@quenty/studio-bridge 0.1.1-canary.656.73a74af.0 → 0.2.0

package/src/server/studio-bridge-server.test.ts

@@ -14,6 +14,19 @@ import { StudioBridgeServer, type StudioBridgePhase } from './studio-bridge-serv
 // Mocks — replace external side-effects with no-ops
 // ---------------------------------------------------------------------------
 
+vi.mock('@quenty/nevermore-template-helpers', () => ({
+  BuildContext: {
+    createAsync: vi.fn(async () => ({
+      resolvePath: vi.fn((rel: string) => `/fake/tmp/${rel}`),
+      executeLuneTransformScriptAsync: vi.fn(async () => {}),
+      rojoBuildAsync: vi.fn(async () => undefined),
+      cleanupAsync: vi.fn(async () => {}),
+    })),
+  },
+  resolvePackagePath: vi.fn((..._args: any[]) => '/fake/transform-script.luau'),
+  resolveTemplatePath: vi.fn((..._args: any[]) => '/fake/default.project.json'),
+}));
+
 vi.mock('../plugin/plugin-injector.js', () => ({
   injectPluginAsync: vi.fn(async () => ({
     pluginPath: '/fake/plugin.rbxmx',
@@ -29,13 +42,6 @@ vi.mock('../process/studio-process-manager.js', () => ({
   findPluginsFolder: vi.fn(() => '/fake/plugins'),
 }));
 
-vi.mock('../process/place-builder.js', () => ({
-  buildMinimalPlaceAsync: vi.fn(async () => ({
-    placePath: '/fake/place.rbxl',
-    cleanupAsync: vi.fn(async () => {}),
-  })),
-}));
-
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -48,7 +54,7 @@ async function connectAndHandshake(
   port: number,
   sessionId: string
 ): Promise<WebSocket> {
-  const ws = new WebSocket(`ws://localhost:${port}`);
+  const ws = new WebSocket(`ws://localhost:${port}/${sessionId}`);
 
   await new Promise<void>((resolve, reject) => {
     ws.on('open', resolve);
@@ -56,7 +62,7 @@ async function connectAndHandshake(
   });
 
   // Send hello
-  ws.send(JSON.stringify({ type: 'hello', payload: { sessionId } }));
+  ws.send(JSON.stringify({ type: 'hello', sessionId, payload: { sessionId } }));
 
   // Wait for welcome
   await new Promise<void>((resolve) => {
@@ -180,7 +186,7 @@ describe('StudioBridgeServer', () => {
       expect(true).toBe(true);
     });
 
-    it('ignores hello with wrong session ID', async () => {
+    it('rejects hello with wrong session ID and closes connection', async () => {
       const sessionId = 'correct-session';
       server = new StudioBridgeServer({
         placePath: '/fake/place.rbxl',
@@ -194,26 +200,66 @@ describe('StudioBridgeServer', () => {
       const wss = (server as any)._wss;
       const port: number = wss.address().port;
 
-      // Connect with wrong session ID
-      const ws = new WebSocket(`ws://localhost:${port}`);
+      // Connect with correct path but wrong session ID in message
+      const ws = new WebSocket(`ws://localhost:${port}/${sessionId}`);
       await new Promise<void>((resolve, reject) => {
         ws.on('open', resolve);
         ws.on('error', reject);
       });
 
+      // Track if server closes the connection
+      const closedPromise = new Promise<void>((resolve) => {
+        ws.on('close', () => resolve());
+      });
+
       ws.send(
         JSON.stringify({
           type: 'hello',
+          sessionId: 'wrong-session',
           payload: { sessionId: 'wrong-session' },
         })
       );
 
+      // Server should close the connection
+      await closedPromise;
+
       // Server should NOT accept — startAsync should time out
       await expect(startPromise).rejects.toThrow('Timed out waiting for Studio plugin handshake');
 
-      ws.close();
       // Server already stopped on failure (startAsync catch cleans up)
     });
+
+    it('rejects connection to wrong WebSocket path', async () => {
+      const sessionId = 'correct-session';
+      server = new StudioBridgeServer({
+        placePath: '/fake/place.rbxl',
+        sessionId,
+        timeoutMs: 1_000,
+      });
+
+      const startPromise = server.startAsync();
+
+      await new Promise((r) => setTimeout(r, 50));
+      const wss = (server as any)._wss;
+      const port: number = wss.address().port;
+
+      // Connect with wrong path
+      const ws = new WebSocket(`ws://localhost:${port}/wrong-path`);
+
+      // Should get an error or unexpected response
+      const errorOrClose = await new Promise<string>((resolve) => {
+        ws.on('error', () => resolve('error'));
+        ws.on('unexpected-response', () => {
+          ws.close();
+          resolve('rejected');
+        });
+      });
+
+      expect(['error', 'rejected']).toContain(errorOrClose);
+
+      // startAsync should time out
+      await expect(startPromise).rejects.toThrow('Timed out waiting for Studio plugin handshake');
+    });
   });
 
   // -----------------------------------------------------------------------
@@ -221,19 +267,19 @@ describe('StudioBridgeServer', () => {
   // -----------------------------------------------------------------------
 
   describe('executeAsync', () => {
-    it('sends execute message and returns result on scriptComplete', async () => {
+    it('sends execute message with sessionId and returns result on scriptComplete', async () => {
       const ready = await createReadyServer();
       server = ready.server;
       client = ready.client;
 
       // Listen for execute message from server
-      const executePromise = new Promise<string>((resolve) => {
+      const executePromise = new Promise<{ script: string; sessionId: string }>((resolve) => {
         client!.on('message', (raw) => {
           const data = JSON.parse(
             typeof raw === 'string' ? raw : raw.toString('utf-8')
           );
           if (data.type === 'execute') {
-            resolve(data.payload.script);
+            resolve({ script: data.payload.script, sessionId: data.sessionId });
           }
         });
       });
@@ -243,14 +289,16 @@ describe('StudioBridgeServer', () => {
         scriptContent: 'print("hello")',
       });
 
-      // Verify the server sent the execute message with correct script
-      const receivedScript = await executePromise;
-      expect(receivedScript).toBe('print("hello")');
+      // Verify the server sent the execute message with correct script and sessionId
+      const received = await executePromise;
+      expect(received.script).toBe('print("hello")');
+      expect(received.sessionId).toBe(ready.sessionId);
 
       // Simulate plugin sending scriptComplete
       client!.send(
         JSON.stringify({
           type: 'scriptComplete',
+          sessionId: ready.sessionId,
           payload: { success: true },
         })
       );
@@ -283,6 +331,7 @@ describe('StudioBridgeServer', () => {
       client!.send(
         JSON.stringify({
           type: 'output',
+          sessionId: ready.sessionId,
           payload: {
             messages: [
               { level: 'Print', body: 'Line 1' },
@@ -295,6 +344,7 @@ describe('StudioBridgeServer', () => {
       client!.send(
         JSON.stringify({
           type: 'output',
+          sessionId: ready.sessionId,
           payload: {
             messages: [{ level: 'Error', body: 'Line 3' }],
           },
@@ -305,6 +355,7 @@ describe('StudioBridgeServer', () => {
       client!.send(
         JSON.stringify({
           type: 'scriptComplete',
+          sessionId: ready.sessionId,
           payload: { success: true },
         })
       );
@@ -342,6 +393,7 @@ describe('StudioBridgeServer', () => {
       client!.send(
         JSON.stringify({
           type: 'output',
+          sessionId: ready.sessionId,
           payload: {
             messages: [
               { level: 'Print', body: 'hello' },
@@ -354,6 +406,7 @@ describe('StudioBridgeServer', () => {
       client!.send(
         JSON.stringify({
           type: 'scriptComplete',
+          sessionId: ready.sessionId,
           payload: { success: true },
         })
       );
@@ -387,6 +440,7 @@ describe('StudioBridgeServer', () => {
       client!.send(
         JSON.stringify({
           type: 'scriptComplete',
+          sessionId: ready.sessionId,
           payload: { success: false, error: 'Script threw: boom' },
         })
       );
@@ -438,6 +492,40 @@ describe('StudioBridgeServer', () => {
       expect(result.success).toBe(false);
       expect(result.logs).toContain('Timed out after 200ms');
     });
+
+    it('ignores messages with wrong session ID during execution', async () => {
+      const ready = await createReadyServer();
+      server = ready.server;
+      client = ready.client;
+
+      const resultPromise = server.executeAsync({
+        scriptContent: 'print("test")',
+        timeoutMs: 500,
+      });
+
+      await new Promise<void>((resolve) => {
+        client!.on('message', (raw) => {
+          const data = JSON.parse(
+            typeof raw === 'string' ? raw : raw.toString('utf-8')
+          );
+          if (data.type === 'execute') resolve();
+        });
+      });
+
+      // Send scriptComplete with wrong session ID — should be ignored
+      client!.send(
+        JSON.stringify({
+          type: 'scriptComplete',
+          sessionId: 'wrong-session',
+          payload: { success: true },
+        })
+      );
+
+      // The server should ignore the above and time out
+      const result = await resultPromise;
+      expect(result.success).toBe(false);
+      expect(result.logs).toContain('Timed out after 500ms');
+    });
   });
 
   // -----------------------------------------------------------------------
@@ -472,6 +560,7 @@ describe('StudioBridgeServer', () => {
         client!.send(
           JSON.stringify({
             type: 'scriptComplete',
+            sessionId: ready.sessionId,
             payload: { success: true },
           })
         );
@@ -515,6 +604,7 @@ describe('StudioBridgeServer', () => {
         client!.send(
           JSON.stringify({
             type: 'output',
+            sessionId: ready.sessionId,
             payload: { messages: [{ level: 'Print', body: outputBody }] },
           })
         );
@@ -522,6 +612,7 @@ describe('StudioBridgeServer', () => {
         client!.send(
           JSON.stringify({
             type: 'scriptComplete',
+            sessionId: ready.sessionId,
             payload: { success: true },
           })
         );
@@ -577,6 +668,7 @@ describe('StudioBridgeServer', () => {
       client!.send(
         JSON.stringify({
           type: 'scriptComplete',
+          sessionId: ready.sessionId,
           payload: { success: true },
         })
       );
@@ -597,7 +689,7 @@ describe('StudioBridgeServer', () => {
   // -----------------------------------------------------------------------
 
   describe('stopAsync', () => {
-    it('sends shutdown message to connected client', async () => {
+    it('sends shutdown message with sessionId to connected client', async () => {
       const ready = await createReadyServer();
       server = ready.server;
       client = ready.client;
@@ -610,7 +702,7 @@ describe('StudioBridgeServer', () => {
       await server.stopAsync();
 
       expect(sendSpy).toHaveBeenCalledWith(
-        JSON.stringify({ type: 'shutdown', payload: {} })
+        JSON.stringify({ type: 'shutdown', sessionId: ready.sessionId, payload: {} })
       );
     });
 

package/src/server/studio-bridge-server.ts

@@ -10,8 +10,14 @@
  */
 
 import { randomUUID } from 'crypto';
+import * as path from 'path';
 import { WebSocketServer, type WebSocket } from 'ws';
 import { OutputHelper } from '@quenty/cli-output-helpers';
+import {
+  BuildContext,
+  resolvePackagePath,
+  resolveTemplatePath,
+} from '@quenty/nevermore-template-helpers';
 import {
   type OutputLevel,
   encodeMessage,
@@ -25,10 +31,17 @@ import {
   launchStudioAsync,
   type StudioProcess,
 } from '../process/studio-process-manager.js';
-import {
-  buildMinimalPlaceAsync,
-  type BuiltPlace,
-} from '../process/place-builder.js';
+
+const defaultProjectPath = resolveTemplatePath(
+  import.meta.url,
+  path.join('default-test-place', 'default.project.json')
+);
+
+const sessionAttributeTransformScript = resolvePackagePath(
+  import.meta.url,
+  'build-scripts',
+  'transform-add-session-attribute.luau'
+);
 
 // ---------------------------------------------------------------------------
 // Public API types
@@ -112,7 +125,7 @@ export class StudioBridgeServer {
   private _wss: WebSocketServer | undefined;
   private _pluginHandle: InjectedPlugin | undefined;
   private _studioProc: StudioProcess | undefined;
-  private _builtPlace: BuiltPlace | undefined;
+  private _placeBuildContext: BuildContext | undefined;
   private _connectedClient: WebSocket | undefined;
 
   constructor(options: StudioBridgeServerOptions = {}) {
@@ -139,16 +152,37 @@ export class StudioBridgeServer {
     this._state = 'starting';
 
     try {
+      this._placeBuildContext = await BuildContext.createAsync({
+        prefix: 'studio-bridge-',
+      });
+
       // 0. Build a minimal place if none was provided
       let placePath = this._placePath;
       if (!placePath) {
         this._onPhase?.('building');
-        this._builtPlace = await buildMinimalPlaceAsync();
-        placePath = this._builtPlace.placePath;
+        const builtPlacePath =
+          this._placeBuildContext.resolvePath('minimal.rbxl');
+        await this._placeBuildContext.rojoBuildAsync({
+          projectPath: defaultProjectPath,
+          output: builtPlacePath,
+        });
+        placePath = builtPlacePath;
       }
 
-      // 1. Start WebSocket server
-      this._wss = new WebSocketServer({ port: 0 });
+      // 0b. Stamp session ID attribute onto the place file
+      const transformedPlacePath = this._placeBuildContext.resolvePath(
+        'studio-bridge-with-session-id.rbxl'
+      );
+      await this._placeBuildContext.executeLuneTransformScriptAsync(
+        sessionAttributeTransformScript,
+        placePath,
+        transformedPlacePath,
+        this._sessionId
+      );
+      placePath = transformedPlacePath;
+
+      // 1. Start WebSocket server (unique path rejects wrong connections at HTTP upgrade level)
+      this._wss = new WebSocketServer({ port: 0, path: `/${this._sessionId}` });
       const port = await startWsServerAsync(this._wss);
       OutputHelper.verbose(
         `[StudioBridge] WebSocket server listening on port ${port}`
@@ -208,6 +242,7 @@ export class StudioBridgeServer {
       this._connectedClient.send(
         encodeMessage({
           type: 'execute',
+          sessionId: this._sessionId,
           payload: { script: options.scriptContent },
         })
       );
@@ -247,7 +282,11 @@ export class StudioBridgeServer {
     if (this._connectedClient) {
       try {
         this._connectedClient.send(
-          encodeMessage({ type: 'shutdown', payload: {} })
+          encodeMessage({
+            type: 'shutdown',
+            sessionId: this._sessionId,
+            payload: {},
+          })
         );
       } catch {
         // ignore
@@ -287,10 +326,14 @@ export class StudioBridgeServer {
             return;
           }
 
-          if (msg.payload.sessionId !== this._sessionId) {
+          if (
+            msg.sessionId !== this._sessionId ||
+            msg.payload.sessionId !== this._sessionId
+          ) {
             OutputHelper.verbose(
-              `[StudioBridge] Ignoring hello with wrong session ID: ${msg.payload.sessionId}`
+              `[StudioBridge] Rejecting hello with wrong session ID`
             );
+            ws.close();
             return;
           }
 
@@ -299,6 +342,7 @@ export class StudioBridgeServer {
           ws.send(
             encodeMessage({
               type: 'welcome',
+              sessionId: this._sessionId,
               payload: { sessionId: this._sessionId },
             })
           );
@@ -387,6 +431,13 @@ export class StudioBridgeServer {
           return;
         }
 
+        if (msg.sessionId !== this._sessionId) {
+          OutputHelper.verbose(
+            `[StudioBridge] Ignoring message with wrong session ID`
+          );
+          return;
+        }
+
         switch (msg.type) {
           case 'output': {
             for (const entry of msg.payload.messages) {
@@ -461,9 +512,9 @@ export class StudioBridgeServer {
     }
 
     // Remove auto-built place
-    if (this._builtPlace) {
-      await this._builtPlace.cleanupAsync();
-      this._builtPlace = undefined;
+    if (this._placeBuildContext) {
+      await this._placeBuildContext.cleanupAsync();
+      this._placeBuildContext = undefined;
     }
 
     // Close WebSocket server — terminate lingering connections first so

package/src/server/web-socket-protocol.smoke.test.ts

@@ -16,7 +16,7 @@ import {
  * internal server, returning the port and a promise for the result.
  */
 function createTestServer(expectedSessionId: string) {
-  const wss = new WebSocketServer({ port: 0 });
+  const wss = new WebSocketServer({ port: 0, path: `/${expectedSessionId}` });
   const logLines: string[] = [];
 
   const resultPromise = new Promise<{ success: boolean; logs: string }>(
@@ -27,12 +27,15 @@ function createTestServer(expectedSessionId: string) {
           const msg = decodePluginMessage(data);
           if (!msg) return;
 
+          if (msg.sessionId !== expectedSessionId) return;
+
           switch (msg.type) {
             case 'hello':
               if (msg.payload.sessionId === expectedSessionId) {
                 ws.send(
                   encodeMessage({
                     type: 'welcome',
+                    sessionId: expectedSessionId,
                     payload: { sessionId: expectedSessionId },
                   })
                 );
@@ -80,7 +83,7 @@ describe('WebSocket protocol smoke test', () => {
       const port = await portPromise;
 
       // Simulate the plugin side with a plain WebSocket client
-      const ws = new WebSocket(`ws://localhost:${port}`);
+      const ws = new WebSocket(`ws://localhost:${port}/${sessionId}`);
 
       await new Promise<void>((resolve, reject) => {
         ws.on('open', resolve);
@@ -88,7 +91,7 @@ describe('WebSocket protocol smoke test', () => {
       });
 
       // 1. Send hello
-      ws.send(JSON.stringify({ type: 'hello', payload: { sessionId } }));
+      ws.send(JSON.stringify({ type: 'hello', sessionId, payload: { sessionId } }));
 
       // 2. Wait for welcome
       const welcome = await new Promise<ServerMessage>((resolve) => {
@@ -103,6 +106,7 @@ describe('WebSocket protocol smoke test', () => {
       });
 
       expect(welcome.type).toBe('welcome');
+      expect(welcome.sessionId).toBe(sessionId);
       expect(
         (welcome as { payload: { sessionId: string } }).payload.sessionId
       ).toBe(sessionId);
@@ -111,6 +115,7 @@ describe('WebSocket protocol smoke test', () => {
       ws.send(
         JSON.stringify({
           type: 'output',
+          sessionId,
           payload: {
             messages: [
               { level: 'Print', body: 'Hello from test' },
@@ -124,6 +129,7 @@ describe('WebSocket protocol smoke test', () => {
       ws.send(
         JSON.stringify({
           type: 'scriptComplete',
+          sessionId,
           payload: { success: true },
         })
       );
@@ -150,14 +156,14 @@ describe('WebSocket protocol smoke test', () => {
 
     try {
       const port = await portPromise;
-      const ws = new WebSocket(`ws://localhost:${port}`);
+      const ws = new WebSocket(`ws://localhost:${port}/${sessionId}`);
 
       await new Promise<void>((resolve, reject) => {
         ws.on('open', resolve);
         ws.on('error', reject);
       });
 
-      ws.send(JSON.stringify({ type: 'hello', payload: { sessionId } }));
+      ws.send(JSON.stringify({ type: 'hello', sessionId, payload: { sessionId } }));
 
       // Wait for welcome before sending more
       await new Promise<void>((resolve) => {
@@ -172,6 +178,7 @@ describe('WebSocket protocol smoke test', () => {
       ws.send(
         JSON.stringify({
           type: 'output',
+          sessionId,
           payload: {
             messages: [{ level: 'Error', body: 'Something went wrong' }],
           },
@@ -181,6 +188,7 @@ describe('WebSocket protocol smoke test', () => {
       ws.send(
         JSON.stringify({
           type: 'scriptComplete',
+          sessionId,
           payload: { success: false, error: 'Script threw an error' },
         })
       );
@@ -197,7 +205,7 @@ describe('WebSocket protocol smoke test', () => {
 
   it('rejects hello with wrong session ID', async () => {
     const sessionId = 'correct-session';
-    const wss = new WebSocketServer({ port: 0 });
+    const wss = new WebSocketServer({ port: 0, path: `/${sessionId}` });
 
     try {
       const port = await new Promise<number>((resolve) => {
@@ -212,14 +220,14 @@ describe('WebSocket protocol smoke test', () => {
         ws.on('message', (raw) => {
           const data = typeof raw === 'string' ? raw : raw.toString('utf-8');
           const msg = decodePluginMessage(data);
-          if (msg?.type === 'hello' && msg.payload.sessionId === sessionId) {
+          if (msg?.type === 'hello' && msg.sessionId === sessionId && msg.payload.sessionId === sessionId) {
             welcomeSent = true;
-            ws.send(encodeMessage({ type: 'welcome', payload: { sessionId } }));
+            ws.send(encodeMessage({ type: 'welcome', sessionId, payload: { sessionId } }));
           }
         });
       });
 
-      const ws = new WebSocket(`ws://localhost:${port}`);
+      const ws = new WebSocket(`ws://localhost:${port}/${sessionId}`);
       await new Promise<void>((resolve, reject) => {
         ws.on('open', resolve);
         ws.on('error', reject);
@@ -229,6 +237,7 @@ describe('WebSocket protocol smoke test', () => {
       ws.send(
         JSON.stringify({
           type: 'hello',
+          sessionId: 'wrong-session',
           payload: { sessionId: 'wrong-session' },
         })
       );