@swissjs/swite 0.3.5 → 0.4.2

package/src/dev-engine/server.ts

@@ -53,7 +53,32 @@ export class SwiteServer {
     };
 
     this.resolver = new ModuleResolver(this.config.root);
-    this.hmr = new HMREngine(this.config.root, this.config.hmrPort);
+    // Security (R-002): build the HMR allowed-origin list from the dev server
+    // host+port so the WebSocket server can reject cross-origin connections.
+    // When host is "localhost" we also add the numeric loopback form and vice
+    // versa — browsers send whichever name the user typed in the address bar.
+    const devOrigins = this.buildHmrAllowedOrigins();
+    this.hmr = new HMREngine(this.config.root, this.config.hmrPort, devOrigins);
+  }
+
+  /**
+   * Build the list of origins that are allowed to open an HMR WebSocket.
+   * Always includes both the configured host and its loopback alias so the
+   * browser can connect regardless of whether the dev typed "localhost" or
+   * "127.0.0.1" in the address bar.
+   */
+  private buildHmrAllowedOrigins(): string[] {
+    const { host, port } = this.config;
+    const origins: string[] = [];
+    const add = (h: string) => origins.push(`http://${h}:${port}`);
+
+    add(host);
+
+    // When the dev host is either loopback alias, also allow the other form.
+    if (host === "localhost") add("127.0.0.1");
+    else if (host === "127.0.0.1") add("localhost");
+
+    return origins;
   }
 
   // CG-03: find workspace root by walking up from startDir
@@ -137,8 +162,13 @@ export class SwiteServer {
     console.timeEnd("HMR Start");
 
     // Start HTTP server
-    // Use 0.0.0.0 to bind to all interfaces (IPv4 and IPv6)
-    const bindHost = this.config.host === "localhost" ? "0.0.0.0" : this.config.host;
+    // Security (R-001): honour the requested host literally.
+    // The default host is "localhost" which Node binds to the loopback
+    // interface only (127.0.0.1 / ::1).  Binding all interfaces (0.0.0.0)
+    // must be an explicit opt-in: the developer must set host to "0.0.0.0"
+    // in their swite.config.ts or pass --host 0.0.0.0 on the CLI.
+    // We never silently rewrite a requested loopback address to 0.0.0.0.
+    const bindHost = this.config.host;
     console.time("HTTP Listen");
     await new Promise<void>((resolve) => {
       this.app.listen(this.config.port, bindHost, () => {

package/src/kernel/package-finder.ts

@@ -20,7 +20,7 @@ export interface PackageLocation {
 /**
  * Find any sibling monorepo by searching for its package.json
  */
-export async function findSiblingRepository(startPath: string, repoName: string): Promise<string | null> {
+async function findSiblingRepository(startPath: string, repoName: string): Promise<string | null> {
   let current = startPath;
   for (let i = 0; i < 20; i++) {
     const siblingPath = path.join(current, repoName);
@@ -148,7 +148,7 @@ export async function findPackage(
 /**
  * Find all possible workspace roots by searching up the tree
  */
-export async function findWorkspaceRoots(startPath: string): Promise<string[]> {
+async function findWorkspaceRoots(startPath: string): Promise<string[]> {
   const roots: string[] = [];
   let current = startPath;
   

package/src/kernel/package-registry.ts

@@ -196,3 +196,12 @@ export function getPackageRegistry(): PackageRegistry {
   }
   return registryInstance;
 }
+
+/**
+ * Reset the package registry singleton. For use in tests only.
+ * Call before creating a ModuleResolver to prevent the previous scan state
+ * from leaking between tests.
+ */
+export function resetPackageRegistry(): void {
+  registryInstance = null;
+}

package/src/kernel/workspace.ts

@@ -12,38 +12,36 @@ import path from "node:path";
  * Updated: Now also checks for lib/ directory to ensure we find the correct SWS root
  */
 export async function findWorkspaceRoot(root: string): Promise<string | null> {
+  const debug = process.env["SWITE_DEBUG"] === "1";
   let current = root;
-  for (let i = 0; i < 10; i++) { // Increased from 5 to 10 to go higher up
+  for (let i = 0; i < 10; i++) {
     const workspaceFile = path.join(current, "pnpm-workspace.yaml");
     const packageJson = path.join(current, "package.json");
     const libDir = path.join(current, "lib");
-    
+
     try {
       await fs.access(workspaceFile);
-      // Accept root if it has lib/ (SWS with lib/) or packages/ (SWS with packages/ at root)
       const packagesDir = path.join(current, "packages");
       try {
         await fs.access(libDir);
-        console.log(`[workspace] Found workspace root with lib/: ${current}`);
+        if (debug) console.log(`[workspace] Found workspace root with lib/: ${current}`);
         return current;
       } catch {
         try {
           await fs.access(packagesDir);
-          console.log(`[workspace] Found workspace root with packages/: ${current}`);
+          if (debug) console.log(`[workspace] Found workspace root with packages/: ${current}`);
           return current;
         } catch {
-          // Workspace file exists but no lib/ or packages/, continue searching up
-          console.log(`[workspace] Found workspace file at ${current} but no lib/ or packages/, continuing search...`);
+          if (debug) console.log(`[workspace] Found workspace file at ${current} but no lib/ or packages/, continuing search...`);
         }
       }
     } catch {
       try {
         const pkgJson = JSON.parse(await fs.readFile(packageJson, "utf-8"));
         if (pkgJson?.workspaces) {
-          // Also check for lib/ when package.json has workspaces
           try {
             await fs.access(libDir);
-            console.log(`[workspace] Found workspace root with lib/ (via package.json): ${current}`);
+            if (debug) console.log(`[workspace] Found workspace root with lib/ (via package.json): ${current}`);
             return current;
           } catch {
             // Has workspaces but no lib/, continue searching
@@ -57,6 +55,6 @@ export async function findWorkspaceRoot(root: string): Promise<string | null> {
     if (parent === current) break;
     current = parent;
   }
-  console.warn(`[workspace] No workspace root found starting from: ${root}`);
+  if (debug) console.warn(`[workspace] No workspace root found starting from: ${root}`);
   return null;
 }

package/src/resolution/cdn/cdn-fallback.ts

@@ -1,40 +1,40 @@
-/**
- * CDN fallback policy.
- *
- * Swite can fall back to jsDelivr (+esm) for packages it can't resolve locally.
- * This must be safe and project-agnostic:
- * - Unscoped packages (e.g. "react") are usually public on npm; allow by default.
- * - Scoped packages (e.g. "@scope/pkg") may be private; do NOT CDN-fallback by default.
- *
- * Opt-in:
- * - Set `SWITE_CDN_FALLBACK_SCOPES` to a comma-separated list of scopes to allow,
- *   e.g. "@types,@tanstack".
- */
-
-function getScope(specifierOrPkg: string): string | null {
-  if (!specifierOrPkg.startsWith("@")) return null;
-  const firstSlash = specifierOrPkg.indexOf("/");
-  if (firstSlash === -1) return null;
-  return specifierOrPkg.slice(0, firstSlash); // "@scope"
-}
-
-function parseAllowList(): Set<string> {
-  const raw = process.env.SWITE_CDN_FALLBACK_SCOPES || "";
-  const scopes = raw
-    .split(",")
-    .map((s) => s.trim())
-    .filter(Boolean)
-    .map((s) => (s.startsWith("@") ? s : `@${s}`));
-  return new Set(scopes);
-}
-
-export function shouldUseCdnFallback(specifierOrPkg: string): boolean {
-  const scope = getScope(specifierOrPkg);
-  // Unscoped packages (e.g. "react") are not automatically CDN-eligible; require
-  // explicit opt-in via SWITE_CDN_FALLBACK_SCOPES to prevent accidental exfiltration
-  // of package requests for private-registry or unscoped internal packages.
-  if (!scope) return false;
-  const allow = parseAllowList();
-  return allow.has(scope);
-}
-
+/**
+ * CDN fallback policy.
+ *
+ * Swite can fall back to jsDelivr (+esm) for packages it can't resolve locally.
+ * This must be safe and project-agnostic:
+ * - Unscoped packages (e.g. "react") are usually public on npm; allow by default.
+ * - Scoped packages (e.g. "@scope/pkg") may be private; do NOT CDN-fallback by default.
+ *
+ * Opt-in:
+ * - Set `SWITE_CDN_FALLBACK_SCOPES` to a comma-separated list of scopes to allow,
+ *   e.g. "@types,@tanstack".
+ */
+
+function getScope(specifierOrPkg: string): string | null {
+  if (!specifierOrPkg.startsWith("@")) return null;
+  const firstSlash = specifierOrPkg.indexOf("/");
+  if (firstSlash === -1) return null;
+  return specifierOrPkg.slice(0, firstSlash); // "@scope"
+}
+
+function parseAllowList(): Set<string> {
+  const raw = process.env.SWITE_CDN_FALLBACK_SCOPES || "";
+  const scopes = raw
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean)
+    .map((s) => (s.startsWith("@") ? s : `@${s}`));
+  return new Set(scopes);
+}
+
+export function shouldUseCdnFallback(specifierOrPkg: string): boolean {
+  const scope = getScope(specifierOrPkg);
+  // Unscoped packages (e.g. "react") are not automatically CDN-eligible; require
+  // explicit opt-in via SWITE_CDN_FALLBACK_SCOPES to prevent accidental exfiltration
+  // of package requests for private-registry or unscoped internal packages.
+  if (!scope) return false;
+  const allow = parseAllowList();
+  return allow.has(scope);
+}
+

package/src/resolution/path/path-fixup.ts

@@ -1,27 +1,27 @@
-/**
- * Centralised /swiss-lib/ → /swiss-packages/ path fixup.
- *
- * Root cause: the UiCompiler emits absolute `/swiss-lib/` paths in some code
- * paths (compiler was written against an older directory structure). Until the
- * compiler is fixed at source this single function is the authoritative fixup.
- * Apply it once per compilation, before passing code to the import rewriter.
- *
- * Pass `patterns` from `userConfig.compilerPathFixup.patterns` to override the
- * defaults. Pass an empty array to disable all fixups.
- */
-export function fixSwissLibPaths(
-  code: string,
-  patterns?: Array<{ from: string; to: string }>,
-): string {
-  const activePatterns = patterns ?? [
-    { from: '/swiss-lib/packages/', to: '/swiss-packages/' },
-    { from: '/swiss-lib/', to: '/swiss-packages/' },
-  ];
-  let result = code;
-  for (const { from, to } of activePatterns) {
-    if (result.includes(from)) {
-      result = result.split(from).join(to);
-    }
-  }
-  return result;
-}
+/**
+ * Centralised /swiss-lib/ → /swiss-packages/ path fixup.
+ *
+ * Root cause: the UiCompiler emits absolute `/swiss-lib/` paths in some code
+ * paths (compiler was written against an older directory structure). Until the
+ * compiler is fixed at source this single function is the authoritative fixup.
+ * Apply it once per compilation, before passing code to the import rewriter.
+ *
+ * Pass `patterns` from `userConfig.compilerPathFixup.patterns` to override the
+ * defaults. Pass an empty array to disable all fixups.
+ */
+export function fixSwissLibPaths(
+  code: string,
+  patterns?: Array<{ from: string; to: string }>,
+): string {
+  const activePatterns = patterns ?? [
+    { from: '/swiss-lib/packages/', to: '/swiss-packages/' },
+    { from: '/swiss-lib/', to: '/swiss-packages/' },
+  ];
+  let result = code;
+  for (const { from, to } of activePatterns) {
+    if (result.includes(from)) {
+      result = result.split(from).join(to);
+    }
+  }
+  return result;
+}