];
     
+    // File-level exclusions: files whose entire purpose IS a local dev server
+    const LEGIT_LOCAL_FILES = new Set(['pre-publish.js', 'mcp-tv.js', 'invent-ui.js']);
+
     for (const file of ctx.files.filter(f => /\.(js|ts|json)$/.test(f)).slice(0, 30)) {
-      // Skip this file itself (it contains localhost patterns for checking)
-      if (path.basename(file) === 'pre-publish.js') continue;
-      
+      if (LEGIT_LOCAL_FILES.has(path.basename(file))) continue;
+
       try {
         const content = fs.readFileSync(file, 'utf8');
         if (/localhost|127\.0\.0\.1|0\.0\.0\.0/.test(content)) {
-          // Check it's not in a comment or config option
           const lines = content.split('\n');
           for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
-            if (/localhost|127\.0\.0\.1/.test(line) && !line.trim().startsWith('//') && !line.includes('||') && !line.includes('regex') && !line.includes('pattern')) {
+            const trimmed = line.trim();
+            // Exclude legitimate patterns:
+            //   - Comments (// or  *)
+            //   - env-fallback (|| 'localhost')
+            //   - regex/pattern keywords
+            //   - Template-literal dynamic ports (`http://localhost:${port}`)
+            //   - API protocol documentation in help text (POST/GET http://localhost)
+            //   - JSDoc protocol descriptions
+            if (
+              /localhost|127\.0\.0\.1/.test(line)
+              && !trimmed.startsWith('//')
+              && !trimmed.startsWith('*')
+              && !line.includes('||')
+              && !line.includes('regex')
+              && !line.includes('pattern')
+              && !line.includes('${')
+              && !line.includes('POST http')
+              && !line.includes('GET http')
+            ) {
               findings.push(`${path.basename(file)}:${i+1}`);
               break;
             }