catalyst-core 0.3.0-beta.2 → 0.3.0-beta.4

package/dist/native/androidSetup.js

@@ -209,13 +209,15 @@ async function checkEmulator(ADB_PATH) {
 }
 async function startEmulator(EMULATOR_PATH, androidConfig) {
   progress.log(`Starting emulator: ${androidConfig.emulatorName}...`);
-  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - EMULATOR_PATH is derived from SDK configuration and emulatorName is local native setup config.
-  // eslint-disable-next-line security/detect-child-process
-  (0, _child_process.exec)(`${EMULATOR_PATH} -avd ${androidConfig.emulatorName} -read-only > /dev/null &`, error => {
-    if (error) {
-      progress.log(`Error starting emulator: ${error}`, "error");
-    }
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - spawn with an argv array (no shell), so androidConfig.emulatorName can't be interpreted as shell syntax even though it comes from a locally-editable config file.
+  const child = (0, _child_process.spawn)(EMULATOR_PATH, ["-avd", androidConfig.emulatorName, "-read-only"], {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.on("error", error => {
+    progress.log(`Error starting emulator: ${error}`, "error");
   });
+  child.unref();
 }
 async function updateLocalProperties(sdkPath) {
   progress.start("properties");

package/dist/offline/catalyst-sw.js

@@ -99,6 +99,7 @@ function isOfflineRoute(url, manifest) {
     const { pathname } = new URL(url)
     return (manifest.routes || []).some((route) => {
         try {
+            // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp - route.regex is generated at build time by generateOfflineManifest.js's routeRegex(), which escapes every regex metacharacter in literal path segments and only ever emits flat (non-nested, non-repeating) patterns for :param and * segments — it cannot produce a catastrophic-backtracking shape. The manifest itself is same-origin build output, not user-submitted at runtime.
             return new RegExp(route.regex).test(pathname)
         } catch (_) {
             return false

package/dist/scripts/build.js

@@ -4,6 +4,7 @@ import { arrayToObject } from "./scriptUtils.js"
 import { fileURLToPath } from "url"
 import { dirname } from "path"
 import { readFileSync, existsSync, rmSync } from "fs"
+import { createRequire } from "module"
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = dirname(__filename)
@@ -11,16 +12,19 @@ const loaderPath = path.resolve(__dirname, "../../dist/vite/node-loader.mjs")
 const configPath = path.join(process.env.PWD, "config/config.json")
 const configJSON = JSON.parse(readFileSync(configPath), "utf-8")
 
+// Resolve vite's actual JS entry point rather than spawning the "vite" command name,
+// which on Windows only resolves via the npm-installed .cmd shim (i.e. requires a shell).
+// Invoking process.execPath + this path directly works cross-platform with no shell.
+const require = createRequire(import.meta.url)
+const viteBinPath = path.join(path.dirname(require.resolve("vite/package.json")), "bin", "vite.js")
+
 /**
- * @param {string} command
+ * @param {string[]} args
  * @param {import('child_process').SpawnOptions} options
  */
-function runBuildStep(command, options) {
+function runBuildStep(args, options) {
     return new Promise((resolve, reject) => {
-        const child = spawn(command, [], {
-            ...options,
-            shell: true,
-        })
+        const child = spawn(process.execPath, args, options)
         child.on("close", (code) => {
             if (code === 0) {
                 resolve()
@@ -69,8 +73,8 @@ async function build() {
         ]),
     }
 
-    const serverBuildCommand = `vite build --config ./dist/vite/vite.config.server.js --ssr`
-    const clientBuildCommand = `vite build --config ./dist/vite/vite.config.client.js`
+    const serverBuildArgs = [viteBinPath, "build", "--config", "./dist/vite/vite.config.server.js", "--ssr"]
+    const clientBuildArgs = [viteBinPath, "build", "--config", "./dist/vite/vite.config.client.js"]
     const spawnBase = {
         cwd: dirname,
         stdio: "inherit",
@@ -80,11 +84,11 @@ async function build() {
 
     try {
         await Promise.all([
-            runBuildStep(serverBuildCommand, {
+            runBuildStep(serverBuildArgs, {
                 ...spawnBase,
                 env: { ...baseEnv, CATALYST_VITE_CACHE_ID: "ssr" },
             }),
-            runBuildStep(clientBuildCommand, {
+            runBuildStep(clientBuildArgs, {
                 ...spawnBase,
                 env: { ...baseEnv, CATALYST_VITE_CACHE_ID: "client" },
             }),
@@ -96,7 +100,7 @@ async function build() {
 
     console.log("✅ Server and client builds completed!")
 
-    await runBuildStep("node ./dist/scripts/generateOfflineManifest.js", {
+    await runBuildStep(["./dist/scripts/generateOfflineManifest.js"], {
         ...spawnBase,
         env: baseEnv,
     })

package/dist/scripts/generateOfflineManifest.js

@@ -68,6 +68,7 @@ async function loadAppRoutes(appRoot) {
     })
 
     try {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - appRoot is the app's own build root and the remainder is a hardcoded literal path, not request input.
         const routesModule = await vite.ssrLoadModule(path.join(appRoot, "src/js/routes/utils.js"))
         return typeof routesModule.getRoutes === "function" ? routesModule.getRoutes() : []
     } finally {

package/dist/scripts/scriptUtils.js

@@ -23,6 +23,7 @@ export const printBundleInformation = () => {
         const files = fs.readdirSync(directoryPath)
         files.forEach((file) => {
             if (!file.includes("txt") && !file.includes("json")) {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - file comes from fs.readdirSync(directoryPath), i.e. actual filenames already on disk in the build output, not request input.
                 const filePath = path.join(directoryPath, file)
                 const fileSize = getFileSizeSync(filePath)
                 if (fileSize !== null) {

package/dist/scripts/serve.js

@@ -24,28 +24,30 @@ function startProd() {
 
     console.log("🚀 Starting production server...")
 
-    const inspectFlag = commandLineArguments.includes("--inspect") ? "--inspect" : ""
-    const command = `node ${inspectFlag} --import ${preInitPath} --loader ${loaderPath} ./dist/server/expressServer.js`
-    spawnSync(command, [], {
-        cwd: dirname,
-        stdio: "inherit",
-        shell: true,
-        env: {
-            ...process.env,
-            src_path: process.env.PWD,
-            NODE_ENV: "production",
-            IS_DEV_COMMAND: false,
-            APPLICATION: name || "catalyst_app",
-            ...argumentsObject,
-            filterKeys: JSON.stringify([
-                "src_path",
-                "NODE_ENV",
-                "IS_DEV_COMMAND",
-                "APPLICATION",
-                ...Object.keys(argumentsObject),
-            ]),
-        },
-    })
+    const inspectArgs = commandLineArguments.includes("--inspect") ? ["--inspect"] : []
+    spawnSync(
+        "node",
+        [...inspectArgs, "--import", preInitPath, "--loader", loaderPath, "./dist/server/expressServer.js"],
+        {
+            cwd: dirname,
+            stdio: "inherit",
+            env: {
+                ...process.env,
+                src_path: process.env.PWD,
+                NODE_ENV: "production",
+                IS_DEV_COMMAND: false,
+                APPLICATION: name || "catalyst_app",
+                ...argumentsObject,
+                filterKeys: JSON.stringify([
+                    "src_path",
+                    "NODE_ENV",
+                    "IS_DEV_COMMAND",
+                    "APPLICATION",
+                    ...Object.keys(argumentsObject),
+                ]),
+            },
+        }
+    )
 }
 
 startProd()

package/dist/scripts/start.js

@@ -22,11 +22,9 @@ function start() {
     const packageJson = JSON.parse(readFileSync(path.join(process.env.PWD, "package.json"), "utf-8"))
     const { name } = packageJson
 
-    const command = `node --import ${preInitPath} --loader ${loaderPath} ./dist/server/expressServer.js`
-    spawnSync(command, [], {
+    spawnSync("node", ["--import", preInitPath, "--loader", loaderPath, "./dist/server/expressServer.js"], {
         cwd: dirname,
         stdio: "inherit",
-        shell: true,
         env: {
             ...process.env,
             src_path: process.env.PWD,

package/dist/server/expressServer.js

@@ -10,6 +10,7 @@ import pc from "picocolors"
 import fs from "fs"
 const { cyan, yellow, green } = pc
 
+import { toMountPathPrefix } from "../vite/resolveDevServerConfig.js"
 import { validateMiddleware, safeCall } from "./utils/validator.js"
 import { botDetectionMiddleware } from "./utils/botDetectionMiddleware.js"
 import { cjsRequire } from "./utils/cjsRequire.js"
@@ -126,6 +127,7 @@ const isProduction = process.env.NODE_ENV === "production"
 
 function serveBuildFile(app, buildPath, urlPath, fileName, headers = {}) {
     app.get(urlPath, (_req, res, next) => {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - fileName is always a hardcoded literal passed at each serveBuildFile call site, never derived from the request.
         const filePath = path.join(buildPath, fileName)
         if (!fs.existsSync(filePath)) return next()
         res.set(headers)
@@ -207,6 +209,12 @@ async function createServer() {
             appType: "custom",
             root: process.env.src_path,
         })
+
+        // Expose Vite's resolved base to the SSR renderer so the URLs it injects
+        // (client entry, react-refresh preamble) match the path Vite serves under.
+        // Vite normalizes base with a trailing slash; trim it for clean URL joins.
+        process.env.APP_MOUNT_PATH = toMountPathPrefix(vite.config.base)
+
         app.use(vite.middlewares)
     }
 

package/dist/server/renderer/document/Body.jsx

@@ -30,7 +30,10 @@ export function Body(props) {
                     __html: `window.__SAFE_AREA_INITIAL__ = ${JSON.stringify(safeArea)}; window.__CATALYST_NATIVE_WEBVIEW__ = ${nativeWebView ? "true" : "false"}`,
                 }}
             />
-            {process.env.NODE_ENV === "development" && <script type="module" src="/client/index.js"></script>}
+            {process.env.NODE_ENV === "development" && (
+                // Base pinned to Vite's resolved base by server/expressServer.js.
+                <script type="module" src={`${process.env.APP_MOUNT_PATH || ""}/client/index.js`}></script>
+            )}
             {jsx}
             <script
                 /* eslint-disable */

package/dist/server/renderer/document/Head.jsx

@@ -34,9 +34,11 @@ export function Head(props) {
             {metaTags && metaTags}
 
             {/* Inline critical CSS — prevents FOUC/CLS */}
+            {/* nosemgrep: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - inlineCss is compiled CSS read from disk (readCssFromDisk), sourced from the app's own build output, never from request/user input. */}
             {inlineCss && <style dangerouslySetInnerHTML={{ __html: inlineCss }} />}
 
             {/* Deferred CSS from prior SSRs on this route — avoids late layout from post-body <style> */}
+            {/* nosemgrep: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - deferredRouteInlineCss is compiled CSS read from disk (readCssFromDisk), sourced from the app's own build output, never from request/user input. */}
             {deferredRouteInlineCss && <style dangerouslySetInnerHTML={{ __html: deferredRouteInlineCss }} />}
 
             {/* JS modules */}

package/dist/server/renderer/extract.js

@@ -103,6 +103,7 @@ export const readCssFromDisk = (cssPaths = [], basePath) => {
         seen.add(asset)
         if (asset.startsWith("http")) continue
 
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - asset paths come from the Vite build manifest generated at build time, never from a request, so there is no user-controlled input here.
         const filePath = path.isAbsolute(asset) ? asset : path.join(basePath, asset.replace(/^\/+/, ""))
 
         try {

package/dist/server/renderer/handler.jsx

@@ -265,6 +265,7 @@ const _renderMarkUp = async (
                     if (chunkExtractor) {
                         const renderedKeys = chunkExtractor.getRenderedComponentKeys()
                         this.push(
+                            // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag - renderedKeys are internal bundler component-module keys tracked by ChunkExtractor, never request/user input, and are JSON.stringify-escaped before embedding.
                             `<script>window.__SSR_RENDERED_COMPONENTS__=new Set(${JSON.stringify(renderedKeys)})</script>`
                         )
                     }

package/dist/vite/FastRefresh.jsx

@@ -6,8 +6,10 @@ const FastRefresh = () => {
             type="module"
             // eslint-disable-next-line risxss/catch-potential-xss-react
             dangerouslySetInnerHTML={{
+                // Base-prefixed so the preamble resolves under a sub-path; otherwise
+                // plugin-react modules throw "$RefreshSig$ is not defined".
                 __html: `
-        import { injectIntoGlobalHook } from "/@react-refresh";
+        import { injectIntoGlobalHook } from "${process.env.APP_MOUNT_PATH || ""}/@react-refresh";
         injectIntoGlobalHook(window);
         window.$RefreshReg$ = () => {};
         window.$RefreshSig$ = () => (type) => type;

package/dist/vite/inject-cache-key-plugin.js

@@ -45,9 +45,11 @@ function loadAliases() {
     for (const [alias, aliasPath] of Object.entries(allAliases)) {
         if (aliasPath && typeof aliasPath === "string") {
             try {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - appRoot is the app's own build root and aliasPath comes from the developer's package.json config, not request/user input.
                 const resolvedPath = path.resolve(appRoot, ...aliasPath.split("/"))
                 aliasCache[alias] = resolvedPath
             } catch (error) {
+                // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - alias is a key from the developer's own package.json config, not attacker-controlled; console.warn here does no printf-style substitution.
                 console.warn(`Failed to resolve alias ${alias}:`, error.message)
             }
         }
@@ -87,6 +89,7 @@ function resolveWithExtensions(basePath) {
     }
 
     for (const ext of extensions) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - basePath is derived from module import specifiers resolved by this plugin's own alias/relative-import logic, never from a request.
         const candidate = path.join(basePath, `index${ext}`)
         if (existsSync(candidate)) {
             return candidate
@@ -107,9 +110,11 @@ function resolveToAbsolutePath(importPath, importerId) {
     for (const [alias, aliasPath] of Object.entries(aliases)) {
         if (importPath === alias || importPath.startsWith(alias + "/")) {
             const remainingPath = importPath === alias ? "" : importPath.slice(alias.length + 1)
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - importPath comes from the app's own module import graph and aliasPath from the developer's package.json config, never from a request.
             const rawResolved = path.join(aliasPath, remainingPath)
             const finalResolved = resolveWithExtensions(rawResolved)
             if (finalResolved) {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - finalResolved is derived from the same alias/import resolution above, not request input.
                 return path.resolve(finalResolved)
             }
         }
@@ -118,6 +123,7 @@ function resolveToAbsolutePath(importPath, importerId) {
     // 2. Relative imports — resolve from the importer's directory
     if (importPath.startsWith("./") || importPath.startsWith("../")) {
         const importerDir = path.dirname(importerId)
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - importPath comes from the app's own module import graph and importerId from Vite's module resolution, never from a request.
         const absolutePath = path.resolve(importerDir, importPath)
         const resolved = resolveWithExtensions(absolutePath)
         if (resolved) {
@@ -149,6 +155,7 @@ function resolveImportPath(importPath, importerId) {
         // Fallback: strip leading ./ and return as-is
         return importPath.replace(/^\.\//, "")
     } catch (error) {
+        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - importPath comes from the app's own module import graph resolved by Vite at build time, not attacker-controlled; console.warn here does no printf-style substitution.
         console.warn(`Error resolving import path ${importPath}:`, error.message)
         return importPath.replace(/^\.\//, "")
     }

package/dist/vite/loadCustomViteConfig.js

@@ -5,11 +5,40 @@ import { pathToFileURL } from "url"
 const emptyConfig = {
     ssrPlugins: [],
     clientPlugins: [],
+    /**
+     * devServer lets apps tune the Vite dev server without editing framework
+     * internals.  All fields are optional and map 1-to-1 onto Vite's `server`
+     * config (https://vite.dev/config/server-options).
+     *
+     * The most common use-case is an app served under a sub-path behind an SSL
+     * reverse proxy (nginx/caddy):
+     *
+     *   // buildConfig.js
+     *   export default {
+     *     devServer: {
+     *       // Vite's base path — the single source of truth for the dev mount
+     *       // path; must match the reverse-proxy location prefix. Defaults to "/".
+     *       base: "/o-mweb",
+     *
+     *       // HMR WebSocket tuning when the browser connects via the proxy
+     *       hmr: {
+     *         clientPort: 443,   // port the browser uses (proxy's SSL port)
+     *         path: "__vite_hmr" // WebSocket pathname (relative to base)
+     *       },
+     *
+     *       // Vite 6 rejects requests whose Host header isn't localhost/127.0.0.1.
+     *       // Add your proxy hostname here so the dev server accepts them.
+     *       allowedHosts: ["local.odinweb.1mg.com"],
+     *     },
+     *   }
+     */
+    devServer: {},
 }
 
 export async function loadCustomViteConfig() {
     const configNames = ["buildConfig.js", "webpackConfig.js"]
     const configPath = configNames
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - configName is one of two hardcoded literals above, and process.env.src_path is the app root set by the framework's own build tooling, not request/user input.
         .map((configName) => path.join(process.env.src_path, configName))
         .find((candidatePath) => existsSync(candidatePath))
 

package/dist/vite/manifest-categorization-plugin.js

@@ -293,6 +293,7 @@ export function manifestCategorizationPlugin(options = {}) {
     // branch of the import graph, the affected CSS would vanish from server responses
     // with no runtime error — this check surfaces that as a build-time warning.
     function validateCssCoverage(categorizedManifest, buildDir) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - buildDir is the build tool's own output directory and the remaining segments are hardcoded literals, not request input.
         const cssDir = path.join(buildDir, "client", "assets", "css")
         if (!fs.existsSync(cssDir)) return
 
@@ -403,6 +404,7 @@ export function manifestCategorizationPlugin(options = {}) {
                             })
                         }
                     } catch (err) {
+                        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - importPath comes from the app's own module import graph resolved by Vite at build time, not attacker-controlled; console.log here does no printf-style substitution.
                         console.log(`❌ Error resolving ${importPath}:`, err.message)
                     }
                 })

package/dist/vite/node-loader.mjs

@@ -56,6 +56,7 @@ function loadAliases() {
                 const resolvedPath = resolvePath(appRoot, ...aliasPath.split("/"))
                 aliasCache[alias] = resolvedPath
             } catch (error) {
+                // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - alias is a key from the developer's own package.json _moduleAliases config, not attacker-controlled; console.warn here does no printf-style substitution.
                 console.warn(`Failed to resolve alias ${alias}:`, error.message)
             }
         }
@@ -100,6 +101,7 @@ function resolveWithExtensions(basePath) {
 
     // Try index files inside a directory
     for (const ext of extensions) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - basePath is derived from module import specifiers resolved by the Node loader itself, never from a request.
         const candidate = join(basePath, `index${ext}`)
         if (existsSync(candidate)) {
             return candidate
@@ -119,10 +121,12 @@ function resolveAlias(specifier, parentURL) {
     for (const [alias, aliasPath] of Object.entries(aliases)) {
         if (specifier.startsWith(alias + "/") || specifier === alias) {
             const remainingPath = specifier === alias ? "" : specifier.slice(alias.length + 1)
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - specifier comes from an ES module import statement in the app's own source code, and aliasPath from the developer's package.json config, never from a request.
             const rawResolvedPath = join(aliasPath, remainingPath)
             const finalResolvedPath = resolveWithExtensions(rawResolvedPath)
 
             if (finalResolvedPath) {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - finalResolvedPath is derived from the same alias/import resolution above, not request input.
                 return resolvePath(finalResolvedPath)
             }
         }
@@ -140,6 +144,7 @@ function resolveRelative(specifier, parentURL) {
     try {
         const parentPath = fileURLToPath(parentURL)
         const parentDir = dirname(parentPath)
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - specifier comes from an ES module import statement in the app's own source code, parentURL from the module loader itself, never from a request.
         const absolutePath = resolvePath(parentDir, specifier)
         return resolveWithExtensions(absolutePath)
     } catch {
@@ -225,6 +230,7 @@ export async function resolve(specifier, context, defaultResolve) {
  */
 function findNearestPackageType(dir) {
     while (dir !== dirname(dir)) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - dir is walked up from the module's own filesystem location via dirname(), never from a request; "package.json" is a hardcoded literal.
         const pkgPath = join(dir, "package.json")
         if (existsSync(pkgPath)) {
             try {
@@ -302,9 +308,37 @@ function isValidExportName(name) {
 // Loader-scoped require for discovering CJS exports
 const loaderRequire = createRequire(import.meta.url)
 
-const CJS_PATTERN = /\b(module\.exports\b|exports\.\w+\s*=)/
 const REQUIRE_CALL_PATTERN = /\brequire\s*\(/
 
+/**
+ * Decide whether a source file is really CommonJS by parsing it, not by
+ * regex-matching the raw text.
+ *
+ * A regex like /module\.exports\b/ cannot tell code from text, so any file that
+ * merely *mentions* module.exports inside a string, comment or template literal
+ * was misclassified as CJS. When such a file was real ESM with its own
+ * `export default`, the CJS shim appended a second one and Node failed the
+ * module with "Duplicate export of 'default'". Docs sites hit this constantly:
+ * a Markdown page documenting a CJS config compiles into a string literal in
+ * the bundled ESM output. Do not reintroduce source-regex detection.
+ *
+ * esbuild parses properly and lowers CJS itself, so a file it wraps in its
+ * __commonJS helper had no ESM syntax of its own — that is the CJS signal.
+ */
+function isCjsSource(source, filePath) {
+    try {
+        const { code } = transformSync(source, {
+            loader: "jsx",
+            format: "esm",
+            sourcefile: filePath,
+            target: "node20",
+        })
+        return /\bvar __commonJS =/.test(code)
+    } catch {
+        return false
+    }
+}
+
 // Shim __dirname and __filename for ESM app files (these globals only exist in CJS)
 const createDirnameShim = (source) => {
     const hasFilename = /\b(?:const|let|var)\s+__filename\b/.test(source)
@@ -390,7 +424,7 @@ export async function load(url, context, defaultLoad) {
         // We can't use createRequire here because the file lives in a "type":"module"
         // package — Node's CJS require refuses to load it. Instead, we wrap the
         // source inline so that `module.exports` becomes the default export.
-        if (CJS_PATTERN.test(source)) {
+        if (isCjsSource(source, filePath)) {
             const shimmed = [
                 createRequireShim(source),
                 createDirnameShim(source),

package/dist/vite/resolveDevServerConfig.js

@@ -0,0 +1,45 @@
+// Pure resolvers for the Vite dev-server config derived from an app's
+// `buildConfig.devServer`. Side-effect free so the base precedence and the fs
+// allowlist merge can be unit-tested without spinning up Vite.
+
+/**
+ * Vite `base` for the dev server. `buildConfig.devServer.base` is the single
+ * source of truth (default "/"). Normalized to a leading slash and no trailing
+ * slash so it doubles as a URL prefix for the SSR renderer.
+ */
+export function resolveDevBase(devServer = {}) {
+    const base = devServer?.base
+    if (!base || base === "/") return "/"
+    return `/${String(base).trim().replace(/^\/+|\/+$/g, "")}`
+}
+
+/**
+ * A resolved base as a URL prefix. Root ("/") becomes "" so
+ * `${prefix}/client/index.js` stays single-slashed.
+ */
+export function toMountPathPrefix(base) {
+    return !base || base === "/" ? "" : String(base).replace(/\/+$/, "")
+}
+
+/**
+ * fs.allow for the dev server. Framework paths are always present; apps may
+ * extend the list via `devServer.fs.allow` but cannot replace it or relax other
+ * fs guards (e.g. `strict`), so buildConfig can't widen filesystem exposure.
+ */
+export function resolveDevFsAllow(devFs, frameworkPaths) {
+    const extra = Array.isArray(devFs?.allow) ? devFs.allow : []
+    return [...frameworkPaths, ...extra]
+}
+
+/**
+ * Vite `server` block from `buildConfig.devServer`. Passthrough keys are spread
+ * first so the framework-owned `hmr` and `fs` always win.
+ */
+export function buildDevServer(devServer = {}, { frameworkPaths, isProduction = false } = {}) {
+    const { base, hmr, fs, ...serverOverrides } = devServer
+    return {
+        ...serverOverrides,
+        hmr: isProduction ? false : (hmr ?? true),
+        fs: { allow: resolveDevFsAllow(fs, frameworkPaths) },
+    }
+}

package/dist/vite/vite.config.client.js

@@ -1,7 +1,7 @@
 import loadEnvironmentVariables from "../scripts/loadEnvironmentVariables.js"
 loadEnvironmentVariables()
 import { defineConfig } from "vite"
-import baseConfig, { getClientEnvVariables } from "./vite.config.js"
+import { sharedViteConfig as baseConfig, getClientEnvVariables } from "./vite.config.js"
 import path from "path"
 import { manifestCategorizationPlugin } from "./manifest-categorization-plugin.js"
 import { injectCacheKeyPlugin } from "./inject-cache-key-plugin.js"

package/dist/vite/vite.config.js

@@ -2,6 +2,8 @@ import { defineConfig, transformWithEsbuild } from "vite"
 import react from "@vitejs/plugin-react"
 import svgr from "vite-plugin-svgr"
 import { builtinModules, createRequire } from "node:module"
+import { loadCustomViteConfig } from "./loadCustomViteConfig.js"
+import { resolveDevBase, buildDevServer } from "./resolveDevServerConfig.js"
 
 /**
  * Treat all .scss imports as CSS modules (webpack compat).
@@ -113,6 +115,7 @@ try {
     const packageJson = JSON.parse(packageJsonContent)
     _moduleAliases = packageJson._moduleAliases || {}
 } catch (error) {
+    // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - packageJsonConfig is a build-time-resolved local path, not attacker-controlled; console.warn here does no printf-style substitution.
     console.warn(`Failed to read or parse package.json from ${packageJsonConfig}:`, error.message)
 }
 
@@ -122,6 +125,7 @@ try {
     catalyst_moduleAliases = catalystPackageJson._moduleAliases || {}
 } catch (error) {
     console.warn(
+        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - catalystPackageJsonConfig is a build-time-resolved local path, not attacker-controlled; console.warn here does no printf-style substitution.
         `Failed to read or parse catalyst package.json from ${catalystPackageJsonConfig}:`,
         error.message
     )
@@ -146,6 +150,7 @@ import { imageUrl, fontUrl } from "./scssParams.js"
 // options — so anything else is left alone and Vite falls back to its normal
 // auto-loaded postcss.config.js resolution.
 const resolvePostcssPlugins = () => {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - process.env.src_path is the app root set by the framework's own build tooling, not request/user input.
     const configPath = path.join(process.env.src_path, "postcss.config.js")
     if (!fs.existsSync(configPath)) return null
 
@@ -168,6 +173,7 @@ const resolvePostcssPlugins = () => {
             return plugin(finalOptions)
         })
     } catch (error) {
+        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - configPath is a build-time-resolved local path, not attacker-controlled; console.warn here does no printf-style substitution.
         console.warn(`Failed to patch postcss config at ${configPath}:`, error.message)
         return null
     }
@@ -183,9 +189,11 @@ const alias = () => {
     return Object.keys(allAliases).reduce((moduleEnvMap, alias) => {
         if (allAliases[alias] && typeof allAliases[alias] === "string") {
             try {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - process.env.src_path is the app root and allAliases comes from the developer's own package.json _moduleAliases config, not request/user input.
                 const aliasPath = path.join(process.env.src_path, ...allAliases[alias].split("/"))
                 moduleEnvMap[alias] = aliasPath
             } catch (error) {
+                // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - alias is a key from the developer's own package.json _moduleAliases config, not attacker-controlled; console.warn here does no printf-style substitution.
                 console.warn(`Failed to configure alias ${alias}:`, error.message)
             }
         }
@@ -356,7 +364,10 @@ export const isNodeOnlyExternal = (id) =>
     id === "@grpc/grpc-js" ||
     id.startsWith("@opentelemetry/")
 
-export default defineConfig({
+// ─── Shared config ────────────────────────────────────────────────────────────
+// Exported for the production build (vite.config.client.js spreads this in).
+// Does NOT include `base` or `server` — those differ between dev and prod.
+export const sharedViteConfig = {
     // Parallel `vite build` (SSR + client) must use separate dirs or Vite will block on shared `node_modules/.vite`.
     cacheDir: path.join(
         process.env.src_path,
@@ -482,17 +493,34 @@ export default defineConfig({
         "**/*.woff2",
     ],
 
-    // Server configuration
-    server: {
-        hmr: !isProduction,
-        fs: {
-            allow: [process.env.src_path, __dirname],
-        },
-    },
-
     // Preview configuration for production preview
     preview: {
         port: process.env.NODE_SERVER_PORT ? parseInt(process.env.NODE_SERVER_PORT) : 3005,
         host: process.env.NODE_SERVER_HOSTNAME || "localhost",
     },
+}
+
+// ─── Dev server config ────────────────────────────────────────────────────────
+// Async factory so it can read the app's buildConfig.devServer for `base`, HMR
+// and other Vite server options. `base` comes solely from devServer.base; the
+// resolved value is propagated to the SSR renderer by server/expressServer.js.
+// The production build (vite.config.client.js) ignores this and spreads
+// sharedViteConfig directly.
+export default defineConfig(async () => {
+    const { devServer = {}, ssrPlugins = [] } = await loadCustomViteConfig()
+
+    return {
+        ...sharedViteConfig,
+        base: resolveDevBase(devServer),
+        server: buildDevServer(devServer, {
+            frameworkPaths: [process.env.src_path, __dirname],
+            isProduction,
+        }),
+        // Apply the app's SSR plugins in dev too — the production build already
+        // does this in vite.config.server.js. This lets buildConfig.ssrPlugins
+        // inject SSR-only config (e.g. a plugin whose `config()` hook adds
+        // ssr.noExternal to bundle React-consuming deps so dev SSR shares the
+        // app's single React instance) without hardcoding anything in the framework.
+        plugins: [...(sharedViteConfig.plugins || []), ...ssrPlugins],
+    }
 })

package/dist/vite/vite.config.server.js

@@ -1,7 +1,11 @@
 import loadEnvironmentVariables from "../scripts/loadEnvironmentVariables.js"
 loadEnvironmentVariables()
 import { defineConfig } from "vite"
-import baseConfig, { getClientEnvVariables, isNodeOnlyExternal } from "./vite.config.js"
+// Spread the static shared config (a plain object), NOT the default export —
+// the default export is now an async dev-server factory function, and spreading
+// a function would silently drop cacheDir, resolve aliases, css, plugins and
+// build from the production SSR bundle. Mirrors vite.config.client.js.
+import { sharedViteConfig as baseConfig, getClientEnvVariables, isNodeOnlyExternal } from "./vite.config.js"
 import path from "path"
 import { fileURLToPath } from "url"
 import { dirname } from "path"

package/mcp_v2/tools/github.js

@@ -161,6 +161,7 @@ function safeReadText(filePath, maxBytes = 8000) {
 
 function runGit(root, command) {
     try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - command is always one of the fixed git/node/npm strings hardcoded at call sites, never external input.
         return execSync(command, {
             cwd: root,
             encoding: "utf8",
@@ -183,6 +184,7 @@ function slugify(input) {
 }
 
 function ensureFallbackDir(root) {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter letting a local developer's coding agent point this tool at any project directory it already has filesystem access to (see mcp.js inputSchema). Not a network-facing input; the caller already has direct fs access via other tools. FALLBACK_DIR is a hardcoded literal.
     const dir = path.join(root, FALLBACK_DIR)
     fs.mkdirSync(dir, { recursive: true })
     return dir
@@ -406,7 +408,9 @@ function appendSection(sections, heading, content) {
 }
 
 function isPathInside(root, candidate) {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - this is the containment-check helper itself (used by callers below to reject paths outside root); root/candidate here are the values being validated, not yet trusted for file access.
     const resolvedRoot = path.resolve(root)
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - this is the containment-check helper itself; candidate is the value being validated, not yet trusted for file access.
     const resolvedCandidate = path.resolve(candidate)
     const relative = path.relative(resolvedRoot, resolvedCandidate)
     return relative === "" || (relative && !relative.startsWith("..") && !path.isAbsolute(relative))
@@ -543,6 +547,7 @@ function normalizeImages(images, root) {
             continue
         }
 
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - raw is an MCP tool argument (attachment path) and root the project_path argument; the isPathInside() check on the next line rejects anything that resolves outside root before it is ever read.
         const absolutePath = path.isAbsolute(raw) ? path.resolve(raw) : path.resolve(root, raw)
         if (!isPathInside(root, absolutePath)) {
             localFiles.push({ path: raw, exists: false, rejected: true, reason: "outside_project_root" })
@@ -789,6 +794,7 @@ function collectRelatedFiles(root, query, explicitFiles) {
     const candidates = Array.isArray(explicitFiles) ? explicitFiles : []
     for (const file of candidates) {
         if (typeof file !== "string") continue
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - file is an MCP tool argument (explicit related-files list) and root the project_path argument; the isPathInside() check on the next line rejects anything that resolves outside root before it is ever read.
         const absolute = path.isAbsolute(file) ? path.resolve(file) : path.resolve(root, file)
         if (!isPathInside(root, absolute)) continue
         const content = safeReadText(absolute, 12000)
@@ -802,6 +808,7 @@ function collectRelatedFiles(root, query, explicitFiles) {
     const words = normalizeSearchText(query).split(/\s+/).filter(Boolean).slice(0, 5)
     if (words.length === 0) return files
 
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter (see mcp.js inputSchema); "src" is a hardcoded literal.
     const srcDir = path.join(root, "src")
     const matches = []
     function walk(dir) {
@@ -813,6 +820,7 @@ function collectRelatedFiles(root, query, explicitFiles) {
         }
         for (const entry of entries) {
             if (entry.name === "node_modules" || entry.name === ".git") continue
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - entry.name comes from fs.readdirSync(dir) above, i.e. actual filenames already on disk under srcDir, not request input.
             const full = path.join(dir, entry.name)
             if (entry.isDirectory()) {
                 walk(full)
@@ -831,7 +839,9 @@ function collectRelatedFiles(root, query, explicitFiles) {
 
 function gatherGithubIssueContext(args = {}) {
     const root = getProjectRoot(args)
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter (see mcp.js inputSchema); "package.json" is a hardcoded literal.
     const pkg = safeReadJson(path.join(root, "package.json"))
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter (see mcp.js inputSchema); "config/config.json" is a hardcoded literal.
     const configJson = safeReadJson(path.join(root, "config", "config.json"))
     const branch = runGit(root, "git rev-parse --abbrev-ref HEAD")
     const commit = runGit(root, "git rev-parse --short HEAD")
@@ -874,6 +884,7 @@ function generateIssueMarkdown(args = {}) {
     const built = buildIssueBody(args, { enrich: true })
     const labels = resolveIssueLabels(args, built.body)
     const dir = ensureFallbackDir(root)
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - dir is the FALLBACK_DIR under the project_path MCP argument; the filename is a generated ISO timestamp plus slugify(title), which strips to [a-z0-9-] only, so it cannot contain path separators.
     const filePath = path.join(dir, `${new Date().toISOString().replace(/[:.]/g, "-")}-${slugify(title)}.md`)
 
     const markdown = [

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "catalyst-core",
-    "version": "0.3.0-beta.2",
+    "version": "0.3.0-beta.4",
     "type": "module",
     "main": "./dist/index.jsx",
     "description": "Web framework that provides great performance out of the box",
@@ -30,6 +30,7 @@
     "scripts": {
         "lint": "eslint .",
         "lint-staged": "lint-staged",
+        "test:unit": "node --test \"test/**/*.test.js\"",
         "prettify": "prettier . --write",
         "prepare": "node ../../scripts/safe-rimraf.js ./dist && cp -r ./src ./dist && babel src/native --out-dir dist/native --config-file ./babel.native.config.cjs --ignore '**/.build/**' && babel src/sentry.js --out-file dist/sentry.cjs --config-file ./babel.native.config.cjs",
         "prepublishOnly": "npm run prepare",
@@ -51,7 +52,7 @@
         "react-refresh": "^0.14.0",
         "react-router-dom": "^6.16.0",
         "redux": "^4.2.1",
-        "sanitize-html": "^2.13.1",
+        "sanitize-html": "^2.17.6",
         "sass": "^1.89.2",
         "ua-parser-js": "^1.0.37",
         "vite": "^6.4.3",

package/test/vite/resolveDevServerConfig.test.js

@@ -0,0 +1,113 @@
+import { test } from "node:test"
+import assert from "node:assert/strict"
+
+import {
+    resolveDevBase,
+    toMountPathPrefix,
+    resolveDevFsAllow,
+    buildDevServer,
+} from "../../src/vite/resolveDevServerConfig.js"
+
+// ─── resolveDevBase ───────────────────────────────────────────────────────────
+
+test("resolveDevBase: resolves from devServer.base", () => {
+    assert.equal(resolveDevBase({ base: "/o-mweb" }), "/o-mweb")
+})
+
+test("resolveDevBase: defaults to '/' when base is unset", () => {
+    assert.equal(resolveDevBase({}), "/")
+    assert.equal(resolveDevBase(undefined), "/")
+    assert.equal(resolveDevBase({ base: "/" }), "/")
+})
+
+test("resolveDevBase: normalizes to a leading slash, no trailing slash", () => {
+    assert.equal(resolveDevBase({ base: "o-mweb" }), "/o-mweb")
+    assert.equal(resolveDevBase({ base: "/o-mweb/" }), "/o-mweb")
+    assert.equal(resolveDevBase({ base: "  /o-mweb//  " }), "/o-mweb")
+})
+
+// ─── toMountPathPrefix ────────────────────────────────────────────────────────
+
+test("toMountPathPrefix: root maps to empty string for clean URL joins", () => {
+    assert.equal(toMountPathPrefix("/"), "")
+    assert.equal(toMountPathPrefix(""), "")
+    assert.equal(toMountPathPrefix(undefined), "")
+})
+
+test("toMountPathPrefix: trims Vite's trailing slash", () => {
+    assert.equal(toMountPathPrefix("/o-mweb/"), "/o-mweb")
+    assert.equal(toMountPathPrefix("/o-mweb"), "/o-mweb")
+    // The joined result stays single-slashed.
+    assert.equal(`${toMountPathPrefix("/o-mweb/")}/client/index.js`, "/o-mweb/client/index.js")
+    assert.equal(`${toMountPathPrefix("/")}/client/index.js`, "/client/index.js")
+})
+
+// ─── resolveDevFsAllow: security-sensitive allowlist merge ─────────────────────
+
+const FRAMEWORK = ["/app/src", "/framework/dist/vite"]
+
+test("resolveDevFsAllow: framework paths always present, none provided", () => {
+    assert.deepEqual(resolveDevFsAllow(undefined, FRAMEWORK), FRAMEWORK)
+    assert.deepEqual(resolveDevFsAllow({}, FRAMEWORK), FRAMEWORK)
+})
+
+test("resolveDevFsAllow: apps may EXTEND but never drop framework paths", () => {
+    const result = resolveDevFsAllow({ allow: ["/extra/pkg"] }, FRAMEWORK)
+    assert.deepEqual(result, ["/app/src", "/framework/dist/vite", "/extra/pkg"])
+})
+
+test("resolveDevFsAllow: non-array allow is ignored (no widening via bad input)", () => {
+    assert.deepEqual(resolveDevFsAllow({ allow: "/" }, FRAMEWORK), FRAMEWORK)
+    assert.deepEqual(resolveDevFsAllow({ allow: null }, FRAMEWORK), FRAMEWORK)
+})
+
+// ─── buildDevServer: precedence + security ────────────────────────────────────
+
+test("buildDevServer: hmr defaults to true in dev", () => {
+    const server = buildDevServer({}, { frameworkPaths: FRAMEWORK, isProduction: false })
+    assert.equal(server.hmr, true)
+})
+
+test("buildDevServer: hmr is false in production", () => {
+    const server = buildDevServer({ hmr: { clientPort: 443 } }, { frameworkPaths: FRAMEWORK, isProduction: true })
+    assert.equal(server.hmr, false)
+})
+
+test("buildDevServer: app hmr overrides are honored in dev", () => {
+    const hmr = { clientPort: 443, path: "__vite_hmr" }
+    const server = buildDevServer({ hmr }, { frameworkPaths: FRAMEWORK, isProduction: false })
+    assert.deepEqual(server.hmr, hmr)
+})
+
+test("buildDevServer: passthrough keys (proxy/allowedHosts) are forwarded", () => {
+    const server = buildDevServer(
+        { allowedHosts: ["local.example.com"], proxy: { "/api": "http://localhost:9000" } },
+        { frameworkPaths: FRAMEWORK, isProduction: false }
+    )
+    assert.deepEqual(server.allowedHosts, ["local.example.com"])
+    assert.deepEqual(server.proxy, { "/api": "http://localhost:9000" })
+})
+
+test("buildDevServer: app fs cannot replace the allowlist, only extend it", () => {
+    const server = buildDevServer(
+        { fs: { allow: ["/extra"] } },
+        { frameworkPaths: FRAMEWORK, isProduction: false }
+    )
+    assert.deepEqual(server.fs.allow, ["/app/src", "/framework/dist/vite", "/extra"])
+})
+
+test("buildDevServer: app cannot relax fs.strict or clobber fs via overrides", () => {
+    const server = buildDevServer(
+        { fs: { allow: ["/"], strict: false } },
+        { frameworkPaths: FRAMEWORK, isProduction: false }
+    )
+    // strict is dropped entirely (framework keeps Vite's secure default), and
+    // the framework paths remain — "/" is merely appended, not a replacement.
+    assert.equal(server.fs.strict, undefined)
+    assert.ok(server.fs.allow.includes("/app/src"))
+})
+
+test("buildDevServer: 'base' is not leaked into the server block", () => {
+    const server = buildDevServer({ base: "/o-mweb" }, { frameworkPaths: FRAMEWORK, isProduction: false })
+    assert.equal(server.base, undefined)
+})