@ahmed-3m/idea2prototype 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 1.0.1
+
+Fixes for the critical + high findings of the 2026-10-20 repo review:
+
+- Security: `add api-crud` refuses resource names another feature owns (`users`, `auth`, `jobs`, `uploads`, `events`, `sse`, `ping`, `ratelimit`, `cors`, `cors-ping`, `health`). `--resource users` used to share `data/users.json` with `auth-local` — anonymous `GET /api/users` served every salt + hash, and an anonymous POST could plant a login-capable account.
+- Security: `upload` serves only passive types inline (text, csv, json, raster images); everything else — including html, svg, js — comes back as `application/octet-stream` + `content-disposition: attachment`, and every response carries `x-content-type-options: nosniff` + a sandboxing CSP. Uploaded HTML used to render on the app's own origin (stored XSS).
+- Fix: `verify`/`check` boot the server even when no tests exist — a `start()` that throws used to verify PASS on syntax alone. Boot still skips after a syntax failure (structured `cause` on the tests step, no string coupling).
+- Fix: `verify` accepts a foreign `start()` that returns a bare `http.Server` (port via `address()`, callback-style close) and never lets a throwing/hanging `close()` replace the verdict — it crashed with `app.close(...).catch is not a function` before printing anything.
+- Fix: boot runs with the project as cwd (as the tests step already did), so `verify <dir>` from elsewhere boots the same app as `verify` from inside — scaffolds used to boot with no routes and no `public/`, foreign servers failed on cwd-relative reads.
+- Fix: `api-crud` POST ignores client-sent `id`/`createdAt` (two POSTs with the same `id` created duplicates, the second unreachable); PUT keeps `createdAt` too. SKILL.md/README composition snippets follow the same body-first pattern.
+- Tests: regression test per finding above (engine suite + the generated template tests that every scaffold runs). The review's seventh finding — `rateLimit()` sharing one bucket map — was fixed independently on main and shipped in 1.0.0.
+- Fix: the upload route's path guard checks the separator boundary (`uploads` + `/`) — a sibling directory sharing the prefix (`uploads-x/`) used to pass the traversal check (flagged in review; served inert either way).
+
 ## 1.0.0
 
 First stable release. The scaffold contract — route objects, check/verify verdicts, `add`-module shapes — is frozen as-is; 1.x commits to additive changes only.

package/README.md

@@ -15,7 +15,9 @@ Idea2Prototype check — PASS (3/3)
   boot    PASS  GET /api/health -> 200, GET / -> 200 in 45ms
 ```
 
-**Status:** v1.0.0 · actively maintained · 1.x — the check/verify contract and template shapes are stable; new capabilities arrive as `add` modules.
+**Status:** v1.0.1 · actively maintained · 1.x — the check/verify contract and template shapes are stable; new capabilities arrive as `add` modules.
+
+> **Idea still fuzzy?** Start one stage earlier with [brainstorm2idea](https://github.com/ahmed-3m/brainstorm2idea) — a Socratic dialogue turns raw thought into a machine-linted `brief.md`, then hands off directly into `i2p new`.
 
 That verdict is the whole idea: an agent building a prototype should **never generate boilerplate it didn't need to, and never read logs it didn't need to**. The syntax step covers server code (`node --check`) and every `.js` under `public/`, recursively (parsed as both ESM and classic script — only code broken in both modes fails).
 
@@ -94,7 +96,7 @@ import { requireAuth } from './auth.mjs';
 
 POST: requireAuth(async ({ body, user }) => {
   // ...original handler body...
-  const item = { id, createdAt, ...body, author: user.username };
+  const item = { ...body, id, createdAt, author: user.username }; // body first: server-owned fields win
   // ...persist and return [201, item]...
 }),
 ```

package/agents/AGENTS.md

@@ -4,6 +4,8 @@ Copy this file into any project where your coding agent should build with idea2p
 
 You have `idea2prototype` (`i2p`) available — a zero-dependency prototype tool. Use it instead of hand-writing scaffolding. If the npm package isn't installed or available, run the engine directly instead of `npx @ahmed-3m/idea2prototype`: `node <path-to-idea2prototype-repo>/skills/idea2prototype/scripts/idea2prototype.mjs <command>`.
 
+If starting from a fuzzy or unformed idea, load the `brainstorm2idea` skill and run `/b2i "<raw idea>"` to generate an approved `brief.md`, then run `b2i handoff <dir> --brief brief.md` (or `npx @ahmed-3m/brainstorm2idea handoff <dir>`) to scaffold directly into `idea2prototype new`.
+
 ## Commands
 
 - `npx @ahmed-3m/idea2prototype new <dir> --template web|api|cli|worker|library` — scaffold a running, tested project (~0 tokens vs 10–30k hand-written)

package/agents/CLAUDE.md

@@ -4,6 +4,8 @@ Copy this file into any project where your coding agent should build with idea2p
 
 You have `idea2prototype` (`i2p`) available — a zero-dependency prototype tool. Use it instead of hand-writing scaffolding. If the npm package isn't installed or available, run the engine directly instead of `npx @ahmed-3m/idea2prototype`: `node <path-to-idea2prototype-repo>/skills/idea2prototype/scripts/idea2prototype.mjs <command>`.
 
+If starting from a fuzzy or unformed idea, load the `brainstorm2idea` skill and run `/b2i "<raw idea>"` to generate an approved `brief.md`, then run `b2i handoff <dir> --brief brief.md` (or `npx @ahmed-3m/brainstorm2idea handoff <dir>`) to scaffold directly into `idea2prototype new`.
+
 ## Commands
 
 - `npx @ahmed-3m/idea2prototype new <dir> --template web|api|cli|worker|library` — scaffold a running, tested project (~0 tokens vs 10–30k hand-written)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ahmed-3m/idea2prototype",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Turn ideas into tested prototypes \u2014 token-lean scaffolds + one-command verification for any coding agent. Zero dependencies.",
   "type": "module",
   "license": "MIT",

package/skills/idea2prototype/SKILL.md

@@ -18,7 +18,7 @@ node "<skill-base>/scripts/idea2prototype.mjs" <command>
 `<skill-base>` is this skill's own directory (shown at the top of this skill when loaded). Commands:
 
 - `new <dir> --template web|api|cli|worker|library --name "..." --idea "..."` — scaffold a project
-- `add api-crud --resource <name>` — add a JSON-file CRUD resource + tests (web/api)
+- `add api-crud --resource <name>` — add a JSON-file CRUD resource + tests (web/api). Names another feature owns are refused (`users`, `auth`, `jobs`, `uploads`, `events`, `ping`, …) — e.g. use `members`, not `users`, next to `auth-local`
 - `add auth-local` — register/login/logout/me accounts: scrypt hashes, HMAC-signed cookies, `requireAuth` helper (web/api)
 - `add upload` — multipart file uploads with fetch-back endpoint + tests (web/api)
 - `add rate-limit` — per-key fixed-window limiter: `rateLimit({ max, windowMs, keyFn })` wraps any handler, 429 + Retry-After + X-RateLimit-* headers, `GET /api/ping` demo (web/api)
@@ -52,7 +52,7 @@ import { requireAuth } from './auth.mjs';
 POST: requireAuth(async ({ body, user }) => {
   const bad = requireObject(body);
   if (bad) return bad;
-  const item = { id: randomUUID(), createdAt: new Date().toISOString(), ...body, author: user.username };
+  const item = { ...body, id: randomUUID(), createdAt: new Date().toISOString(), author: user.username };
   (await load()).push(item);
   await persist();
   return [201, item];

package/skills/idea2prototype/scripts/idea2prototype.mjs

@@ -18,7 +18,7 @@ import { spawnSync } from 'node:child_process';
 import { basename, dirname, extname, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
-const VERSION = '1.0.0';
+const VERSION = '1.0.1';
 const PKG_NAME = '@ahmed-3m/idea2prototype';
 const HERE = dirname(fileURLToPath(import.meta.url));
 const TEMPLATES_DIR = join(HERE, '..', 'templates');
@@ -227,6 +227,25 @@ const FEATURES = {
   },
 };
 
+// api-crud resource names that would collide with another feature's data
+// store, route file, or URL path — in EITHER add order, so a file-exists
+// check alone can't catch them. "users" is the dangerous one: a CRUD resource
+// over data/users.json serves auth-local's salts + hashes to anonymous GETs
+// and lets anonymous POSTs plant login-capable accounts.
+const RESERVED_RESOURCES = new Map([
+  ['users', 'auth-local stores accounts in data/users.json'],
+  ['auth', 'auth-local owns routes/auth.mjs and /api/auth/*'],
+  ['jobs', 'worker-jobs owns data/jobs.json, routes/jobs.mjs and /api/jobs'],
+  ['uploads', 'upload owns routes/uploads.mjs and /api/uploads'],
+  ['events', 'sse owns /api/events'],
+  ['sse', 'sse owns routes/sse.mjs'],
+  ['ping', 'rate-limit owns /api/ping'],
+  ['ratelimit', 'rate-limit owns routes/ratelimit.mjs'],
+  ['cors', 'cors owns routes/cors.mjs'],
+  ['cors-ping', 'cors owns /api/cors-ping'],
+  ['health', 'the server answers /api/health itself'],
+]);
+
 async function cmdAdd(rest) {
   const feature = rest[0]?.startsWith('--') ? undefined : rest[0];
   const opts = parseFlags(rest.slice(feature ? 1 : 0), ['resource']);
@@ -246,6 +265,9 @@ async function cmdAdd(rest) {
     if (!/^[a-z][a-z0-9-]*$/.test(resource)) {
       die(`invalid resource name "${resource}" — lowercase letters, digits, dashes`);
     }
+    if (RESERVED_RESOURCES.has(resource)) {
+      die(`resource name "${resource}" is reserved — ${RESERVED_RESOURCES.get(resource)}; pick another name`);
+    }
     opts.resource = resource;
   }
 
@@ -435,14 +457,15 @@ async function discoverTestFiles(projectDir) {
 }
 
 async function stepTests(projectDir, syntaxPassed) {
-  if (!syntaxPassed) return { name: 'tests', status: 'skip', detail: 'skipped (syntax failed)' };
+  if (!syntaxPassed) return { name: 'tests', status: 'skip', detail: 'skipped (syntax failed)', cause: 'syntax' };
   const testFiles = (await discoverTestFiles(projectDir)).map((f) => relative(projectDir, f));
   if (!testFiles.length) {
     return {
       name: 'tests',
       status: 'skip',
       detail: 'no test files found',
-      notes: ['looked for node:test conventions (*.test.{js,mjs,cjs}, test-*.js, *-test.js, *_test.js, test.js, and every .js/.mjs/.cjs under a test/ directory), skipping node_modules, uploads, data, dist, coverage, public — if your tests live elsewhere, this verdict is syntax-only'],
+      cause: 'no-tests',
+      notes: ['looked for node:test conventions (*.test.{js,mjs,cjs}, test-*.js, *-test.js, *_test.js, test.js, and every .js/.mjs/.cjs under a test/ directory), skipping node_modules, uploads, data, dist, coverage, public — if your tests live elsewhere, this verdict covers syntax + boot only'],
     };
   }
 
@@ -521,15 +544,26 @@ async function stepTests(projectDir, syntaxPassed) {
 
 async function stepBoot(projectDir, testsStep, marker) {
   if (testsStep.status === 'fail') return { name: 'boot', status: 'skip', detail: 'skipped (tests failed)' };
-  if (testsStep.status === 'skip') {
-    // Name the actual cause — a syntax failure is why nothing ran, not
-    // "no tests found" ("skipped (…)" details unwrap to their inner cause).
-    const cause = testsStep.detail.replace(/^skipped \((.*)\)$/, '$1');
-    return { name: 'boot', status: 'skip', detail: `skipped (${cause})` };
-  }
-  // Library projects have no server to probe — boot = import the public API.
-  if (marker?.template === 'library') return bootLibrary(projectDir);
-  return bootServer(projectDir, marker);
+  // A syntax failure is why nothing ran — importing broken code proves nothing.
+  if (testsStep.cause === 'syntax') return { name: 'boot', status: 'skip', detail: 'skipped (syntax failed)' };
+  // "No tests found" is NOT a reason to skip boot: a project without tests is
+  // exactly the one whose only remaining evidence is whether it starts (a
+  // server that throws in start() used to verify PASS on syntax alone).
+  //
+  // Boot runs in THIS process, so the project's cwd-relative paths (the
+  // templates' ROOT/routes/data, a foreign readFileSync('config.json')) must
+  // resolve against the project — as they do for the tests step (cwd:
+  // projectDir) and for `npm start`. Otherwise `verify <dir>` from elsewhere
+  // boots a different app than `verify` from inside it.
+  const previousCwd = process.cwd();
+  process.chdir(projectDir);
+  try {
+    // Library projects have no server to probe — boot = import the public API.
+    if (marker?.template === 'library') return await bootLibrary(projectDir);
+    return await bootServer(projectDir, marker);
+  } finally {
+    process.chdir(previousCwd);
+  }
 }
 
 async function bootLibrary(projectDir) {
@@ -553,67 +587,95 @@ async function bootServer(projectDir, marker) {
   if (!existsSync(serverPath)) return { name: 'boot', status: 'skip', detail: 'no server.mjs' };
 
   const started = Date.now();
-  let app; // closed in finally once started — a leaked listener hangs the process forever
-  // The import ran but no app handle came back to close: the module may hold
+  let app; // closed below once started — a leaked listener hangs the process forever
+  // The import ran but no closable app handle came back: the module may hold
   // its own listeners (foreign entry points often listen at import time).
   // Mark the step so runChecks exits explicitly after printing the verdict —
   // those handles are unreachable from here and would hang the process.
   const leakedImport = { unreachableHandles: true };
+  let result;
   try {
     const mod = await withTimeout(import(pathToFileURL(serverPath).href), 15_000, 'server import');
     if (typeof mod.start !== 'function') {
       return { name: 'boot', status: 'skip', detail: 'server.mjs does not export start()', ...leakedImport };
     }
     app = await withTimeout(mod.start(0), 10_000, 'server start');
-    // redirect: 'manual' — never follow a redirect off the probe target; the
-    // 3xx itself counts as serving (foreign ok-range is 200–399).
-    const probe = async (path) =>
-      withTimeout(fetch(`http://127.0.0.1:${app.port}${path}`, { redirect: 'manual' }), 10_000, `${path} request`);
-    let res = await probe('/api/health');
-    let detail = `GET /api/health -> ${res.status}`;
-    // Foreign projects (verify mode) may not implement our template's health
-    // route — a server that starts and serves its own surface still boots.
-    let rootProbed = false;
-    if (res.status === 404) {
-      res = await probe('/');
-      detail = `GET /api/health -> 404, GET / -> ${res.status}`;
-      rootProbed = true;
-    }
-    const body = await res.json().catch(() => ({}));
-
-    // Scaffolded projects follow the template contract (health returns
-    // {"status":"ok"}); foreign projects only have to start and serve.
-    const ok = marker
-      ? res.status === 200 && body.status === 'ok'
-      : res.status >= 200 && res.status < 400;
-    if (!ok) {
-      return { name: 'boot', status: 'fail', detail: `${detail} ${JSON.stringify(body)}` };
-    }
+    result = await probeServer(app, marker, started);
+  } catch (err) {
+    result = { name: 'boot', status: 'fail', detail: String(err?.message ?? err) };
+  }
+  // Not a finally: a close() that throws or never settles must not replace
+  // the verdict (foreign handles are untrusted) — it only flags the exit.
+  if (!(await closeApp(app))) Object.assign(result, leakedImport);
+  return result;
+}
 
-    // #18: a health route alone can certify an app whose every real route
-    // 500s — also probe the root. 4xx on / is legitimate (API-only projects),
-    // a 5xx root is a real defect. Symmetric for scaffolded and foreign
-    // projects; a request error here surfaces via the outer catch.
-    if (!rootProbed) {
-      const root = await probe('/');
-      detail += `, GET / -> ${root.status}`;
-      if (root.status >= 500) {
-        return { name: 'boot', status: 'fail', detail: `${detail} — root serves an error` };
-      }
+// start(0) may hand back the template contract ({ port, close() }) or, in
+// foreign projects, a bare listening http.Server — read the port from either.
+function appPort(app) {
+  return app?.port ?? app?.address?.()?.port ?? app?.server?.address?.()?.port;
+}
+
+// Close whatever start() returned: a promise-returning close() (template
+// contract) or a callback-style http.Server close(cb). Returns false when
+// nothing closable came back or the close failed/hung — the caller then
+// exits explicitly instead of hanging on handles it cannot reach.
+async function closeApp(app) {
+  if (typeof app?.close !== 'function') return false;
+  try {
+    app.closeAllConnections?.(); // bare http.Server: drop keep-alive sockets so close(cb) settles
+    await withTimeout(new Promise((resolve, reject) => {
+      const ret = app.close((err) => (err ? reject(err) : resolve()));
+      if (typeof ret?.then === 'function') ret.then(resolve, reject);
+    }), 5_000, 'server close');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function probeServer(app, marker, started) {
+  const port = appPort(app);
+  if (!Number.isInteger(port)) {
+    return { name: 'boot', status: 'fail', detail: 'start() returned no port — expected { port, close() } or a listening http.Server' };
+  }
+  // redirect: 'manual' — never follow a redirect off the probe target; the
+  // 3xx itself counts as serving (foreign ok-range is 200–399).
+  const probe = async (path) =>
+    withTimeout(fetch(`http://127.0.0.1:${port}${path}`, { redirect: 'manual' }), 10_000, `${path} request`);
+  let res = await probe('/api/health');
+  let detail = `GET /api/health -> ${res.status}`;
+  // Foreign projects (verify mode) may not implement our template's health
+  // route — a server that starts and serves its own surface still boots.
+  let rootProbed = false;
+  if (res.status === 404) {
+    res = await probe('/');
+    detail = `GET /api/health -> 404, GET / -> ${res.status}`;
+    rootProbed = true;
+  }
+  const body = await res.json().catch(() => ({}));
+
+  // Scaffolded projects follow the template contract (health returns
+  // {"status":"ok"}); foreign projects only have to start and serve.
+  const ok = marker
+    ? res.status === 200 && body.status === 'ok'
+    : res.status >= 200 && res.status < 400;
+  if (!ok) {
+    return { name: 'boot', status: 'fail', detail: `${detail} ${JSON.stringify(body)}` };
+  }
+
+  // #18: a health route alone can certify an app whose every real route
+  // 500s — also probe the root. 4xx on / is legitimate (API-only projects),
+  // a 5xx root is a real defect. Symmetric for scaffolded and foreign
+  // projects; a request error here surfaces via bootServer's catch.
+  if (!rootProbed) {
+    const root = await probe('/');
+    detail += `, GET / -> ${root.status}`;
+    if (root.status >= 500) {
+      return { name: 'boot', status: 'fail', detail: `${detail} — root serves an error` };
     }
-    return { name: 'boot', status: 'pass', detail: `${detail} in ${Date.now() - started}ms` };
-  } catch (err) {
-    // Import or start() threw before app was assigned → nothing was closed.
-    // (Probe failures after a successful start still run the finally close.)
-    return {
-      name: 'boot',
-      status: 'fail',
-      detail: String(err?.message ?? err),
-      ...(app ? {} : leakedImport),
-    };
-  } finally {
-    if (typeof app?.close === 'function') await app.close().catch(() => {});
   }
+  return { name: 'boot', status: 'pass', detail: `${detail} in ${Date.now() - started}ms` };
 }
 
 // ---------------------------------------------------------------------------

package/skills/idea2prototype/templates/api/.idea2prototype.json

@@ -1,6 +1,6 @@
 {
   "tool": "idea2prototype",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "template": "api",
   "name": "{{name}}",
   "slug": "{{slug}}",

package/skills/idea2prototype/templates/cli/.idea2prototype.json

@@ -1,6 +1,6 @@
 {
   "tool": "idea2prototype",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "template": "cli",
   "name": "{{name}}",
   "slug": "{{slug}}",

package/skills/idea2prototype/templates/features/api-crud/route.tmpl.mjs

@@ -68,7 +68,9 @@ export default [
       POST: async ({ body }) => {
         const bad = requireObject(body);
         if (bad) return bad;
-        const item = { id: randomUUID(), createdAt: new Date().toISOString(), ...body };
+        // body first: the server owns id + createdAt — a client-sent id would
+        // otherwise duplicate (or shadow) an existing item
+        const item = { ...body, id: randomUUID(), createdAt: new Date().toISOString() };
         (await load()).push(item);
         await persist();
         return [201, item];
@@ -88,7 +90,7 @@ export default [
         const list = await load();
         const index = list.findIndex((x) => x.id === params.id);
         if (index === -1) return [404, { error: 'not found' }];
-        list[index] = { ...list[index], ...body, id: list[index].id };
+        list[index] = { ...list[index], ...body, id: list[index].id, createdAt: list[index].createdAt };
         await persist();
         return [200, list[index]];
       },

package/skills/idea2prototype/templates/features/api-crud/test.tmpl.mjs

@@ -40,6 +40,27 @@ test('{{resource}} CRUD roundtrip', async () => {
   }
 });
 
+test('{{resource}} ignores client-sent id and createdAt', async () => {
+  const app = await start(0);
+  const base = `http://127.0.0.1:${app.port}/api/{{resource}}`;
+  try {
+    const spoof = { id: 'client-chosen', createdAt: '1999-01-01T00:00:00.000Z', title: 'spoof' };
+    const a = await (await fetch(base, { method: 'POST', headers: JSON_HEADERS, body: JSON.stringify(spoof) })).json();
+    const b = await (await fetch(base, { method: 'POST', headers: JSON_HEADERS, body: JSON.stringify(spoof) })).json();
+    assert.notEqual(a.id, 'client-chosen');
+    assert.notEqual(a.id, b.id, 'two creates must never share an id');
+    assert.notEqual(a.createdAt, spoof.createdAt);
+
+    const put = await (await fetch(`${base}/${a.id}`, { method: 'PUT', headers: JSON_HEADERS, body: JSON.stringify(spoof) })).json();
+    assert.equal(put.id, a.id);
+    assert.equal(put.createdAt, a.createdAt);
+
+    for (const item of [a, b]) await fetch(`${base}/${item.id}`, { method: 'DELETE' });
+  } finally {
+    await app.close();
+  }
+});
+
 test('{{resource}} rejects non-object bodies', async () => {
   const app = await start(0);
   try {

package/skills/idea2prototype/templates/features/upload/route.tmpl.mjs

@@ -1,28 +1,31 @@
 // Idea2Prototype feature: upload — multipart/form-data file uploads with a
 // zero-dependency parser. Files land in uploads/, served back by id.
 import { mkdir, readFile, stat, writeFile } from 'node:fs/promises';
-import { extname, join } from 'node:path';
+import { basename, extname, join, sep } from 'node:path';
 import { randomUUID } from 'node:crypto';
 
 const UPLOAD_DIR = join(process.cwd(), 'uploads');
 const MAX_FILE_BYTES = 5 * 1024 * 1024;
 
-const MIME = {
+// Uploads are served from the app's own origin, so anything a browser would
+// EXECUTE (html, svg, js) must never come back as active content — that is
+// stored XSS riding the user's session. Only these passive types render
+// inline; everything else is sent as application/octet-stream + attachment.
+// Every response also carries nosniff + a sandboxing CSP (belt and braces).
+const INLINE_MIME = {
   '.txt': 'text/plain; charset=utf-8',
   '.md': 'text/plain; charset=utf-8',
   '.json': 'application/json; charset=utf-8',
   '.csv': 'text/csv; charset=utf-8',
-  '.html': 'text/html; charset=utf-8',
-  '.js': 'text/javascript; charset=utf-8',
-  '.css': 'text/css; charset=utf-8',
   '.png': 'image/png',
   '.jpg': 'image/jpeg',
   '.jpeg': 'image/jpeg',
   '.gif': 'image/gif',
-  '.svg': 'image/svg+xml',
   '.webp': 'image/webp',
-  '.pdf': 'application/pdf',
-  '.zip': 'application/zip',
+};
+const SAFE_HEADERS = {
+  'x-content-type-options': 'nosniff',
+  'content-security-policy': "default-src 'none'; sandbox",
 };
 
 // Parse a multipart/form-data buffer into parts. Minimal per RFC 7578: each
@@ -82,7 +85,8 @@ export default [
     methods: {
       GET: async ({ params }) => {
         const full = join(UPLOAD_DIR, params.name);
-        if (!full.startsWith(UPLOAD_DIR)) return [400, { error: 'bad path' }];
+        // sep-boundary: without it, a sibling like uploads-x/ would pass the prefix check
+        if (!full.startsWith(UPLOAD_DIR + sep)) return [400, { error: 'bad path' }];
         try {
           const fileStat = await stat(full);
           if (!fileStat.isFile()) return [404, { error: 'not found' }];
@@ -90,7 +94,15 @@ export default [
           return [404, { error: 'not found' }];
         }
         const data = await readFile(full);
-        return [200, data, { 'content-type': MIME[extname(full).toLowerCase()] ?? 'application/octet-stream' }];
+        const inline = INLINE_MIME[extname(full).toLowerCase()];
+        return [200, data, inline
+          ? { ...SAFE_HEADERS, 'content-type': inline }
+          : {
+              ...SAFE_HEADERS,
+              'content-type': 'application/octet-stream',
+              // re-sanitized: files dropped into uploads/ by hand skip safeName()
+              'content-disposition': `attachment; filename="${basename(full).replace(/[^a-zA-Z0-9._-]/g, '_')}"`,
+            }];
       },
     },
   },

package/skills/idea2prototype/templates/features/upload/test.tmpl.mjs

@@ -26,6 +26,29 @@ test('upload roundtrip: multipart POST then fetch back', async () => {
   }
 });
 
+// Stored XSS guard: an uploaded page must never render as active content on
+// the app's own origin — it comes back as an inert download instead.
+test('uploaded html/svg is served as an attachment, never as active content', async () => {
+  const app = await start(0);
+  const base = `http://127.0.0.1:${app.port}`;
+  try {
+    for (const [name, type] of [['evil.html', 'text/html'], ['evil.svg', 'image/svg+xml']]) {
+      const form = new FormData();
+      form.append('file', new Blob(['<script>alert(1)</script>'], { type }), name);
+      const info = await (await fetch(`${base}/api/uploads`, { method: 'POST', body: form })).json();
+      const fetched = await fetch(`${base}${info.url}`);
+      assert.equal(fetched.status, 200);
+      assert.equal(fetched.headers.get('content-type'), 'application/octet-stream');
+      assert.match(fetched.headers.get('content-disposition') ?? '', /^attachment; filename="[\w.-]+"$/);
+      assert.equal(fetched.headers.get('x-content-type-options'), 'nosniff');
+      assert.match(fetched.headers.get('content-security-policy') ?? '', /sandbox/);
+      await fetched.arrayBuffer();
+    }
+  } finally {
+    await app.close();
+  }
+});
+
 test('upload rejects non-multipart and unknown ids', async () => {
   const app = await start(0);
   const base = `http://127.0.0.1:${app.port}`;
@@ -42,6 +65,10 @@ test('upload rejects non-multipart and unknown ids', async () => {
 
     const traversal = await fetch(`${base}/api/uploads/..%2Fserver.mjs`);
     assert.ok(traversal.status === 400 || traversal.status === 404);
+
+    // a sibling directory sharing the prefix (uploads-x) must not pass the guard
+    const sibling = await fetch(`${base}/api/uploads/..%2Fuploads-x%2Fevil.html`);
+    assert.equal(sibling.status, 400);
   } finally {
     await app.close();
   }

package/skills/idea2prototype/templates/library/.idea2prototype.json

@@ -1,6 +1,6 @@
 {
   "tool": "idea2prototype",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "template": "library",
   "name": "{{name}}",
   "slug": "{{slug}}",

package/skills/idea2prototype/templates/web/.idea2prototype.json

@@ -1,6 +1,6 @@
 {
   "tool": "idea2prototype",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "template": "web",
   "name": "{{name}}",
   "slug": "{{slug}}",

package/skills/idea2prototype/templates/worker/.idea2prototype.json

@@ -1,6 +1,6 @@
 {
   "tool": "idea2prototype",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "template": "worker",
   "name": "{{name}}",
   "slug": "{{slug}}",