@swissjs/swite 0.3.4 → 0.4.1

package/src/dev-engine/pythonDevManager.ts

@@ -5,7 +5,7 @@ import { initPythonProxy } from "../adapters/proxy/proxyToPython.js";
 import type { PythonServiceConfig } from "../config/config.js";
 
 const POLL_INTERVAL_MS = 500;
-const HEALTH_TIMEOUT_MS = 15_000;
+const HEALTH_TIMEOUT_MS = 30_000;
 const BACKOFF_THRESHOLD = 5;
 
 let _child: ChildProcess | null = null;

package/src/dev-engine/router/file-router.ts

@@ -11,7 +11,6 @@ import type { RouteDefinition } from "@swissjs/core";
 import { RouteScanner } from "@swissjs/plugin-file-router/core";
 import { createFileWatcher } from "@swissjs/plugin-file-router/dev";
 import { HMREngine } from "../hmr/hmr.js";
-import { findWorkspaceRoot } from "../../kernel/workspace.js";
 
 export interface FileRouterConfig {
   root: string;
@@ -38,7 +37,6 @@ export async function setupFileRouter(
   };
 
   try {
-    const workspaceRoot = await findWorkspaceRoot(config.root);
     const appRoot = config.root;
 
     // Initialize route scanner
@@ -49,59 +47,18 @@ export async function setupFileRouter(
       lazyLoading: true,
     });
 
-          // Scan routes from multiple locations:
-          // 1. App's pages directory (apps/alpine/src/pages)
-          // 2. SKLTN's pages directory (framework/skltn/src/pages) - for reusable auth pages
     const routesToScan: string[] = [];
 
-    // App pages
+    // App pages directory
     const appPagesDir = path.join(appRoot, "src", "pages");
     try {
       await fs.access(appPagesDir);
       routesToScan.push(appPagesDir);
-      console.log(chalk.gray(`  📄 Scanning app routes from ${appPagesDir}`));
+      console.log(chalk.gray(`  Scanning app routes from ${appPagesDir}`));
     } catch {
       // pages directory doesn't exist, skip
     }
 
-    // SKLTN pages (if workspace root exists)
-    if (workspaceRoot && workspaceRoot !== appRoot) {
-      // Try framework/skltn first (new location), then fallback to lib/skltn (legacy)
-      const skltnPagesDir = path.join(
-        workspaceRoot,
-        "framework",
-        "skltn",
-        "src",
-        "pages",
-      );
-      const legacySkltnPagesDir = path.join(
-        workspaceRoot,
-        "lib",
-        "skltn",
-        "src",
-        "pages",
-      );
-      
-      try {
-        await fs.access(skltnPagesDir);
-        routesToScan.push(skltnPagesDir);
-        console.log(
-          chalk.gray(`  📄 Scanning SKLTN routes from ${skltnPagesDir}`),
-        );
-      } catch {
-        // Try legacy location
-        try {
-          await fs.access(legacySkltnPagesDir);
-          routesToScan.push(legacySkltnPagesDir);
-          console.log(
-            chalk.gray(`  📄 Scanning SKLTN routes from ${legacySkltnPagesDir} (legacy)`),
-          );
-        } catch {
-          // pages directory doesn't exist, skip
-        }
-      }
-    }
-
     // Scan all route directories
     for (const pagesDir of routesToScan) {
       try {

package/src/dev-engine/server.ts

@@ -53,7 +53,32 @@ export class SwiteServer {
     };
 
     this.resolver = new ModuleResolver(this.config.root);
-    this.hmr = new HMREngine(this.config.root, this.config.hmrPort);
+    // Security (R-002): build the HMR allowed-origin list from the dev server
+    // host+port so the WebSocket server can reject cross-origin connections.
+    // When host is "localhost" we also add the numeric loopback form and vice
+    // versa — browsers send whichever name the user typed in the address bar.
+    const devOrigins = this.buildHmrAllowedOrigins();
+    this.hmr = new HMREngine(this.config.root, this.config.hmrPort, devOrigins);
+  }
+
+  /**
+   * Build the list of origins that are allowed to open an HMR WebSocket.
+   * Always includes both the configured host and its loopback alias so the
+   * browser can connect regardless of whether the dev typed "localhost" or
+   * "127.0.0.1" in the address bar.
+   */
+  private buildHmrAllowedOrigins(): string[] {
+    const { host, port } = this.config;
+    const origins: string[] = [];
+    const add = (h: string) => origins.push(`http://${h}:${port}`);
+
+    add(host);
+
+    // When the dev host is either loopback alias, also allow the other form.
+    if (host === "localhost") add("127.0.0.1");
+    else if (host === "127.0.0.1") add("localhost");
+
+    return origins;
   }
 
   // CG-03: find workspace root by walking up from startDir
@@ -137,8 +162,13 @@ export class SwiteServer {
     console.timeEnd("HMR Start");
 
     // Start HTTP server
-    // Use 0.0.0.0 to bind to all interfaces (IPv4 and IPv6)
-    const bindHost = this.config.host === "localhost" ? "0.0.0.0" : this.config.host;
+    // Security (R-001): honour the requested host literally.
+    // The default host is "localhost" which Node binds to the loopback
+    // interface only (127.0.0.1 / ::1).  Binding all interfaces (0.0.0.0)
+    // must be an explicit opt-in: the developer must set host to "0.0.0.0"
+    // in their swite.config.ts or pass --host 0.0.0.0 on the CLI.
+    // We never silently rewrite a requested loopback address to 0.0.0.0.
+    const bindHost = this.config.host;
     console.time("HTTP Listen");
     await new Promise<void>((resolve) => {
       this.app.listen(this.config.port, bindHost, () => {

package/src/kernel/package-finder.ts

@@ -20,7 +20,7 @@ export interface PackageLocation {
 /**
  * Find any sibling monorepo by searching for its package.json
  */
-export async function findSiblingRepository(startPath: string, repoName: string): Promise<string | null> {
+async function findSiblingRepository(startPath: string, repoName: string): Promise<string | null> {
   let current = startPath;
   for (let i = 0; i < 20; i++) {
     const siblingPath = path.join(current, repoName);
@@ -148,7 +148,7 @@ export async function findPackage(
 /**
  * Find all possible workspace roots by searching up the tree
  */
-export async function findWorkspaceRoots(startPath: string): Promise<string[]> {
+async function findWorkspaceRoots(startPath: string): Promise<string[]> {
   const roots: string[] = [];
   let current = startPath;
   

package/src/kernel/package-registry.ts

@@ -196,3 +196,12 @@ export function getPackageRegistry(): PackageRegistry {
   }
   return registryInstance;
 }
+
+/**
+ * Reset the package registry singleton. For use in tests only.
+ * Call before creating a ModuleResolver to prevent the previous scan state
+ * from leaking between tests.
+ */
+export function resetPackageRegistry(): void {
+  registryInstance = null;
+}

package/src/kernel/workspace.ts

@@ -12,38 +12,36 @@ import path from "node:path";
  * Updated: Now also checks for lib/ directory to ensure we find the correct SWS root
  */
 export async function findWorkspaceRoot(root: string): Promise<string | null> {
+  const debug = process.env["SWITE_DEBUG"] === "1";
   let current = root;
-  for (let i = 0; i < 10; i++) { // Increased from 5 to 10 to go higher up
+  for (let i = 0; i < 10; i++) {
     const workspaceFile = path.join(current, "pnpm-workspace.yaml");
     const packageJson = path.join(current, "package.json");
     const libDir = path.join(current, "lib");
-    
+
     try {
       await fs.access(workspaceFile);
-      // Accept root if it has lib/ (SWS with lib/) or packages/ (SWS with packages/ at root)
       const packagesDir = path.join(current, "packages");
       try {
         await fs.access(libDir);
-        console.log(`[workspace] Found workspace root with lib/: ${current}`);
+        if (debug) console.log(`[workspace] Found workspace root with lib/: ${current}`);
         return current;
       } catch {
         try {
           await fs.access(packagesDir);
-          console.log(`[workspace] Found workspace root with packages/: ${current}`);
+          if (debug) console.log(`[workspace] Found workspace root with packages/: ${current}`);
           return current;
         } catch {
-          // Workspace file exists but no lib/ or packages/, continue searching up
-          console.log(`[workspace] Found workspace file at ${current} but no lib/ or packages/, continuing search...`);
+          if (debug) console.log(`[workspace] Found workspace file at ${current} but no lib/ or packages/, continuing search...`);
         }
       }
     } catch {
       try {
         const pkgJson = JSON.parse(await fs.readFile(packageJson, "utf-8"));
         if (pkgJson?.workspaces) {
-          // Also check for lib/ when package.json has workspaces
           try {
             await fs.access(libDir);
-            console.log(`[workspace] Found workspace root with lib/ (via package.json): ${current}`);
+            if (debug) console.log(`[workspace] Found workspace root with lib/ (via package.json): ${current}`);
             return current;
           } catch {
             // Has workspaces but no lib/, continue searching
@@ -57,6 +55,6 @@ export async function findWorkspaceRoot(root: string): Promise<string | null> {
     if (parent === current) break;
     current = parent;
   }
-  console.warn(`[workspace] No workspace root found starting from: ${root}`);
+  if (debug) console.warn(`[workspace] No workspace root found starting from: ${root}`);
   return null;
 }