@avsbhq/cli 3.9.0 → 3.9.1

package/dist/cli.js

@@ -39214,6 +39214,19 @@ var import_websocket_server = __toESM(require_websocket_server(), 1);
 // src/lib/wsServer.ts
 import http from "node:http";
 import net from "node:net";
+
+// src/lib/devOrigin.ts
+var LOCAL_PAGE = /^https?:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d{1,5})?$/;
+var CHROME_EXTENSION = /^chrome-extension:\/\/[a-p]{32}$/;
+var FIREFOX_EXTENSION = /^moz-extension:\/\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+function isAllowedDevOrigin(origin) {
+  if (origin === void 0 || origin === "") return true;
+  const value = origin.trim().toLowerCase();
+  return LOCAL_PAGE.test(value) || CHROME_EXTENSION.test(value) || FIREFOX_EXTENSION.test(value);
+}
+var REFUSED_ORIGIN_STATUS = 403;
+
+// src/lib/wsServer.ts
 var PORT_START = 4400;
 var PORT_END = 4409;
 var DEFAULT_HOST = "127.0.0.1";
@@ -39342,7 +39355,14 @@ function tryPort(port, host, experimentName, experimentId, onExtensionMessage) {
         })
       );
     });
-    const wss = new import_websocket_server.default({ server: httpServer });
+    const wss = new import_websocket_server.default({
+      server: httpServer,
+      // A web page must not reach the code this server streams (devOrigin.ts).
+      verifyClient: (info2, done) => {
+        if (isAllowedDevOrigin(info2.req.headers.origin)) done(true);
+        else done(false, REFUSED_ORIGIN_STATUS, "Origin not allowed");
+      }
+    });
     let settled = false;
     const fail2 = (err) => {
       if (settled) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avsbhq/cli",
-  "version": "3.9.0",
+  "version": "3.9.1",
   "description": "CLI tool for local A/B experiment development with the A vs B platform",
   "type": "module",
   "license": "MIT",