@fabrika/builder 0.2.0 → 0.3.2

package/cli/src/layout.ts

@@ -1,6 +1,8 @@
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'fs'
-import { join, resolve } from 'path'
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { type BuilderProjectConfig, parseBuilderProjectConfig } from '../../shared'
 import { FABRIKA_DIRNAME, hashRepoPath } from './config'
+import { BuilderCliError } from './errors'
 
 export const LAYER_DIRS = [
 	'intent',
@@ -14,19 +16,7 @@ export const LAYER_DIRS = [
 
 export const EXTERNAL_DIRS = ['tests/browser']
 
-export interface FabrikaConfig {
-	profile: string
-	sessionId: string
-	createdAt: string
-}
-
-function parseConfig(value: unknown): FabrikaConfig | null {
-	if (typeof value !== 'object' || value === null || Array.isArray(value)) return null
-	if (!('profile' in value) || !('sessionId' in value) || !('createdAt' in value)) return null
-	const { profile, sessionId, createdAt } = value
-	if (typeof profile !== 'string' || typeof sessionId !== 'string' || typeof createdAt !== 'string') return null
-	return { profile, sessionId, createdAt }
-}
+export type FabrikaConfig = BuilderProjectConfig
 
 export function fabrikaDir(repoRoot: string): string {
 	return join(resolve(repoRoot), FABRIKA_DIRNAME)
@@ -44,9 +34,9 @@ export function readConfig(repoRoot: string): FabrikaConfig | null {
 	const p = configPath(repoRoot)
 	if (!existsSync(p)) return null
 	try {
-		return parseConfig(JSON.parse(readFileSync(p, 'utf-8')))
+		return parseBuilderProjectConfig(JSON.parse(readFileSync(p, 'utf-8')))
 	} catch {
-		return null
+		throw new BuilderCliError('Invalid .fabrika/config.json; repair it before continuing.')
 	}
 }
 
@@ -69,6 +59,7 @@ export function scaffold(
 	const createdDirs: string[] = []
 
 	const alreadyInitialized = isInitialized(root)
+	const existing = readConfig(root)
 
 	for (const dir of ['.', ...LAYER_DIRS]) {
 		const abs = dir === '.' ? fdir : join(fdir, dir)
@@ -88,7 +79,6 @@ export function scaffold(
 
 	let config: FabrikaConfig
 	let createdConfig = false
-	const existing = readConfig(root)
 	if (existing) {
 		config = existing
 	} else {

package/cli/src/packet.ts

@@ -1,21 +1,12 @@
-import { join } from 'path'
+import { join } from 'node:path'
+import type { BuilderProjectConnection } from '../../shared'
+import { PHASE_COUNT, phaseById, type PhaseId, phaseIndex } from '../../shared/phases'
 import { resolveStackPointer, type StackPointer } from './catalog'
 import type { PhaseState } from './derive'
-import { PHASE_COUNT, phaseById, type PhaseId, phaseIndex, PHASES } from './phases'
 
 export interface RenderOpts {
 	profile?: string
-}
-
-const SHORT_LABEL: Record<PhaseId, string> = {
-	intake: 'intake',
-	vision: 'vision',
-	flows: 'flows',
-	tech: 'tech',
-	design: 'design',
-	skeletons: 'skeletons',
-	issues: 'issues',
-	build: 'build',
+	connection?: BuilderProjectConnection
 }
 
 const CHECK = '✓' // ✓
@@ -23,8 +14,9 @@ const CHECK = '✓' // ✓
 export function renderPacket(state: PhaseState, opts: RenderOpts = {}): string {
 	const phase = phaseById(state.current)
 	const lines: string[] = []
+	if (opts.connection) lines.push(`Platform: ${JSON.stringify(connectionContext(opts.connection))}`)
 
-	const done = state.completed.map((id) => `${SHORT_LABEL[id]} ${CHECK}`).join(', ')
+	const done = state.completed.map((id) => `${id} ${CHECK}`).join(', ')
 	const completedSuffix = done ? `   (${done})` : ''
 	lines.push(`## Phase ${phase.number}/${PHASE_COUNT} - ${phase.title}${completedSuffix}`)
 
@@ -37,7 +29,7 @@ export function renderPacket(state: PhaseState, opts: RenderOpts = {}): string {
 
 	lines.push(`Goal:    ${phase.goal}`)
 
-	lines.push(`Skills:  ${phase.skills.join(', ')}`)
+	if (phase.skills) lines.push(`Skills:  ${phase.skills.join(', ')}`)
 
 	if (phase.gate) {
 		const view = phase.gateView ?? `${phase.id}.jsx`
@@ -85,11 +77,13 @@ export interface PacketJson {
 	completed: PhaseId[]
 	satisfied: boolean
 	stack: StackPointer | null
+	platform: ReturnType<typeof connectionContext> | null
 }
 
 export function packetJson(state: PhaseState, opts: RenderOpts = {}): PacketJson {
 	const phase = phaseById(state.current)
 	return {
+		platform: opts.connection ? connectionContext(opts.connection) : null,
 		phase: phase.id,
 		index: phaseIndex(phase.id),
 		number: phase.number,
@@ -98,11 +92,18 @@ export function packetJson(state: PhaseState, opts: RenderOpts = {}): PacketJson
 		produces: state.produces,
 		gate: phase.gate,
 		gateView: phase.gateView ?? null,
-		skills: phase.skills,
+		skills: phase.skills ?? [],
 		completed: state.completed,
 		satisfied: state.satisfied,
 		stack: phase.catalog && opts.profile ? resolveStackPointer(opts.profile) : null,
 	}
 }
 
-export const PHASE_IDS: PhaseId[] = PHASES.map((p) => p.id)
+function connectionContext(connection: BuilderProjectConnection) {
+	return {
+		controlOrigin: connection.controlOrigin,
+		provider: connection.receipt.provider,
+		app: connection.receipt.app,
+		environment: connection.receipt.environment,
+	}
+}

package/cli/src/platform-client.ts

@@ -0,0 +1,40 @@
+import { type BuilderPlatformStatus, builderProjectPath, parseBuilderPlatformStatus } from '../../shared'
+import { BASE_URL } from './config'
+import { BuilderCliError } from './errors'
+
+export async function platformRequest(
+	sessionId: string,
+	suffix: Parameters<typeof builderProjectPath>[1],
+	body?: object,
+	timeoutMs = 30_000,
+): Promise<BuilderPlatformStatus> {
+	let response: Response
+	try {
+		response = await fetch(`${BASE_URL}${builderProjectPath(sessionId, suffix)}`, {
+			method: body === undefined ? 'GET' : 'POST',
+			redirect: 'error',
+			headers: body === undefined ? {} : { 'Content-Type': 'application/json' },
+			...(body === undefined ? {} : { body: JSON.stringify(body) }),
+			signal: AbortSignal.timeout(timeoutMs),
+		})
+	} catch {
+		throw new BuilderCliError('Local builder request failed. Check the local dashboard and retry.')
+	}
+	if (!response.ok) throw new BuilderCliError(`Local builder request refused (HTTP ${response.status}). Check the local dashboard.`)
+	try {
+		return parseBuilderPlatformStatus(await response.json())
+	} catch {
+		throw new BuilderCliError('Invalid local builder response.')
+	}
+}
+
+export function publicPlatformStatus(status: BuilderPlatformStatus) {
+	return {
+		...status,
+		pairing: status.pairing === null ? null : {
+			status: status.pairing.status,
+			...(status.pairing.status === 'pending' ? { expiresAt: status.pairing.expiresAt } : {}),
+		},
+		deployment: status.deployment === null ? null : { ...status.deployment, message: null },
+	}
+}

package/daemon/src/admission.ts

@@ -0,0 +1,21 @@
+import { BUILDER_DAEMON_HOST } from '../../shared/urls'
+
+export function admitRequest(req: Request, url: URL, port: number): Response | null {
+	const authority = req.headers.get('host')
+	const allowedHostname = url.hostname === BUILDER_DAEMON_HOST || url.hostname === 'localhost'
+	const allowedAuthority = authority === `${url.hostname}:${port}` || (port === 80 && authority === url.hostname)
+	const expectedPort = port === 80 ? '' : String(port)
+	const origin = req.headers.get('origin')
+	const site = req.headers.get('sec-fetch-site')
+	const safeNavigation = site === 'none' && (req.method === 'GET' || req.method === 'HEAD')
+
+	if (
+		!allowedHostname || !allowedAuthority || url.protocol !== 'http:' || url.port !== expectedPort || url.username !== '' || url.password !== ''
+		|| (origin !== null && origin !== url.origin)
+		|| (site !== null && site !== 'same-origin' && !safeNavigation)
+	) {
+		return new Response('Forbidden', { status: 403 })
+	}
+
+	return null
+}

package/daemon/src/bin.ts

@@ -2,27 +2,25 @@
 
 import { mkdirSync, rmSync, writeFileSync } from 'fs'
 import { resolve } from 'path'
+import { activeDaemonSchema, builderDaemonUrl } from '../../shared'
 import { startDaemon } from './index'
 import { PID_FILE, SESSIONS_DIR, TEMP_DIR } from './paths'
 
 const port = parseInt(process.env['FABRIKA_PORT'] || '19410', 10)
 
 interface ActiveDaemon {
-	ok?: boolean
-	sessionsDir?: string
+	ok: boolean
+	sessionsDir: string
 }
 
 function parseActiveDaemon(value: unknown): ActiveDaemon | null {
-	if (typeof value !== 'object' || value === null || Array.isArray(value)) return null
-	const ok = 'ok' in value ? value.ok : undefined
-	const sessionsDir = 'sessionsDir' in value ? value.sessionsDir : undefined
-	if (ok !== true || (sessionsDir !== undefined && typeof sessionsDir !== 'string')) return null
-	return { ok, ...(sessionsDir === undefined ? {} : { sessionsDir }) }
+	const result = activeDaemonSchema.safeParse(value)
+	return result.success ? result.data : null
 }
 
 async function activeDaemon(): Promise<ActiveDaemon | null> {
 	try {
-		const res = await fetch(`http://localhost:${port}/health`, {
+		const res = await fetch(`${builderDaemonUrl(port)}/health`, {
 			signal: AbortSignal.timeout(1000),
 		})
 		const data: unknown = await res.json()
@@ -34,20 +32,20 @@ async function activeDaemon(): Promise<ActiveDaemon | null> {
 
 const active = await activeDaemon()
 if (active) {
-	if (active.sessionsDir && resolve(active.sessionsDir) === resolve(SESSIONS_DIR)) {
-		console.log(`fabrika daemon already running on http://localhost:${port} — not starting a second.`)
+	if (resolve(active.sessionsDir) === resolve(SESSIONS_DIR)) {
+		console.log(`fabrika daemon already running on ${builderDaemonUrl(port)} — not starting a second.`)
 		process.exit(0)
 	}
 	console.error(
-		`fabrika daemon on :${port} uses ${active.sessionsDir ?? 'an unknown legacy data root'}; `
+		`fabrika daemon on :${port} uses ${active.sessionsDir}; `
 			+ `requested ${SESSIONS_DIR}. Stop it before starting this daemon.`,
 	)
 	process.exit(1)
 }
 
-let server: ReturnType<typeof startDaemon>['server']
+let boundPort: number
 try {
-	;({ server } = startDaemon({ port }))
+	;({ port: boundPort } = startDaemon({ port }))
 } catch (error: unknown) {
 	console.error(`fabrika daemon failed to bind :${port}: ${error instanceof Error ? error.message : String(error)}`)
 	process.exit(1)
@@ -56,7 +54,7 @@ try {
 mkdirSync(TEMP_DIR, { recursive: true })
 writeFileSync(PID_FILE, String(process.pid))
 
-console.log(`fabrika daemon listening on http://localhost:${server.port}`)
+console.log(`fabrika daemon listening on ${builderDaemonUrl(boundPort)}`)
 
 function shutdown() {
 	try {

package/daemon/src/handlers.ts

@@ -1,10 +1,14 @@
-import { type CanvasScope, compileJsx, type SessionManager, watchSession } from '@fabrika/canvas-kernel/server'
+import { type AssertReadable, type CanvasScope, compileJsx, type SessionManager, watchSession } from '@fabrika/canvas-kernel/server'
 import type { Route } from '@fabrika/daemon-kit'
 import { existsSync, readdirSync, readFileSync, statSync } from 'fs'
-import { basename, dirname, extname, join, resolve, sep } from 'path'
+import { basename, dirname, extname, join } from 'path'
+import type { z } from 'zod'
+import { builderDaemonUrl, buildEventSchema, planInputSchema } from '../../shared'
 import type { BuildEvent, BuildStream } from './build-stream'
 import { COMPILE_TEMP_DIR } from './paths'
 import { derivePhaseState, type GateOracle } from './phases'
+import { BuilderPlatform } from './platform'
+import { PlatformError } from './platform-storage'
 
 function jsonResponse(data: unknown, status = 200): Response {
 	return new Response(JSON.stringify(data), {
@@ -13,10 +17,6 @@ function jsonResponse(data: unknown, status = 200): Response {
 	})
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-	return typeof value === 'object' && value !== null && !Array.isArray(value)
-}
-
 function errorMessage(error: unknown): string {
 	return error instanceof Error ? error.message : String(error)
 }
@@ -27,33 +27,9 @@ function routeParam(match: URLPatternResult, name: string): string {
 	return value
 }
 
-function optionalString(value: unknown): string | undefined {
-	return typeof value === 'string' ? value : undefined
-}
-
-function isBuildStatus(value: unknown): value is BuildEvent['status'] {
-	return value === 'queued' || value === 'running' || value === 'passed' || value === 'failed' || value === 'blocked'
-		|| value === 'info'
-}
-
-function parseBuildEvent(value: unknown): BuildEvent | null {
-	if (!isRecord(value) || !isBuildStatus(value['status'])) return null
-	const issue = optionalString(value['issue'])
-	const message = optionalString(value['message'])
-	const at = optionalString(value['at'])
-	const data = isRecord(value['data']) ? value['data'] : undefined
-	return {
-		status: value['status'],
-		...(issue === undefined ? {} : { issue }),
-		...(message === undefined ? {} : { message }),
-		...(at === undefined ? {} : { at }),
-		...(data === undefined ? {} : { data }),
-	}
-}
-
 export function corsHeaders(port: number): Record<string, string> {
 	return {
-		'Access-Control-Allow-Origin': `http://localhost:${port}`,
+		'Access-Control-Allow-Origin': builderDaemonUrl(port),
 		'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
 		'Access-Control-Allow-Headers': 'Content-Type',
 	}
@@ -67,6 +43,7 @@ export interface HandlerContext {
 	sessionsDir: string
 	port: number
 	version: string
+	platform?: BuilderPlatform
 }
 
 function gateOracleFor(sm: SessionManager): GateOracle {
@@ -89,9 +66,18 @@ interface CanvasSelection {
 	scope: CanvasScope
 }
 
-function resolveCanvasSelection(body: Record<string, unknown>): CanvasSelection {
-	const view = typeof body['view'] === 'string' ? body['view'] : null
-	const directory = typeof body['directory'] === 'string' ? body['directory'] : null
+function readCanvasFile(path: string, assertReadable: AssertReadable): string {
+	try {
+		assertReadable(path)
+		return readFileSync(path, 'utf-8')
+	} catch {
+		throw new Error('Canvas file access refused')
+	}
+}
+
+function resolveCanvasSelection(body: z.infer<typeof planInputSchema>, assertReadable: AssertReadable): CanvasSelection {
+	const view = body.view ?? null
+	const directory = body.directory ?? null
 	if (!!view === !!directory) {
 		throw new Error('Provide exactly one of view or directory')
 	}
@@ -105,7 +91,7 @@ function resolveCanvasSelection(body: Record<string, unknown>): CanvasSelection
 		}
 		const filename = basename(view)
 		return {
-			files: new Map([[filename, readFileSync(view, 'utf-8')]]),
+			files: new Map([[filename, readCanvasFile(view, assertReadable)]]),
 			scope: { kind: 'view', filename },
 		}
 	}
@@ -118,13 +104,15 @@ function resolveCanvasSelection(body: Record<string, unknown>): CanvasSelection
 	if (filenames.length === 0) throw new Error('No .jsx files found in directory')
 	const files = new Map<string, string>()
 	for (const filename of filenames) {
-		files.set(filename, readFileSync(join(directory, filename), 'utf-8'))
+		files.set(filename, readCanvasFile(join(directory, filename), assertReadable))
 	}
 	return { files, scope: { kind: 'directory' } }
 }
 
 export function createHandlers(ctx: HandlerContext): Route[] {
 	const { sessionManager, broadcastPlanUpdate, broadcastRevisionUpdate, buildStream } = ctx
+	const platform = ctx.platform ?? new BuilderPlatform((id) => sessionManager.get(id)?.projectRoot)
+	const assertReadable: AssertReadable = (path) => platform.storage.assertPublicFile(path)
 
 	function handleHealth(): Response {
 		return jsonResponse({
@@ -138,10 +126,11 @@ export function createHandlers(ctx: HandlerContext): Route[] {
 	}
 
 	function handlePhase(_req: Request, url: URL): Response {
-		const root = url.searchParams.get('root')
-		if (!root) return jsonResponse({ error: 'Missing ?root=<fabrikaDir>' }, 400)
 		const sessionId = url.searchParams.get('session') ?? ''
 		try {
+			const projectRoot = sessionId ? platform.projectRoot(sessionId) : undefined
+			const root = url.searchParams.get('root') ?? (projectRoot ? join(projectRoot, '.fabrika') : null)
+			if (!root) return jsonResponse({ error: 'Missing ?root=<fabrikaDir>' }, 400)
 			const state = derivePhaseState(root, sessionId, gateOracleFor(sessionManager))
 			return jsonResponse(state)
 		} catch (error: unknown) {
@@ -152,12 +141,12 @@ export function createHandlers(ctx: HandlerContext): Route[] {
 	async function handlePlanPost(req: Request, _url: URL, match: URLPatternResult): Promise<Response> {
 		const sessionId = routeParam(match, 'id')
 		try {
-			const parsedBody: unknown = await req.json()
-			if (!isRecord(parsedBody)) return jsonResponse({ error: 'Expected a JSON object' }, 400)
-			const body = parsedBody
+			const parsedBody = planInputSchema.safeParse(await req.json())
+			if (!parsedBody.success) return jsonResponse({ error: 'Expected a JSON object' }, 400)
+			const body = parsedBody.data
 			let selection: CanvasSelection
 			try {
-				selection = resolveCanvasSelection(body)
+				selection = resolveCanvasSelection(body, assertReadable)
 			} catch (error) {
 				return jsonResponse({ error: error instanceof Error ? error.message : String(error) }, 400)
 			}
@@ -177,17 +166,18 @@ export function createHandlers(ctx: HandlerContext): Route[] {
 				)
 			}
 
-			const projectRoot = optionalString(body['projectRoot']) ?? process.cwd()
+			const boundRoot = platform.projectRoot(sessionId)
+			const projectRoot = platform.storage.assertProjectRoot(boundRoot ?? body.projectRoot ?? process.cwd(), true)
 			const isNew = !sessionManager.get(sessionId)
-			const gate = optionalString(body['gate'])
-			const label = gate ?? optionalString(body['label'])
-			const response = optionalString(body['response'])
+			const gate = body.gate
+			const label = gate ?? body.label
+			const response = body.response
 
 			const compiled = new Map<string, string>()
 			const errors: Record<string, string> = {}
 			await Promise.all(
 				[...canvasFiles.entries()].map(async ([filename, jsx]) => {
-					const result = await compileJsx(jsx, { projectRoot, tempDir: COMPILE_TEMP_DIR })
+					const result = await compileJsx(jsx, { projectRoot, tempDir: COMPILE_TEMP_DIR, assertReadable })
 					if (result.ok) compiled.set(filename, result.js)
 					else errors[filename] = result.error
 				}),
@@ -209,9 +199,9 @@ export function createHandlers(ctx: HandlerContext): Route[] {
 			}
 
 			broadcastPlanUpdate(sessionId)
-			watchSession(sessionId, sessionManager, broadcastPlanUpdate)
+			watchSession(sessionId, sessionManager, broadcastPlanUpdate, { tempDir: COMPILE_TEMP_DIR, assertReadable })
 
-			const browserUrl = `http://localhost:${ctx.port}/s/${sessionId}`
+			const browserUrl = `${builderDaemonUrl(ctx.port)}/s/${sessionId}`
 			return jsonResponse({
 				ok: true,
 				browserUrl,
@@ -233,32 +223,42 @@ export function createHandlers(ctx: HandlerContext): Route[] {
 		const revParam = url.searchParams.get('rev')
 		const rev = revParam ? parseInt(revParam, 10) : undefined
 
-		let compiled = sessionManager.getCompiled(sessionId, jsxFilename, rev)
-
-		if (!compiled && rev) {
-			const session = sessionManager.get(sessionId)
-			if (session) {
-				const jsx = sessionManager.readRevisionJsx(sessionId, rev, jsxFilename)
-				if (jsx) {
-					const result = await compileJsx(jsx, { projectRoot: session.projectRoot, tempDir: COMPILE_TEMP_DIR })
-					if (result.ok) {
-						sessionManager.saveCompiled(sessionId, jsxFilename, result.js, rev)
-						compiled = result.js
-					}
-				}
-			}
+		const session = sessionManager.get(sessionId)
+		const revision = rev ?? session?.currentRevision
+		if (!session || !revision || !session.revisions.some((r) => r.revision === revision && r.canvasFiles.some((f) => f.filename === jsxFilename))) {
+			return jsonResponse({ error: 'No compiled canvas' }, 404)
+		}
+		try {
+			const projectRoot = platform.storage.assertProjectRoot(session.projectRoot)
+			const jsx = readCanvasFile(sessionManager.getRevisionJsxPath(sessionId, revision, jsxFilename), assertReadable)
+			// Stored bundles predate admission and dependencies can change after a successful compile.
+			const result = await compileJsx(jsx, { projectRoot, tempDir: COMPILE_TEMP_DIR, assertReadable })
+			if (!result.ok) return jsonResponse({ error: 'Canvas compilation failed' }, 400)
+			sessionManager.saveCompiled(sessionId, jsxFilename, result.js, revision)
+			return new Response(result.js, {
+				headers: { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' },
+			})
+		} catch {
+			return jsonResponse({ error: 'Canvas file access refused' }, 403)
 		}
-
-		if (!compiled) return jsonResponse({ error: 'No compiled canvas' }, 404)
-		return new Response(compiled, {
-			headers: { 'Content-Type': 'application/javascript', 'Cache-Control': 'no-cache' },
-		})
 	}
 
 	function handleMeta(_req: Request, _url: URL, match: URLPatternResult): Response {
 		const sessionId = routeParam(match, 'id')
 		const session = sessionManager.get(sessionId)
-		if (!session) return jsonResponse({ error: 'Session not found' }, 404)
+		if (!session) {
+			const project = platform.storage.project(sessionId)
+			if (!project) return jsonResponse({ error: 'Session not found' }, 404)
+			const config = platform.storage.config(project)
+			return jsonResponse({
+				projectRoot: project.projectRoot,
+				currentRevision: 0,
+				revisions: [],
+				canvasFiles: [],
+				createdAt: config.createdAt,
+				updatedAt: config.createdAt,
+			})
+		}
 		return jsonResponse({
 			projectRoot: session.projectRoot,
 			currentRevision: session.currentRevision,
@@ -271,23 +271,20 @@ export function createHandlers(ctx: HandlerContext): Route[] {
 
 	function handleArtifact(_req: Request, url: URL, match: URLPatternResult): Response {
 		const sessionId = routeParam(match, 'id')
-		const session = sessionManager.get(sessionId)
-		if (!session) return jsonResponse({ error: 'Session not found' }, 404)
+		const projectRoot = platform.projectRoot(sessionId)
+		if (!projectRoot) return jsonResponse({ error: 'Session not found' }, 404)
 
 		const rel = url.searchParams.get('path')
 		if (!rel) return jsonResponse({ error: 'Missing ?path=<relative path>' }, 400)
 
-		const root = resolve(session.projectRoot)
-		const target = resolve(root, rel)
-		if (target !== root && !target.startsWith(root + sep)) {
-			return jsonResponse({ error: 'Path escapes project root' }, 403)
-		}
 		try {
+			const target = platform.storage.artifact(projectRoot, rel)
+			platform.storage.assertPublicFile(target)
 			const st = statSync(target)
 			if (!st.isFile()) return jsonResponse({ error: 'Not a file' }, 404)
 			return jsonResponse({ path: rel, content: readFileSync(target, 'utf-8') })
-		} catch {
-			return jsonResponse({ error: 'Artifact not found' }, 404)
+		} catch (error) {
+			return jsonResponse({ error: 'Artifact not found or outside the project' }, error instanceof PlatformError ? 403 : 404)
 		}
 	}
 
@@ -317,6 +314,12 @@ export function createHandlers(ctx: HandlerContext): Route[] {
 		const skeletons: unknown[] = []
 		for (const entry of readdirSync(dir).sort()) {
 			if (!/\.test\.ts$/.test(entry)) continue
+			try {
+				platform.storage.artifact(session.projectRoot, join('tests', 'browser', entry))
+				platform.storage.assertPublicFile(join(dir, entry))
+			} catch {
+				continue
+			}
 			const src = readFileSync(join(dir, entry), 'utf-8')
 			const re = /browserTest\s*\(/g
 			let mm: RegExpExecArray | null
@@ -415,9 +418,9 @@ export function createHandlers(ctx: HandlerContext): Route[] {
 	async function handleBuildEvent(req: Request): Promise<Response> {
 		try {
 			const body: unknown = await req.json()
-			const event = parseBuildEvent(body)
-			if (event === null) return jsonResponse({ error: 'Invalid or missing status' }, 400)
-			const ev = buildStream.append(event)
+			const event = buildEventSchema.safeParse(body)
+			if (!event.success) return jsonResponse({ error: 'Invalid or missing status' }, 400)
+			const ev = buildStream.append(event.data)
 			return jsonResponse({ ok: true, event: ev })
 		} catch (error: unknown) {
 			return jsonResponse({ error: errorMessage(error) }, 500)

package/daemon/src/index.ts

@@ -1,14 +1,18 @@
 import { createWebSocketManager, SessionManager, unwatchAll, type WSData } from '@fabrika/canvas-kernel/server'
 import { dispatch } from '@fabrika/daemon-kit'
 import { resolve } from 'path'
+import { BUILDER_DAEMON_HOST } from '../../shared/urls'
+import { admitRequest } from './admission'
 import { BuildStream } from './build-stream'
-import { corsHeaders, createHandlers } from './handlers'
+import { createHandlers } from './handlers'
 import { SESSIONS_DIR } from './paths'
+import { BuilderPlatform, type BuilderPlatformOptions } from './platform'
+import { createPlatformRoutes } from './platform-routes'
 import { createStaticHandlers } from './static'
 
+export { type Phase, type PhaseId, PHASES } from '../../shared/phases'
 export type { BuildEvent } from './build-stream'
-export { derivePhaseState, PHASES } from './phases'
-export type { Phase, PhaseId, PhaseState } from './phases'
+export { derivePhaseState, type PhaseState } from './phases'
 
 export interface GateRecord {
 	name: string
@@ -23,6 +27,7 @@ const VERSION = '0.0.0'
 export interface StartDaemonOptions {
 	port?: number
 	sessionsDir?: string
+	platform?: BuilderPlatformOptions
 }
 
 export interface RunningDaemon {
@@ -40,6 +45,7 @@ export function startDaemon(opts: StartDaemonOptions = {}): RunningDaemon {
 	sessionManager.cleanupStale()
 	const wsManager = createWebSocketManager(sessionManager, { feedbackConsumption: 'external' })
 	const buildStream = new BuildStream()
+	const platform = new BuilderPlatform((id) => sessionManager.get(id)?.projectRoot, opts.platform)
 
 	const portRef = { value: port }
 
@@ -48,6 +54,7 @@ export function startDaemon(opts: StartDaemonOptions = {}): RunningDaemon {
 		broadcastPlanUpdate: wsManager.broadcastPlanUpdate,
 		broadcastRevisionUpdate: wsManager.broadcastRevisionUpdate,
 		buildStream,
+		platform,
 		sessionsDir,
 		get port() {
 			return portRef.value
@@ -55,16 +62,18 @@ export function startDaemon(opts: StartDaemonOptions = {}): RunningDaemon {
 		version: VERSION,
 	}
 
-	const routes = [...createHandlers(handlerCtx), ...createStaticHandlers()]
+	const routes = [...createPlatformRoutes(platform), ...createHandlers(handlerCtx), ...createStaticHandlers()]
 
 	const server = Bun.serve<WSData>({
 		port,
-		hostname: 'localhost',
+		hostname: BUILDER_DAEMON_HOST,
 		fetch(req, server) {
 			const url = new URL(req.url)
+			const rejection = admitRequest(req, url, portRef.value)
+			if (rejection) return rejection
 
 			if (req.method === 'OPTIONS') {
-				return new Response(null, { status: 204, headers: corsHeaders(portRef.value) })
+				return new Response(null, { status: 204 })
 			}
 
 			const wsBrowser = url.pathname.match(/^\/ws\/session\/([^/]+)$/)
@@ -113,6 +122,7 @@ export function startDaemon(opts: StartDaemonOptions = {}): RunningDaemon {
 		port: boundPort,
 		sessionManager,
 		stop() {
+			platform.stop()
 			try {
 				unwatchAll()
 			} catch {