@mandujs/core 0.54.25 → 0.54.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mandujs/core",
-  "version": "0.54.25",
+  "version": "0.54.27",
   "description": "Mandu Framework Core - Spec, Generator, Guard, Runtime",
   "type": "module",
   "main": "./src/index.ts",

package/src/bundler/__tests__/jsx-runtime-shim.test.ts

@@ -1,51 +1,86 @@
 /**
- * Regression guard for issue #322 — dev island hydration broke because the
- * generated `_jsx-dev-runtime` shim imported `jsxDEV` from bare `"react"`.
- * React's main entry does NOT export `jsxDEV` (it lives in
- * `react/jsx-dev-runtime`), so `jsxDEV` resolved to `undefined` and every
- * island threw `TypeError: jsxDEV is not a function` in dev mode.
+ * Regression guard for issues #322 / #323 — dev island hydration broke with
+ * `TypeError: jsxDEV is not a function`.
  *
- * These tests assert the generated shim sources reference the correct React
- * subpaths and never pull JSX runtime functions from bare `"react"`.
+ * #322: the shim imported `jsxDEV` from bare `"react"`, which (via the import
+ * map → `_react.js`) only worked if `_react.js` re-exported jsxDEV.
+ * #323: the "fix" changed the import to `"react/jsx-dev-runtime"`, but the
+ * import map maps `react/jsx-dev-runtime` to THIS shim — a circular
+ * self-import, so jsxDEV stayed `undefined`.
+ *
+ * The correct source: import JSX runtime functions from bare `"react"`, which
+ * the import map resolves to the self-contained `_react.js` vendor bundle
+ * (built with no `external`, so the real jsx/jsxs/jsxDEV/Fragment are inlined
+ * and re-exported). The shim must NEVER import from the import-map-aliased
+ * subpath that points back at itself.
  */
 import { describe, expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
 import {
   _testOnly_generateJsxDevRuntimeShimSource,
   _testOnly_generateJsxRuntimeShimSource,
 } from "../build";
 
-describe("JSX runtime shim sources (issue #322)", () => {
-  test("dev shim imports jsxDEV/Fragment from react/jsx-dev-runtime", () => {
+describe("JSX runtime shim sources (issues #322 / #323)", () => {
+  test("dev shim imports jsxDEV/Fragment from bare 'react', never the self-aliased subpath", () => {
     const source = _testOnly_generateJsxDevRuntimeShimSource();
 
-    // The fix: jsxDEV + Fragment must come from the real subpath.
-    expect(source).toContain("react/jsx-dev-runtime");
-    expect(source).toMatch(
-      /import\s*\{\s*jsxDEV\s*,\s*Fragment\s*\}\s*from\s*['"]react\/jsx-dev-runtime['"]/,
-    );
+    // #323: must NOT import from 'react/jsx-dev-runtime' — that is this shim's
+    // own import-map alias, which would be a circular self-import. (Targets
+    // the import statement, not comment mentions of the path.)
+    expect(source).not.toMatch(/from\s*['"]react\/jsx-dev-runtime['"]/);
 
-    // Regression: must NOT import jsxDEV from bare "react".
-    expect(source).not.toMatch(
-      /import\s*\{[^}]*jsxDEV[^}]*\}\s*from\s*['"]react['"]/,
+    // Correct: jsxDEV + Fragment come from bare 'react' (→ _react.js).
+    expect(source).toMatch(
+      /import\s*\{\s*jsxDEV\s*,\s*Fragment\s*\}\s*from\s*['"]react['"]/,
     );
 
     // Shim still re-exports what the import map expects.
     expect(source).toContain("export { jsxDEV, Fragment }");
   });
 
-  test("prod shim imports jsx/jsxs/Fragment from react/jsx-runtime", () => {
+  test("prod shim imports jsx/jsxs/Fragment from bare 'react', never the self-aliased subpath", () => {
     const source = _testOnly_generateJsxRuntimeShimSource();
 
-    expect(source).toContain("react/jsx-runtime");
-    expect(source).toMatch(
-      /import\s*\{\s*jsx\s*,\s*jsxs\s*,\s*Fragment\s*\}\s*from\s*['"]react\/jsx-runtime['"]/,
-    );
+    // #323: must NOT import from 'react/jsx-runtime' (this shim's own alias).
+    expect(source).not.toMatch(/from\s*['"]react\/jsx-runtime['"]/);
 
-    // Regression: must NOT import jsx/jsxs from bare "react".
-    expect(source).not.toMatch(
-      /import\s*\{[^}]*\bjsx\b[^}]*\}\s*from\s*['"]react['"]/,
+    expect(source).toMatch(
+      /import\s*\{\s*jsx\s*,\s*jsxs\s*,\s*Fragment\s*\}\s*from\s*['"]react['"]/,
     );
 
     expect(source).toContain("export { jsx, jsxs, Fragment }");
   });
+
+  // #323 build-level guard: the SOURCE test alone missed the real bug because
+  // the broken 0.54.24 build still emitted `from "react/jsx-dev-runtime"` in
+  // the OUTPUT (the import-map alias pointing back at this shim). Build the
+  // shim the same way buildVendorShims does (external: ["react"]) and assert
+  // the emitted module never self-imports the alias.
+  test("built dev shim never self-imports react/jsx-dev-runtime", async () => {
+    const dir = await mkdtemp(path.join(tmpdir(), "mandu-jsx-shim-"));
+    try {
+      const srcPath = path.join(dir, "_jsx-dev-runtime.js");
+      await writeFile(srcPath, _testOnly_generateJsxDevRuntimeShimSource(), "utf-8");
+
+      const result = await Bun.build({
+        entrypoints: [srcPath],
+        external: ["react"],
+        target: "browser",
+      });
+
+      expect(result.success).toBe(true);
+      const out = await result.outputs[0]!.text();
+
+      // The emitted shim must source jsxDEV from bare 'react' (→ _react.js),
+      // NOT from the import-map alias that resolves back to itself.
+      expect(out).not.toMatch(/from\s*["']react\/jsx-dev-runtime["']/);
+      expect(out).toMatch(/from\s*["']react["']/);
+      expect(out).toContain("jsxDEV");
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
 });

package/src/bundler/build.ts

@@ -633,11 +633,13 @@ function generateJsxRuntimeShimSource(): string {
 /**
  * Mandu JSX Runtime Shim (Generated)
  * Production JSX 변환용
- * jsx/jsxs/Fragment는 'react/jsx-runtime' 원본에서 직접 가져온다.
- * import map의 'react/jsx-runtime'이 다시 이 셰임을 가리키므로,
- * 셰임 내부는 실제 원본 경로를 직접 참조해야 순환/누락이 생기지 않는다.
+ *
+ * #323: import map의 'react/jsx-runtime'이 다시 이 셰임을 가리키므로
+ * 'react/jsx-runtime'에서 import하면 순환 self-import가 된다. 대신
+ * 'react'(→ _react.js, external 없이 react 전체를 인라인하며 jsx/jsxs/
+ * Fragment를 re-export하는 vendor 번들)에서 가져와 순환을 끊는다.
  */
-import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
+import { jsx, jsxs, Fragment } from 'react';
 
 // Named exports
 export { jsx, jsxs, Fragment };
@@ -656,11 +658,14 @@ function generateJsxDevRuntimeShimSource(): string {
 /**
  * Mandu JSX Dev Runtime Shim (Generated)
  * Development JSX 변환용
- * jsxDEV/Fragment는 'react'가 아니라 'react/jsx-dev-runtime'에서만 export된다.
- * import map의 'react/jsx-dev-runtime'이 다시 이 셰임을 가리키므로,
- * 셰임 내부는 실제 원본 경로를 직접 참조해야 순환/누락(jsxDEV undefined)이 생기지 않는다.
+ *
+ * #323: import map의 'react/jsx-dev-runtime'이 다시 이 셰임을 가리키므로
+ * 'react/jsx-dev-runtime'에서 import하면 순환 self-import가 되어 jsxDEV가
+ * undefined가 된다. 대신 'react'(→ _react.js, external 없이 react 전체를
+ * 인라인하며 jsxDEV/Fragment를 re-export하는 vendor 번들)에서 가져와
+ * 순환을 끊는다.
  */
-import { jsxDEV, Fragment } from 'react/jsx-dev-runtime';
+import { jsxDEV, Fragment } from 'react';
 
 // Named exports
 export { jsxDEV, Fragment };

package/src/devtools/client/catchers/network-proxy.ts

@@ -56,6 +56,8 @@ const DEFAULT_OPTIONS: Required<NetworkProxyOptions> = {
   ignorePatterns: [
     // DevTools 자체 요청
     /__mandu/,
+    // DevTools 에러 리포트 엔드포인트 (자기추적/피드백 루프 방지)
+    /__kitchen/,
     // HMR
     /__vite/,
     /\.hot-update\./,

package/src/devtools/server/source-context.ts

@@ -174,11 +174,22 @@ export class SourceContextProvider {
    * 안전한 경로 확인 (Path Traversal 방지)
    */
   private resolveSafePath(file: string): string | null {
+    // Reject absolute inputs outright: path.resolve(root, "/etc/passwd")
+    // returns "/etc/passwd", escaping the project root.
+    if (path.isAbsolute(file)) {
+      return null;
+    }
+
     const absolutePath = path.resolve(this.options.projectRoot, file);
     const normalizedRoot = path.normalize(this.options.projectRoot);
-
-    // 확인된 경로가 프로젝트 루트 내에 있는지 확인
-    if (!absolutePath.startsWith(normalizedRoot)) {
+    // Compare with a trailing separator so a sibling sharing the root's
+    // prefix (e.g. "/app/project-secrets" vs root "/app/project") is NOT
+    // treated as inside the root. Allow the root itself.
+    const rootWithSep = normalizedRoot.endsWith(path.sep)
+      ? normalizedRoot
+      : normalizedRoot + path.sep;
+
+    if (absolutePath !== normalizedRoot && !absolutePath.startsWith(rootWithSep)) {
       return null;
     }
 

package/src/devtools/worker/worker-manager.ts

@@ -245,6 +245,8 @@ export class WorkerManager {
         { source: '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\\\.[a-zA-Z]{2,}', label: 'EMAIL' },
         { source: '\\\\+?[1-9]\\\\d{1,14}', label: 'PHONE' },
         { source: '\\\\b(?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\b', label: 'IP' },
+        { source: '\\\\b(?:\\\\d{4}[- ]?){3}\\\\d{4}\\\\b', label: 'CARD' },
+        { source: '\\\\b\\\\d{3}-\\\\d{2}-\\\\d{4}\\\\b', label: 'SSN' },
       ];
 
       function applyPattern(text, pattern) {