@blocofy/cli 0.17.0 → 0.17.1

package/README.md

@@ -132,6 +132,9 @@ and editor views for this command are retired; to share a draft page, create a p
 it (v1 API `POST /themes/{id}/preview-links` or MCP `create_preview_link`; one page per link).
 The target site is verified once at start; a long session keeps that target (restart it after
 changing credentials, context or the project binding).
+The dev server answers this machine only: it listens on `http://127.0.0.1:<port>`, refuses a request
+whose `Host` (or `Origin`, when sent) is not that address or `localhost:<port>`, and answers only
+`GET`/`HEAD` (anything else gets `405`). The reload channel is same-origin only.
 - `--port <n>` — local port (default 3030).
 - `--no-sync` — local preview only (skip draft sync).
 - `--name <name>` — name the draft when it is first created (ignored if it already exists).
@@ -623,6 +626,15 @@ Each retry prints a notice on stderr.
 
 ## Changelog
 
+- **0.17.1** (2026-11-01) — Security fix: `theme dev` answers this machine only.
+  - The local server listens on IPv4 loopback (`127.0.0.1`) instead of every network interface, and
+    prints that address. There is no option to open it to the network.
+  - A request whose `Host` is not `127.0.0.1:<port>` / `localhost:<port>`, or whose `Origin` is another
+    site, is refused before anything is read or rendered (DNS-rebinding and cross-site pages).
+  - Only `GET` and `HEAD` are answered; other methods get `405` with `Allow: GET, HEAD` and never reach
+    the platform. `HEAD` returns headers only and never spends a render.
+  - The reload channel no longer sends `Access-Control-Allow-Origin: *`; the local page still reloads on
+    save. Views on other origins no longer subscribe to it.
 - **0.17.0** (2026-10-31) — `theme publish` tells you when the live site is not serving the files
   you published.
   - **`theme publish` reports an unrefreshed live site.** When the platform answers

package/bin/blocofy.mjs

@@ -2596,7 +2596,8 @@ async function themeDev(rest) {
     }
   }
 
-  const localUrl = `http://localhost:${port}`;
+  // The URL the dev server actually binds (IPv4 loopback): `localhost` may resolve to ::1 first.
+  const localUrl = `http://127.0.0.1:${port}`;
   // A session without a URL (an older platform answer) must not become "undefined&hr=…".
   const previewUrl = session?.previewUrl ? `${session.previewUrl}&hr=${port}` : null;
   const editorUrl = session?.editorUrl ? `${session.editorUrl}&hr=${port}` : null;
@@ -2616,7 +2617,7 @@ async function themeDev(rest) {
     .filter(Boolean)
     .join("   ");
   console.log(`\n  Press:  ${keys}`);
-  console.log(`  Edit a theme file and save — every open view reloads automatically.\n`);
+  console.log(`  Edit a theme file and save — the local view reloads automatically.\n`);
 
   // Senkron kapsamı (#119 CLI bulgu #2): hangi dizinler taşınıyor / taşınmıyor —
   // "config/pages senkronlanıyor sandım" karışıklığını açıkça önler.

package/lib/dev-server.mjs

@@ -11,6 +11,43 @@ import {
 } from "./local-theme.mjs";
 import { DRAFT_TARGET_AMBIGUOUS, draftSyncErrorLine, pushTheme } from "./theme-sync.mjs";
 
+/**
+ * The dev server proxies page renders with the developer's bearer, so it answers only this machine:
+ * it binds IPv4 loopback, and every request must name it (Host + optional Origin) before any branch runs.
+ * There is no LAN option on purpose — exposing it needs its own auth/threat model.
+ */
+const DEV_SERVER_HOST = "127.0.0.1";
+const ALLOWED_METHODS = "GET, HEAD";
+
+/** Why `req` is refused (status + short reason; never echoes request data or the credential), or null. */
+function refusal(req, port) {
+  if (req.method !== "GET" && req.method !== "HEAD") return { status: 405, reason: "Method not allowed." };
+  // Origin-form only: an absolute request target (proxy style) could name another authority.
+  if (typeof req.url !== "string" || !req.url.startsWith("/")) return { status: 400, reason: "Bad request target." };
+  const ownHosts = new Set([`${DEV_SERVER_HOST}:${port}`, `localhost:${port}`]);
+  const ownOrigins = new Set([...ownHosts].map((host) => `http://${host}`));
+  // rawHeaders keeps duplicates that req.headers would silently collapse.
+  const headerValues = (name) => {
+    const values = [];
+    for (let i = 0; i < req.rawHeaders.length; i += 2) {
+      if (req.rawHeaders[i].toLowerCase() === name) values.push(req.rawHeaders[i + 1].trim().toLowerCase());
+    }
+    return values;
+  };
+  // Exactly one Host, and it is this server: a DNS-rebinding page arrives with its own host name.
+  // X-Forwarded-Host / Forwarded / Referer are never read.
+  const hosts = headerValues("host");
+  if (hosts.length !== 1 || !ownHosts.has(hosts[0])) {
+    return { status: 403, reason: `This dev server only answers http://${DEV_SERVER_HOST}:${port}.` };
+  }
+  // A browser that sends Origin must be on this server's own origin (cross-origin pages and `null` refused).
+  const origins = headerValues("origin");
+  if (origins.length > 1 || (origins.length === 1 && !ownOrigins.has(origins[0]))) {
+    return { status: 403, reason: `Cross-origin requests are not served; open http://${DEV_SERVER_HOST}:${port}.` };
+  }
+  return null;
+}
+
 /**
  * Standalone dev server. For each page request it reads the local theme files and
  * posts them to the platform's `/api/dev/render` endpoint, then injects a livereload
@@ -105,18 +142,29 @@ export function startDevServer({ dir, url, token, port, syncDraft = false, insta
   }
 
   const server = createServer(async (req, res) => {
+    // Before every branch: no SSE subscription, disk read or authenticated render for a refused request.
+    const refused = refusal(req, server.address()?.port);
+    if (refused) {
+      res.writeHead(refused.status, {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store",
+        ...(refused.status === 405 ? { allow: ALLOWED_METHODS } : {}),
+      });
+      res.end(`${refused.reason}\n`);
+      return;
+    }
+    const head = req.method === "HEAD";
     try {
       const pathname = decodeURIComponent(new URL(req.url, "http://localhost").pathname);
 
-      // Livereload SSE channel.
+      // Livereload SSE channel — same-origin only (no CORS header): cross-origin views no longer subscribe.
       if (pathname === LIVERELOAD_PATH) {
         res.writeHead(200, {
           "content-type": "text/event-stream",
           "cache-control": "no-cache, no-transform",
-          connection: "keep-alive",
-          // Cross-origin iframe'ler (canlı-domain önizleme + editör) subscribe edebilsin.
-          "access-control-allow-origin": "*",
+          ...(head ? {} : { connection: "keep-alive" }),
         });
+        if (head) return void res.end();
         res.write("retry: 1000\n\n");
         clients.add(res);
         req.on("close", () => clients.delete(res));
@@ -127,7 +175,14 @@ export function startDevServer({ dir, url, token, port, syncDraft = false, insta
       const assetFile = safeAssetFile(dir, pathname);
       if (assetFile) {
         res.writeHead(200, { "content-type": contentTypeFor(assetFile), "cache-control": "no-store" });
-        res.end(readFileSync(assetFile));
+        res.end(head ? undefined : readFileSync(assetFile));
+        return;
+      }
+
+      // HEAD never spends an authenticated render: headers only.
+      if (head) {
+        res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" });
+        res.end();
         return;
       }
 
@@ -166,7 +221,7 @@ export function startDevServer({ dir, url, token, port, syncDraft = false, insta
     onReload?.({ file, synced: syncDraft && !error, clients: clients.size, error });
   });
 
-  server.listen(port);
+  server.listen(port, DEV_SERVER_HOST);
 
   return {
     server,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blocofy/cli",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "Develop your Blocofy theme locally against live data with instant preview — login, theme dev, pull, push.",
   "type": "module",
   "license": "MIT",