@jetstart/core 1.1.3 → 1.2.0

package/dist/websocket/handler.d.ts

@@ -17,7 +17,7 @@ export declare class WebSocketHandler {
     sendBuildStart(sessionId: string): void;
     sendBuildComplete(sessionId: string, apkUrl: string): void;
     /**
-     * Send UI update (DSL-based hot reload)
+     * Send UI update (DSL-based hot reload) - SECURE, session-isolated
      */
     sendUIUpdate(sessionId: string, dslContent: string, screens?: string[]): void;
     private generateHash;

package/dist/websocket/handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/websocket/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAG9C,qBAAa,gBAAgB;IAIzB,OAAO,CAAC,iBAAiB;IAH3B,OAAO,CAAC,iBAAiB,CAAC,CAA8B;gBAG9C,iBAAiB,EAAE,iBAAiB,EAC5C,OAAO,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE;IAK/D,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAenD,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,gBAAgB;IAKxB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAUvC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAqB1D;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI;IAe7E,OAAO,CAAC,YAAY;CAUrB"}
+{"version":3,"file":"handler.d.ts","sourceRoot":"","sources":["../../src/websocket/handler.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAG9C,qBAAa,gBAAgB;IAIzB,OAAO,CAAC,iBAAiB;IAH3B,OAAO,CAAC,iBAAiB,CAAC,CAA8B;gBAG9C,iBAAiB,EAAE,iBAAiB,EAC5C,OAAO,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE;IAK/D,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAenD,OAAO,CAAC,eAAe;IAIvB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,aAAa;IAuBrB,OAAO,CAAC,gBAAgB;IAKxB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAUvC,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAqB1D;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI;IAe7E,OAAO,CAAC,YAAY;CAUrB"}

package/dist/websocket/handler.js

@@ -50,6 +50,8 @@ class WebSocketHandler {
     }
     handleConnect(clientId, message) {
         (0, logger_1.log)(`Client connecting with session: ${message.sessionId}`);
+        // Associate this client with the session for isolation
+        this.connectionManager.setClientSession(clientId, message.sessionId);
         // Send connected confirmation
         const response = {
             type: 'core:connected',
@@ -74,7 +76,7 @@ class WebSocketHandler {
             timestamp: Date.now(),
             sessionId,
         };
-        this.connectionManager.broadcast(message);
+        this.connectionManager.broadcastToSession(sessionId, message);
     }
     sendBuildComplete(sessionId, apkUrl) {
         const message = {
@@ -93,10 +95,10 @@ class WebSocketHandler {
             },
             downloadUrl: apkUrl,
         };
-        this.connectionManager.broadcast(message);
+        this.connectionManager.broadcastToSession(sessionId, message);
     }
     /**
-     * Send UI update (DSL-based hot reload)
+     * Send UI update (DSL-based hot reload) - SECURE, session-isolated
      */
     sendUIUpdate(sessionId, dslContent, screens) {
         const message = {
@@ -107,9 +109,9 @@ class WebSocketHandler {
             screens,
             hash: this.generateHash(dslContent),
         };
-        (0, logger_1.log)(`Sending UI update: ${dslContent.length} bytes`);
+        (0, logger_1.log)(`Sending UI update to session ${sessionId}: ${dslContent.length} bytes`);
         (0, logger_1.log)(`DSL Content: ${dslContent}`);
-        this.connectionManager.broadcast(message);
+        this.connectionManager.broadcastToSession(sessionId, message);
     }
     generateHash(content) {
         // Simple hash for caching (in production, use crypto.createHash)

package/dist/websocket/handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/websocket/handler.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAWH,4CAAyD;AAEzD,MAAa,gBAAgB;IAIjB;IAHF,iBAAiB,CAA+B;IAExD,YACU,iBAAoC,EAC5C,OAA6D;QADrD,sBAAiB,GAAjB,iBAAiB,CAAmB;QAG5C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;IACtD,CAAC;IAED,aAAa,CAAC,QAAgB,EAAE,IAAY;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvD,IAAA,YAAG,EAAC,yBAAyB,QAAQ,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAE1D,8BAA8B;YAC9B,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;QAEH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAA,cAAQ,EAAC,gCAAgC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,OAAkB;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAEO,mBAAmB,CAAC,QAAgB,EAAE,OAAsB;QAClE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,gBAAgB;gBACnB,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACtC,MAAM;YACR,KAAK,eAAe;gBAClB,IAAA,YAAG,EAAC,UAAU,QAAQ,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,YAAY;gBACf,0BAA0B;gBAC1B,MAAM;YACR,KAAK,kBAAkB;gBACrB,uBAAuB;gBACvB,MAAM;YACR,KAAK,mBAAmB;gBACtB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACzC,MAAM;QACV,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,QAAgB,EAAE,OAAmD;QACzF,IAAA,YAAG,EAAC,mCAAmC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAE5D,8BAA8B;QAC9B,MAAM,QAAQ,GAAyB;YACrC,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,aAAa,EAAE,2CAA2C;SACxE,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExD,uCAAuC;QACvC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,IAAA,YAAG,EAAC,yCAAyC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,QAAgB,EAAE,OAAsD;QAC/F,IAAA,YAAG,EAAC,yBAAyB,OAAO,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,2BAA2B;IAC3B,cAAc,CAAC,SAAiB;QAC9B,MAAM,OAAO,GAA0B;YACrC,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS;SACV,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,iBAAiB,CAAC,SAAiB,EAAE,MAAc;QACjD,MAAM,OAAO,GAA6B;YACxC,IAAI,EAAE,qBAAqB;YAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,CAAC;gBACd,WAAW,EAAE,OAAO;gBACpB,aAAa,EAAE,EAAE;gBACjB,gBAAgB,EAAE,EAAE;gBACpB,aAAa,EAAE,iBAAiB;aACjC;YACD,WAAW,EAAE,MAAM;SACpB,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAAiB,EAAE,UAAkB,EAAE,OAAkB;QACpE,MAAM,OAAO,GAAwB;YACnC,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS;YACT,UAAU;YACV,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;SACpC,CAAC;QAEF,IAAA,YAAG,EAAC,sBAAsB,UAAU,CAAC,MAAM,QAAQ,CAAC,CAAC;QACrD,IAAA,YAAG,EAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEO,YAAY,CAAC,OAAe;QAClC,iEAAiE;QACjE,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACnC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,2BAA2B;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF;AArID,4CAqIC"}
+{"version":3,"file":"handler.js","sourceRoot":"","sources":["../../src/websocket/handler.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAWH,4CAAyD;AAEzD,MAAa,gBAAgB;IAIjB;IAHF,iBAAiB,CAA+B;IAExD,YACU,iBAAoC,EAC5C,OAA6D;QADrD,sBAAiB,GAAjB,iBAAiB,CAAmB;QAG5C,IAAI,CAAC,iBAAiB,GAAG,OAAO,EAAE,iBAAiB,CAAC;IACtD,CAAC;IAED,aAAa,CAAC,QAAgB,EAAE,IAAY;QAC1C,IAAI,CAAC;YACH,MAAM,OAAO,GAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvD,IAAA,YAAG,EAAC,yBAAyB,QAAQ,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAE1D,8BAA8B;YAC9B,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC;QAEH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAA,cAAQ,EAAC,gCAAgC,QAAQ,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,OAAkB;QACxC,OAAO,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAEO,mBAAmB,CAAC,QAAgB,EAAE,OAAsB;QAClE,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,gBAAgB;gBACnB,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACtC,MAAM;YACR,KAAK,eAAe;gBAClB,IAAA,YAAG,EAAC,UAAU,QAAQ,YAAY,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpD,MAAM;YACR,KAAK,YAAY;gBACf,0BAA0B;gBAC1B,MAAM;YACR,KAAK,kBAAkB;gBACrB,uBAAuB;gBACvB,MAAM;YACR,KAAK,mBAAmB;gBACtB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBACzC,MAAM;QACV,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,QAAgB,EAAE,OAAmD;QACzF,IAAA,YAAG,EAAC,mCAAmC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAE5D,uDAAuD;QACvD,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAErE,8BAA8B;QAC9B,MAAM,QAAQ,GAAyB;YACrC,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,aAAa,EAAE,2CAA2C;SACxE,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAExD,uCAAuC;QACvC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,IAAA,YAAG,EAAC,yCAAyC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,QAAgB,EAAE,OAAsD;QAC/F,IAAA,YAAG,EAAC,yBAAyB,OAAO,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,2BAA2B;IAC3B,cAAc,CAAC,SAAiB;QAC9B,MAAM,OAAO,GAA0B;YACrC,IAAI,EAAE,kBAAkB;YACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS;SACV,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED,iBAAiB,CAAC,SAAiB,EAAE,MAAc;QACjD,MAAM,OAAO,GAA6B;YACxC,IAAI,EAAE,qBAAqB;YAC3B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS;YACT,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,CAAC;gBACd,WAAW,EAAE,OAAO;gBACpB,aAAa,EAAE,EAAE;gBACjB,gBAAgB,EAAE,EAAE;gBACpB,aAAa,EAAE,iBAAiB;aACjC;YACD,WAAW,EAAE,MAAM;SACpB,CAAC;QAEF,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAAiB,EAAE,UAAkB,EAAE,OAAkB;QACpE,MAAM,OAAO,GAAwB;YACnC,IAAI,EAAE,gBAAgB;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,SAAS;YACT,UAAU;YACV,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;SACpC,CAAC;QAEF,IAAA,YAAG,EAAC,gCAAgC,SAAS,KAAK,UAAU,CAAC,MAAM,QAAQ,CAAC,CAAC;QAC7E,IAAA,YAAG,EAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAChE,CAAC;IAEO,YAAY,CAAC,OAAe;QAClC,iEAAiE;QACjE,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YACnC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,2BAA2B;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;CACF;AAxID,4CAwIC"}

package/dist/websocket/manager.d.ts

@@ -1,6 +1,6 @@
 /**
  * Connection Manager
- * Manages WebSocket connections
+ * Manages WebSocket connections with session isolation
  */
 import { WebSocket } from 'ws';
 import { CoreMessage } from '@jetstart/shared';
@@ -9,8 +9,24 @@ export declare class ConnectionManager {
     addConnection(ws: WebSocket): string;
     removeConnection(id: string): void;
     getConnection(id: string): WebSocket | undefined;
+    /**
+     * Associate a client with a session for isolation
+     */
+    setClientSession(clientId: string, sessionId: string): void;
     sendToClient(clientId: string, message: CoreMessage): boolean;
+    /**
+     * Broadcast to all clients (UNSAFE - use broadcastToSession instead)
+     * @deprecated Use broadcastToSession for session isolation
+     */
     broadcast(message: CoreMessage): void;
+    /**
+     * Broadcast to all clients in a specific session (SECURE)
+     */
+    broadcastToSession(sessionId: string, message: CoreMessage): void;
+    /**
+     * Broadcast to ALL clients regardless of session (use with caution)
+     */
+    private broadcastToAll;
     getConnectionCount(): number;
 }
 //# sourceMappingURL=manager.d.ts.map

package/dist/websocket/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/websocket/manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,WAAW,CAAqC;IAExD,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM;IAMpC,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIlC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAIhD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO;IAgB7D,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAiBrC,kBAAkB,IAAI,MAAM;CAG7B"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/websocket/manager.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAO/C,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,WAAW,CAA4C;IAE/D,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM;IAMpC,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;IAIlC,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS;IAIhD;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAQ3D,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO;IAgB7D;;;OAGG;IACH,SAAS,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI;IAKrC;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,IAAI;IAoBjE;;OAEG;IACH,OAAO,CAAC,cAAc;IAiBtB,kBAAkB,IAAI,MAAM;CAG7B"}

package/dist/websocket/manager.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Connection Manager
- * Manages WebSocket connections
+ * Manages WebSocket connections with session isolation
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ConnectionManager = void 0;
@@ -11,22 +11,32 @@ class ConnectionManager {
     connections = new Map();
     addConnection(ws) {
         const id = (0, uuid_1.v4)();
-        this.connections.set(id, ws);
+        this.connections.set(id, { ws, sessionId: undefined });
         return id;
     }
     removeConnection(id) {
         this.connections.delete(id);
     }
     getConnection(id) {
-        return this.connections.get(id);
+        return this.connections.get(id)?.ws;
+    }
+    /**
+     * Associate a client with a session for isolation
+     */
+    setClientSession(clientId, sessionId) {
+        const connection = this.connections.get(clientId);
+        if (connection) {
+            connection.sessionId = sessionId;
+            console.log(`[ConnectionManager] Client ${clientId} joined session ${sessionId}`);
+        }
     }
     sendToClient(clientId, message) {
-        const ws = this.connections.get(clientId);
-        if (!ws || ws.readyState !== ws_1.WebSocket.OPEN) {
+        const connection = this.connections.get(clientId);
+        if (!connection || connection.ws.readyState !== ws_1.WebSocket.OPEN) {
             return false;
         }
         try {
-            ws.send(JSON.stringify(message));
+            connection.ws.send(JSON.stringify(message));
             return true;
         }
         catch (err) {
@@ -34,14 +44,46 @@ class ConnectionManager {
             return false;
         }
     }
+    /**
+     * Broadcast to all clients (UNSAFE - use broadcastToSession instead)
+     * @deprecated Use broadcastToSession for session isolation
+     */
     broadcast(message) {
+        console.warn('[ConnectionManager] WARNING: Using unsafe broadcast() - use broadcastToSession() instead');
+        this.broadcastToAll(message);
+    }
+    /**
+     * Broadcast to all clients in a specific session (SECURE)
+     */
+    broadcastToSession(sessionId, message) {
+        const data = JSON.stringify(message);
+        let sentCount = 0;
+        this.connections.forEach((connection, clientId) => {
+            // Only send to clients in the same session
+            if (connection.sessionId === sessionId && connection.ws.readyState === ws_1.WebSocket.OPEN) {
+                try {
+                    connection.ws.send(data);
+                    sentCount++;
+                    console.log(`[ConnectionManager] Sent ${message.type} to client ${clientId} in session ${sessionId}`);
+                }
+                catch (err) {
+                    console.error(`Failed to send to ${clientId}:`, err);
+                }
+            }
+        });
+        console.log(`[ConnectionManager] Broadcasted ${message.type} to ${sentCount} clients in session ${sessionId}`);
+    }
+    /**
+     * Broadcast to ALL clients regardless of session (use with caution)
+     */
+    broadcastToAll(message) {
         const data = JSON.stringify(message);
-        const connectionCount = Array.from(this.connections.values()).filter(ws => ws.readyState === ws_1.WebSocket.OPEN).length;
+        const connectionCount = Array.from(this.connections.values()).filter(c => c.ws.readyState === ws_1.WebSocket.OPEN).length;
         console.log(`[ConnectionManager] Broadcasting ${message.type} to ${connectionCount} connected clients`);
-        this.connections.forEach((ws, clientId) => {
-            if (ws.readyState === ws_1.WebSocket.OPEN) {
+        this.connections.forEach((connection, clientId) => {
+            if (connection.ws.readyState === ws_1.WebSocket.OPEN) {
                 try {
-                    ws.send(data);
+                    connection.ws.send(data);
                     console.log(`[ConnectionManager] Sent ${message.type} to client ${clientId}`);
                 }
                 catch (err) {

package/dist/websocket/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/websocket/manager.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,2BAA+B;AAC/B,+BAAoC;AAGpC,MAAa,iBAAiB;IACpB,WAAW,GAA2B,IAAI,GAAG,EAAE,CAAC;IAExD,aAAa,CAAC,EAAa;QACzB,MAAM,EAAE,GAAG,IAAA,SAAM,GAAE,CAAC;QACpB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,gBAAgB,CAAC,EAAU;QACzB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,OAAoB;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS,CAAC,OAAoB;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACpH,OAAO,CAAC,GAAG,CAAC,oCAAoC,OAAO,CAAC,IAAI,OAAO,eAAe,oBAAoB,CAAC,CAAC;QAExG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE;YACxC,IAAI,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACd,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,IAAI,cAAc,QAAQ,EAAE,CAAC,CAAC;gBAChF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,0BAA0B,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;CACF;AArDD,8CAqDC"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/websocket/manager.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,2BAA+B;AAC/B,+BAAoC;AAQpC,MAAa,iBAAiB;IACpB,WAAW,GAAkC,IAAI,GAAG,EAAE,CAAC;IAE/D,aAAa,CAAC,EAAa;QACzB,MAAM,EAAE,GAAG,IAAA,SAAM,GAAE,CAAC;QACpB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,gBAAgB,CAAC,EAAU;QACzB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,aAAa,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAgB,EAAE,SAAiB;QAClD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,8BAA8B,QAAQ,mBAAmB,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,OAAoB;QACjD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAElD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,OAAoB;QAC5B,OAAO,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;QACzG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,SAAiB,EAAE,OAAoB;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;YAChD,2CAA2C;YAC3C,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,UAAU,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBACtF,IAAI,CAAC;oBACH,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACzB,SAAS,EAAE,CAAC;oBACZ,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,IAAI,cAAc,QAAQ,eAAe,SAAS,EAAE,CAAC,CAAC;gBACxG,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,qBAAqB,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,CAAC,IAAI,OAAO,SAAS,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACjH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAoB;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QACrH,OAAO,CAAC,GAAG,CAAC,oCAAoC,OAAO,CAAC,IAAI,OAAO,eAAe,oBAAoB,CAAC,CAAC;QAExG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,UAAU,CAAC,EAAE,CAAC,UAAU,KAAK,cAAS,CAAC,IAAI,EAAE,CAAC;gBAChD,IAAI,CAAC;oBACH,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACzB,OAAO,CAAC,GAAG,CAAC,4BAA4B,OAAO,CAAC,IAAI,cAAc,QAAQ,EAAE,CAAC,CAAC;gBAChF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,OAAO,CAAC,KAAK,CAAC,0BAA0B,QAAQ,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IAC/B,CAAC;CACF;AAnGD,8CAmGC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jetstart/core",
-  "version": "1.1.3",
+  "version": "1.2.0",
   "description": "Build server and orchestration for JetStart",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -33,7 +33,7 @@
   },
   "homepage": "https://github.com/dev-phantom/jetstart#readme",
   "dependencies": {
-    "@jetstart/shared": "^1.1.3",
+    "@jetstart/shared": "^1.2.0",
     "express": "^4.18.2",
     "ws": "^8.14.2",
     "chokidar": "^3.5.3",

package/src/websocket/handler.ts

@@ -66,6 +66,9 @@ export class WebSocketHandler {
   private handleConnect(clientId: string, message: ClientMessage & { type: 'client:connect' }): void {
     log(`Client connecting with session: ${message.sessionId}`);
 
+    // Associate this client with the session for isolation
+    this.connectionManager.setClientSession(clientId, message.sessionId);
+
     // Send connected confirmation
     const response: CoreConnectedMessage = {
       type: 'core:connected',
@@ -95,7 +98,7 @@ export class WebSocketHandler {
       sessionId,
     };
 
-    this.connectionManager.broadcast(message);
+    this.connectionManager.broadcastToSession(sessionId, message);
   }
 
   sendBuildComplete(sessionId: string, apkUrl: string): void {
@@ -116,11 +119,11 @@ export class WebSocketHandler {
       downloadUrl: apkUrl,
     };
 
-    this.connectionManager.broadcast(message);
+    this.connectionManager.broadcastToSession(sessionId, message);
   }
 
   /**
-   * Send UI update (DSL-based hot reload)
+   * Send UI update (DSL-based hot reload) - SECURE, session-isolated
    */
   sendUIUpdate(sessionId: string, dslContent: string, screens?: string[]): void {
     const message: CoreUIUpdateMessage = {
@@ -132,9 +135,9 @@ export class WebSocketHandler {
       hash: this.generateHash(dslContent),
     };
 
-    log(`Sending UI update: ${dslContent.length} bytes`);
+    log(`Sending UI update to session ${sessionId}: ${dslContent.length} bytes`);
     log(`DSL Content: ${dslContent}`);
-    this.connectionManager.broadcast(message);
+    this.connectionManager.broadcastToSession(sessionId, message);
   }
 
   private generateHash(content: string): string {

package/src/websocket/manager.ts

@@ -1,18 +1,23 @@
 /**
  * Connection Manager
- * Manages WebSocket connections
+ * Manages WebSocket connections with session isolation
  */
 
 import { WebSocket } from 'ws';
 import { v4 as uuidv4 } from 'uuid';
 import { CoreMessage } from '@jetstart/shared';
 
+interface ClientConnection {
+  ws: WebSocket;
+  sessionId?: string; // Session ID for isolation
+}
+
 export class ConnectionManager {
-  private connections: Map<string, WebSocket> = new Map();
+  private connections: Map<string, ClientConnection> = new Map();
 
   addConnection(ws: WebSocket): string {
     const id = uuidv4();
-    this.connections.set(id, ws);
+    this.connections.set(id, { ws, sessionId: undefined });
     return id;
   }
 
@@ -21,18 +26,29 @@ export class ConnectionManager {
   }
 
   getConnection(id: string): WebSocket | undefined {
-    return this.connections.get(id);
+    return this.connections.get(id)?.ws;
+  }
+
+  /**
+   * Associate a client with a session for isolation
+   */
+  setClientSession(clientId: string, sessionId: string): void {
+    const connection = this.connections.get(clientId);
+    if (connection) {
+      connection.sessionId = sessionId;
+      console.log(`[ConnectionManager] Client ${clientId} joined session ${sessionId}`);
+    }
   }
 
   sendToClient(clientId: string, message: CoreMessage): boolean {
-    const ws = this.connections.get(clientId);
-    
-    if (!ws || ws.readyState !== WebSocket.OPEN) {
+    const connection = this.connections.get(clientId);
+
+    if (!connection || connection.ws.readyState !== WebSocket.OPEN) {
       return false;
     }
 
     try {
-      ws.send(JSON.stringify(message));
+      connection.ws.send(JSON.stringify(message));
       return true;
     } catch (err) {
       console.error(`Failed to send message to ${clientId}:`, err);
@@ -40,15 +56,50 @@ export class ConnectionManager {
     }
   }
 
+  /**
+   * Broadcast to all clients (UNSAFE - use broadcastToSession instead)
+   * @deprecated Use broadcastToSession for session isolation
+   */
   broadcast(message: CoreMessage): void {
+    console.warn('[ConnectionManager] WARNING: Using unsafe broadcast() - use broadcastToSession() instead');
+    this.broadcastToAll(message);
+  }
+
+  /**
+   * Broadcast to all clients in a specific session (SECURE)
+   */
+  broadcastToSession(sessionId: string, message: CoreMessage): void {
+    const data = JSON.stringify(message);
+    let sentCount = 0;
+
+    this.connections.forEach((connection, clientId) => {
+      // Only send to clients in the same session
+      if (connection.sessionId === sessionId && connection.ws.readyState === WebSocket.OPEN) {
+        try {
+          connection.ws.send(data);
+          sentCount++;
+          console.log(`[ConnectionManager] Sent ${message.type} to client ${clientId} in session ${sessionId}`);
+        } catch (err) {
+          console.error(`Failed to send to ${clientId}:`, err);
+        }
+      }
+    });
+
+    console.log(`[ConnectionManager] Broadcasted ${message.type} to ${sentCount} clients in session ${sessionId}`);
+  }
+
+  /**
+   * Broadcast to ALL clients regardless of session (use with caution)
+   */
+  private broadcastToAll(message: CoreMessage): void {
     const data = JSON.stringify(message);
-    const connectionCount = Array.from(this.connections.values()).filter(ws => ws.readyState === WebSocket.OPEN).length;
+    const connectionCount = Array.from(this.connections.values()).filter(c => c.ws.readyState === WebSocket.OPEN).length;
     console.log(`[ConnectionManager] Broadcasting ${message.type} to ${connectionCount} connected clients`);
 
-    this.connections.forEach((ws, clientId) => {
-      if (ws.readyState === WebSocket.OPEN) {
+    this.connections.forEach((connection, clientId) => {
+      if (connection.ws.readyState === WebSocket.OPEN) {
         try {
-          ws.send(data);
+          connection.ws.send(data);
           console.log(`[ConnectionManager] Sent ${message.type} to client ${clientId}`);
         } catch (err) {
           console.error(`Failed to broadcast to ${clientId}:`, err);