@selvakumaresra/specship 0.1.1 → 0.1.2

package/dist/server/server.js

@@ -16,9 +16,9 @@ import { existsSync, promises as fs } from 'node:fs';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import Fastify from 'fastify';
 import cors from '@fastify/cors';
-import fastifyStatic from '@fastify/static';
 import { startWatcher } from './ingest/index.js';
 import { ProjectRegistry } from './project-registry.js';
+import { makeStaticHandler } from './static-handler.js';
 import { registerGraphRoutes } from './routes/graph.js';
 import { registerSpecRoutes } from './routes/spec.js';
 import { registerWorkflowRoutes } from './routes/workflow.js';
@@ -155,18 +155,17 @@ export async function createServer(options) {
             }
         }
         if (indexBuffer) {
-            await app.register(fastifyStatic, {
-                root: options.webDir,
-                prefix: '/',
-                // index.html is served via the SPA fallback so it always reflects
-                // the latest bytes (even when a future hot-swap drops a new build).
-                index: false,
-                wildcard: false,
-            });
             const cachedIndex = indexBuffer;
+            const serveStatic = makeStaticHandler(options.webDir);
+            // A single 404 handler does both jobs:
+            //   1. Try the requested URL as a real file under webDir → serve it
+            //      with the right content-type. Covers the SPA's chunk-*.js,
+            //      styles.css, favicons, fonts, etc.
+            //   2. Fall through to index.html for any other GET so Angular's
+            //      client-side router can take over (`/memory`, `/graph`, …).
+            // Non-GET methods and `/api/*` paths still 404 cleanly so the UI
+            // can surface them.
             app.setNotFoundHandler((request, reply) => {
-                // Only fall back for browser GETs that aren't API requests. API
-                // 404s should stay 404s so the UI can surface them properly.
                 if (request.method !== 'GET') {
                     reply.code(404).send({ error: 'not found' });
                     return;
@@ -175,6 +174,11 @@ export async function createServer(options) {
                     reply.code(404).send({ error: 'not found' });
                     return;
                 }
+                const hit = serveStatic(request.url);
+                if (hit) {
+                    reply.code(200).type(hit.contentType).send(hit.body);
+                    return;
+                }
                 reply.code(200).type('text/html').send(cachedIndex);
             });
             if (verbose)

package/dist/server/static-handler.js

@@ -0,0 +1,87 @@
+/**
+ * In-house static file serving for the desktop SPA. Replaces the
+ * `@fastify/static` plugin so we don't pull in `glob` (deprecated maintainer-side
+ * across every 10.x and 11.x release, which polluted every user's install
+ * with a deprecation warning).
+ *
+ * Usage from server.ts:
+ *
+ *   const serveStatic = makeStaticHandler(options.webDir);
+ *   app.setNotFoundHandler((req, reply) => {
+ *     if (req.method !== 'GET' || req.url.startsWith('/api/')) {
+ *       reply.code(404).send({ error: 'not found' });
+ *       return;
+ *     }
+ *     const hit = serveStatic(req.url);
+ *     if (hit) { reply.type(hit.contentType).send(hit.body); return; }
+ *     reply.code(200).type('text/html').send(cachedIndex);
+ *   });
+ *
+ * Path traversal is blocked by resolving the requested path inside webDir and
+ * rejecting anything that resolves outside.
+ */
+import { readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+const CT = {
+    '.html': 'text/html; charset=utf-8',
+    '.htm': 'text/html; charset=utf-8',
+    '.js': 'application/javascript; charset=utf-8',
+    '.mjs': 'application/javascript; charset=utf-8',
+    '.css': 'text/css; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.map': 'application/json; charset=utf-8',
+    '.svg': 'image/svg+xml',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.ico': 'image/x-icon',
+    '.webp': 'image/webp',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+    '.otf': 'font/otf',
+    '.txt': 'text/plain; charset=utf-8',
+    '.wasm': 'application/wasm',
+};
+export function makeStaticHandler(rootDir) {
+    const absRoot = path.resolve(rootDir);
+    return function serveStatic(urlPath) {
+        // Strip query/hash — Fastify gives us the raw URL.
+        const qIdx = urlPath.indexOf('?');
+        const hIdx = urlPath.indexOf('#');
+        let clean = urlPath;
+        if (qIdx >= 0)
+            clean = clean.slice(0, qIdx);
+        if (hIdx >= 0)
+            clean = clean.slice(0, hIdx);
+        // Decode percent-encoding (but reject anything that throws).
+        let decoded;
+        try {
+            decoded = decodeURIComponent(clean);
+        }
+        catch {
+            return null;
+        }
+        // Strip leading slash so path.resolve doesn't escape the root.
+        const rel = decoded.replace(/^\/+/, '');
+        // Resolve under root and verify containment to block ../../ traversal.
+        const candidate = path.resolve(absRoot, rel);
+        if (candidate !== absRoot && !candidate.startsWith(absRoot + path.sep)) {
+            return null;
+        }
+        let stat;
+        try {
+            stat = statSync(candidate);
+        }
+        catch {
+            return null;
+        }
+        if (!stat.isFile())
+            return null;
+        const body = readFileSync(candidate);
+        const ext = path.extname(candidate).toLowerCase();
+        const contentType = CT[ext] ?? 'application/octet-stream';
+        return { body, contentType };
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvakumaresra/specship",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Supercharge Claude Code with semantic code intelligence. 94% fewer tool calls • 77% faster exploration • 100% local.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -40,7 +40,6 @@
   "dependencies": {
     "@clack/prompts": "^1.3.0",
     "@fastify/cors": "^9.0.1",
-    "@fastify/static": "^7.0.4",
     "commander": "^14.0.2",
     "fast-string-width": "^3.0.2",
     "fast-wrap-ansi": "^0.2.0",
@@ -53,9 +52,6 @@
     "web-tree-sitter": "^0.25.3",
     "yaml": "^2.9.0"
   },
-  "overrides": {
-    "glob": "^13.0.6"
-  },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.0",
     "@types/node": "^20.19.30",