dinou 4.0.12 → 4.0.14

package/CHANGELOG.md

@@ -5,6 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [4.0.14] - 2026-06-29
+### Added
+- **Soft Redirects**: Exposes the SPA transition navigation internally via `window.__DINOU_ROUTER_NAVIGATE__` to enable smooth client-side redirects from both Server Functions and RSC payloads, keeping the React client state intact and preventing full browser page reloads.
+### Fixed
+- **External Links Interception**: Restored native browser navigation for external domains, protocol-relative links (`//...`), and special protocols (`mailto:`, `tel:`, etc.) by preventing the SPA router from capturing or prefetching non-internal routes.
+
+## [4.0.13] - 2026-06-29
+
+### Added
+- **Universal Redirects**: Full support for redirects on Server Components, `getProps`, Server Actions, and client SPA navigation.
+- **Standard Relative Paths**: Support for relative paths (`../sibling`, `./child`, `?query`, `#hash`) matching directory-first URL resolution.
+- **Absolute Link Hover**: Links now render resolved absolute paths to ensure correct browser previews and right-click behaviors.
+
+### Fixed
+- **RSC Stream Stability**: Resolved socket crashes (`Connection closed`) and duplicate Express header warnings when redirects occur during streamed RSC requests.
+- **SSR Process Leaks**: Render processes are now cleaned up immediately after an HTML redirect is triggered.
+
+### Security
+- **Redirect Sanitization**: Blocked unsafe external domains (`https://...`), protocol-relative URLs (`//...`), and scripting payloads (`javascript:...`).
+
+### Refactored
+- **Shared Helpers**: Unified path resolution logic into a shared module (`url-resolver.js`).
+
 ## [4.0.12] - 2026-06-28
 
 ### Security

package/dinou/core/client-error-webpack.jsx

@@ -9,7 +9,7 @@ import {
 import { createFromFetch } from "react-server-dom-webpack/client";
 import { hydrateRoot } from "react-dom/client";
 import { RouterContext } from "./navigation.js";
-import { resolveUrl } from "./navigation-utils.js";
+import { resolveUrl, isExternalUrl } from "./navigation-utils.js";
 
 // ====================================================================
 // 1. GLOBAL STATE (Outside the component)
@@ -167,7 +167,7 @@ function Router() {
       }
 
       const href = anchor.getAttribute("href");
-      if (!href || href.startsWith("mailto:") || href.startsWith("tel:"))
+      if (!href || href.startsWith("mailto:") || href.startsWith("tel:") || isExternalUrl(href))
         return;
 
       // We use the unified helper

package/dinou/core/client-error.jsx

@@ -9,7 +9,7 @@ import {
 import { createFromFetch } from "@roggc/react-server-dom-esm/client";
 import { hydrateRoot } from "react-dom/client";
 import { RouterContext } from "./navigation.js";
-import { resolveUrl } from "./navigation-utils.js";
+import { resolveUrl, isExternalUrl } from "./navigation-utils.js";
 
 // ====================================================================
 // 1. GLOBAL STATE (Outside the component)
@@ -167,7 +167,7 @@ function Router() {
       }
 
       const href = anchor.getAttribute("href");
-      if (!href || href.startsWith("mailto:") || href.startsWith("tel:"))
+      if (!href || href.startsWith("mailto:") || href.startsWith("tel:") || isExternalUrl(href))
         return;
 
       // We use the unified helper

package/dinou/core/client-redirect.jsx

@@ -1,15 +1,22 @@
 // dinou/core/client-redirect.jsx
 "use client";
 
-import { useEffect } from "react";
 import { useRouter } from "./navigation.js";
 
 export function ClientRedirect({ to }) {
   const router = useRouter();
 
-  useEffect(() => {
-    router.replace(to);
-  }, [to, router]);
+  if (typeof window !== "undefined") {
+    Promise.resolve().then(() => {
+      if (window.__DINOU_ROUTER_NAVIGATE__) {
+        window.__DINOU_ROUTER_NAVIGATE__(to, { replace: true });
+      } else {
+        router.replace(to);
+      }
+    });
+    // Suspend to prevent React from committing this intermediate page
+    throw new Promise(() => {});
+  }
 
   return null;
 }

package/dinou/core/client-webpack.jsx

@@ -9,7 +9,7 @@ import {
 import { createFromFetch } from "react-server-dom-webpack/client";
 import { hydrateRoot } from "react-dom/client";
 import { RouterContext } from "./navigation.js";
-import { resolveUrl } from "./navigation-utils.js";
+import { resolveUrl, isExternalUrl } from "./navigation-utils.js";
 
 // ====================================================================
 // 1. GLOBAL STATE (Outside the component)
@@ -38,7 +38,7 @@ const isHashChangeOnly = (finalPath) => {
   );
 };
 
-const getRSCPayload = (rscKey) => {
+const getRSCPayload = (rscKey, isPrefetch = false) => {
   const url = rscKey.split("::")[0];
   // 1. Check Idempotence (Avoids the infinite loop of React)
   if (cache.has(url)) {
@@ -64,7 +64,24 @@ const getRSCPayload = (rscKey) => {
   }
 
   // 3. Fetch and Cache Storage
-  const promise = createFromFetch(fetch(payloadUrl));
+  const promise = createFromFetch(
+    fetch(payloadUrl).then((res) => {
+      if (res.headers.has("x-rsc-redirect")) {
+        const redirectUrl = res.headers.get("x-rsc-redirect");
+        cache.delete(url);
+        if (!isPrefetch) {
+          if (window.__DINOU_ROUTER_NAVIGATE__) {
+            window.__DINOU_ROUTER_NAVIGATE__(redirectUrl, { replace: true });
+          } else {
+            window.location.href = redirectUrl;
+          }
+        }
+        // Return a promise that never resolves to avoid React Server DOM throwing "Connection closed"
+        return new Promise(() => {});
+      }
+      return res;
+    }),
+  );
   cache.set(url, promise); // <--- KEY TO AVOID LOOP
   return promise;
 };
@@ -79,18 +96,6 @@ function Router() {
   const [isPending, startTransition] = useTransition();
   const [version, setVersion] = useState(0);
 
-  // 🔌 EFFECT 1: Expose Global Prefetch
-  useEffect(() => {
-    window.__DINOU_PREFETCH__ = (url) => {
-      // 🛡️ PREFETCH PROTECTION: If it's a local hash, do nothing
-      if (isHashChangeOnly(url)) return;
-      getRSCPayload(url);
-    };
-
-    // Hydration
-    document.body.setAttribute("data-hydrated", "true");
-  }, []); // Only on mount
-
   // 🧭 NAVIGATE FUNCTION (Core Logic)
   const navigate = (href, options = {}) => {
     const finalPath = resolveUrl(href, window.location.pathname);
@@ -136,6 +141,26 @@ function Router() {
     });
   };
 
+  // 🔌 EFFECT 1: Expose Global Prefetch & Navigation
+  useEffect(() => {
+    window.__DINOU_PREFETCH__ = (url) => {
+      // 🛡️ PREFETCH PROTECTION: If it's a local hash, do nothing
+      if (isHashChangeOnly(url)) return;
+      getRSCPayload(url, true);
+    };
+
+    window.__DINOU_ROUTER_NAVIGATE__ = navigate;
+
+    // Hydration
+    document.body.setAttribute("data-hydrated", "true");
+
+    return () => {
+      if (window.__DINOU_ROUTER_NAVIGATE__ === navigate) {
+        window.__DINOU_ROUTER_NAVIGATE__ = undefined;
+      }
+    };
+  }, [navigate]);
+
   const back = () => window.history.back();
   const forward = () => window.history.forward();
   const refresh = () => {
@@ -174,7 +199,7 @@ function Router() {
       }
 
       const href = anchor.getAttribute("href");
-      if (!href || href.startsWith("mailto:") || href.startsWith("tel:"))
+      if (!href || href.startsWith("mailto:") || href.startsWith("tel:") || isExternalUrl(href))
         return;
 
       // We use the unified helper

package/dinou/core/client.jsx

@@ -10,7 +10,7 @@ import {
 import { createFromFetch } from "@roggc/react-server-dom-esm/client";
 import { hydrateRoot } from "react-dom/client";
 import { RouterContext } from "./navigation.js";
-import { resolveUrl } from "./navigation-utils.js";
+import { resolveUrl, isExternalUrl } from "./navigation-utils.js";
 
 // ====================================================================
 // 1. GLOBAL STATE (Outside the component)
@@ -39,7 +39,7 @@ const isHashChangeOnly = (finalPath) => {
   );
 };
 
-const getRSCPayload = (rscKey) => {
+const getRSCPayload = (rscKey, isPrefetch = false) => {
   const url = rscKey.split("::")[0];
   // 1. Check Idempotence (Avoids the infinite loop of React)
   if (cache.has(url)) {
@@ -65,7 +65,24 @@ const getRSCPayload = (rscKey) => {
   }
 
   // 3. Fetch and Cache Storage
-  const promise = createFromFetch(fetch(payloadUrl));
+  const promise = createFromFetch(
+    fetch(payloadUrl).then((res) => {
+      if (res.headers.has("x-rsc-redirect")) {
+        const redirectUrl = res.headers.get("x-rsc-redirect");
+        cache.delete(url);
+        if (!isPrefetch) {
+          if (window.__DINOU_ROUTER_NAVIGATE__) {
+            window.__DINOU_ROUTER_NAVIGATE__(redirectUrl, { replace: true });
+          } else {
+            window.location.href = redirectUrl;
+          }
+        }
+        // Return a promise that never resolves to avoid React Server DOM throwing "Connection closed"
+        return new Promise(() => {});
+      }
+      return res;
+    }),
+  );
   cache.set(url, promise); // <--- KEY TO AVOID LOOP
   return promise;
 };
@@ -80,18 +97,6 @@ function Router() {
   const [isPending, startTransition] = useTransition();
   const [version, setVersion] = useState(0);
 
-  // 🔌 EFFECT 1: Expose Global Prefetch
-  useEffect(() => {
-    window.__DINOU_PREFETCH__ = (url) => {
-      // 🛡️ PREFETCH PROTECTION: If it's a local hash, do nothing
-      if (isHashChangeOnly(url)) return;
-      getRSCPayload(url);
-    };
-
-    // Hydration
-    document.body.setAttribute("data-hydrated", "true");
-  }, []); // Only on mount
-
   // 🧭 NAVIGATE FUNCTION (Core Logic)
   const navigate = (href, options = {}) => {
     const finalPath = resolveUrl(href, window.location.pathname);
@@ -137,6 +142,26 @@ function Router() {
     });
   };
 
+  // 🔌 EFFECT 1: Expose Global Prefetch & Navigation
+  useEffect(() => {
+    window.__DINOU_PREFETCH__ = (url) => {
+      // 🛡️ PREFETCH PROTECTION: If it's a local hash, do nothing
+      if (isHashChangeOnly(url)) return;
+      getRSCPayload(url, true);
+    };
+
+    window.__DINOU_ROUTER_NAVIGATE__ = navigate;
+
+    // Hydration
+    document.body.setAttribute("data-hydrated", "true");
+
+    return () => {
+      if (window.__DINOU_ROUTER_NAVIGATE__ === navigate) {
+        window.__DINOU_ROUTER_NAVIGATE__ = undefined;
+      }
+    };
+  }, [navigate]);
+
   const back = () => window.history.back();
   const forward = () => window.history.forward();
   const refresh = () => {
@@ -175,7 +200,7 @@ function Router() {
       }
 
       const href = anchor.getAttribute("href");
-      if (!href || href.startsWith("mailto:") || href.startsWith("tel:"))
+      if (!href || href.startsWith("mailto:") || href.startsWith("tel:") || isExternalUrl(href))
         return;
 
       // We use the unified helper

package/dinou/core/link.jsx

@@ -1,7 +1,7 @@
 "use client";
 
-import { useRouter } from "./navigation.js";
-import { resolveUrl } from "./navigation-utils.js";
+import { useRouter, usePathname } from "./navigation.js";
+import { resolveUrl, isExternalUrl } from "./navigation-utils.js";
 
 export function Link({
   href,
@@ -11,17 +11,18 @@ export function Link({
   ...props
 }) {
   const { push } = useRouter();
+  const pathname = usePathname();
+  const resolvedHref = resolveUrl(href, pathname);
 
   const handlePrefetch = () => {
-    if (!prefetch || !href || fresh) return;
-    const finalPath = resolveUrl(href, window.location.pathname);
+    if (!prefetch || !href || fresh || isExternalUrl(href)) return;
     if (window.__DINOU_PREFETCH__) {
-      window.__DINOU_PREFETCH__(finalPath);
+      window.__DINOU_PREFETCH__(resolvedHref);
     }
   };
 
   const handleClick = (e) => {
-    if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey) return;
+    if (e.metaKey || e.ctrlKey || e.shiftKey || e.altKey || isExternalUrl(href)) return;
 
     e.preventDefault();
     push(href, { fresh });
@@ -29,7 +30,7 @@ export function Link({
 
   return (
     <a
-      href={href}
+      href={resolvedHref}
       onClick={handleClick}
       onMouseEnter={handlePrefetch}
       {...props}

package/dinou/core/navigation-utils.js

@@ -1,13 +1,46 @@
+export function isExternalUrl(href) {
+  if (!href) return false;
+
+  // Protocol-relative (e.g. //google.com)
+  if (href.startsWith("//")) {
+    return true;
+  }
+
+  // Absolute with protocol (e.g. https://google.com)
+  if (href.includes("://")) {
+    try {
+      const origin = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+      const url = new URL(href, origin);
+      return url.origin !== origin;
+    } catch (e) {
+      return true;
+    }
+  }
+
+  // Other protocols (mailto:, tel:, javascript:, etc.)
+  if (/^[a-zA-Z0-9+-.]+:[^//]/.test(href) || href.startsWith("mailto:") || href.startsWith("tel:") || href.startsWith("javascript:")) {
+    return true;
+  }
+
+  return false;
+}
+
 export function resolveUrl(href, currentPathname) {
+  if (isExternalUrl(href)) {
+    return href;
+  }
+
+  const origin = typeof window !== "undefined" ? window.location.origin : "http://localhost";
+
   if (href.startsWith("/") || href.includes("://")) {
-    const url = new URL(href, window.location.origin);
+    const url = new URL(href, origin);
     return normalize(url.pathname + url.search + url.hash);
   }
 
   let base = currentPathname;
   if (!base.endsWith("/")) base += "/";
 
-  const resolved = new URL(href, window.location.origin + base);
+  const resolved = new URL(href, origin + base);
   return normalize(resolved.pathname + resolved.search + resolved.hash);
 }
 

package/dinou/core/render-app-to-html.js

@@ -27,6 +27,8 @@ const childExecArgv = ESSENTIAL_NODE_ARGS.concat(loaderArg);
 
 // ----------------------------------------------------
 
+const { resolveRelativeUrl } = require("./url-resolver");
+
 function renderAppToHtml(
   reqPath,
   paramsString,
@@ -82,13 +84,28 @@ function renderAppToHtml(
         if (res.headersSent) {
           // --- REDIRECT (JS Injection) ---
           if (command === "redirect") {
-            const url = args.length === 1 ? args[0] : args[1];
+            const rawUrl = args.length === 1 ? args[0] : args[1];
+            const resolvedUrl = resolveRelativeUrl(rawUrl, reqPath);
             console.log(
-              `[Dinou] Streaming active. Redirecting via JavaScript to: ${url}`,
+              `[Dinou] Streaming active. Redirecting via JavaScript to: ${resolvedUrl}`,
             );
-            const safeUrl = JSON.stringify(url);
+            let finalUrl = "/";
+            if (
+              typeof resolvedUrl === "string" &&
+              resolvedUrl.startsWith("/") &&
+              !resolvedUrl.startsWith("//")
+            ) {
+              finalUrl = resolvedUrl;
+            } else {
+              console.warn(
+                `[Dinou Security] Blocked unsafe streaming redirect to: ${rawUrl}`,
+              );
+            }
+            const safeUrl = JSON.stringify(finalUrl);
             res.write(`<script>window.location.href = ${safeUrl};</script>`);
             res.end();
+            child.stdout.unpipe(res);
+            child.kill();
             return;
           }
 
@@ -186,16 +203,19 @@ function renderAppToHtml(
             rawUrl = args[0];
           }
 
+          // Resolve relative URL relative to reqPath
+          const resolvedUrl = resolveRelativeUrl(rawUrl, reqPath);
+
           // 2. Security Logic (Safe Redirect)
           // We allow only relative routes starting with '/' but not '//'
           let finalUrl = "/";
 
           if (
-            typeof rawUrl === "string" &&
-            rawUrl.startsWith("/") &&
-            !rawUrl.startsWith("//")
+            typeof resolvedUrl === "string" &&
+            resolvedUrl.startsWith("/") &&
+            !resolvedUrl.startsWith("//")
           ) {
-            finalUrl = rawUrl;
+            finalUrl = resolvedUrl;
           } else {
             console.warn(
               `[Dinou Security] Blocked unsafe redirect to: ${rawUrl}`,
@@ -205,6 +225,8 @@ function renderAppToHtml(
 
           // 3. Execute safe redirect always using (status, url)
           res.redirect.apply(res, [status, finalUrl]);
+          child.stdout.unpipe(res);
+          child.kill();
           return;
         }
 

package/dinou/core/server-function-proxy-webpack.js

@@ -1,5 +1,19 @@
 import { createFromFetch } from "react-server-dom-webpack/client";
 
+function isSafeRedirect(url) {
+  return typeof url === "string" && url.startsWith("/") && !url.startsWith("//");
+}
+
+function executeRedirect(url) {
+  const safeUrl = isSafeRedirect(url) ? url : "/";
+  const isInternal = safeUrl.startsWith("/") && !safeUrl.startsWith("//");
+  if (isInternal && typeof window !== "undefined" && window.__DINOU_ROUTER_NAVIGATE__) {
+    window.__DINOU_ROUTER_NAVIGATE__(safeUrl);
+  } else if (typeof window !== "undefined") {
+    window.location.href = safeUrl;
+  }
+}
+
 function createServerFunctionProxy(id) {
   return new Proxy(() => { }, {
     apply: async (_target, _thisArg, args) => {
@@ -33,8 +47,8 @@ function createServerFunctionProxy(id) {
       // Check header first
       const redirectUrl = res.headers.get("X-Dinou-Redirect");
       if (redirectUrl) {
-        window.location.href = redirectUrl;
-        return new Promise(() => { });
+        executeRedirect(redirectUrl);
+        return Promise.resolve();
       }
 
       const contentType = res.headers.get("content-type") || "";
@@ -50,8 +64,8 @@ function createServerFunctionProxy(id) {
       if (contentType.includes("application/json")) {
         const data = await res.json();
         if (data && data.redirect) {
-          window.location.href = data.redirect;
-          return new Promise(() => { });
+          executeRedirect(data.redirect);
+          return Promise.resolve();
         }
         return data;
       }
@@ -78,7 +92,7 @@ function createServerFunctionProxy(id) {
                         const payload = JSON.parse(buffer.slice(2));
                         if (payload.type === "redirect") {
                           isRedirecting = true;
-                          window.location.href = payload.url;
+                          executeRedirect(payload.url);
                         } else if (payload.type === "cookie") {
                           document.cookie = payload.cookie;
                         }
@@ -115,7 +129,7 @@ function createServerFunctionProxy(id) {
                         const payload = JSON.parse(line.slice(2));
                         if (payload.type === "redirect") {
                           isRedirecting = true;
-                          window.location.href = payload.url;
+                          executeRedirect(payload.url);
                         } else if (payload.type === "cookie") {
                           document.cookie = payload.cookie;
                         }
@@ -126,18 +140,14 @@ function createServerFunctionProxy(id) {
                       cleanChunk += line + "\n";
                     }
                   }
-
                   if (cleanChunk) {
                     controller.enqueue(encoder.encode(cleanChunk));
                   }
                 }
               }
+              controller.close();
             } catch (err) {
               controller.error(err);
-            } finally {
-              if (!isRedirecting) {
-                controller.close();
-              }
             }
           },
         });

package/dinou/core/server-function-proxy.js

@@ -1,6 +1,20 @@
 // public/server-function-proxy.js
 import { createFromFetch } from "@roggc/react-server-dom-esm/client";
 
+function isSafeRedirect(url) {
+  return typeof url === "string" && url.startsWith("/") && !url.startsWith("//");
+}
+
+function executeRedirect(url) {
+  const safeUrl = isSafeRedirect(url) ? url : "/";
+  const isInternal = safeUrl.startsWith("/") && !safeUrl.startsWith("//");
+  if (isInternal && typeof window !== "undefined" && window.__DINOU_ROUTER_NAVIGATE__) {
+    window.__DINOU_ROUTER_NAVIGATE__(safeUrl);
+  } else if (typeof window !== "undefined") {
+    window.location.href = safeUrl;
+  }
+}
+
 export function createServerFunctionProxy(id) {
   return new Proxy(() => {}, {
     apply: async (_target, _thisArg, args) => {
@@ -34,8 +48,8 @@ export function createServerFunctionProxy(id) {
       // Check header first
       const redirectUrl = res.headers.get("X-Dinou-Redirect");
       if (redirectUrl) {
-        window.location.href = redirectUrl;
-        return new Promise(() => {});
+        executeRedirect(redirectUrl);
+        return Promise.resolve();
       }
 
       const contentType = res.headers.get("content-type") || "";
@@ -51,8 +65,8 @@ export function createServerFunctionProxy(id) {
       if (contentType.includes("application/json")) {
         const data = await res.json();
         if (data && data.redirect) {
-          window.location.href = data.redirect;
-          return new Promise(() => {});
+          executeRedirect(data.redirect);
+          return Promise.resolve();
         }
         return data;
       }
@@ -79,7 +93,7 @@ export function createServerFunctionProxy(id) {
                         const payload = JSON.parse(buffer.slice(2));
                         if (payload.type === "redirect") {
                           isRedirecting = true;
-                          window.location.href = payload.url;
+                          executeRedirect(payload.url);
                         } else if (payload.type === "cookie") {
                           document.cookie = payload.cookie;
                         }
@@ -116,7 +130,7 @@ export function createServerFunctionProxy(id) {
                         const payload = JSON.parse(line.slice(2));
                         if (payload.type === "redirect") {
                           isRedirecting = true;
-                          window.location.href = payload.url;
+                          executeRedirect(payload.url);
                         } else if (payload.type === "cookie") {
                           document.cookie = payload.cookie;
                         }
@@ -133,12 +147,9 @@ export function createServerFunctionProxy(id) {
                   }
                 }
               }
+              controller.close();
             } catch (err) {
               controller.error(err);
-            } finally {
-              if (!isRedirecting) {
-                controller.close();
-              }
             }
           },
         });

package/dinou/core/server.js

@@ -248,20 +248,24 @@ const appUseCookieParser = cookieParser();
 const app = express();
 app.use(appUseCookieParser);
 app.use(express.json());
+const { resolveRelativeUrl } = require("./url-resolver");
 
 function getContext(req, res) {
+  let hasRedirected = false;
   // Helper to execute res methods safely
   const safeResCall = (methodName, ...args) => {
+    if (hasRedirected) return;
     if (res.headersSent) {
+      if (methodName === "redirect" && req.path.includes("____rsc_payload")) {
+        return; // Silence streaming redirects during RSC payload requests
+      }
       console.log(
         `[Dinou] res.${methodName} called but headers already sent. Ignoring.`,
       );
-      // console.warn(
-      //   `[Dinou Warning] RSC Stream active. Ignoring res.${methodName}() to avoid crash.`
-      // );
       return; // Exit silently
     }
     if (methodName === "redirect") {
+      hasRedirected = true;
       // 1. Normalize arguments (Status and URL)
       let url = args[0];
       let status = 302; // Default
@@ -272,16 +276,27 @@ function getContext(req, res) {
       }
 
       function safeRedirect(targetUrl) {
-        // Validate it's a string before calling startsWith
+        const resolvedUrl = resolveRelativeUrl(targetUrl, req.path);
+        let finalUrl = "/";
         if (
-          typeof targetUrl === "string" &&
-          targetUrl.startsWith("/") &&
-          !targetUrl.startsWith("//")
+          typeof resolvedUrl === "string" &&
+          resolvedUrl.startsWith("/") &&
+          !resolvedUrl.startsWith("//")
         ) {
-          res.redirect.apply(res, [status, targetUrl]);
+          finalUrl = resolvedUrl;
         } else {
-          res.redirect.apply(res, [status, "/"]);
+          console.warn(
+            `[Dinou Security] Blocked unsafe redirect to: ${targetUrl}`,
+          );
+        }
+
+        if (req.path.includes("____rsc_payload")) {
+          res.setHeader("x-rsc-redirect", finalUrl);
+          res.status(200).end();
+          return;
         }
+
+        res.redirect.apply(res, [status, finalUrl]);
       }
       return safeRedirect(url);
     }
@@ -351,11 +366,31 @@ function getContextForServerFunctionEndpoint(req, res) {
     },
     res: {
       redirect: (urlOrStatus, url) => {
-        const targetUrl = url || urlOrStatus;
+        const rawUrl = url || urlOrStatus;
+        const referer = req.headers["referer"];
+        let refererPath = "/";
+        if (referer) {
+          try {
+            refererPath = new URL(referer).pathname;
+          } catch (e) {}
+        }
+        const resolvedUrl = resolveRelativeUrl(rawUrl, refererPath);
+        let finalUrl = "/";
+        if (
+          typeof resolvedUrl === "string" &&
+          resolvedUrl.startsWith("/") &&
+          !resolvedUrl.startsWith("//")
+        ) {
+          finalUrl = resolvedUrl;
+        } else {
+          console.warn(
+            `[Dinou Security] Blocked unsafe server function redirect to: ${rawUrl}`,
+          );
+        }
         // We throw a special object that the endpoint will intercept
         throw {
           $$type: "dinou-internal-redirect",
-          url: targetUrl,
+          url: finalUrl,
         };
       },
       status: (code) => {
@@ -530,6 +565,11 @@ async function serveRSCPayload(req, res, isOld = false, isStatic = false) {
         isNotFound,
         isDevelopment,
       );
+
+      if (res.headersSent) {
+        return;
+      }
+
       const manifest = isDevelopment
         ? JSON.parse(
           readFileSync(

package/dinou/core/url-resolver.js

@@ -0,0 +1,13 @@
+function resolveRelativeUrl(href, currentPathname) {
+  if (href.startsWith("/") || href.includes("://")) {
+    return href;
+  }
+  let base = currentPathname || "/";
+  if (!base.endsWith("/")) {
+    base += "/";
+  }
+  const resolved = new URL(href, "http://localhost" + base);
+  return resolved.pathname + resolved.search + resolved.hash;
+}
+
+module.exports = { resolveRelativeUrl };

package/dinou/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou-ejected",
-  "version": "4.0.12",
+  "version": "4.0.14",
   "main": "index.js",
   "private": true,
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dinou",
-  "version": "4.0.12",
+  "version": "4.0.14",
   "description": "Full-Stack React 19 framework with React Server Components, Server Functions, and Streaming SSR.",
   "main": "index.js",
   "bin": {