codebase-onboarder 0.1.0

package/server/paths.js

@@ -0,0 +1,39 @@
+// Path containment, in one place. Anything that turns a string the client sent
+// into a filesystem path goes through here first.
+
+import path from 'node:path';
+import os from 'node:os';
+
+// Is `abs` the root itself, or something inside it?
+//
+// The obvious `abs.startsWith(root)` is the wrong check: with a root of
+// `/home/me/repo` it also says yes to `/home/me/repo-secrets/.env`, because
+// the prefix matches before the separator does. The separator has to be part
+// of the comparison.
+export function isInside(rootAbs, abs) {
+  const root = path.resolve(rootAbs);
+  const target = path.resolve(abs);
+  if (target === root) return true;
+  return target.startsWith(root.endsWith(path.sep) ? root : root + path.sep);
+}
+
+// Resolve a repo-relative POSIX path (`src/app.js`) against a root, or return
+// null if it doesn't land inside that root.
+//
+// `path.join` normalizes `..` away before we look, so this judges a path by
+// where it ends up rather than by what it looks like — there's no spelling of
+// `..` to outsmart, and a leading `/` becomes an empty segment instead of an
+// absolute path.
+export function resolveInside(rootAbs, relPath) {
+  if (typeof relPath !== 'string' || relPath === '') return null;
+  if (relPath.includes('\0')) return null; // fs throws on these; a 400 reads better
+  const abs = path.join(rootAbs, ...relPath.split('/'));
+  return isInside(rootAbs, abs) ? abs : null;
+}
+
+// `~` and `~/code/thing` are what people actually type into the path box.
+export function expandHome(p) {
+  if (p === '~') return os.homedir();
+  if (p.startsWith('~/')) return path.join(os.homedir(), p.slice(2));
+  return path.resolve(p);
+}

package/server/router.js

@@ -0,0 +1,218 @@
+// The route table and the two gates in front of it.
+//
+// Everything arrives here: one function decides whether a request is allowed to
+// be answered at all, then which handler answers it. The routes are a list rather
+// than a ladder of `if` statements so that the whole surface of the server is
+// visible in one screen — six endpoints, and everything else is a static file.
+//
+// Neither gate is authentication. A local server with no accounts cannot
+// authenticate anyone; what it can do is refuse requests that a browser on some
+// other site made on the person's behalf. `server/httpGuards.js` explains both
+// attacks; the short version is that `Host` stops DNS rebinding from turning
+// `evil.com` into our own origin, and `Origin`/`Sec-Fetch-Site` stops a page the
+// person happened to have open from driving the API.
+
+import { handleDocs } from './apiDocs.js';
+import { handleFile } from './apiFile.js';
+import { handleCleanup, handleScan } from './apiScan.js';
+import { sendError, sendJSON, readBody } from './http.js';
+import { crossOriginReason, rebindingReason } from './httpGuards.js';
+import { proxyChat } from './llmProxy.js';
+import { serveStatic } from './static.js';
+import { handleSearch } from './apiSearch.js';
+import { handleBlame } from './apiGitBlame.js';
+import { handleDiff, handleDiffRefs } from './apiDiff.js';
+import { handleToolsInstall, handleToolsRun, handleToolsStatus } from './apiTools.js';
+import { handleMcpStart, handleMcpStatus, handleMcpStop, handleMcpCommand } from './apiMcp.js';
+import { handleGetSettings, handleRotateAccessKey, handleUpdateSettings } from './apiSettings.js';
+import { allowedHosts, authReason, DEFAULT_SETTINGS } from './config.js';
+
+const ROUTES = [
+  {
+    method: 'GET', path: '/api/diff/refs', sameOrigin: true,
+    run: ({ res, url }) => handleDiffRefs(res, url.searchParams.get('scan')),
+  },
+  {
+    method: 'GET', path: '/api/diff', sameOrigin: true,
+    run: ({ res, url }) => handleDiff(res, url.searchParams.get('scan'), url.searchParams),
+  },
+  {
+    method: 'POST', path: '/api/search', body: true,
+    run: ({ res, body }) => handleSearch(res, body),
+  },
+  {
+    method: 'GET', path: '/api/blame', sameOrigin: true,
+    run: ({ res, url }) => handleBlame(res, url.searchParams.get('scan'), url.searchParams.get('path')),
+  },
+  {
+    method: 'POST', path: '/api/scan', body: true,
+    run: ({ res, body, config }) => handleScan(res, body, config),
+  },
+  {
+    method: 'DELETE', prefix: '/api/scan/',
+    run: ({ res, rest }) => handleCleanup(res, decodeURIComponent(rest)),
+  },
+  {
+    method: 'GET', path: '/api/file', sameOrigin: true,
+    run: ({ res, url }) => handleFile(res, url.searchParams.get('scan'), url.searchParams.get('path')),
+  },
+  {
+    // The proxy is the handler; there is no wrapper to write. It forwards the
+    // browser's key to the endpoint the browser chose and never keeps either.
+    method: 'POST', path: '/api/explain', body: true,
+    run: ({ res, body }) => proxyChat(res, body),
+  },
+  {
+    method: 'POST', path: '/api/doc', body: true,
+    run: ({ res, body }) => handleDocs(res, body),
+  },
+  {
+    // Reports which analyzers are installed — environment information a foreign
+    // page has no business reading, so it is guarded like /api/file.
+    method: 'GET', path: '/api/tools', sameOrigin: true,
+    run: ({ res }) => handleToolsStatus(res),
+  },
+  {
+    // Runs real analyzers over a scanned root. `body: true` applies the size
+    // limit; the session check in the handler is the capability gate.
+    method: 'POST', path: '/api/tools/run', body: true,
+    run: ({ res, body }) => handleToolsRun(res, body),
+  },
+  {
+    // Installs a missing analyzer from the GUI. Same-origin like every POST;
+    // the tool name is validated against the registry and the install plans
+    // are fixed data, so the request body never reaches a command line.
+    method: 'POST', path: '/api/tools/install', body: true,
+    run: ({ res, body }) => handleToolsInstall(res, body),
+  },
+  {
+    // The MCP button's state, and the command an agent harness is configured with.
+    // The config is not secret, but it is a path into this machine and a foreign
+    // page has no business reading either one.
+    method: 'GET', path: '/api/mcp', sameOrigin: true,
+    run: ({ req, res, config }) => handleMcpStatus(req, res, config),
+  },
+  {
+    method: 'GET', path: '/api/mcp/command', sameOrigin: true,
+    run: ({ req, res, config }) => handleMcpCommand(req, res, config),
+  },
+  {
+    // Starting and stopping a process is a side effect on the person's machine, so
+    // these take a body like every other POST and are checked like every other POST.
+    method: 'POST', path: '/api/mcp/start', body: true,
+    run: ({ req, res, config }) => handleMcpStart(req, res, config),
+  },
+  {
+    method: 'POST', path: '/api/mcp/stop', body: true,
+    run: ({ req, res, config }) => handleMcpStop(req, res, config),
+  },
+  {
+    method: 'GET', path: '/api/health',
+    run: ({ res }) => sendJSON(res, 200, { ok: true }),
+  },
+  {
+    // The settings drawer and the CLI read the same public shape: everything
+    // about the configuration except the access key itself.
+    method: 'GET', path: '/api/settings', sameOrigin: true,
+    run: ({ req, res, config }) => handleGetSettings(req, res, config),
+  },
+  {
+    // PATCH semantics over a small allow-listed key set; the validation that
+    // rejects a bad port or a lawless mode lives in `server/config.js` and is
+    // shared with the CLI wizard, so both surfaces enforce one schema.
+    method: 'PUT', path: '/api/settings', body: true,
+    run: ({ res, body, config }) => handleUpdateSettings(res, body, config),
+  },
+  {
+    // The only way the key changes: generated on the server, shown once in
+    // this response, never readable again. In self-hosted mode this endpoint
+    // is itself behind the current key, so rotation requires possession.
+    method: 'POST', path: '/api/settings/access-key', body: true,
+    run: ({ res, config }) => handleRotateAccessKey(res, config),
+  },
+];
+
+// The table itself, for the test that walks it. Exported read-only: the routes
+// are decided here, not assembled by whoever imports this.
+export const routes = Object.freeze(ROUTES.map((r) => Object.freeze({ ...r })));
+
+export function matchRoute(method, pathname) {
+  for (const route of ROUTES) {
+    if (route.method !== method) continue;
+    if (route.path === pathname) return { route, rest: '' };
+    if (route.prefix && pathname.startsWith(route.prefix)) {
+      return { route, rest: pathname.slice(route.prefix.length) };
+    }
+  }
+  return null;
+}
+
+// `config` carries the directories the handlers need — the project root to scan
+// for the demo, and the two roots static serving maps into. Passed in rather
+// than resolved here so a test can point the server somewhere else, and so this
+// module has nothing to say about where it was installed.
+//
+// Settings arrive the same way: `config.getSettings` is read on every request,
+// so a key rotated or a domain changed through the API takes effect on the next
+// request without a restart. A bare `createServer()` (the tests) has no getter
+// and sees the local-mode defaults — never somebody's home directory.
+async function liveSettings(config) {
+  if (typeof config?.getSettings !== 'function') return DEFAULT_SETTINGS;
+  try {
+    return await config.getSettings();
+  } catch {
+    return null; // unreadable config: fail closed, every /api call gets a 500
+  }
+}
+
+export function createRouter(config) {
+  return async function handleRequest(req, res) {
+    try {
+      const url = new URL(req.url, 'http://127.0.0.1');
+
+      const settings = await liveSettings(config);
+      if (!settings) {
+        return sendError(res, 500, 'The settings file could not be read — run `onboarder doctor` to find out why.');
+      }
+
+      const wrongHost = rebindingReason(req, allowedHosts(settings));
+      if (wrongHost) {
+        const scope = settings.mode === 'self-hosted'
+          ? 'Onboarder only answers to its configured host and domain. '
+          : 'Onboarder only answers to localhost. ';
+        return sendError(res, 403, scope + wrongHost);
+      }
+
+      const found = matchRoute(req.method, url.pathname);
+      if (req.method !== 'GET' || found?.route.sameOrigin) {
+        const foreign = crossOriginReason(req);
+        if (foreign) {
+          return sendError(res, 403, 'That request did not come from Onboarder’s own page. ' + foreign);
+        }
+      }
+
+      // The self-hosted gate. It is authentication, unlike the two guards
+      // above: the mode says the network can reach us, so every API call
+      // proves it holds the access key. `/api/health` stays open — a tunnel
+      // or uptime check has no key and tells an attacker nothing.
+      if (found && url.pathname.startsWith('/api/') && url.pathname !== '/api/health') {
+        const denied = authReason(req, settings);
+        if (denied) return sendError(res, 401, denied);
+      }
+
+      if (found) {
+        const body = found.route.body ? await readBody(req) : null;
+        return await found.route.run({ req, res, url, body, rest: found.rest, config });
+      }
+
+      if (req.method === 'GET') return await serveStatic(res, url.pathname, config);
+
+      sendError(res, 404, 'Nothing lives at ' + url.pathname + '.');
+    } catch (err) {
+      // The last resort. Handlers turn their own expected failures into a status
+      // that says something useful; anything reaching here is a bug or a broken
+      // request body, and the message is more use to the person than "500".
+      sendError(res, 500, err.message || 'Something went sideways.');
+    }
+  };
+}

package/server/searchIndex.js

@@ -0,0 +1,118 @@
+// The search index lives with the scan, not behind a request. Building it
+// here means:
+//
+//   * The first /api/search call is fast. The user is searching — make it feel
+//     that way; the work that would have been a request-blocking second walk
+//     is already done.
+//   * The index reads exactly the files the scanner did. The caller hands us
+//     `scan.files`, the list of paths the scanner accepted; we never walk
+//     the tree ourselves, so the index can never disagree with the scan
+//     about which files exist.
+//   * The index has a hard cap. A repo with a single 200 MB SQL dump used to
+//     hold its full content in the process for the lifetime of the session;
+//     now it stops indexing at the cap and records what it skipped, so a
+//     future "why doesn't my file show up?" question has a real answer.
+//
+// The on-disk cost of the work the old /api/search did — re-listing every
+// directory, re-reading every file, parsing its tokens — is gone. The
+// per-request cost is one Map lookup plus the scoring pass over matching
+// documents, which is bounded by the index size, not the repo size.
+
+const DEFAULTS = {
+  // Aggregate content size. Files beyond this are not indexed, only counted.
+  // 200 MB is enough to index the source of a large monorepo comfortably;
+  // past that the search would be matching against vendor copies and
+  // generated code more often than against code people wrote.
+  maxTotalBytes: 200 * 1024 * 1024,
+  // Per-file ceiling. Files larger than this are skipped (the scanner has
+  // its own ceiling for the same reason).
+  maxFileBytes: 1024 * 1024,
+  // Reads in flight at once. Same shape as `scan.js`'s read-ahead — a file
+  // is held in memory whole before the next one starts.
+  width: 8,
+};
+
+const BINARY_HEAD_BYTES = 1000;
+
+function looksBinary(content) {
+  // NUL in the first KB is a reliable, cheap heuristic for "this is not
+  // text the search would help with". The first KB also covers the BOM and
+  // the shebang without missing the start of the file.
+  return content.slice(0, BINARY_HEAD_BYTES).includes('\0');
+}
+
+// Read each path's text up to width at a time. Failures are skipped, the
+// same way `scan.js:readAhead` handles them: one unreadable file should not
+// end an index build, and the caller counts it in `skipped.readFailed`.
+async function* readAhead(source, paths, width) {
+  const inFlight = [];
+  let next = 0;
+  const read = (p) =>
+    Promise.resolve()
+      .then(() => source.read(p))
+      .then(
+        (text) => ({ path: p, text, failed: false }),
+        () => ({ path: p, text: '', failed: true }),
+      );
+
+  while (next < paths.length && inFlight.length < width) inFlight.push(read(paths[next++]));
+  while (inFlight.length) {
+    const settled = inFlight.shift();
+    if (next < paths.length) inFlight.push(read(paths[next++]));
+    yield await settled;
+  }
+}
+
+// Build the search index from the file list the scanner already produced.
+// The scanner has read these files once for parsing; indexing reads them a
+// second time for tokenizing, which is the cheapest place to do it — a
+// refactor that streamed text from the scanner into both consumers would
+// save one disk pass at the cost of a much larger refactor. This is the
+// smallest change that closes the audit's three real concerns (first-search
+// latency, no aggregate cap, no concurrency).
+export async function buildSearchIndex(source, codeFiles, options = {}) {
+  const opts = { ...DEFAULTS, ...options };
+  const index = new Map();
+  const docCounts = new Map();
+  let totalDocs = 0;
+  let totalBytes = 0;
+
+  // Files the indexer cannot or will not index, broken down by reason. The
+  // shape matches `scan.js:skips` so a future UI surface can render one
+  // unified "what was left out" panel without translation.
+  const skipped = {
+    tooLarge: 0,    // one file over maxFileBytes
+    overCap: 0,     // a later file pushed the aggregate over maxTotalBytes
+    readFailed: 0,  // the file would not read
+    binary: 0,      // NUL in the first KB
+    noTokens: 0,    // the file read, but tokenizing produced nothing useful
+  };
+
+  for await (const { path, text, failed } of readAhead(source, codeFiles, opts.width)) {
+    if (failed) { skipped.readFailed++; continue; }
+
+    if (text.length > opts.maxFileBytes) { skipped.tooLarge++; continue; }
+    if (totalBytes + text.length > opts.maxTotalBytes) { skipped.overCap++; continue; }
+    if (looksBinary(text)) { skipped.binary++; continue; }
+
+    const tokens = text.toLowerCase().split(/\W+/).filter((t) => t.length > 1);
+    if (!tokens.length) { skipped.noTokens++; continue; }
+
+    const tf = new Map();
+    for (const t of tokens) tf.set(t, (tf.get(t) || 0) + 1);
+    for (const t of tf.keys()) docCounts.set(t, (docCounts.get(t) || 0) + 1);
+
+    index.set(path, { tf, content: text, tokenCount: tokens.length });
+    totalDocs++;
+    totalBytes += text.length;
+  }
+
+  return {
+    index,
+    docCounts,
+    totalDocs,
+    totalBytes,
+    skipped,
+    cap: { maxFileBytes: opts.maxFileBytes, maxTotalBytes: opts.maxTotalBytes },
+  };
+}

package/server/sessions.js

@@ -0,0 +1,163 @@
+// What the server remembers between requests: which directory each scan came
+// from. `/api/file` needs it — the browser asks for `server/paths.js` and the
+// server has to know which root that is relative to — and the git-URL flow needs
+// it to find a clone again when the page says it is done with one.
+//
+// A scan id is the capability. Handing the browser a path and trusting it back
+// would make `/api/file` a "read any file on this machine" endpoint; handing it
+// an opaque id means the only readable roots are ones the person chose to scan
+// during this run.
+//
+// Two things the inline Map this replaces got wrong:
+//
+//   * It never forgot. Every scan added an entry and nothing removed one, so an
+//     afternoon of scanning left a growing list of roots still being served
+//     from. A cap with oldest-out eviction bounds it, and evicting a cloned repo
+//     deletes the clone with it.
+//   * It leaked clones on exit. A clone lives in the OS temp dir until someone
+//     removes it, and only an explicit `DELETE /api/scan/:id` did. Ctrl-C left
+//     every clone of the session behind — hundreds of megabytes, silently.
+
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { realpathSync } from 'node:fs';
+
+import { isCloneDir, removeClone, removeCloneSync } from './gitClone.js';
+
+// Twelve repos is far more than anyone holds open at once, and each entry is a
+// couple of strings — the cap is about not serving from a root the person has
+// forgotten scanning, not about memory.
+export const MAX_SESSIONS = 12;
+
+// scanId -> { root, cloneDir, at, searchIndex? }. Insertion-ordered, which is
+// what makes "oldest first" a `keys().next()` rather than a sort.
+//
+// `searchIndex`, when present, is the TF-IDF index built at scan time
+// (`searchIndex.js`). It is held on the session for the same reason `root`
+// is — `/api/search` is a request that has to be answered against this
+// particular scan — and is dropped when the session is evicted. Reopening
+// the same repo would rebuild it; the cost of one scan's worth of work is
+// far below the cost of re-fetching the repo.
+const sessions = new Map();
+
+export function openSession({ root, cloneDir = null, searchIndex = null }) {
+  const scanId = crypto.randomBytes(8).toString('hex');
+  sessions.set(scanId, { root: canonicalRoot(root), cloneDir, at: Date.now(), searchIndex });
+  evictBeyondCap();
+  return scanId;
+}
+
+// Resolve symlinks once, so the root every consumer sees is the real one. On
+// macOS `/tmp` is a symlink to `/private/tmp`, and an analyzer run against the
+// alias reports paths rooted at the target — without this, `/api/tools/run`
+// findings and `/api/file` lookups would silently miss every file in a repo
+// scanned through a symlinked path. Failing to resolve (a path that is gone)
+// is not fatal: the original is used and the scan's own error path reports it.
+function canonicalRoot(root) {
+  if (typeof root !== 'string' || !root) return root;
+  try {
+    return realpathSync(root);
+  } catch {
+    return root;
+  }
+}
+
+// Reading from a scan keeps it alive. Without the touch, opening files in the
+// first repo you scanned is what evicts it — you would lose the one you are
+// actually using and keep eleven you are not.
+export function getSession(scanId) {
+  if (!scanId) return null;
+  const session = sessions.get(scanId);
+  if (!session) return null;
+  session.at = Date.now();
+  sessions.delete(scanId);
+  sessions.set(scanId, session);
+  return session;
+}
+
+// Clone ids are the 12 hex characters `gitClone` puts after `onboarder-`. The
+// match is on the exact directory name: `endsWith(cloneId)` treated an empty id
+// as a match against every clone, so `DELETE /api/scan/` used to delete
+// whichever clone the map happened to yield first.
+export function isCloneId(id) {
+  return /^[0-9a-f]{12}$/.test(id || '');
+}
+
+// Removes the clone with this id and forgets every scan pointing at it. Returns
+// whether anything was there — a repeat DELETE is not an error; the page sends
+// one on unload and may well be the second to arrive.
+export async function closeClone(cloneId) {
+  const dirName = 'onboarder-' + cloneId;
+  let found = null;
+  for (const [scanId, session] of sessions) {
+    if (session.cloneDir && path.basename(session.cloneDir) === dirName) {
+      found = session.cloneDir;
+      sessions.delete(scanId);
+    }
+  }
+  if (found) await removeClone(found);
+  return Boolean(found);
+}
+
+function evictBeyondCap() {
+  while (sessions.size > MAX_SESSIONS) {
+    const [scanId, session] = sessions.entries().next().value;
+    sessions.delete(scanId);
+    if (session.cloneDir && !stillReferenced(session.cloneDir)) sweep(session.cloneDir);
+  }
+}
+
+// Eviction happens inside a scan request, and the person is waiting on the scan,
+// not on a directory being swept — so the removal is started and not awaited. The
+// promises are chained rather than dropped so that a caller who does need to know
+// when the disk is quiet can wait for it; the only one that does is a test.
+let removals = Promise.resolve();
+
+function sweep(dir) {
+  removals = removals.then(() => removeClone(dir));
+}
+
+export function removalsSettled() {
+  return removals;
+}
+
+// Two sessions can name the same clone — scan a git URL, then scan the temp path
+// it landed in. Do not delete a directory another live session still reads from.
+function stillReferenced(dir) {
+  for (const session of sessions.values()) if (session.cloneDir === dir) return true;
+  return false;
+}
+
+// Synchronous on purpose: this is what an exit handler can finish.
+export function sweepClonesSync() {
+  for (const [scanId, session] of sessions) {
+    sessions.delete(scanId);
+    if (isCloneDir(session.cloneDir)) removeCloneSync(session.cloneDir);
+  }
+}
+
+// Called from the `node server/index.js` path only, never on import. The tests
+// drive the real router in-process, and a module that added signal handlers just
+// by being imported would take Ctrl-C away from the test runner.
+export function installExitCleanup(proc = process) {
+  proc.on('exit', sweepClonesSync);
+  // A signal does not run `exit` handlers on its own — the process dies where it
+  // stands. Sweeping in the signal handler and then exiting is what gets the
+  // clones removed.
+  for (const signal of ['SIGINT', 'SIGTERM', 'SIGHUP']) {
+    proc.on(signal, () => {
+      sweepClonesSync();
+      proc.exit(0);
+    });
+  }
+}
+
+// Tests only. The store is module state, so a test that opens sessions would
+// otherwise leak them into the next one.
+export function _resetSessions() {
+  sessions.clear();
+}
+
+export function _sessionCount() {
+  return sessions.size;
+}

package/server/static.js

@@ -0,0 +1,59 @@
+// Serving the app itself: `public/` is the site root, and `/shared/` is mapped to
+// the repo's `shared/` directory so the analyzer the server imports and the
+// analyzer the browser imports are the same files. That mapping is the reason
+// nothing under `shared/` may touch `fs` or `window` — both runtimes load it.
+//
+// It also means no relative specifier can point from `public/js/` into `shared/`
+// and work in both places, which is why browser modules reach for `/shared/...`
+// and pure logic that Node needs to test lives in `shared/` rather than beside
+// its caller.
+
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+import { sendError } from './http.js';
+import { resolveInside } from './paths.js';
+
+const MIME = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.ico': 'image/x-icon',
+  '.map': 'application/json',
+  '.woff2': 'font/woff2',
+};
+
+// `null` for anything that resolves outside the directory it was mapped into —
+// `resolveInside` is the traversal guard, and a request for `/../../etc/passwd`
+// has to fail here rather than reach `readFile`.
+export function resolveAsset(urlPath, { publicDir, sharedDir }) {
+  if (urlPath === '/' || urlPath === '/index.html') return path.join(publicDir, 'index.html');
+  if (urlPath.startsWith('/shared/')) return resolveInside(sharedDir, urlPath.slice('/shared/'.length));
+  return resolveInside(publicDir, urlPath);
+}
+
+// Everything we author is served no-cache: the UI and the engine ship as loose
+// modules with no build step and no content hashes, so a stale app.js against a
+// fresh index.html breaks the whole page. Vendored builds are the exception —
+// they are versioned by the directory they sit in and never edited in place.
+export function cacheControlFor(file) {
+  return file.includes(path.sep + 'vendor' + path.sep) ? 'public, max-age=86400' : 'no-cache';
+}
+
+export async function serveStatic(res, urlPath, dirs) {
+  const file = resolveAsset(urlPath, dirs);
+  if (!file) return sendError(res, 403, 'Not from here.');
+
+  const data = await fs.readFile(file).catch(() => null);
+  if (data === null) return sendError(res, 404, 'Not found: ' + urlPath);
+
+  res.writeHead(200, {
+    'content-type': MIME[path.extname(file).toLowerCase()] || 'application/octet-stream',
+    'cache-control': cacheControlFor(file),
+  });
+  res.end(data);
+}