veryfront 0.0.82 → 0.0.83

package/src/src/cli/index/start-handler.ts

@@ -0,0 +1,195 @@
+/**
+ * Start Handler - Full TUI dashboard with project discovery
+ *
+ * Default command when running `veryfront` without arguments.
+ * Provides a TUI experience with project navigation and dev server.
+ */
+import * as dntShim from "../../../_dnt.shims.js";
+
+
+import { cwd, getEnv } from "../../platform/compat/process.js";
+import { createFileSystem } from "../../platform/compat/fs.js";
+import { isAbsolute, join, resolve } from "../../platform/compat/path/index.js";
+import { cliLogger } from "../../utils/index.js";
+import { exitProcess, registerTerminationSignals } from "../utils/index.js";
+import type { ParsedArgs } from "./types.js";
+
+const DEFAULT_START_PORT = 8080;
+const DEFAULT_MCP_PORT = 9999;
+
+interface DiscoveredProjects {
+  projects: Map<string, string>;
+  examples: Map<string, string>;
+  defaultProject: string | null;
+}
+
+function getProjectSlug(path: string): string {
+  return path.replace(/\/+$/, "").split("/").pop() || "";
+}
+
+async function isVeryFrontProject(projectPath: string): Promise<boolean> {
+  const fs = createFileSystem();
+  const markers = ["app", "pages", "components"];
+  const checks = await Promise.all(markers.map((m) => fs.exists(join(projectPath, m))));
+  return checks.some(Boolean);
+}
+
+async function findProjectsInDirs(baseDirs: string[]): Promise<Map<string, string>> {
+  const projects = new Map<string, string>();
+  const fs = createFileSystem();
+
+  for (const baseDir of baseDirs) {
+    const absoluteBase = isAbsolute(baseDir) ? baseDir : join(cwd(), baseDir);
+    if (!(await fs.exists(absoluteBase))) continue;
+
+    try {
+      for await (const entry of fs.readDir(absoluteBase)) {
+        if (!entry.isDirectory || entry.name.startsWith(".")) continue;
+
+        const projectPath = join(absoluteBase, entry.name);
+        if (await isVeryFrontProject(projectPath)) {
+          projects.set(entry.name, resolve(projectPath));
+        }
+      }
+    } catch {
+      // Directory not readable - skip
+    }
+  }
+
+  return projects;
+}
+
+async function discoverProjects(explicitPath: string | null): Promise<DiscoveredProjects> {
+  const [projects, examples] = await Promise.all([
+    findProjectsInDirs(["data/projects", "projects"]),
+    findProjectsInDirs(["examples"]),
+  ]);
+  const fs = createFileSystem();
+  let defaultProject: string | null = null;
+
+  // Add explicit project path if provided
+  if (explicitPath) {
+    const absolutePath = isAbsolute(explicitPath) ? explicitPath : join(cwd(), explicitPath);
+    if (await fs.exists(absolutePath)) {
+      const slug = getProjectSlug(absolutePath);
+      projects.set(slug, resolve(absolutePath));
+      defaultProject = slug;
+    }
+  }
+
+  // Fall back to current directory if no projects found
+  if (projects.size === 0 && !defaultProject) {
+    const currentDir = cwd();
+    if (await isVeryFrontProject(currentDir)) {
+      const slug = getProjectSlug(currentDir);
+      projects.set(slug, resolve(currentDir));
+      defaultProject = slug;
+    }
+  }
+
+  return { projects, examples, defaultProject };
+}
+
+interface ProxySetup {
+  interceptor: ((req: dntShim.Request) => Promise<dntShim.Request>) | undefined;
+  close: () => Promise<void>;
+}
+
+async function trySetupProxy(localProjects: Map<string, string>): Promise<ProxySetup> {
+  try {
+    // Proxy is only available in local dev, not in the npm package
+    const { createProxyHandler, injectContextHeaders } = await import(
+      "../../../proxy/handler.js"
+    );
+    const { createCacheFromEnv } = await import("../../../proxy/cache/index.js");
+
+    const proxyConfig = {
+      apiBaseUrl: getEnv("VERYFRONT_API_BASE_URL") || "http://api.lvh.me:4000",
+      clientId: getEnv("OAUTH_CLIENT_ID") || "",
+      clientSecret: getEnv("OAUTH_CLIENT_SECRET") || "",
+      previewClientId: getEnv("OAUTH_PREVIEW_CLIENT_ID") || "",
+      previewClientSecret: getEnv("OAUTH_PREVIEW_CLIENT_SECRET") || "",
+      apiToken: getEnv("VERYFRONT_API_TOKEN") || "",
+      localProjects: Object.fromEntries(localProjects),
+    };
+
+    const cache = await createCacheFromEnv();
+    const handler = createProxyHandler({ config: proxyConfig, cache });
+
+    return {
+      interceptor: async (req: dntShim.Request) =>
+        injectContextHeaders(req, await handler.processRequest(req)),
+      close: () => handler.close(),
+    };
+  } catch {
+    return { interceptor: undefined, close: async () => {} };
+  }
+}
+
+export async function handleStartCommand(args: ParsedArgs): Promise<void> {
+  const port = typeof args.port === "number" ? args.port : DEFAULT_START_PORT;
+  const mcpPort = typeof args["mcp-port"] === "number" ? args["mcp-port"] : DEFAULT_MCP_PORT;
+  const projectPath = args.project ? String(args.project) : null;
+  const headless = Boolean(args.headless || args["no-tui"]);
+
+  const { createApp, showStartup } = await import("../app/index.js");
+  const discovered = await discoverProjects(projectPath);
+
+  const app = createApp({
+    port,
+    mcpPort,
+    headless,
+    projects: discovered.projects,
+    examples: discovered.examples,
+    defaultProject: discovered.defaultProject ?? undefined,
+  });
+
+  const restoreConsole = app.interceptConsole();
+
+  if (!headless) {
+    await showStartup(["Loading configuration", "Discovering projects", "Starting server"]);
+  }
+
+  const allProjects = new Map([...discovered.projects, ...discovered.examples]);
+  const proxy = await trySetupProxy(allProjects);
+
+  const { createDevServer } = await import("../../server/dev-server.js");
+  const shutdownController = new AbortController();
+
+  const devServer = await createDevServer({
+    port,
+    projectDir: cwd(),
+    hmrPort: port + 1,
+    enableHMR: true,
+    enableFastRefresh: true,
+    signal: shutdownController.signal,
+    requestInterceptor: proxy.interceptor,
+  });
+  await devServer.ready;
+
+  const { createMCPServer } = await import("../mcp/index.js");
+  const mcpServer = await createMCPServer({ httpPort: mcpPort });
+
+  app.setServerReady();
+
+  let shuttingDown = false;
+  async function shutdown(): Promise<void> {
+    if (shuttingDown) return;
+    shuttingDown = true;
+
+    restoreConsole();
+    cliLogger.info("Shutting down...");
+
+    app.stop();
+    await mcpServer.stop();
+    shutdownController.abort();
+    await devServer.stop();
+    await proxy.close();
+    exitProcess(0);
+  }
+
+  registerTerminationSignals(() => void shutdown());
+  app.start();
+
+  await new Promise(() => {});
+}

package/src/src/cli/mcp/index.ts

@@ -0,0 +1,11 @@
+/**
+ * MCP Module for Dev Server
+ *
+ * Exposes dev server functionality via MCP (Model Context Protocol)
+ * for coding agents like Claude Code and Cursor.
+ */
+
+export * from "./server.js";
+export * from "./error-collector.js";
+export * from "./log-buffer.js";
+export * from "./tools.js";

package/src/src/middleware/builtin/security/redis-rate-limit.ts

@@ -19,6 +19,7 @@ export interface RedisRateLimitOptions {
 
 export class RedisRateLimitStore implements RateLimitStore {
   private client: RedisClient | null = null;
+  private clientPromise: Promise<RedisClient> | null = null;
   private readonly url?: string;
   private readonly keyPrefix: string;
 
@@ -27,9 +28,15 @@ export class RedisRateLimitStore implements RateLimitStore {
     this.keyPrefix = options.keyPrefix ?? "veryfront:ratelimit:";
   }
 
-  private async ensureClient(): Promise<RedisClient> {
-    if (this.client) return this.client;
+  private ensureClient(): Promise<RedisClient> {
+    if (this.client) return Promise.resolve(this.client);
+    if (this.clientPromise) return this.clientPromise;
 
+    this.clientPromise = this.connectClient();
+    return this.clientPromise;
+  }
+
+  private async connectClient(): Promise<RedisClient> {
     let createClient: ((options: { url?: string }) => RedisClient) | undefined;
 
     try {
@@ -37,6 +44,7 @@ export class RedisRateLimitStore implements RateLimitStore {
       const mod = await import(redisClientModule);
       createClient = mod.createClient as (options: { url?: string }) => RedisClient;
     } catch {
+      this.clientPromise = null;
       throw toError(
         createError({
           type: "config",
@@ -46,15 +54,20 @@ export class RedisRateLimitStore implements RateLimitStore {
       );
     }
 
-    const client = createClient({ url: this.url });
-
-    client.on?.("error", (err: unknown) => {
-      logger.error("[redis-ratelimit] client error", err);
-    });
-
-    await client.connect();
-    this.client = client;
-    return client;
+    try {
+      const client = createClient({ url: this.url });
+
+      client.on?.("error", (err: unknown) => {
+        logger.error("[redis-ratelimit] client error", err);
+      });
+
+      await client.connect();
+      this.client = client;
+      return client;
+    } catch (error) {
+      this.clientPromise = null;
+      throw error;
+    }
   }
 
   private storageKey(key: string): string {

package/src/src/modules/react-loader/ssr-module-loader/cache/redis.ts

@@ -1,59 +1,38 @@
 /** Redis caching for cross-pod SSR module sharing */
 
 import { rendererLogger as logger } from "../../../../utils/index.js";
-import {
-  getRedisClient,
-  isRedisConfigured,
-  type RedisClient,
-} from "../../../../utils/redis-client.js";
+import { type RedisClient } from "../../../../utils/redis-client.js";
 import { buildRedisSSRModuleKey } from "../../../../cache/index.js";
 import { getSSRModuleRedisTTL } from "../constants.js";
-
-let redisEnabled = false;
-let redisClient: RedisClient | null = null;
-let redisInitialized = false;
-let redisInitPromise: Promise<void> | null = null;
-
+import { CacheBackends, createDistributedCacheAccessor } from "../../../../cache/backend.js";
+
+/** Lazy-loaded distributed cache backend for cross-pod sharing */
+const getDistributedCache = createDistributedCacheAccessor(
+  () => CacheBackends.ssrModule(),
+  "SSR-MODULE-LOADER",
+);
+
+/**
+ * @deprecated Legacy key builder. CacheBackend handles prefixing internally.
+ * Used only for backward compatibility if needed.
+ */
 export function redisKey(key: string): string {
   return buildRedisSSRModuleKey(key);
 }
 
 /** Initialize distributed caching for SSR modules */
 export async function initializeSSRDistributedCache(): Promise<boolean> {
-  if (redisInitialized) return redisEnabled;
-
-  if (redisInitPromise) {
-    await redisInitPromise;
-    return redisEnabled;
-  }
-
-  redisInitPromise = (async () => {
-    if (!isRedisConfigured()) {
-      logger.debug("[SSR-MODULE-LOADER] Redis not configured, using memory cache");
-      redisInitialized = true;
-      return;
-    }
-
-    try {
-      redisClient = await getRedisClient();
-      redisEnabled = true;
-      logger.debug("[SSR-MODULE-LOADER] Redis cache enabled");
-    } catch (error) {
-      logger.warn("[SSR-MODULE-LOADER] Redis unavailable, falling back to memory cache", { error });
-      redisEnabled = false;
-    } finally {
-      redisInitialized = true;
-    }
-  })();
-
-  await redisInitPromise;
-  redisInitPromise = null;
-
-  return redisEnabled;
+  const backend = await getDistributedCache();
+  return backend !== null;
 }
 
+/** Check if distributed caching is enabled for SSR modules */
 export function isSSRDistributedCacheEnabled(): boolean {
-  return redisEnabled && redisClient !== null;
+  // We can't synchronously check if backend is initialized without accessing the promise
+  // But we can check if we *should* be enabled based on env via CacheBackend utils
+  // For now, this returns true because it's used as a guard for get/set calls
+  // which themselves are async and handle missing backends gracefully.
+  return true;
 }
 
 /** @deprecated Use initializeSSRDistributedCache instead */
@@ -62,21 +41,27 @@ export const initializeSSRRedisCache = initializeSSRDistributedCache;
 /** @deprecated Use isSSRDistributedCacheEnabled instead */
 export const isSSRRedisCacheEnabled = isSSRDistributedCacheEnabled;
 
+/** @deprecated Use isSSRDistributedCacheEnabled instead */
 export function getRedisEnabled(): boolean {
-  return redisEnabled;
+  return isSSRDistributedCacheEnabled();
 }
 
+/**
+ * @deprecated Direct Redis client access is deprecated. Use CacheBackend abstraction.
+ * Returns null to force use of CacheBackend path in updated consumers.
+ */
 export function getRedisClientInstance(): RedisClient | null {
-  return redisClient;
+  return null;
 }
 
 export async function getFromRedis(cacheKey: string): Promise<string | null> {
-  if (!redisEnabled || !redisClient) return null;
+  const backend = await getDistributedCache();
+  if (!backend) return null;
 
   try {
-    return await redisClient.get(redisKey(cacheKey));
+    return await backend.get(cacheKey);
   } catch (error) {
-    logger.debug("[SSR-MODULE-LOADER] Redis get failed", { key: cacheKey, error });
+    logger.debug("[SSR-MODULE-LOADER] Distributed cache get failed", { key: cacheKey, error });
     return null;
   }
 }
@@ -87,13 +72,14 @@ export async function setInRedis(
   code: string,
   options?: { isProduction?: boolean; ttlSeconds?: number },
 ): Promise<void> {
-  if (!redisEnabled || !redisClient) return;
+  const backend = await getDistributedCache();
+  if (!backend) return;
 
   const ttl = options?.ttlSeconds ?? getSSRModuleRedisTTL(options?.isProduction ?? true);
 
   try {
-    await redisClient.set(redisKey(cacheKey), code, { EX: ttl });
+    await backend.set(cacheKey, code, ttl);
   } catch (error) {
-    logger.debug("[SSR-MODULE-LOADER] Redis set failed", { key: cacheKey, error });
+    logger.debug("[SSR-MODULE-LOADER] Distributed cache set failed", { key: cacheKey, error });
   }
 }

package/src/src/modules/react-loader/ssr-module-loader/loader.ts

@@ -40,18 +40,18 @@ import { withTimeoutThrow } from "../../../rendering/utils/stream-utils.js";
 import {
   failedComponents,
   getFromRedis,
-  getRedisClientInstance,
-  getRedisEnabled,
   globalCrossProjectCache,
   globalInProgress,
   globalModuleCache,
   globalTmpDirs,
+  isSSRDistributedCacheEnabled,
   setInRedis,
   transformSemaphore,
 } from "./cache/index.js";
 import type { ModuleCacheEntry, SSRModuleLoaderOptions } from "./types.js";
 import { getCacheBaseDir, getHttpBundleCacheDir } from "../../../utils/cache-dir.js";
 import { ensureHttpBundlesExist } from "../../../transforms/esm/http-cache.js";
+import { LRUCache } from "../../../utils/lru-wrapper.js";
 
 /** Pattern to match HTTP bundle file:// paths in transformed code */
 const HTTP_BUNDLE_PATTERN = /file:\/\/([^"'\s]+veryfront-http-bundle\/http-([a-f0-9]+)\.mjs)/gi;
@@ -73,8 +73,12 @@ function extractHttpBundlePaths(code: string): Array<{ path: string; hash: strin
   return bundles;
 }
 
-/** Track temp paths that have been verified for HTTP bundles to avoid redundant I/O */
-const verifiedHttpBundlePaths = new Set<string>();
+/**
+ * Track modules whose HTTP bundles have been verified, keyed by tempPath:contentHash.
+ * Bounded LRU to prevent unbounded memory growth in long-running pods.
+ * Keying by contentHash ensures verification is re-done when content changes at the same path.
+ */
+const verifiedHttpBundlePaths = new LRUCache<string, true>({ maxEntries: 2000 });
 
 /**
  * SSR Module Loader with Redis Support.
@@ -430,8 +434,9 @@ export class SSRModuleLoader {
 
     const cachedEntry = globalModuleCache.get(contentCacheKey);
     if (cachedEntry) {
-      // Verify HTTP bundles exist for in-memory cached transforms (once per path)
-      if (!verifiedHttpBundlePaths.has(cachedEntry.tempPath)) {
+      // Verify HTTP bundles exist for in-memory cached transforms (once per path+content)
+      const verifyKey = `${cachedEntry.tempPath}:${cachedEntry.contentHash}`;
+      if (!verifiedHttpBundlePaths.get(verifyKey)) {
         try {
           const cachedCode = await this.fs.readTextFile(cachedEntry.tempPath);
           const bundlePaths = extractHttpBundlePaths(cachedCode);
@@ -450,10 +455,10 @@ export class SSRModuleLoader {
               globalModuleCache.delete(filePathCacheKey);
               // Fall through to Redis or fresh transform
             } else {
-              verifiedHttpBundlePaths.add(cachedEntry.tempPath);
+              verifiedHttpBundlePaths.set(verifyKey, true);
             }
           } else {
-            verifiedHttpBundlePaths.add(cachedEntry.tempPath);
+            verifiedHttpBundlePaths.set(verifyKey, true);
           }
         } catch {
           // File doesn't exist or unreadable, invalidate cache
@@ -470,9 +475,7 @@ export class SSRModuleLoader {
       }
     }
 
-    const redisEnabled = getRedisEnabled();
-    const redisClient = getRedisClientInstance();
-    if (redisEnabled && redisClient) {
+    if (isSSRDistributedCacheEnabled()) {
       const redisCode = await getFromRedis(contentCacheKey);
       if (redisCode) {
         // Proactively ensure HTTP bundles exist before using cached transform.
@@ -501,7 +504,7 @@ export class SSRModuleLoader {
             recursive: true,
           });
           await this.fs.writeTextFile(tempPath, redisCode);
-          verifiedHttpBundlePaths.add(tempPath);
+          verifiedHttpBundlePaths.set(`${tempPath}:${contentHash}`, true);
 
           const entry: ModuleCacheEntry = { tempPath, contentHash };
           globalModuleCache.set(contentCacheKey, entry);
@@ -633,6 +636,22 @@ export class SSRModuleLoader {
         // This ensures that each content version uses its own cached module
         transformed = this.rewriteLocalImports(transformed, localImportPaths, filePath);
 
+        // Ensure HTTP bundles exist for this transform (handles nested bundle deps)
+        const bundlePaths = extractHttpBundlePaths(transformed);
+        if (bundlePaths.length > 0) {
+          const cacheDir = getHttpBundleCacheDir();
+          const failed = await ensureHttpBundlesExist(bundlePaths, cacheDir);
+          if (failed.length > 0) {
+            logger.warn(
+              "[SSR-MODULE-LOADER] Some HTTP bundles could not be recovered",
+              {
+                file: filePath.slice(-40),
+                failed,
+              },
+            );
+          }
+        }
+
         // Hash the TRANSFORMED content (after import rewrites) for cache busting
         // This ensures Deno's module cache is invalidated when dependencies change
         const transformedHash = await this.hashContentAsync(transformed);
@@ -641,10 +660,15 @@ export class SSRModuleLoader {
         await this.fs.mkdir(tempPath.substring(0, tempPath.lastIndexOf("/")), { recursive: true });
         await this.fs.writeTextFile(tempPath, transformed);
 
-        if (redisEnabled && redisClient) {
+        if (isSSRDistributedCacheEnabled()) {
           setInRedis(contentCacheKey, transformed, {
             isProduction: this.isProductionContentSource(),
-          }).catch(() => {});
+          }).catch((error) => {
+            logger.debug("[SSR-MODULE-LOADER] Distributed cache set failed", {
+              key: contentCacheKey,
+              error,
+            });
+          });
         }
 
         // Use transformedHash for cache busting in dynamic imports

package/src/src/platform/adapters/fs/cache/file-cache.ts

@@ -221,7 +221,9 @@ export class FileCache {
       const serialized = JSON.stringify(entry);
       // Update request-scoped cache so subsequent reads in same request see the new value
       setInRequestCache(key, serialized);
-      backend.set(key, serialized, BACKEND_TTL_SECONDS).catch(() => {});
+      backend.set(key, serialized, BACKEND_TTL_SECONDS).catch((error) => {
+        logger.debug("[FileCache] Backend set failed", { key, error });
+      });
       return;
     }
 
@@ -308,7 +310,9 @@ export class FileCache {
 
     // Fire-and-forget backend deletion
     // Note: prefix already includes "file:" from buildFileCacheKeyPrefix, don't add it again
-    cacheBackend?.delByPattern?.(`${prefix}*`).catch(() => {});
+    cacheBackend?.delByPattern?.(`${prefix}*`).catch((error) => {
+      logger.debug("[FileCache] Backend invalidation failed", { prefix, error });
+    });
 
     return count;
   }
@@ -346,7 +350,9 @@ export class FileCache {
 
     // Fire-and-forget backend deletion
     // Note: prefix already includes "file:" from buildFileCacheKeyPrefix, don't add it again
-    cacheBackend?.delByPattern?.(`${prefix}*:${suffix}`).catch(() => {});
+    cacheBackend?.delByPattern?.(`${prefix}*:${suffix}`).catch((error) => {
+      logger.debug("[FileCache] Backend invalidation failed", { prefix, suffix, error });
+    });
 
     return count;
   }

package/src/src/server/context/cache-invalidation.ts

@@ -3,6 +3,7 @@ import {
   clearModulePathCache,
   invalidateModulePaths,
 } from "../../transforms/mdx/esm-module-loader/index.js";
+import { clearModuleCacheForProject } from "../../cache/module-cache.js";
 import {
   clearSSRModuleCache,
   clearSSRModuleCacheForProject,
@@ -63,6 +64,9 @@ export async function invalidateProjectCaches(
   });
   if (projectId) {
     clearSSRModuleCacheForProject(projectId);
+    // Also clear the pod-level module cache (used by RenderPipeline)
+    // This was previously missed, causing stale renders despite SSR module cache clearing
+    clearModuleCacheForProject(projectId);
   } else {
     clearSSRModuleCache();
   }

package/src/src/server/handlers/dev/dashboard/api.ts

@@ -360,6 +360,7 @@ async function handleListFiles(req: dntShim.Request, ctx: HandlerContext): Promi
   if (!projectDir) return errorResponse("No project directory configured", 500);
 
   const relativePath = new URL(req.url).searchParams.get("path") || "";
+  if (relativePath.includes("..")) return errorResponse("Invalid path", 400);
   const fullPath = relativePath ? `${projectDir}/${relativePath}` : projectDir;
 
   try {
@@ -394,6 +395,7 @@ async function handleReadFileContent(req: dntShim.Request, ctx: HandlerContext):
 
   const relativePath = new URL(req.url).searchParams.get("path") || "";
   if (!relativePath) return errorResponse("path parameter is required", 400);
+  if (relativePath.includes("..")) return errorResponse("Invalid path", 400);
 
   try {
     const content = await adapter.fs.readFile(`${projectDir}/${relativePath}`);

package/src/src/server/handlers/dev/projects/ui-handler.ts

@@ -83,6 +83,12 @@ export function handleProjectsUI(req: dntShim.Request): Promise<dntShim.Response
     "server.dev.projectsUI.handle",
     async () => {
       const relativePath = pathname.replace("/_projects/ui/", "").replace(/\.js$/, "");
+      if (relativePath.includes("..")) {
+        return new dntShim.Response("Invalid path", {
+          status: 400,
+          headers: { "Content-Type": "text/plain" },
+        });
+      }
       const uiDir = getUiDirectory();
 
       const module = await readUiSource(uiDir, relativePath);