veryfront 0.1.49 → 0.1.51

package/src/src/server/handlers/dev/dashboard/api.ts

@@ -1,5 +1,6 @@
 import * as dntShim from "../../../../../_dnt.shims.js";
 import { getMCPRegistry, getMCPStats } from "../../../../mcp/index.js";
+import { REQUEST_ERROR } from "../../../../errors/index.js";
 import { executeTool, toolRegistry } from "../../../../tool/index.js";
 import { resourceRegistry } from "../../../../resource/index.js";
 import { promptRegistry } from "../../../../prompt/index.js";
@@ -26,6 +27,16 @@ import { getLogBuffer } from "../../../../observability/log-buffer.js";
 import { ReloadNotifier } from "../../../reload-notifier.js";
 import type { HandlerContext } from "../../types.js";
 
+const WORKFLOW_EXECUTION_TIMEOUT_MS = 30_000;
+
+/** Validate a relative path for directory traversal and null bytes.
+ *  Note: searchParams.get() already percent-decodes, so no extra decoding needed. */
+function isValidRelativePath(path: string): boolean {
+  if (path.includes("\0")) return false;
+  if (path.includes("..")) return false;
+  return true;
+}
+
 const JSON_HEADERS = {
   "Content-Type": "application/json",
   "Cache-Control": "no-cache",
@@ -308,13 +319,21 @@ async function handleStartWorkflow(req: dntShim.Request): Promise<dntShim.Respon
     const startTime = Date.now();
     const handle = await client.start(workflowId, (input as Record<string, unknown>) ?? {});
 
-    const timeoutMs = 30000;
-    const result = await Promise.race([
-      handle.result(),
-      new Promise((_, reject) =>
-        dntShim.setTimeout(() => reject(new Error("Workflow execution timed out (30s)")), timeoutMs)
-      ),
-    ]);
+    let timeoutId: ReturnType<typeof dntShim.setTimeout> | undefined;
+    let result: unknown;
+    try {
+      result = await Promise.race([
+        handle.result(),
+        new Promise((_, reject) => {
+          timeoutId = dntShim.setTimeout(
+            () => reject(REQUEST_ERROR.create({ detail: "Workflow execution timed out (30s)" })),
+            WORKFLOW_EXECUTION_TIMEOUT_MS,
+          );
+        }),
+      ]);
+    } finally {
+      clearTimeout(timeoutId);
+    }
 
     const run = await client.getRun(handle.runId);
 
@@ -376,7 +395,7 @@ async function handleListFiles(req: dntShim.Request, ctx: HandlerContext): Promi
   if (!projectDir) return errorResponse("No project directory configured", 500);
 
   const relativePath = new URL(req.url).searchParams.get("path") ?? "";
-  if (relativePath.includes("..")) return errorResponse("Invalid path", 400);
+  if (!isValidRelativePath(relativePath)) return errorResponse("Invalid path", 400);
 
   const fullPath = relativePath ? `${projectDir}/${relativePath}` : projectDir;
 
@@ -412,7 +431,7 @@ async function handleReadFileContent(req: dntShim.Request, ctx: HandlerContext):
 
   const relativePath = new URL(req.url).searchParams.get("path") ?? "";
   if (!relativePath) return errorResponse("path parameter is required", 400);
-  if (relativePath.includes("..")) return errorResponse("Invalid path", 400);
+  if (!isValidRelativePath(relativePath)) return errorResponse("Invalid path", 400);
 
   try {
     const content = await adapter.fs.readFile(`${projectDir}/${relativePath}`);

package/src/src/server/handlers/dev/dashboard/ui-handler.ts

@@ -8,7 +8,7 @@ import devUiManifest from "../../../dev-ui/manifest.js";
 const logger = baseLogger.component("dev-dashboard");
 
 const moduleCache = new Map<string, { code: string; timestamp: number }>();
-const CACHE_TTL = 5000;
+const CACHE_TTL_MS = 5_000;
 
 const JS_HEADERS = {
   "Content-Type": "application/javascript",
@@ -31,15 +31,15 @@ async function readUiModule(
   const tsxPath = `${uiDir}/${relativePath}.tsx`;
   try {
     return { filePath: tsxPath, source: await readTextFile(tsxPath) };
-  } catch {
-    // try .ts from filesystem
+  } catch (_) {
+    // expected: .tsx not found, try .ts next
   }
 
   const tsPath = `${uiDir}/${relativePath}.ts`;
   try {
     return { filePath: tsPath, source: await readTextFile(tsPath) };
-  } catch {
-    // Filesystem failed, try embedded manifest (for compiled binary)
+  } catch (_) {
+    // expected: .ts not found on filesystem, try embedded manifest
   }
 
   // Try embedded manifest - paths are relative to dev-ui directory
@@ -83,7 +83,7 @@ export function handleDashboardUI(req: dntShim.Request): Promise<dntShim.Respons
 
       const now = Date.now();
       const cached = moduleCache.get(filePath);
-      if (cached && now - cached.timestamp < CACHE_TTL) {
+      if (cached && now - cached.timestamp < CACHE_TTL_MS) {
         return new dntShim.Response(cached.code, { headers: JS_HEADERS });
       }
 

package/src/src/server/handlers/dev/debug-context.handler.ts

@@ -80,7 +80,8 @@ export class DebugContextHandler extends BaseHandler {
     try {
       const fs = ctx.adapter?.fs as { isMultiProjectMode?: () => boolean } | undefined;
       return fs?.isMultiProjectMode?.() ?? false;
-    } catch {
+    } catch (_) {
+      /* expected: adapter may not support multi-project mode */
       return false;
     }
   }
@@ -99,7 +100,8 @@ export class DebugContextHandler extends BaseHandler {
       }
 
       return underlying.getManagerStats();
-    } catch {
+    } catch (_) {
+      /* expected: adapter may not support getManagerStats */
       return null;
     }
   }

package/src/src/server/handlers/dev/endpoints.handler.ts

@@ -12,6 +12,8 @@ import { getHMRScript, getPreviewHMRScript } from "./scripts/hmr-scripts.js";
 import { getErrorOverlay } from "./scripts/error-overlay.js";
 import { getHydrateScript } from "./scripts/dev-loader.js";
 
+const DEFAULT_HMR_PORT = "3000";
+
 export class DevEndpointsHandler extends BaseHandler {
   metadata: HandlerMetadata = {
     name: "DevEndpointsHandler",
@@ -46,7 +48,7 @@ export class DevEndpointsHandler extends BaseHandler {
   private getScriptForPath(pathname: string, url: URL): string | null {
     switch (pathname) {
       case "/_veryfront/hmr.js": {
-        const port = url.searchParams.get("port") ?? "3000";
+        const port = url.searchParams.get("port") ?? DEFAULT_HMR_PORT;
         return getHMRScript(parseInt(port, 10));
       }
       case "/_veryfront/hydrate.js": {

package/src/src/server/handlers/dev/files/esbuild-plugins.ts

@@ -1,5 +1,6 @@
 import * as dntShim from "../../../../../_dnt.shims.js";
 import type { OnLoadArgs, OnResolveArgs, Plugin, PluginBuild } from "esbuild";
+import { NETWORK_ERROR } from "../../../../errors/index.js";
 // Direct import from base.ts to avoid circular dependency through barrel
 import type { RuntimeAdapter } from "../../../../platform/adapters/base.js";
 import { getDirectory, joinPath } from "../../../../utils/path-utils.js";
@@ -50,8 +51,8 @@ export function createRelativeFsPlugin(projectDir: string, adapter: RuntimeAdapt
           try {
             const st = await adapter.fs.stat(f);
             if (st.isFile) return { path: f };
-          } catch {
-            // next
+          } catch (_) {
+            // expected: candidate path doesn't exist, try next
           }
         }
 
@@ -86,7 +87,7 @@ const ESM_PACKAGE_MAP: Record<string, string> = {
   "react/jsx-dev-runtime": getReactJSXDevRuntimeCDNUrl(REACT_DEFAULT_VERSION),
 };
 
-export interface BareExternalPluginOptions {
+interface BareExternalPluginOptions {
   bundle?: boolean;
   lockfile?: LockfileManager;
   projectDir?: string;
@@ -148,7 +149,7 @@ async function loadFromLockfile(
 
     logger.warn(`integrity mismatch, refetching: ${url}`);
     return null;
-  } catch {
+  } catch (_) {
     logger.warn(`cached URL failed, refetching: ${url}`);
     return null;
   }
@@ -185,7 +186,11 @@ export function createBareExternalPlugin(
 
         try {
           const response = await dntShim.fetch(args.path, { redirect: "follow" });
-          if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+          if (!response.ok) {
+            throw NETWORK_ERROR.create({
+              detail: `HTTP ${response.status}: ${response.statusText}`,
+            });
+          }
 
           const contents = await response.text();
           const resolvedUrl = response.url || args.path;

package/src/src/server/handlers/dev/files/path-validator.ts

@@ -51,7 +51,8 @@ export async function validateDevFilePath(
   try {
     const info = await ctx.adapter.fs.stat(absPath);
     if (!info.isFile) return "Error: Not a file";
-  } catch {
+  } catch (_) {
+    /* expected: file may not exist */
     return "Error: File not found";
   }
 

package/src/src/server/handlers/dev/framework-candidates.generated.ts

@@ -556,6 +556,8 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "AgentContainerProps",
   "AgentContainerProps,",
   "AgentContainerProps>(",
+  "AgentMessage,",
+  "AgentMessage[];",
   "AgentStatus",
   "AgentStatus):",
   "AgentStatus,",
@@ -656,6 +658,8 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "CLOCK_ICON_ELEMENTS:",
   "CODE_BRACKETS_ICON_ELEMENTS);",
   "CODE_BRACKETS_ICON_ELEMENTS:",
+  "COMPONENT_ERROR",
+  "COMPONENT_ERROR.create({",
   "COPY_ICON_ELEMENTS);",
   "COPY_ICON_ELEMENTS:",
   "CSS",
@@ -939,7 +943,6 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "End",
   "Enter",
   "Error",
-  "Error(",
   "Error)",
   "Error):",
   "Error,",
@@ -967,7 +970,6 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "FadeIn({",
   "FadeIn,",
   "Failed",
-  "Fallback",
   "FallbackMarkdown",
   "FallbackMarkdown({",
   "Features",
@@ -1222,7 +1224,6 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "MessageSquareIcon",
   "MessageSquareIcon(",
   "MessageSquareIcon,",
-  "Message[];",
   "Messages",
   "Mode",
   "Model",
@@ -1358,7 +1359,9 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "React.ReactNode",
   "React.ReactNode);",
   "React.ReactNode;",
+  "React.RefObject<HTMLInputElement>}",
   "React.RefObject<HTMLTextAreaElement>)",
+  "React.RefObject<HTMLTextAreaElement>}",
   "React.TextareaHTMLAttributes<HTMLTextAreaElement>)}",
   "React.createContext<ChatContextValue",
   "React.createContext<ColorModeContextValue",
@@ -1534,7 +1537,6 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "StopIcon",
   "StopIcon():",
   "StopIcon({",
-  "Storage",
   "Streaming",
   "StreamingMessage",
   "StreamingMessage({",
@@ -1955,7 +1957,6 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "any",
   "any)",
   "anything",
-  "any}",
   "api/chat",
   "api:",
   "application",
@@ -2564,6 +2565,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "description?:",
   "description}",
   "design",
+  "detail:",
   "diagram",
   "diagram...",
   "diff",
@@ -2594,6 +2596,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "doc",
   "doc.name}",
   "doc.size",
+  "doc.url",
   "docs",
   "docs)",
   "document.addEventListener(",
@@ -2743,6 +2746,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "execute-skill-script",
   "execute-skill-script)",
   "execute-skill-script).",
+  "expected:",
   "export",
   "export?:",
   "exportAsMarkdown",
@@ -3050,6 +3054,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "hover:text-[var(--foreground)]",
   "hover:text-emerald-500",
   "hover:underline",
+  "href={doc.url}",
   "href={props.href}",
   "html:",
   "html>",
@@ -3462,7 +3467,6 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "messageVariants,",
   "messageVariants:",
   "messages",
-  "messages!.map((msg)",
   "messages)",
   "messages,",
   "messages.",
@@ -3475,6 +3479,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "messages={chat.messages}",
   "messages={messages}",
   "messages?.length",
+  "messages?.map((msg)",
   "messages?:",
   "messagesEndRef",
   "messagesEndRef.current?.scrollIntoView({",
@@ -4968,6 +4973,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "types",
   "typing",
   "unavailable",
+  "unavailable,",
   "undefined",
   "undefined)",
   "undefined,",
@@ -5107,6 +5113,7 @@ export const FRAMEWORK_CANDIDATES: readonly string[] = [
   "veryfront/agent",
   "veryfront/agent/react",
   "veryfront/chat",
+  "veryfront/errors",
   "veryfront/platform/compat/runtime.ts",
   "veryfront/security/client/html-sanitizer.ts",
   "veryfront/testing/assert.ts",

package/src/src/server/handlers/dev/projects/ui-handler.ts

@@ -8,7 +8,7 @@ import devUiManifest from "../../../dev-ui/manifest.js";
 const logger = baseLogger.component("projects");
 
 const moduleCache = new Map<string, { code: string; timestamp: number }>();
-const CACHE_TTL = 5000;
+const CACHE_TTL_MS = 5_000;
 
 const JS_HEADERS = {
   "Content-Type": "application/javascript",
@@ -48,15 +48,15 @@ async function readUiSource(
   const tsxPath = `${uiDir}/${resolvedPath}.tsx`;
   try {
     return { filePath: tsxPath, source: await readTextFile(tsxPath) };
-  } catch {
-    // try .ts from filesystem
+  } catch (_) {
+    /* expected: .tsx file may not exist, try .ts */
   }
 
   const tsPath = `${uiDir}/${resolvedPath}.ts`;
   try {
     return { filePath: tsPath, source: await readTextFile(tsPath) };
-  } catch {
-    // Filesystem failed, try embedded manifest (for compiled binary)
+  } catch (_) {
+    /* expected: filesystem files may not exist, try embedded manifest */
   }
 
   // Try embedded manifest - paths match the resolved path
@@ -106,7 +106,7 @@ export function handleProjectsUI(req: dntShim.Request): Promise<dntShim.Response
 
       const cached = moduleCache.get(filePath);
       const now = Date.now();
-      if (cached && now - cached.timestamp < CACHE_TTL) {
+      if (cached && now - cached.timestamp < CACHE_TTL_MS) {
         return new dntShim.Response(cached.code, { headers: JS_HEADERS });
       }
 

package/src/src/server/handlers/dev/scripts/hmr-scripts.ts

@@ -7,7 +7,7 @@
  * keepalive pings, debounced updates, and CSS hot-swap.
  */
 
-export interface HMRScriptOptions {
+interface HMRScriptOptions {
   /** Log prefix for console messages */
   logPrefix: string;
   /** Whether to use debug-gated logging (localStorage VERYFRONT_DEBUG_HMR) */
@@ -114,7 +114,7 @@ function generateHMRClient(opts: HMRScriptOptions): string {
   const debugPreamble = debugMode
     ? `
   const HMR_DEBUG = (() => {
-    try { return window.localStorage.getItem('VERYFRONT_DEBUG_HMR') === '1'; } catch { return false; }
+    try { return window.localStorage.getItem('VERYFRONT_DEBUG_HMR') === '1'; } catch (_) { return false; }
   })();
   const dlog = (...args) => { if (HMR_DEBUG) console.log(...args); };`
     : "";
@@ -134,7 +134,7 @@ function generateHMRClient(opts: HMRScriptOptions): string {
         isInitialLoad: true,
         url: window.location.href
       }, '*');
-    } catch { /* cross-origin iframe - expected */ }
+    } catch (_) { /* cross-origin iframe - expected */ }
   }
 
   const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
@@ -147,10 +147,10 @@ function generateHMRClient(opts: HMRScriptOptions): string {
   let lastReloadAt = 0;
 
   const RECONNECT_BASE_DELAY_MS = 500;
-  const RECONNECT_MAX_DELAY_MS = 5000;
-  const RELOAD_THROTTLE_MS = 2000;
-  const PING_INTERVAL_MS = 30000;
-  const PONG_TIMEOUT_MS = 90000;
+  const RECONNECT_MAX_DELAY_MS = 5_000;
+  const RELOAD_THROTTLE_MS = 2_000;
+  const PING_INTERVAL_MS = 30_000;
+  const PONG_TIMEOUT_MS = 90_000;
 
   let pingIntervalId = null;
   let lastPongAt = Date.now();
@@ -165,7 +165,7 @@ function generateHMRClient(opts: HMRScriptOptions): string {
     if (window.parent === window) return;
     try {
       window.parent.postMessage({ action: 'appUpdated', url: window.location.href }, '*');
-    } catch { /* ignore */ }
+    } catch (_) { /* expected: cross-origin iframe */ }
   }
 
   function notifyStudioAndReload(reason) {
@@ -201,7 +201,7 @@ function generateHMRClient(opts: HMRScriptOptions): string {
       if (!ws || ws.readyState !== WebSocket.OPEN) return;
       if (Date.now() - lastPongAt > PONG_TIMEOUT_MS) {
         console.warn('${logPrefix} Pong timeout, reconnecting...');
-        try { ws.close(); } catch { /* ignore */ }
+        try { ws.close(); } catch (_) { /* expected: socket already closed */ }
         return;
       }
       try { ws.send(JSON.stringify({ type: 'ping', timestamp: Date.now() })); }
@@ -242,7 +242,7 @@ function generateHMRClient(opts: HMRScriptOptions): string {
             break;
           case 'ping':
             lastPongAt = Date.now();
-            try { ws.send(JSON.stringify({ type: 'pong' })); } catch { /* ignore */ }
+            try { ws.send(JSON.stringify({ type: 'pong' })); } catch (_) { /* expected: socket closed */ }
             break;
           case 'update':
             handleUpdate(data);
@@ -306,7 +306,7 @@ function generateHMRClient(opts: HMRScriptOptions): string {
       }
 
       // Single re-render handles all paths (server propagates timestamps to all imports)
-      await updateJS(paths[0]);
+      if (paths.length > 0) await updateJS(paths[0]);
     }, UPDATE_DEBOUNCE_MS);
   }
 ${getUpdateJSFunction(logPrefix)}
@@ -320,8 +320,8 @@ ${getUpdateJSFunction(logPrefix)}
       clearTimeout(reconnectTimerId);
       reconnectTimerId = null;
     }
-    try { ws && ws.close(); } catch { /* ignore */ }
-  });
+    try { ws && ws.close(); } catch (_) { /* expected: socket already closed */ }
+  }, { once: true });
 
   window.__veryfrontHMR = { getSocket: () => ws };
 })();

package/src/src/server/handlers/dev/shared/ui-module-transform.ts

@@ -1,7 +1,7 @@
 import { withSpan } from "../../../../observability/tracing/otlp-setup.js";
 import { getEsbuild } from "../../../../platform/compat/esbuild.js";
 
-export interface TransformUiModuleOptions {
+interface TransformUiModuleOptions {
   spanName: string;
   importBasePath: string;
 }

package/src/src/server/handlers/dev/styles-candidate-scanner.ts

@@ -81,7 +81,8 @@ async function scanLocalFiles(projectDir: string, ctx: HandlerContext): Promise<
     let entries: AsyncIterable<{ name: string; isDirectory: boolean; isFile: boolean }>;
     try {
       entries = fs.readDir(dir);
-    } catch {
+    } catch (_) {
+      /* expected: directory may not exist */
       return;
     }
 
@@ -99,8 +100,8 @@ async function scanLocalFiles(projectDir: string, ctx: HandlerContext): Promise<
       try {
         const content = await ctx.adapter.fs.readFile(fullPath);
         for (const cls of extractCandidates(content)) candidates.add(cls);
-      } catch {
-        // Skip files that can't be read
+      } catch (_) {
+        /* expected: skip files that can't be read */
       }
     }
   };

package/src/src/server/handlers/dev/styles-css.handler.ts

@@ -136,7 +136,8 @@ body::before {
     const globalsPath = joinPath(ctx.projectDir, "globals.css");
     try {
       return await ctx.adapter.fs.readFile(globalsPath);
-    } catch {
+    } catch (_) {
+      /* expected: globals.css may not exist */
       logger.debug("No stylesheet found, using default");
       return DEFAULT_STYLESHEET;
     }

package/src/src/server/handlers/monitoring/client-log.handler.ts

@@ -12,6 +12,12 @@ const logger = serverLogger.component("client-log-handler");
 /** Max body size for client log payloads (64 KB) */
 const CLIENT_LOG_MAX_BODY_BYTES = 64 * 1024;
 
+/** Max length of the log message field */
+const CLIENT_LOG_MESSAGE_MAX_LENGTH = 5_000;
+
+/** Max chars of raw body shown in parse-error diagnostics */
+const CLIENT_LOG_BODY_PREVIEW_LENGTH = 500;
+
 export class ClientLogHandler extends BaseHandler {
   metadata: HandlerMetadata = {
     name: "ClientLogHandler",
@@ -37,7 +43,7 @@ export class ClientLogHandler extends BaseHandler {
 
       const level = typeof logData?.level === "string" ? logData.level : "info";
       const message = typeof logData?.message === "string"
-        ? logData.message.slice(0, 5000)
+        ? logData.message.slice(0, CLIENT_LOG_MESSAGE_MAX_LENGTH)
         : "[invalid message]";
       const details = logData?.details && typeof logData.details === "object"
         ? logData.details
@@ -92,8 +98,8 @@ export class ClientLogHandler extends BaseHandler {
       getErrorMessage(e),
     );
     serverLogger.error(
-      "[ClientLogHandler] Raw body received (first 500 chars):",
-      body.slice(0, 500),
+      `[ClientLogHandler] Raw body received (first ${CLIENT_LOG_BODY_PREVIEW_LENGTH} chars):`,
+      body.slice(0, CLIENT_LOG_BODY_PREVIEW_LENGTH),
     );
     logger.error("Body length:", body.length);
 

package/src/src/server/handlers/monitoring/health.handler.ts

@@ -35,7 +35,8 @@ export class HealthHandler extends BaseHandler {
 
       const projectDirStat = await ctx.adapter.fs.stat(ctx.projectDir);
       return !!projectDirStat?.isDirectory;
-    } catch {
+    } catch (_) {
+      /* expected: project directory may not exist */
       return false;
     }
   }
@@ -88,7 +89,8 @@ export class HealthHandler extends BaseHandler {
     try {
       const st = await ctx.adapter.fs.stat(joinPath(ctx.projectDir, "dist"));
       return !!st?.isDirectory;
-    } catch {
+    } catch (_) {
+      /* expected: dist directory may not exist */
       return false;
     }
   }

package/src/src/server/handlers/monitoring/memory.handler.ts

@@ -18,16 +18,24 @@ import { rendererLogger } from "../../../utils/index.js";
 
 const logger = rendererLogger.component("memory-debug-handler");
 
+/** Delay after forcing GC before re-measuring heap, so the runtime can settle */
+const GC_SETTLE_DELAY_MS = 200;
+
 export class MemoryDebugHandler extends BaseHandler {
   metadata: HandlerMetadata = {
     name: "MemoryDebugHandler",
     priority: PRIORITY_HIGH as HandlerPriority,
     patterns: [{ pattern: "/_debug/memory", prefix: true }],
+    enabled: (ctx) => !!ctx.isLocalProject,
   };
 
   async handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult> {
     const pathname = new URL(req.url).pathname;
 
+    if (!ctx.isLocalProject) {
+      return this.continue();
+    }
+
     if (!pathname.startsWith("/_debug/memory")) {
       return this.continue();
     }
@@ -115,7 +123,7 @@ export class MemoryDebugHandler extends BaseHandler {
     const beforeHeap = getHeapStats();
     const gcTriggered = await forceGC();
 
-    await new Promise((resolve) => dntShim.setTimeout(resolve, 200));
+    await new Promise((resolve) => dntShim.setTimeout(resolve, GC_SETTLE_DELAY_MS)); // no cleanup needed: one-shot
 
     const afterHeap = getHeapStats();
     const freedMB = Math.round((beforeHeap.usedHeapSizeMB - afterHeap.usedHeapSizeMB) * 100) / 100;

package/src/src/server/handlers/monitoring/metrics.handler.ts

@@ -15,9 +15,12 @@ export class MetricsHandler extends BaseHandler {
     name: "MetricsHandler",
     priority: PRIORITY_HIGH as HandlerPriority,
     patterns: [{ pattern: "/_metrics", exact: true }],
+    enabled: (ctx) => !!ctx.isLocalProject,
   };
 
   handle(req: dntShim.Request, ctx: HandlerContext): Promise<HandlerResult> {
+    if (!ctx.isLocalProject) return Promise.resolve(this.continue());
+
     const { pathname } = new URL(req.url);
     if (pathname !== "/_metrics") return Promise.resolve(this.continue());
 

package/src/src/server/handlers/preview/hmr-client-manager.ts

@@ -13,7 +13,7 @@ export interface HMRClientInfo {
 }
 
 /** Detailed client info for the status endpoint (no socket reference) */
-export interface HMRClientDetail {
+interface HMRClientDetail {
   id: string;
   connectedAt: number;
   projectSlug?: string;
@@ -79,21 +79,12 @@ export function getOpenSockets(projectSlug?: string): WebSocket[] {
   return sockets;
 }
 
-/** Get count of open sockets (may differ from clientsMap.size if some are closing) */
-export function getOpenSocketCount(): number {
-  let count = 0;
-  for (const client of clientsMap.values()) {
-    if (client.socket.readyState === WebSocket.OPEN) count++;
-  }
-  return count;
-}
-
 export function clearAll(): void {
   for (const client of clientsMap.values()) {
     try {
       client.socket.close();
-    } catch {
-      // Ignore close errors
+    } catch (_) {
+      /* expected: socket may already be closed */
     }
   }
   clientsMap.clear();

package/src/src/server/handlers/preview/hmr-message-router.ts

@@ -3,7 +3,7 @@ import { getClientCount, getOpenSockets } from "./hmr-client-manager.js";
 
 const logger = serverLogger.component("hmr-handler");
 
-export interface HMRMetrics {
+interface HMRMetrics {
   broadcastsSent: number;
   messagesForwarded: number;
   lastBroadcastTime: number;
@@ -19,7 +19,7 @@ export function getMetrics(): { clients: number } & HMRMetrics {
   return { clients: getClientCount(), ...metrics };
 }
 
-export function requiresFullReload(path: string): boolean {
+function requiresFullReload(path: string): boolean {
   const ext = path.split(".").pop()?.toLowerCase();
   return ext === "mdx" || ext === "md" || path.includes("veryfront.config");
 }
@@ -55,7 +55,7 @@ export function broadcastUpdate(changedPaths?: string[], projectSlug?: string):
   }
 }
 
-export function broadcastMessage(message: string, projectSlug?: string): void {
+function broadcastMessage(message: string, projectSlug?: string): void {
   const sockets = getOpenSockets(projectSlug);
   let sentCount = 0;