@svenroth-ai/shipwright 0.28.0 → 0.29.1

package/server/dist/core/adopt-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt-scan.js","sourceRoot":"","sources":["../../src/core/adopt-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7I,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,OAAO,EAAE,eAAe,EAA0B,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAwB,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,mBAAmB,EAAc,MAAM,sBAAsB,CAAC;AACjG,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AA2B9B,uFAAuF;AACvF,MAAM,UAAU,qBAAqB,CAAC,OAA0D,EAAE;IAChG,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC;IACvF,IAAI,QAAQ;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC9F,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACxD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAChF,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;IACnG,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,wBAAwB,EAAE,CAAC;YAC7E,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxC,CAAC,CAAC,CAAC,CAAC,QAAQ;aACP,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;aACjD,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC;aACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC;QAC9B,OAAO,EAAE;YACP,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;YAC7F,UAAU,EAAE,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;YACnG,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;YACzF,QAAQ;SACT;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,6CAA6C,CAAC;IAC/E,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,iDAAiD,CAAC;IACvI,OAAO,IAAI,CAAC;AACd,CAAC;AAED,IAAI,IAAI,GAAG,KAAK,CAAC;AAEjB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAwB,EAAE,OAAsB,EAAE;IACtF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;IACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7I,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;IAChH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,IAAI,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAExE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAoB,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,oBAAoB;QAC5B,MAAM;QACN,aAAa,EAAE,wBAAwB;KACxC,CAAC,CAAC;IACH,mFAAmF;IACnF,6EAA6E;IAC7E,IAAI,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IAC9E,IAAI,GAAG,IAAI,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACT,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,IAAmB,EAAE,WAAiD;IAC5G,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAC9E,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,0EAA0E,CAAC,CAAC;IACxG,IAAI,GAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC5E,mEAAmE;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,oBAAoB,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,KAAK,CACxB,EAAE,CAAC,GAAG,EACN,CAAC,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,EAC/F,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,qBAAqB,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CACpE,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,WAAW,CAAC,oCAAoC,CAAC,CAAC;QACjF,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QACpH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAC3F,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACtG,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,kBAAkB;oBAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;gBACnH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YACjD,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;QACjF,CAAC;QACD,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACpE,CAAC;YAAS,CAAC;QACT,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,0EAA0E;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/server/dist/core/custom-profile-command-policy.d.ts

@@ -0,0 +1,6 @@
+/** Project-source command policy. Returns a refusal reason, or null when allowed. */
+export declare function projectCommandRefusal(command: string): string | null;
+/** User-source: any bare program, or an ABSOLUTE path - never a path relative to the repo. */
+export declare function userCommandRefusal(command: string, projectPath?: string): string | null;
+export declare function contained(root: string, target: string): boolean;
+//# sourceMappingURL=custom-profile-command-policy.d.ts.map

package/server/dist/core/custom-profile-command-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-profile-command-policy.d.ts","sourceRoot":"","sources":["../../src/core/custom-profile-command-policy.ts"],"names":[],"mappings":"AAsBA,qFAAqF;AACrF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAqCpE;AAED,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,MAAM,GAAG,IAAI,CAwBnF;AAeD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAG/D"}

package/server/dist/core/custom-profile-command-policy.js

@@ -0,0 +1,110 @@
+/*
+ * custom-profile-command-policy.ts — command policy for custom Preview profiles.
+ * Split out of custom-profile-loader.ts (300-line cap). A PROJECT-source command
+ * must be a bare allowlisted runner; a USER-source one may be any bare program or
+ * absolute path, never one pointing into the repo. Pure functions, no I/O beyond
+ * realpath of the program being checked.
+ */
+import { realpathSync } from "node:fs";
+import path from "node:path";
+import { PreviewSessionManager } from "./preview-session-manager.js";
+// `npx` is deliberately absent: it downloads and runs a package the repo names.
+const RUNNERS = new Set(["npm", "pnpm", "yarn", "bun", "node", "vite", "next", "python", "python3", "uv", "deno"]);
+const PACKAGE_MANAGERS = new Set(["npm", "pnpm", "yarn", "bun"]);
+const SCRIPT_VERBS = new Set(["run", "run-script", "dev", "start", "serve", "preview"]);
+// Interpreters take code from flags (-e, --eval=, -cprint, -Ic, --import data:...),
+// subcommands (deno eval, -m) and URLs. For these the only accepted shape is
+// "runner + plain file argument(s)": any dash-led argument, `eval`, or URL is refused.
+const INTERPRETERS = new Set(["node", "python", "python3", "deno", "uv"]);
+/** Project-source command policy. Returns a refusal reason, or null when allowed. */
+export function projectCommandRefusal(command) {
+    let argv;
+    try {
+        argv = PreviewSessionManager.tokenizeCommand(command);
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : "unparseable command";
+    }
+    const exe = argv[0] ?? "";
+    if (/[\\/:]/.test(exe))
+        return "a project profile may not run a path or a program inside the repo";
+    const name = exe.toLowerCase().replace(/\.(cmd|exe|bat)$/, "");
+    if (!RUNNERS.has(name))
+        return `“${exe}” is not an allowed runner for a project profile`;
+    const args = argv.slice(1);
+    const argRefusal = runnerArgRefusal(args);
+    if (argRefusal)
+        return argRefusal;
+    if (PACKAGE_MANAGERS.has(name)) {
+        // Run a script the repo's own package.json declares - the same trust as `npm run dev`.
+        // exec / dlx / x / create fetch and run a package; -e / -c run inline code.
+        if (!SCRIPT_VERBS.has((args[0] ?? "").toLowerCase()))
+            return "a project profile may only run a package script (run, dev, start)";
+        const verb = (args[0] ?? "").toLowerCase();
+        const script = verb === "run" || verb === "run-script" ? (args[1] ?? "") : "dev";
+        if (!script || script.startsWith("-") || /^[a-z][a-z0-9+.-]*:/i.test(script) || /[\\/]/.test(script)) {
+            return "a project profile must name a plain package script";
+        }
+    }
+    if (INTERPRETERS.has(name)) {
+        if (args.some((a) => a.startsWith("-") || a.toLowerCase() === "eval" || /^[a-z][a-z0-9+.-]*:/i.test(a))) {
+            return "flags, eval and URLs are not allowed for an interpreter in a project profile";
+        }
+        // a script INSIDE the repo only: no absolute / drive / UNC / parent-relative file argument
+        if (args.some((a) => /^([\\/]|[a-z]:)/i.test(a) || a.split(/[\\/]/).includes(".."))) {
+            return "an interpreter may only run a script inside the project";
+        }
+        if (name === "uv" && (args[0] !== "run" || INTERPRETERS.has((args[1] ?? "").toLowerCase().replace(/\.(cmd|exe|bat)$/, "")))) {
+            return "uv may only run a script file in a project profile";
+        }
+    }
+    return null;
+}
+/** User-source: any bare program, or an ABSOLUTE path - never a path relative to the repo. */
+export function userCommandRefusal(command, projectPath = "") {
+    let argv;
+    try {
+        argv = PreviewSessionManager.tokenizeCommand(command);
+    }
+    catch (err) {
+        return err instanceof Error ? err.message : "unparseable command";
+    }
+    const exe = argv[0] ?? "";
+    if (/[\\/]/.test(exe) && !path.isAbsolute(exe))
+        return "a profile command must be a bare program or an absolute path";
+    // an absolute path that points INTO the repository is the same thing as a repo-relative one
+    if (projectPath && path.isAbsolute(exe)) {
+        let root = projectPath;
+        let target = exe;
+        try {
+            root = realpathSync(projectPath);
+            target = realpathSync(exe);
+        }
+        catch {
+            // a program that does not exist yet cannot be resolved - compare the literal paths
+        }
+        if (contained(root, target) || contained(path.resolve(projectPath), path.resolve(exe))) {
+            return "a profile command may not point into the project";
+        }
+    }
+    return null;
+}
+/** Arguments no runner may take: a path out of the project, a URL, or a config/eval flag. */
+function runnerArgRefusal(args) {
+    for (const a of args) {
+        if (/^([\\/]|[a-z]:)/i.test(a) || a.split(/[\\/]/).includes(".."))
+            return "a project profile argument may not be an absolute path or leave the project";
+        if (/^[a-z][a-z0-9+.-]*:/i.test(a) && !/^[a-z]:[\\/]/i.test(a))
+            return "a project profile argument may not be a URL";
+        const flag = a.toLowerCase().split("=")[0];
+        if (["-c", "--config", "-e", "--eval", "--print", "--require", "-r", "--import", "--loader", "--input-type"].includes(flag ?? "")) {
+            return "config, eval and preload flags are not allowed in a project profile";
+        }
+    }
+    return null;
+}
+export function contained(root, target) {
+    const rel = path.relative(root, target);
+    return rel !== "" && rel !== ".." && !rel.startsWith(".." + path.sep) && !path.isAbsolute(rel);
+}
+//# sourceMappingURL=custom-profile-command-policy.js.map

package/server/dist/core/custom-profile-command-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-profile-command-policy.js","sourceRoot":"","sources":["../../src/core/custom-profile-command-policy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,gFAAgF;AAChF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;AACnH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AACxF,oFAAoF;AACpF,6EAA6E;AAC7E,uFAAuF;AACvF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAE1E,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,mEAAmE,CAAC;IACnG,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,GAAG,kDAAkD,CAAC;IACzF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,uFAAuF;QACvF,4EAA4E;QAC5E,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,mEAAmE,CAAC;QACjI,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QACjF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACrG,OAAO,oDAAoD,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxG,OAAO,8EAA8E,CAAC;QACxF,CAAC;QACD,2FAA2F;QAC3F,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACpF,OAAO,yDAAyD,CAAC;QACnE,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5H,OAAO,oDAAoD,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,WAAW,GAAG,EAAE;IAClE,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,8DAA8D,CAAC;IACtH,4FAA4F;IAC5F,IAAI,WAAW,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,IAAI,GAAG,WAAW,CAAC;QACvB,IAAI,MAAM,GAAG,GAAG,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;YACjC,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;QACrF,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACvF,OAAO,kDAAkD,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6FAA6F;AAC7F,SAAS,gBAAgB,CAAC,IAAc;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,6EAA6E,CAAC;QACxJ,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,6CAA6C,CAAC;QACrH,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAClI,OAAO,qEAAqE,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,MAAc;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACjG,CAAC"}

package/server/dist/core/custom-profile-loader.d.ts

@@ -0,0 +1,34 @@
+import { projectCommandRefusal, userCommandRefusal } from "./custom-profile-command-policy.js";
+import type { PreviewProfile } from "./preview-session-manager.js";
+import { validateStackProfile, type StackProfileDeps } from "./stack-profiles.js";
+export { projectCommandRefusal, userCommandRefusal };
+export type ResolvedPreviewProfile = PreviewProfile & {
+    stack?: {
+        frontend?: unknown;
+    };
+};
+export interface PreviewProfileLookup {
+    profile: ResolvedPreviewProfile | null;
+    /** Why there is no profile (diagnostics only; never shown as a verdict). */
+    reason?: string;
+}
+export interface PreviewProfileResolverDeps {
+    /** Bundled-snapshot loader (the existing sync one). */
+    bundled: (name: string) => ResolvedPreviewProfile | null;
+    validate?: typeof validateStackProfile;
+    stack?: StackProfileDeps;
+    homeDir?: string;
+    now?: () => number;
+    /** Max concurrent resolver processes. */
+    maxConcurrent?: number;
+}
+export declare const POSITIVE_TTL_MS = 15000;
+export declare const NEGATIVE_TTL_MS = 30000;
+export declare function createPreviewProfileResolver(deps: PreviewProfileResolverDeps): {
+    /** `fresh` bypasses the cache (spawn re-resolves right before it runs). Never throws. */
+    resolve(name: string, projectPath: string, opts?: {
+        fresh?: boolean;
+    }): Promise<PreviewProfileLookup>;
+    clear(): void;
+};
+//# sourceMappingURL=custom-profile-loader.d.ts.map

package/server/dist/core/custom-profile-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-profile-loader.d.ts","sourceRoot":"","sources":["../../src/core/custom-profile-loader.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAa,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAC1G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAsB,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGtG,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,CAAC;AAErD,MAAM,MAAM,sBAAsB,GAAG,cAAc,GAAG;IAAE,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAEzF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IACvC,4EAA4E;IAC5E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,uDAAuD;IACvD,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,sBAAsB,GAAG,IAAI,CAAC;IACzD,QAAQ,CAAC,EAAE,OAAO,oBAAoB,CAAC;IACvC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,eAAO,MAAM,eAAe,QAAS,CAAC;AAwBtC,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,0BAA0B;IAsGzE,yFAAyF;kBACrE,MAAM,eAAe,MAAM,SAAQ;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAQ,OAAO,CAAC,oBAAoB,CAAC;aAkCtG,IAAI;EAIhB"}

package/server/dist/core/custom-profile-loader.js

@@ -0,0 +1,225 @@
+/*
+ * custom-profile-loader.ts — turns a stack-profile NAME into a runnable
+ * Preview profile, including the user's OWN profiles (project / user source)
+ * that the bundled-snapshot loader (`profile-loader.ts`) cannot see.
+ *
+ * The shipwright resolver is the authority on WHICH file a name means and
+ * whether it is valid (`validateStackProfile`, same bridge as Settings) — the
+ * lookup order is never re-implemented here. A custom profile file is
+ * UNTRUSTED input (a cloned repo can ship `.shipwright/profiles/x.json`), so:
+ *   - it must lie inside `<project>/.shipwright/profiles` or
+ *     `~/.shipwright/profiles` after realpath (path.relative, not startsWith);
+ *   - it is read ONCE and only an allowlist of fields is copied (no env / cwd);
+ *   - a PROJECT-source command must be a bare runner name from an allowlist
+ *     (no path, no inline-eval flag) — a repo-relative binary never runs;
+ *   - spawn stays `shell:false` through `preview-session-manager` only.
+ * Bundled profiles keep their sync loader; when the resolver is unavailable
+ * they fall back to it, so Preview for bundled stacks never regresses.
+ */
+import { closeSync, existsSync, fstatSync, lstatSync, openSync, readFileSync, realpathSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { contained, projectCommandRefusal, userCommandRefusal } from "./custom-profile-command-policy.js";
+import { isProfileNameShape, validateStackProfile } from "./stack-profiles.js";
+import { userProfilesDir } from "./stack-profiles-create.js";
+export { projectCommandRefusal, userCommandRefusal };
+export const POSITIVE_TTL_MS = 15_000;
+export const NEGATIVE_TTL_MS = 30_000;
+const MAX_WAITING = 8;
+const BUSY = "profile resolver busy";
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Copy ONLY the fields Preview uses; refuse anything malformed. */
+function allowlisted(raw) {
+    if (!isObject(raw))
+        return null;
+    const dev = raw.dev_server;
+    if (!isObject(dev) || typeof dev.command !== "string" || !dev.command.trim())
+        return null;
+    const port = dev.port;
+    if (typeof port !== "number" || !Number.isInteger(port) || port < 1024 || port > 65535)
+        return null;
+    const out = { command: dev.command, port };
+    if (typeof dev.ready_path === "string" && dev.ready_path.startsWith("/"))
+        out.ready_path = dev.ready_path;
+    if (dev.host === "127.0.0.1" || dev.host === "localhost")
+        out.host = dev.host;
+    const t = dev.ready_timeout_seconds;
+    if (typeof t === "number" && Number.isInteger(t) && t >= 1 && t <= 600)
+        out.ready_timeout_seconds = t;
+    const frontend = isObject(raw.stack) ? raw.stack.frontend : undefined;
+    return { dev_server: out, stack: { frontend: frontend ?? undefined } };
+}
+export function createPreviewProfileResolver(deps) {
+    const validate = deps.validate ?? validateStackProfile;
+    const now = deps.now ?? (() => Date.now());
+    const home = deps.homeDir ?? os.homedir();
+    const cache = new Map();
+    const inFlight = new Map();
+    const max = deps.maxConcurrent ?? 2;
+    let running = 0;
+    const waiters = [];
+    async function slot(fn) {
+        // Hand the slot straight to the next waiter (no decrement), so a newcomer can never
+        // slip in between the release and the wake-up and exceed the cap.
+        // A stuck resolver must not queue the hot actions endpoint without bound: past a
+        // short queue the lookup degrades (no Preview for now) instead of waiting.
+        if (running >= max && waiters.length >= MAX_WAITING)
+            throw new Error(BUSY);
+        if (running >= max)
+            await new Promise((r) => waiters.push(r));
+        else
+            running++;
+        try {
+            return await fn();
+        }
+        finally {
+            const next = waiters.shift();
+            if (next)
+                next();
+            else
+                running--;
+        }
+    }
+    function readCustom(source, file, projectPath) {
+        const base = source === "project" ? path.join(projectPath, ".shipwright", "profiles") : userProfilesDir({ homeDir: home });
+        let realBase;
+        let real;
+        try {
+            // the folder itself must not be a symlink out of the project / home
+            if (lstatSync(base).isSymbolicLink())
+                return { profile: null, reason: "profiles folder is a symlink" };
+            realBase = realpathSync(base);
+            // an ancestor symlink (e.g. `.shipwright` -> elsewhere) must not relocate the folder
+            const anchor = source === "project" ? projectPath : home;
+            if (!contained(realpathSync(anchor), realBase)) {
+                return { profile: null, reason: "profiles folder resolves outside its allowed location" };
+            }
+            real = realpathSync(file);
+        }
+        catch {
+            return { profile: null, reason: "profile file unreadable" };
+        }
+        if (!contained(realBase, real))
+            return { profile: null, reason: "profile file is outside the profiles folder" };
+        let raw;
+        try {
+            // one descriptor for the type check AND the read - no check-then-act window
+            const fd = openSync(real, "r");
+            try {
+                if (!fstatSync(fd).isFile())
+                    return { profile: null, reason: "profile is not a regular file" };
+                raw = JSON.parse(readFileSync(fd, "utf-8"));
+            }
+            finally {
+                closeSync(fd);
+            }
+        }
+        catch {
+            return { profile: null, reason: "profile file is not readable JSON" };
+        }
+        const profile = allowlisted(raw);
+        if (!profile)
+            return { profile: null, reason: "profile has no usable dev_server" };
+        const command = profile.dev_server?.command ?? "";
+        const refusal = source === "project" ? projectCommandRefusal(command) : userCommandRefusal(command, projectPath);
+        if (refusal)
+            return { profile: null, reason: refusal };
+        return { profile };
+    }
+    async function lookup(name, projectPath) {
+        const bundled = () => ({ profile: deps.bundled(name) });
+        if (!isProfileNameShape(name))
+            return { value: bundled(), ttl: POSITIVE_TTL_MS };
+        // (The resolver keys a profile on its FILE NAME - a file whose "name" differs is
+        // invalid - so probing `<name>.json` is exactly its lookup, not a second opinion.)
+        // Fast path: with no `<name>.json` in either custom folder nothing can shadow the
+        // bundled profile, so a resolver process (uv start-up, on a hot endpoint) is
+        // pointless - skip it. This only decides WHETHER to ask the resolver; which file a
+        // name means is still always the resolver's answer.
+        const candidates = [path.join(userProfilesDir({ homeDir: home }), `${name}.json`)];
+        if (projectPath)
+            candidates.push(path.join(projectPath, ".shipwright", "profiles", `${name}.json`));
+        if (!candidates.some((c) => existsSync(c)))
+            return { value: bundled(), ttl: POSITIVE_TTL_MS };
+        const out = await slot(() => validate({ name, projectRoot: projectPath || undefined }, deps.stack));
+        // Resolver unavailable / newer contract / crash => behave exactly as before.
+        if (out.status !== "ok")
+            return { value: bundled(), ttl: NEGATIVE_TTL_MS };
+        const report = out.report;
+        if (!report.valid)
+            return { value: { profile: null, reason: "the resolver reports this profile as invalid" }, ttl: NEGATIVE_TTL_MS };
+        if (!("source" in report) || typeof report.path !== "string")
+            return { value: { profile: null, reason: "unexpected resolver answer" }, ttl: NEGATIVE_TTL_MS };
+        if (report.source === "bundled")
+            return { value: bundled(), ttl: POSITIVE_TTL_MS };
+        if (report.source !== "project" && report.source !== "user")
+            return { value: { profile: null, reason: `unsupported profile source “${report.source}”` }, ttl: NEGATIVE_TTL_MS };
+        if (report.source === "project" && !projectPath)
+            return { value: { profile: null, reason: "no project path" }, ttl: NEGATIVE_TTL_MS };
+        const value = readCustom(report.source, report.path, projectPath);
+        return { value, file: report.path, ttl: value.profile ? POSITIVE_TTL_MS : NEGATIVE_TTL_MS };
+    }
+    function stillFresh(entry) {
+        if (now() - entry.at > entry.ttl)
+            return false;
+        if (!entry.file)
+            return true;
+        try {
+            return lstatSync(entry.file).mtimeMs === entry.mtimeMs;
+        }
+        catch {
+            return false; // deleted => re-resolve
+        }
+    }
+    return {
+        /** `fresh` bypasses the cache (spawn re-resolves right before it runs). Never throws. */
+        async resolve(name, projectPath, opts = {}) {
+            const key = `${projectPath}\0${name}`;
+            const hit = cache.get(key);
+            if (!opts.fresh && hit && stillFresh(hit))
+                return hit.value;
+            const started = now();
+            const pending = inFlight.get(key);
+            if (!opts.fresh && pending)
+                return pending;
+            let p;
+            p = (async () => {
+                try {
+                    const r = await lookup(name, projectPath);
+                    let mtimeMs;
+                    if (r.file) {
+                        try {
+                            mtimeMs = lstatSync(r.file).mtimeMs;
+                        }
+                        catch {
+                            mtimeMs = undefined;
+                        }
+                    }
+                    const newer = cache.get(key);
+                    if (!newer || newer.at <= started)
+                        cache.set(key, { at: now(), ttl: r.ttl, file: r.file, mtimeMs, value: r.value });
+                    return r.value;
+                }
+                catch (err) {
+                    const value = { profile: null, reason: err instanceof Error ? err.message.slice(0, 200) : "lookup failed" };
+                    // an overloaded resolver is transient - do not hide Preview for a whole TTL
+                    if (!(err instanceof Error && err.message === BUSY))
+                        cache.set(key, { at: now(), ttl: NEGATIVE_TTL_MS, value });
+                    return value;
+                }
+                finally {
+                    if (inFlight.get(key) === p)
+                        inFlight.delete(key);
+                }
+            })();
+            inFlight.set(key, p);
+            return p;
+        },
+        clear() {
+            cache.clear();
+        },
+    };
+}
+//# sourceMappingURL=custom-profile-loader.js.map

package/server/dist/core/custom-profile-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-profile-loader.js","sourceRoot":"","sources":["../../src/core/custom-profile-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5G,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE1G,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAyB,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,CAAC;AAqBrD,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,IAAI,GAAG,uBAAuB,CAAC;AAErC,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;IAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IACpG,MAAM,GAAG,GAAsD,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9F,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,UAAU,CAAC;IAC1G,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;QAAE,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IAC9E,MAAM,CAAC,GAAG,GAAG,CAAC,qBAAqB,CAAC;IACpC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG;QAAE,GAAG,CAAC,qBAAqB,GAAG,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACtE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,QAAQ,IAAI,SAAS,EAAE,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,IAAgC;IAC3E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,oBAAoB,CAAC;IACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqG,CAAC;IAC3H,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyC,CAAC;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,UAAU,IAAI,CAAI,EAAoB;QACzC,oFAAoF;QACpF,kEAAkE;QAClE,iFAAiF;QACjF,2EAA2E;QAC3E,IAAI,OAAO,IAAI,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,OAAO,IAAI,GAAG;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC/D,OAAO,EAAE,CAAC;QACf,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,IAAI;gBAAE,IAAI,EAAE,CAAC;;gBACZ,OAAO,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,MAA0B,EAAE,IAAY,EAAE,WAAmB;QAC/E,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3H,IAAI,QAAgB,CAAC;QACrB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,oEAAoE;YACpE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;YACvG,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC9B,qFAAqF;YACrF,MAAM,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;YACzD,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;YAC5F,CAAC;YACD,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;QAChH,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,4EAA4E;YAC5E,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/B,IAAI,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;gBAC/F,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9C,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;QACnF,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACjH,IAAI,OAAO;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACvD,OAAO,EAAE,OAAO,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,IAAY,EAAE,WAAmB;QACrD,MAAM,OAAO,GAAG,GAAyB,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QACjF,iFAAiF;QACjF,mFAAmF;QACnF,kFAAkF;QAClF,6EAA6E;QAC7E,mFAAmF;QACnF,oDAAoD;QACpD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;QACnF,IAAI,WAAW;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC;QACpG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAC9F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,IAAI,SAAS,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACpG,6EAA6E;QAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,8CAA8C,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QACrI,IAAI,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAC9J,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QACnF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAChL,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QACtI,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAClE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IAC9F,CAAC;IAED,SAAS,UAAU,CAAC,KAAmE;QACrF,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,CAAC,wBAAwB;QACxC,CAAC;IACH,CAAC;IAED,OAAO;QACL,yFAAyF;QACzF,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,WAAmB,EAAE,OAA4B,EAAE;YAC7E,MAAM,GAAG,GAAG,GAAG,WAAW,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC,KAAK,CAAC;YAC5D,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;YAC3C,IAAI,CAAiC,CAAC;YACtC,CAAC,GAAG,CAAC,KAAK,IAAmC,EAAE;gBAC7C,IAAI,CAAC;oBACH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;oBAC1C,IAAI,OAA2B,CAAC;oBAChC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;wBACX,IAAI,CAAC;4BACH,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;wBACtC,CAAC;wBAAC,MAAM,CAAC;4BACP,OAAO,GAAG,SAAS,CAAC;wBACtB,CAAC;oBACH,CAAC;oBACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,IAAI,OAAO;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;oBACpH,OAAO,CAAC,CAAC,KAAK,CAAC;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;oBAC5G,4EAA4E;oBAC5E,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC;wBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;oBAChH,OAAO,KAAK,CAAC;gBACf,CAAC;wBAAS,CAAC;oBACT,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;wBAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/server/dist/core/preview-child-lifecycle.d.ts

@@ -59,15 +59,20 @@ export declare function buildReadyUrl(port: number, readyPath: string): URL | nu
  * tree-kills the healthy dev server and misreports preview_timeout.
  */
 export declare function isValidPort(port: unknown): port is number;
+export declare function resolvePreviewHost(host: unknown): string;
 /**
  * Build the RETURNED preview URL (the one handed to window.open in the
  * browser). Mirrors buildReadyUrl's host-pinning (F10): a malicious profile
  * ready_path like "@evil.com/" — or an absolute "http://evil.com/" — must not
  * smuggle a new authority into the string. We resolve the path through the URL
- * constructor against a localhost origin and reject any host drift, preserving
+ * constructor against a pinned origin and reject any host drift, preserving
  * the historical host-only shape for a root path.
+ *
+ * The origin host is the profile's `dev_server.host` when it is one of
+ * PREVIEW_HOSTS (a companion that checks the Host header accepts only the host
+ * it bound, e.g. 127.0.0.1), otherwise `localhost`.
  */
-export declare function buildPreviewUrl(port: number, readyPath: string): string;
+export declare function buildPreviewUrl(port: number, readyPath: string, host?: string): string;
 export declare function defaultProbeReady(args: {
     port: number;
     readyPath: string;

package/server/dist/core/preview-child-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview-child-lifecycle.d.ts","sourceRoot":"","sources":["../../src/core/preview-child-lifecycle.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAKxD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,IAAI,IAAI,MAAM,CAAC;CAChB;AAED,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,cAAc,EACrB,QAAQ,SAAqB,GAC5B,YAAY,CAiBd;AAED,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC;IACtE,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAED,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACjD;AAUD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,aAAa,EACpB,MAAM,GAAE,MAAM,CAAC,OAAmB,EAClC,IAAI,GAAE,YAAiB,GACtB,IAAI,CAqCN;AAED,UAAU,aAAa;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC;CACtE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,EACpB,SAAS,SAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAgBf;AAID,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcrE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAczE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAOzD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAcvE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnB"}
+{"version":3,"file":"preview-child-lifecycle.d.ts","sourceRoot":"","sources":["../../src/core/preview-child-lifecycle.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAKxD,MAAM,WAAW,YAAY;IAC3B,uEAAuE;IACvE,IAAI,IAAI,MAAM,CAAC;CAChB;AAED,UAAU,cAAc;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,cAAc,EACrB,QAAQ,SAAqB,GAC5B,YAAY,CAiBd;AAED,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,KAAK,IAAI,CAAC;IACtE,qDAAqD;IACrD,SAAS,CAAC,EAAE,OAAO,SAAS,CAAC;CAC9B;AAED,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACjD;AAUD;;;;;;GAMG;AACH,wBAAgB,QAAQ,CACtB,KAAK,EAAE,aAAa,EACpB,MAAM,GAAE,MAAM,CAAC,OAAmB,EAClC,IAAI,GAAE,YAAiB,GACtB,IAAI,CAqCN;AAED,UAAU,aAAa;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC;CACtE;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,aAAa,EACpB,SAAS,SAAO,GACf,OAAO,CAAC,IAAI,CAAC,CAgBf;AAID,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcrE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,GAAG,GAAG,IAAI,CAczE;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,MAAM,CAOzD;AAKD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAIxD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,IAAI,CAAC,EAAE,MAAM,GACZ,MAAM,CAeR;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,WAAW,CAAC;CACrB,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnB"}

package/server/dist/core/preview-child-lifecycle.js

@@ -180,23 +180,35 @@ export function isValidPort(port) {
         port > 0 &&
         port <= 65535);
 }
+/** Hosts a profile's dev_server.host may name. Anything else falls back to localhost. */
+const PREVIEW_HOSTS = ["localhost", "127.0.0.1"];
+export function resolvePreviewHost(host) {
+    return typeof host === "string" && PREVIEW_HOSTS.includes(host)
+        ? host
+        : "localhost";
+}
 /**
  * Build the RETURNED preview URL (the one handed to window.open in the
  * browser). Mirrors buildReadyUrl's host-pinning (F10): a malicious profile
  * ready_path like "@evil.com/" — or an absolute "http://evil.com/" — must not
  * smuggle a new authority into the string. We resolve the path through the URL
- * constructor against a localhost origin and reject any host drift, preserving
+ * constructor against a pinned origin and reject any host drift, preserving
  * the historical host-only shape for a root path.
+ *
+ * The origin host is the profile's `dev_server.host` when it is one of
+ * PREVIEW_HOSTS (a companion that checks the Host header accepts only the host
+ * it bound, e.g. 127.0.0.1), otherwise `localhost`.
  */
-export function buildPreviewUrl(port, readyPath) {
-    const origin = `http://localhost:${port}`;
+export function buildPreviewUrl(port, readyPath, host) {
+    const pinned = resolvePreviewHost(host);
+    const origin = `http://${pinned}:${port}`;
     try {
         const clean = readyPath.replace(/^[/@]+/, "/").trim() || "/";
         const url = new URL(clean, `${origin}/`);
         // Reject any host OR scheme drift: an absolute "http://evil.com/", a
         // "//"/"\\" authority smuggle, or a "javascript:"/"data:" scheme all
-        // resolve away from the pinned http://localhost origin.
-        if (url.protocol !== "http:" || url.hostname !== "localhost")
+        // resolve away from the pinned origin.
+        if (url.protocol !== "http:" || url.hostname !== pinned)
             return origin;
         if (url.pathname === "/" && !url.search && !url.hash)
             return origin;

package/server/dist/core/preview-child-lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"preview-child-lifecycle.js","sourceRoot":"","sources":["../../src/core/preview-child-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAYrC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,KAAqB,EACrB,QAAQ,GAAG,kBAAkB;IAE7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAQ,EAAE;QAC9C,GAAG,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACnE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACnE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AAC7B,CAAC;AAgBD,SAAS,QAAQ,CAAC,KAAoB,EAAE,MAAsB;IAC5D,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAoB,EACpB,SAAyB,SAAS,EAClC,OAAqB,EAAE;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9E,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;oBACpE,KAAK,EAAE,QAAQ;oBACf,WAAW,EAAE,IAAI;oBACjB,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;gBACH,kEAAkE;gBAClE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAChD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;YAC1C,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1B,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,KAAoB,EACpB,SAAS,GAAG,IAAI;IAEhB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACtD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,OAAQ,KAAgC,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACjE,KAA+B,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,mEAAmE;IACnE,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,SAAiB;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC;QAClD,kEAAkE;QAClE,oEAAoE;QACpE,4CAA4C;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC;QACR,IAAI,IAAI,KAAK,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,SAAiB;IAC7D,MAAM,MAAM,GAAG,oBAAoB,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC;QACzC,qEAAqE;QACrE,qEAAqE;QACrE,wDAAwD;QACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;YAAE,OAAO,MAAM,CAAC;QAC5E,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC;QACpE,OAAO,GAAG,MAAM,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAIvC;IACC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"preview-child-lifecycle.js","sourceRoot":"","sources":["../../src/core/preview-child-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAYrC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,KAAqB,EACrB,QAAQ,GAAG,kBAAkB;IAE7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAQ,EAAE;QAC9C,GAAG,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,GAAG,CAAC,MAAM,GAAG,QAAQ;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,6EAA6E;IAC7E,sEAAsE;IACtE,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACnE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QACnE,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AAC7B,CAAC;AAgBD,SAAS,QAAQ,CAAC,KAAoB,EAAE,MAAsB;IAC5D,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACtB,KAAoB,EACpB,SAAyB,SAAS,EAClC,OAAqB,EAAE;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9E,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;oBACpE,KAAK,EAAE,QAAQ;oBACf,WAAW,EAAE,IAAI;oBACjB,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;gBACH,kEAAkE;gBAClE,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBAChD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;gBACtD,CAAC;gBACD,OAAO;YACT,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;YAC1C,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IAED,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,WAAW,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC1B,CAAC;AAOD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,KAAoB,EACpB,SAAS,GAAG,IAAI;IAEhB,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IACtD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACnC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,GAAS,EAAE;YACxB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC5C,IAAI,OAAQ,KAAgC,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACjE,KAA+B,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY;IACjD,mEAAmE;IACnE,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,SAAiB;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,oBAAoB,IAAI,GAAG,CAAC,CAAC;QAClD,kEAAkE;QAClE,oEAAoE;QACpE,4CAA4C;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;QACxB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC;QACR,IAAI,IAAI,KAAK,CACd,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,CAAU,CAAC;AAE1D,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpF,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,SAAiB,EACjB,IAAa;IAEb,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,UAAU,MAAM,IAAI,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC;QACzC,qEAAqE;QACrE,qEAAqE;QACrE,uCAAuC;QACvC,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QACvE,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC;QACpE,OAAO,GAAG,MAAM,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAIvC;IACC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,uEAAuE;QACvE,+DAA+D;QAC/D,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/server/dist/core/preview-session-manager.d.ts

@@ -6,6 +6,7 @@ export interface PreviewProfile {
         port?: number;
         ready_path?: string;
         ready_timeout_seconds?: number;
+        host?: string;
     };
 }
 export interface PreviewSpawnOptions {

package/server/dist/core/preview-session-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"preview-session-manager.d.ts","sourceRoot":"","sources":["../../src/core/preview-session-manager.ts"],"names":[],"mappings":"AAwBA,OAAO,EACL,KAAK,IAAI,SAAS,EAClB,KAAK,8BAA8B,EACpC,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,KAAK,CAAC,EAAE,OAAO,SAAS,CAAC;IACzB,wEAAwE;IACxE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qEAAqE;IACrE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,WAAW,CAAC;KACrB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,KAAK,EAAE,8BAA8B,CAAC;CACvC;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAK3B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAK3B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM;CAKzB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,SAAK;CAM3C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,SAAK;CAMvC;AAsBD,qEAAqE;AACrE,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACxD,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,qBAAqB;IAQpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAPtC,OAAO,CAAC,OAAO,CAAmC;IAClD,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAGZ;gBAEyB,SAAS,GAAE,oBAAyB;IAEjE;;;;OAIG;IACH,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE;IAqC7D,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAY1C,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,CAAC;YAsBV,OAAO;IAoIrB,OAAO,IAAI,IAAI;IAQf,2EAA2E;IAC3E,IAAI,IAAI,MAAM;CAGf"}
+{"version":3,"file":"preview-session-manager.d.ts","sourceRoot":"","sources":["../../src/core/preview-session-manager.ts"],"names":[],"mappings":"AAwBA,OAAO,EACL,KAAK,IAAI,SAAS,EAClB,KAAK,8BAA8B,EACpC,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EAQL,KAAK,YAAY,EAClB,MAAM,8BAA8B,CAAC;AAEtC,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE;QACX,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;KAC/C,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,KAAK,CAAC,EAAE,OAAO,SAAS,CAAC;IACzB,wEAAwE;IACxE,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,qEAAqE;IACrE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,WAAW,CAAC;KACrB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,qCAAqC;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,KAAK,EAAE,8BAA8B,CAAC;CACvC;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAK3B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,MAAM,EAAE,MAAM;CAK3B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM;CAKzB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,SAAK;CAM3C;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,SAAK;CAMvC;AAsBD,qEAAqE;AACrE,MAAM,WAAW,oBAAqB,SAAQ,YAAY;IACxD,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,qBAAqB;IAQpB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAPtC,OAAO,CAAC,OAAO,CAAmC;IAClD,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAGZ;gBAEyB,SAAS,GAAE,oBAAyB;IAEjE;;;;OAIG;IACH,MAAM,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE;IAqC7D,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAY1C,KAAK,CACT,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,CAAC;YAsBV,OAAO;IAoIrB,OAAO,IAAI,IAAI;IAQf,2EAA2E;IAC3E,IAAI,IAAI,MAAM;CAGf"}

package/server/dist/core/preview-session-manager.js

@@ -77,7 +77,7 @@ function hashProfile(p) {
         cmd: p.dev_server?.command ?? "",
         port: p.dev_server?.port ?? 0,
         ready: p.dev_server?.ready_path ?? "/",
-        timeout: p.dev_server?.ready_timeout_seconds ?? 60,
+        timeout: p.dev_server?.ready_timeout_seconds ?? 60, host: p.dev_server?.host ?? "",
     });
     return createHash("sha1").update(payload).digest("hex").slice(0, 12);
 }
@@ -273,7 +273,7 @@ export class PreviewSessionManager {
         const entry = {
             projectId,
             pid: child.pid ?? -1,
-            url: buildPreviewUrl(port, readyPath),
+            url: buildPreviewUrl(port, readyPath, profile.dev_server?.host),
             sessionId: randomUUID(),
             startedAt: now(),
             profileHash,