@blocofy/cli 0.16.0 → 0.17.1

package/README.md

@@ -132,6 +132,9 @@ and editor views for this command are retired; to share a draft page, create a p
 it (v1 API `POST /themes/{id}/preview-links` or MCP `create_preview_link`; one page per link).
 The target site is verified once at start; a long session keeps that target (restart it after
 changing credentials, context or the project binding).
+The dev server answers this machine only: it listens on `http://127.0.0.1:<port>`, refuses a request
+whose `Host` (or `Origin`, when sent) is not that address or `localhost:<port>`, and answers only
+`GET`/`HEAD` (anything else gets `405`). The reload channel is same-origin only.
 - `--port <n>` — local port (default 3030).
 - `--no-sync` — local preview only (skip draft sync).
 - `--name <name>` — name the draft when it is first created (ignored if it already exists).
@@ -623,7 +626,27 @@ Each retry prints a notice on stderr.
 
 ## Changelog
 
-- **0.16.0** (unreleased) — Browser login, `blocofy init`, honest `logout` (ADR-0014 wave P4).
+- **0.17.1** (2026-11-01) — Security fix: `theme dev` answers this machine only.
+  - The local server listens on IPv4 loopback (`127.0.0.1`) instead of every network interface, and
+    prints that address. There is no option to open it to the network.
+  - A request whose `Host` is not `127.0.0.1:<port>` / `localhost:<port>`, or whose `Origin` is another
+    site, is refused before anything is read or rendered (DNS-rebinding and cross-site pages).
+  - Only `GET` and `HEAD` are answered; other methods get `405` with `Allow: GET, HEAD` and never reach
+    the platform. `HEAD` returns headers only and never spends a render.
+  - The reload channel no longer sends `Access-Control-Allow-Origin: *`; the local page still reloads on
+    save. Views on other origins no longer subscribe to it.
+- **0.17.0** (2026-10-31) — `theme publish` tells you when the live site is not serving the files
+  you published.
+  - **`theme publish` reports an unrefreshed live site.** When the platform answers
+    `live_sealed: false`, the CLI prints the reason and the fix (`blocofy theme push --live --yes`)
+    and exits 4 (not complete) instead of reporting success. Platforms that do not send the field
+    behave as before.
+  - **`blocofy status` shows live file freshness** ("Live files: up to date", or which files are
+    stale, missing or extra on the live site).
+  - `theme publish` accepts `--yes` / `--confirm` (no prompt to skip; accepted so scripts that pass
+    it to every live command do not fail).
+  - `theme dev` no longer prints a preview URL containing `undefined&hr=` for a session without one.
+- **0.16.0** (2026-10-06) — Browser login, `blocofy init`, honest `logout` (ADR-0014 wave P4).
   Pairs with the platform release of the credential profiles (draft-only "Tema geliştirme" by
   default). **Minimum platform:** the browser login needs a platform that publishes the CLI client
   (`blocofy-cli`), RFC 9207 `iss`, `/revoke` and the `profile` / `audience` / `dev_endpoint` fields of

package/bin/blocofy.mjs

@@ -100,7 +100,8 @@ const KNOWN = {
   themePull: ["draft", "instance"],
   themePush: ["diff", "draft", "instance", "name", "live", "yes", "confirm", "dry-run", "validate", "idempotency-key", "prune", "work"],
   themeDev: ["port", "dry", "no-sync", "name", "instance"],
-  themePublish: ["instance"],
+  // `yes`/`confirm` are accepted (no-op: publish never prompts) so `--yes` works the same as on `theme push --live`.
+  themePublish: ["instance", "yes", "confirm"],
   themeRename: ["name", "dir"],
   themeWorkStart: ["intent", "idempotency-key"],
   themeWorkStatus: ["dir"],
@@ -2595,9 +2596,11 @@ async function themeDev(rest) {
     }
   }
 
-  const localUrl = `http://localhost:${port}`;
-  const previewUrl = session ? `${session.previewUrl}&hr=${port}` : null;
-  const editorUrl = session ? `${session.editorUrl}&hr=${port}` : null;
+  // The URL the dev server actually binds (IPv4 loopback): `localhost` may resolve to ::1 first.
+  const localUrl = `http://127.0.0.1:${port}`;
+  // A session without a URL (an older platform answer) must not become "undefined&hr=…".
+  const previewUrl = session?.previewUrl ? `${session.previewUrl}&hr=${port}` : null;
+  const editorUrl = session?.editorUrl ? `${session.editorUrl}&hr=${port}` : null;
 
   // Çözülen site'ı göster (session TOKEN'dan çözer) → hangi tenant'ı düzenlediğin belli olsun.
   const siteLine = session?.site ? `${siteLabel(session.site)} · ` : "";
@@ -2614,7 +2617,7 @@ async function themeDev(rest) {
     .filter(Boolean)
     .join("   ");
   console.log(`\n  Press:  ${keys}`);
-  console.log(`  Edit a theme file and save — every open view reloads automatically.\n`);
+  console.log(`  Edit a theme file and save — the local view reloads automatically.\n`);
 
   // Senkron kapsamı (#119 CLI bulgu #2): hangi dizinler taşınıyor / taşınmıyor —
   // "config/pages senkronlanıyor sandım" karışıklığını açıkça önler.
@@ -2778,6 +2781,16 @@ async function themePublish(rest) {
   console.log(
     `✓ Theme ${result.published} is now LIVE${result.cloned ? " (pages cloned from the previous live theme)" : ""}.`,
   );
+  // The platform seals the new live theme's current files on publish and says whether it did. Not sealed = the
+  // live site may still serve the files this theme had at its last seal (an older app.js): exit 4 so scripts
+  // notice, and say how to seal again. An older platform sends no `live_sealed`: nothing changes.
+  if (result.live_sealed === false) {
+    console.error(
+      `Warning: the live site may still serve this theme's previous files (live files not refreshed: ${result.live_seal_reason ?? "unknown"}).\n` +
+        `Refresh them with:  blocofy theme push --live --yes`,
+    );
+    process.exitCode = 4;
+  }
 }
 
 // ── theme work ("çalışma"): a safe, private copy of the live theme, continued by its exact handle ──────────────
@@ -3242,6 +3255,17 @@ async function status(rest) {
       : `Live theme: none`,
   );
   console.log(`Health: ${s.health}`);
+  // What live actually serves vs. the stored theme files (platforms that report it).
+  const ls = s.live_source;
+  if (ls?.pinned === true && ls.in_sync === false) {
+    const paths = [...(ls.stale ?? []), ...(ls.missing ?? []), ...(ls.extra ?? [])];
+    console.error(`Live files: OUT OF DATE — the live site does not serve ${paths.length} stored file(s): ${paths.slice(0, 5).join(", ")}${paths.length > 5 ? ", …" : ""}`);
+    console.error("  Refresh them with:  blocofy theme push --live --yes");
+  } else if (ls?.pinned === true) {
+    console.log("Live files: up to date");
+  } else if (ls?.pinned === null) {
+    console.error("Live files: could not be checked right now");
+  }
   // CF-T9: no imperative one-line fix — which theme holds the pages, why, and safe (preview-first) next steps.
   for (const line of healthAdvice(s)) console.error(line);
   if (Array.isArray(s.drafts) && s.drafts.length > 0) {

package/lib/dev-server.mjs

@@ -11,6 +11,43 @@ import {
 } from "./local-theme.mjs";
 import { DRAFT_TARGET_AMBIGUOUS, draftSyncErrorLine, pushTheme } from "./theme-sync.mjs";
 
+/**
+ * The dev server proxies page renders with the developer's bearer, so it answers only this machine:
+ * it binds IPv4 loopback, and every request must name it (Host + optional Origin) before any branch runs.
+ * There is no LAN option on purpose — exposing it needs its own auth/threat model.
+ */
+const DEV_SERVER_HOST = "127.0.0.1";
+const ALLOWED_METHODS = "GET, HEAD";
+
+/** Why `req` is refused (status + short reason; never echoes request data or the credential), or null. */
+function refusal(req, port) {
+  if (req.method !== "GET" && req.method !== "HEAD") return { status: 405, reason: "Method not allowed." };
+  // Origin-form only: an absolute request target (proxy style) could name another authority.
+  if (typeof req.url !== "string" || !req.url.startsWith("/")) return { status: 400, reason: "Bad request target." };
+  const ownHosts = new Set([`${DEV_SERVER_HOST}:${port}`, `localhost:${port}`]);
+  const ownOrigins = new Set([...ownHosts].map((host) => `http://${host}`));
+  // rawHeaders keeps duplicates that req.headers would silently collapse.
+  const headerValues = (name) => {
+    const values = [];
+    for (let i = 0; i < req.rawHeaders.length; i += 2) {
+      if (req.rawHeaders[i].toLowerCase() === name) values.push(req.rawHeaders[i + 1].trim().toLowerCase());
+    }
+    return values;
+  };
+  // Exactly one Host, and it is this server: a DNS-rebinding page arrives with its own host name.
+  // X-Forwarded-Host / Forwarded / Referer are never read.
+  const hosts = headerValues("host");
+  if (hosts.length !== 1 || !ownHosts.has(hosts[0])) {
+    return { status: 403, reason: `This dev server only answers http://${DEV_SERVER_HOST}:${port}.` };
+  }
+  // A browser that sends Origin must be on this server's own origin (cross-origin pages and `null` refused).
+  const origins = headerValues("origin");
+  if (origins.length > 1 || (origins.length === 1 && !ownOrigins.has(origins[0]))) {
+    return { status: 403, reason: `Cross-origin requests are not served; open http://${DEV_SERVER_HOST}:${port}.` };
+  }
+  return null;
+}
+
 /**
  * Standalone dev server. For each page request it reads the local theme files and
  * posts them to the platform's `/api/dev/render` endpoint, then injects a livereload
@@ -105,18 +142,29 @@ export function startDevServer({ dir, url, token, port, syncDraft = false, insta
   }
 
   const server = createServer(async (req, res) => {
+    // Before every branch: no SSE subscription, disk read or authenticated render for a refused request.
+    const refused = refusal(req, server.address()?.port);
+    if (refused) {
+      res.writeHead(refused.status, {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store",
+        ...(refused.status === 405 ? { allow: ALLOWED_METHODS } : {}),
+      });
+      res.end(`${refused.reason}\n`);
+      return;
+    }
+    const head = req.method === "HEAD";
     try {
       const pathname = decodeURIComponent(new URL(req.url, "http://localhost").pathname);
 
-      // Livereload SSE channel.
+      // Livereload SSE channel — same-origin only (no CORS header): cross-origin views no longer subscribe.
       if (pathname === LIVERELOAD_PATH) {
         res.writeHead(200, {
           "content-type": "text/event-stream",
           "cache-control": "no-cache, no-transform",
-          connection: "keep-alive",
-          // Cross-origin iframe'ler (canlı-domain önizleme + editör) subscribe edebilsin.
-          "access-control-allow-origin": "*",
+          ...(head ? {} : { connection: "keep-alive" }),
         });
+        if (head) return void res.end();
         res.write("retry: 1000\n\n");
         clients.add(res);
         req.on("close", () => clients.delete(res));
@@ -127,7 +175,14 @@ export function startDevServer({ dir, url, token, port, syncDraft = false, insta
       const assetFile = safeAssetFile(dir, pathname);
       if (assetFile) {
         res.writeHead(200, { "content-type": contentTypeFor(assetFile), "cache-control": "no-store" });
-        res.end(readFileSync(assetFile));
+        res.end(head ? undefined : readFileSync(assetFile));
+        return;
+      }
+
+      // HEAD never spends an authenticated render: headers only.
+      if (head) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+        res.end();
         return;
       }
 
@@ -166,7 +221,7 @@ export function startDevServer({ dir, url, token, port, syncDraft = false, insta
     onReload?.({ file, synced: syncDraft && !error, clients: clients.size, error });
   });
 
-  server.listen(port);
+  server.listen(port, DEV_SERVER_HOST);
 
   return {
     server,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blocofy/cli",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "description": "Develop your Blocofy theme locally against live data with instant preview — login, theme dev, pull, push.",
   "type": "module",
   "license": "MIT",