mango-cms 0.3.31 → 0.3.33

package/lib/devProxyGateway.js

@@ -27,6 +27,14 @@
 
 export const DEFAULT_STAGING_PREFIX = 'staging.'
 
+// HAP-1188 (Option B): the container shell points its iframe at
+// `<branch>--<baseStagingHost>` so the branch travels in the Host header on the
+// iframe's document AND every one of its sub-resource + HMR-WS requests — sticky
+// per-branch with zero cookie pollution. This is the separator between the
+// branch prefix and the base staging host. The front builds it from
+// VITE_VIBE_SHELL_HOST_TEMPLATE="{branch}--staging-vibe.<site>".
+export const DEFAULT_BRANCH_HOST_SEPARATOR = '--'
+
 // Header / cookie the editing surface (and the orchestrator) use to carry the
 // SELECTED BRANCH with a staging request (HAP-1164). The branch — not the session
 // identity — is what the resolver demuxes on, so it must travel with every
@@ -120,37 +128,84 @@ export function hasBranchSignal(req) {
     return false
 }
 
-// Pure: does this request's Host header look like a staging request, and what
-// site slug does it resolve to?
+// Internal: match an already-normalized (port-stripped, trimmed, lowercased)
+// hostname as a staging host, returning { hostname, slug } | null. This is the
+// pre-HAP-1188 matcher, factored out so the branch-in-hostname peeling below can
+// reuse it on the host's remainder.
 //
 // Matches in this order:
-//   1. exact match against opts.stagingDomain (when configured) — slug is the
-//      part of the hostname after the staging prefix, or the full hostname if
-//      it doesn't have one.
-//   2. any hostname starting with opts.stagingHostPrefix (defaults to
-//      "staging.") — slug is the part after that prefix.
-//
-// Returns null when no match, or when the slug would be empty. Port suffixes
-// (":80") and case are normalized away so the matcher is stable across
-// browsers, curl, and the Vite HMR upgrade.
-export function parseStagingHost(hostHeader, opts = {}) {
-    if (!hostHeader) return null
-    const prefix = String(opts.stagingHostPrefix || DEFAULT_STAGING_PREFIX).toLowerCase()
-    const hostname = String(hostHeader).split(':')[0].trim().toLowerCase()
+//   1. exact match against `configured` (opts.stagingDomain, when set) — slug is
+//      the part after the staging prefix, or the full hostname if it has none.
+//   2. any hostname starting with `prefix` (defaults to "staging.") — slug is the
+//      part after that prefix.
+function matchStagingBase(hostname, prefix, configured) {
     if (!hostname) return null
-
-    const configured = opts.stagingDomain ? String(opts.stagingDomain).toLowerCase() : null
     if (configured && hostname === configured) {
         const slug = hostname.startsWith(prefix) ? hostname.slice(prefix.length) : hostname
         if (!slug) return null
         return { hostname, slug }
     }
-
     if (hostname.startsWith(prefix)) {
         const slug = hostname.slice(prefix.length)
         if (!slug) return null
         return { hostname, slug }
     }
+    return null
+}
+
+// Pure: does this request's Host header look like a staging request, what site
+// slug does it resolve to, and — when the container shell encodes the branch in
+// the hostname (HAP-1188, Option B) — which branch?
+//
+// Returns null when no match, or when the slug would be empty. Port suffixes
+// (":80") and case are normalized away so the matcher is stable across
+// browsers, curl, and the Vite HMR upgrade.
+//
+// Branch-in-hostname (HAP-1188): a host of the form `<branch>--<baseStagingHost>`
+// resolves to the same { hostname, slug } as `<baseStagingHost>` PLUS a `branch`
+// field. The gateway treats that host-branch as a deliberate branch signal, so
+// the iframe's document, modules, AND HMR WebSocket all demux to the one branch's
+// dev server — no `?branch=` on sub-resources, no origin-wide cookie. The shell
+// host (`<baseStagingHost>`, no `--` prefix) carries no branch and is unaffected.
+export function parseStagingHost(hostHeader, opts = {}) {
+    if (!hostHeader) return null
+    const prefix = String(opts.stagingHostPrefix || DEFAULT_STAGING_PREFIX).toLowerCase()
+    const sep = String(opts.branchHostSeparator ?? DEFAULT_BRANCH_HOST_SEPARATOR)
+    const raw = String(hostHeader).split(':')[0].trim()
+    if (!raw) return null
+    const hostname = raw.toLowerCase()
+    const configured = opts.stagingDomain ? String(opts.stagingDomain).toLowerCase() : null
+
+    // Fast path: the shell host and every pre-HAP-1188 staging host (no branch
+    // prefix) match directly. This also means a plain host is never misread as a
+    // branch-prefixed one.
+    const direct = matchStagingBase(hostname, prefix, configured)
+    if (direct) return direct
+
+    // Branch-in-hostname: peel a leading `<branch>--` and match the REMAINDER as
+    // an ordinary staging host. Scan separator positions left→right and accept
+    // the first split whose remainder is a valid base host — so a branch whose
+    // sanitized form itself contains `--` (e.g. two non-git chars in a row) still
+    // resolves to the real base host rather than splitting in the middle.
+    if (sep) {
+        let from = 0
+        let idx
+        while ((idx = hostname.indexOf(sep, from)) > 0) {
+            const base = matchStagingBase(hostname.slice(idx + sep.length), prefix, configured)
+            if (base) {
+                // Slice the ORIGINAL-case host for the branch (toLowerCase keeps
+                // length, so `idx` is valid in both). Browsers usually lowercase
+                // the whole Host, but don't assume it. Percent-decode because the
+                // front builds the prefix with encodeURIComponent(sanitizeBranch()).
+                const rawBranch = raw.slice(0, idx)
+                let branch = rawBranch
+                try { branch = decodeURIComponent(rawBranch) } catch { /* keep raw */ }
+                branch = branch.trim()
+                return branch ? { ...base, branch } : base
+            }
+            from = idx + sep.length
+        }
+    }
 
     return null
 }
@@ -170,7 +225,7 @@ export function parseStagingHost(hostHeader, opts = {}) {
 //   no_workspace      (404) — resolver returned nothing for (user, slug)
 //   resolver_error    (502) — resolver threw / returned a bad shape
 //   forbidden         (403) — resolver explicitly refused (e.g. wrong site)
-export async function resolveStagingTarget({ req, slug, resolve }) {
+export async function resolveStagingTarget({ req, slug, resolve, branch }) {
     if (typeof resolve !== 'function') {
         return { error: 'resolver_error', status: 502, message: 'No staging resolver configured' }
     }
@@ -184,13 +239,19 @@ export async function resolveStagingTarget({ req, slug, resolve }) {
         }
     }
 
-    // The SELECTED BRANCH (HAP-1164) travels with the request and is what the
-    // resolver demuxes on. Absent → resolver falls back to the configured default.
-    const branch = parseBranchFromReq(req)
+    // The SELECTED BRANCH (HAP-1164) is what the resolver demuxes on. It travels
+    // either in the Host header (HAP-1188 branch-in-hostname, passed in here as
+    // `branch` by the gateway) or on the request itself (x-vibe-branch / ?branch=
+    // / vibe_branch cookie). An explicit host-branch wins — it's the most
+    // deliberate signal and is what keeps the iframe's sub-resources sticky.
+    // Absent → resolver falls back to the configured default.
+    const selectedBranch = (branch != null && String(branch).trim())
+        ? String(branch).trim()
+        : parseBranchFromReq(req)
 
     let result
     try {
-        result = await resolve({ slug, branch, cookieHeader, authHeader, req })
+        result = await resolve({ slug, branch: selectedBranch, cookieHeader, authHeader, req })
     } catch (err) {
         return { error: 'resolver_error', status: 502, message: `Vibe staging resolver error: ${err?.message || err}` }
     }
@@ -424,12 +485,15 @@ export function createStagingGatewayServer({
             sendError(res, 404, `Unknown host: ${req?.headers?.host || '(missing Host header)'}`)
             return
         }
-        // HAP-1175: default route is the shared fallback front. Only requests
-        // that carry a deliberate branch signal (vibe_branch cookie, x-vibe-branch
-        // header, or ?branch= URL param) attempt per-branch resolution. A returning
-        // browser with stale session cookies but no branch signal — the case that
-        // re-broke staging in HAP-1175 — passes straight through here.
-        if (!hasBranchSignal(req)) {
+        // HAP-1175 / HAP-1188: default route is the shared fallback front. Only
+        // requests that carry a DELIBERATE branch signal attempt per-branch
+        // resolution — the branch in the Host header (HAP-1188, `<branch>--<host>`),
+        // a vibe_branch cookie, an x-vibe-branch header, or a ?branch= URL param.
+        // A returning browser with stale session cookies but no branch signal —
+        // the case that re-broke staging in HAP-1175 — passes straight through to
+        // the fallback. The shell host has no host-branch, so it lands here too.
+        const hostBranch = parsed.branch || ''
+        if (!hostBranch && !hasBranchSignal(req)) {
             if (fallbackTarget) {
                 proxy.web(req, res, { target: fallbackTarget })
                 return
@@ -437,7 +501,7 @@ export function createStagingGatewayServer({
             sendError(res, 401, 'Vibe staging: no branch signal and no fallback configured')
             return
         }
-        const outcome = await resolveStagingTarget({ req, slug: parsed.slug, resolve })
+        const outcome = await resolveStagingTarget({ req, slug: parsed.slug, resolve, branch: hostBranch })
         if (outcome.error) {
             // HAP-1175: even with a branch signal, a failed resolve falls back
             // to the shared front rather than 401-ing the page load. Hard errors
@@ -458,11 +522,14 @@ export function createStagingGatewayServer({
             try { socket.destroy() } catch { /* noop */ }
             return
         }
-        // HAP-1175: same default-to-fallback rule as handleRequest. The Vite
-        // HMR upgrade for the shared shell rides without a branch signal; only
-        // after the picker fires does the next upgrade carry x-vibe-branch and
-        // resolve per-branch.
-        if (!hasBranchSignal(req)) {
+        // HAP-1175 / HAP-1188: same default-to-fallback rule as handleRequest.
+        // The shell's own HMR upgrade rides without a branch signal → fallback.
+        // The iframe's HMR WebSocket carries the branch in the Host header
+        // (`<branch>--<host>`), so it resolves to the SAME per-branch dev server
+        // as the iframe's document — this is what closes the dual-Vue / white-
+        // screen gap (HAP-1177 class) that `?branch=`-on-document-only left open.
+        const hostBranch = parsed.branch || ''
+        if (!hostBranch && !hasBranchSignal(req)) {
             if (fallbackTarget) {
                 proxy.ws(req, socket, head, { target: fallbackTarget })
                 return
@@ -470,7 +537,7 @@ export function createStagingGatewayServer({
             try { socket.destroy() } catch { /* noop */ }
             return
         }
-        const outcome = await resolveStagingTarget({ req, slug: parsed.slug, resolve })
+        const outcome = await resolveStagingTarget({ req, slug: parsed.slug, resolve, branch: hostBranch })
         if (outcome.error) {
             // Failed resolve on an upgrade: prefer the fallback over destroying
             // the socket so HMR keeps working through the shared front.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mango-cms",
-  "version": "0.3.31",
+  "version": "0.3.33",
   "type": "module",
   "main": "./index.js",
   "exports": {