heyiam 0.2.18 → 0.2.20

package/dist/render/templates/project.liquid

@@ -1,4 +1,4 @@
-<div class="heyiam-project" data-render-version="2">
+<div class="heyiam-project" data-render-version="2"{% if sessionBaseUrl %} data-session-base-url="{{ sessionBaseUrl }}"{% endif %}>
 
   {%- comment -%} Title {%- endcomment -%}
   <h1 class="project-title">{{ project.title }}</h1>

package/dist/routes/preview.js

@@ -180,7 +180,11 @@ export function createPreviewRouter(ctx) {
     });
     // Serve @heyiam/ui mount script for preview pages
     router.get('/heyiam-mount.js', (_req, res) => {
-        const mountPath = path.resolve(__dirname, '..', '..', '..', 'packages', 'ui', 'dist', 'mount.js');
+        // In built dist: dist/mount.js (copied during build)
+        // In dev: ../../../packages/ui/dist/mount.js (monorepo layout)
+        const builtPath = path.resolve(__dirname, '..', 'mount.js');
+        const devPath = path.resolve(__dirname, '..', '..', '..', 'packages', 'ui', 'dist', 'mount.js');
+        const mountPath = existsSync(builtPath) ? builtPath : devPath;
         try {
             const js = readFileSync(mountPath, 'utf-8');
             res.type('application/javascript').send(js);

package/dist/routes/publish.js

@@ -134,7 +134,6 @@ export function createPublishRouter(ctx) {
             }
             const projectData = await projectRes.json();
             send({ type: 'project', status: 'created', projectId: projectData.project_id, slug: projectData.slug });
-            let screenshotUploaded = false;
             // Step 1b: Upload screenshot (non-fatal)
             if (screenshotBase64 || projectUrl) {
                 try {
@@ -177,7 +176,6 @@ export function createPublishRouter(ctx) {
                                 },
                                 body: JSON.stringify({ key }),
                             });
-                            screenshotUploaded = true;
                             send({ type: 'screenshot', status: 'uploaded' });
                         }
                         else {

package/dist/routes/settings.js

@@ -22,7 +22,7 @@ export function createSettingsRouter(_ctx) {
         const key = getAnthropicApiKey();
         res.json({
             hasKey: !!key,
-            maskedKey: key ? `${key.slice(0, 4)}...` : null,
+            maskedKey: key ? `...${key.slice(-4)}` : null,
         });
     });
     return router;

package/dist/screenshot.js

@@ -52,14 +52,19 @@ function isUrlSafe(raw) {
         return false;
     // Reject localhost and private IPs
     const host = parsed.hostname.toLowerCase();
-    if (host === 'localhost' || host === '127.0.0.1' || host === '::1') {
+    // Strip IPv6 brackets for comparison
+    const bare = host.startsWith('[') ? host.slice(1, -1) : host;
+    if (bare === 'localhost' || bare === '127.0.0.1' || bare === '::1' || bare === '0.0.0.0') {
         // Allow our own preview server
         const port = parsed.port || (parsed.protocol === 'https:' ? '443' : '80');
         if (port !== '17845')
             return false;
     }
-    // Reject private IP ranges
-    if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|0\.)/.test(host))
+    // Reject private IP ranges (IPv4)
+    if (/^(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|0\.)/.test(bare))
+        return false;
+    // Reject IPv6 private ranges (link-local, ULA, loopback, IPv4-mapped)
+    if (/^(fe80:|fc|fd|::ffff:(10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|127\.))/i.test(bare))
         return false;
     if (host.endsWith('.local') || host.endsWith('.internal'))
         return false;

package/dist/search.js

@@ -1,5 +1,6 @@
 // Search logic combining FTS5 content search with metadata filters
 import { searchFts } from './db.js';
+import { escapeLikeWildcards } from './format-utils.js';
 // ── Helpers ──────────────────────────────────────────────────
 /**
  * Decode projectDir to a human-readable project name.
@@ -69,7 +70,7 @@ function searchWithFilters(db, filters) {
     const params = [];
     if (filters?.project) {
         conditions.push('s.project_dir LIKE ?');
-        params.push(`%${filters.project}%`);
+        params.push(`%${escapeLikeWildcards(filters.project)}%`);
     }
     if (filters?.source) {
         conditions.push('s.source = ?');
@@ -103,7 +104,7 @@ function searchWithFilters(db, filters) {
       ORDER BY s.start_time DESC
       LIMIT ?
     `;
-        params.unshift(`%${filters.file}%`);
+        params.unshift(`%${escapeLikeWildcards(filters.file)}%`);
         params.push(MAX_RESULTS);
     }
     else {

package/dist/server.js

@@ -5,7 +5,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from '
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { homedir } from 'node:os';
-import { getDatabase } from './db.js';
+import { getDatabase, closeDatabase } from './db.js';
 import { syncWithTracking, startFileWatcher, startCursorPolling, markSyncPending } from './sync.js';
 import { createRouteContext, createProjectsRouter, createEnhanceRouter, createPublishRouter, createSearchRouter, createSessionsRouter, createArchiveRouter, createAuthRouter, createSettingsRouter, createExportRouter, createPreviewRouter, createDashboardRouter, } from './routes/index.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -77,13 +77,16 @@ export function createApp(sessionsBasePath, dbPath) {
         }
         next();
     });
-    app.use(cors({ origin: ['http://localhost:17845', 'http://127.0.0.1:17845', 'http://localhost:5173'] }));
+    const corsOrigins = ['http://localhost:17845', 'http://127.0.0.1:17845'];
+    if (process.env.NODE_ENV !== 'production')
+        corsOrigins.push('http://localhost:5173');
+    app.use(cors({ origin: corsOrigins }));
     app.use((_req, res, next) => {
         res.setHeader('X-Content-Type-Options', 'nosniff');
         res.setHeader('X-Frame-Options', 'DENY');
         next();
     });
-    app.use(express.json({ limit: '50mb' }));
+    app.use(express.json({ limit: '10mb' }));
     // ── Mount domain routers ───────────────────────────────────
     app.use(createProjectsRouter(ctx));
     app.use(createEnhanceRouter(ctx));
@@ -108,11 +111,11 @@ export function createApp(sessionsBasePath, dbPath) {
     const staticDir = existsSync(prodDir) ? prodDir : devDir;
     app.use(express.static(staticDir));
     // SPA fallback -- serve index.html for non-API routes
-    const indexPath = path.join(staticDir, 'index.html');
+    // Express 5 requires { root } option for sendFile (absolute paths fail silently)
     app.get('/{*splat}', (_req, res) => {
-        res.sendFile(indexPath, (err) => {
+        res.sendFile('index.html', { root: staticDir }, (err) => {
             if (err && !res.headersSent) {
-                console.error(`[spa] sendFile failed for ${indexPath}:`, err.message);
+                console.error(`[spa] sendFile failed for ${staticDir}/index.html:`, err.message);
                 res.status(404).send('Page not found');
             }
         });
@@ -146,11 +149,12 @@ export function startServer(port = 17845, options) {
                 server.on('close', () => {
                     stopFileWatcher();
                     stopCursorPolling();
+                    closeDatabase();
                     removeServerPidFile();
                 });
             }
             else {
-                server.on('close', () => { removeServerPidFile(); });
+                server.on('close', () => { closeDatabase(); removeServerPidFile(); });
             }
             resolve(server);
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "heyiam",
-  "version": "0.2.18",
+  "version": "0.2.20",
   "description": "Turn AI coding sessions into portfolio case studies",
   "type": "module",
   "license": "MIT",
@@ -23,7 +23,7 @@
   ],
   "scripts": {
     "clean": "rm -rf dist",
-    "build": "rm -rf dist && tsc -p tsconfig.build.json && chmod +x dist/index.js && cp -r src/render/templates dist/render/templates && cd app && npx vite build && rm -rf ../dist/public && cp -r dist ../dist/public",
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && chmod +x dist/index.js && cp -r src/render/templates dist/render/templates && (test -f ../packages/ui/dist/mount.js && cp ../packages/ui/dist/mount.js dist/mount.js || echo 'Warning: packages/ui/dist/mount.js not found — skipping') && cd app && npx vite build && rm -rf ../dist/public && cp -r dist ../dist/public",
     "verify-build": "node -e \"const fs=require('fs'); const assert=require('assert'); const pkg=require('./package.json'); assert(fs.existsSync('dist/index.js'),'missing dist/index.js'); assert(fs.existsSync('dist/public/index.html'),'missing dist/public/index.html'); assert(fs.existsSync('dist/render/templates'),'missing templates'); const js=fs.readdirSync('dist/public/assets').filter(f=>f.endsWith('.js')); assert(js.length===1,'expected exactly 1 JS bundle, found '+js.length); const html=fs.readFileSync('dist/public/index.html','utf8'); assert(html.includes(js[0]),'index.html does not reference the JS bundle'); const tests=fs.readdirSync('dist',{recursive:true}).filter(f=>String(f).includes('.test.')); assert(tests.length===0,'test files found in dist: '+tests.join(', ')); console.log('Build verified: v'+pkg.version+' — dist/index.js + frontend + templates, 0 test files')\"",
     "prepublishOnly": "npm run test:backend && npm run build && npm run verify-build",
     "prepack": "npm run verify-build",