yap2app 1.1.5 → 1.1.7

package/bridge.js

@@ -18,6 +18,20 @@ const PROJECT_ROOT = process.cwd();
 const CLOUD_RELAY_URL = process.env.YAP2APP_CLOUD_URL || 'https://yap2app-dot-cybage-hackathon.uc.r.appspot.com';
 const PAIR_CODE = (process.env.YAP2APP_PAIR_CODE || ('CYB-' + Math.floor(100 + Math.random() * 900))).toUpperCase();
 
+/**
+ * Validates and resolves relative file paths strictly inside PROJECT_ROOT.
+ * Prevents directory traversal attacks (e.g. ../../etc/passwd or absolute path escapes).
+ */
+function safeResolvePath(baseDir, relativePath) {
+  const cleanRel = (relativePath || '').replace(/^[\\\/]+/, '');
+  const resolved = path.resolve(baseDir, cleanRel);
+  const normalizedBase = path.resolve(baseDir);
+  if (!resolved.startsWith(normalizedBase + path.sep) && resolved !== normalizedBase) {
+    throw new Error(`Security Exception: Path traversal attempt blocked for path: "${relativePath}"`);
+  }
+  return resolved;
+}
+
 // Helper to send outbound HTTPS requests to the Yap2App Cloud Relay
 function sendCloudRelayRequest(method, endpoint, payload) {
   return new Promise((resolve) => {
@@ -148,8 +162,8 @@ const server = http.createServer(async (req, res) => {
     res.writeHead(200, headers);
     res.end(JSON.stringify({
       status: 'healthy',
-      service: 'Yap2App-Localhost-Bridge',
-      version: '1.1.5',
+      service: 'yap2app-bridge',
+      version: '1.1.6',
       port: PORT,
       pair_code: PAIR_CODE,
       project_root: PROJECT_ROOT,
@@ -163,12 +177,11 @@ const server = http.createServer(async (req, res) => {
   if (req.method === 'GET' && (pathname === '/api/context' || pathname === '/context')) {
     try {
       const promptQuery = searchParams.get('q') || '';
-      console.log(`[Yap2App Bridge] 🔍 Scanning shallow codebase context in: ${PROJECT_ROOT}${promptQuery ? ` (ranking for query: "${promptQuery}")` : ''}`);
       const context = await scanCodebase(PROJECT_ROOT, promptQuery);
       res.writeHead(200, headers);
       res.end(JSON.stringify(context));
     } catch (e) {
-      console.error('[Yap2App Bridge] Context scan error:', e);
+      console.error('  [bridge] Context scan error:', e.message);
       res.writeHead(500, headers);
       res.end(JSON.stringify({ error: e.message }));
     }
@@ -211,7 +224,7 @@ const server = http.createServer(async (req, res) => {
           diffs: diffResults
         }));
       } catch (e) {
-        console.error('[Yap2App Bridge] Diff error:', e);
+        console.error('  [bridge] Diff error:', e.message);
         res.writeHead(500, headers);
         res.end(JSON.stringify({ error: e.message }));
       }
@@ -230,14 +243,14 @@ const server = http.createServer(async (req, res) => {
         const written = [];
 
         for (const file of files) {
-          const fullPath = path.join(PROJECT_ROOT, file.path);
+          const fullPath = safeResolvePath(PROJECT_ROOT, file.path);
           
           // Ensure parent directory exists
           await fs.mkdir(path.dirname(fullPath), { recursive: true });
           
           // Write file with utf8 encoding
           await fs.writeFile(fullPath, file.content, 'utf8');
-          console.log(`[Yap2App Bridge] ✍️  Successfully wrote: ${file.path}`);
+          console.log(`  [bridge] Wrote ${file.path}`);
           written.push(file.path);
         }
 
@@ -250,7 +263,7 @@ const server = http.createServer(async (req, res) => {
           message: `Successfully wrote ${written.length} files to ${path.basename(PROJECT_ROOT)}`
         }));
       } catch (e) {
-        console.error('[Yap2App Bridge] Write to disk error:', e);
+        console.error('  [bridge] Write error:', e.message);
         res.writeHead(500, headers);
         res.end(JSON.stringify({ error: e.message }));
       }
@@ -266,40 +279,49 @@ const server = http.createServer(async (req, res) => {
 // Gracefully handle EADDRINUSE without crashing
 server.on('error', (err) => {
   if (err && err.code === 'EADDRINUSE') {
-    console.log(`\n===============================================================`);
-    console.log(`📡 Localhost port ${PORT} is active. Cloud Relay continues seamlessly!`);
-    console.log(`📁 Active Workspace: ${PROJECT_ROOT}`);
-    console.log(`🔑 Pairing Code: ${PAIR_CODE}`);
-    console.log(`🌐 Web Studio: ${CLOUD_RELAY_URL}`);
-    console.log(`===============================================================\n`);
+    console.log(`\n---------------------------------------------------------------`);
+    console.log(`Yap2App Bridge`);
+    console.log(`Port ${PORT} is active. Cloud Relay connected.`);
+    console.log(`Active Workspace:  ${PROJECT_ROOT}`);
+    console.log(`Pairing Code:      ${PAIR_CODE}`);
+    console.log(`Web Studio:        ${CLOUD_RELAY_URL}`);
+    console.log(`---------------------------------------------------------------\n`);
+    console.log(`Bridge is running.`);
+    console.log(`Open Web Studio in your browser to sync components to this workspace.`);
+    console.log(`Press Ctrl/Cmd+C to stop.\n`);
     return;
   }
-  console.error('[Yap2App Bridge Error]:', err);
+  console.error('  [bridge] Error:', err.message || err);
 });
 
 export async function startBridge(port = PORT) {
   server.listen(port, '0.0.0.0', () => {
-    console.log(`\n===============================================================`);
-    console.log(`🚀 Yap2App Localhost Bridge & Telemetry is ACTIVE!`);
-    console.log(`📡 Local Endpoint: http://127.0.0.1:${port}`);
-    console.log(`📁 Active Workspace: ${PROJECT_ROOT}`);
-    console.log(`🔑 Pairing Code: ${PAIR_CODE}`);
-    console.log(`🌐 Connected to Web Studio: ${CLOUD_RELAY_URL}`);
-    console.log(`🛡️  Enterprise Diff, W3C PNA & Cloud Relay Enabled`);
-    console.log(`===============================================================\n`);
-    console.log(`Ready for 1-click sync from Yap2App Web Studio UI...\n`);
+    console.log(`\n---------------------------------------------------------------`);
+    console.log(`Yap2App Bridge v1.1.6`);
+    console.log(`Local Endpoint:    http://127.0.0.1:${port}`);
+    console.log(`Active Workspace:  ${PROJECT_ROOT}`);
+    console.log(`Pairing Code:      ${PAIR_CODE}`);
+    console.log(`Web Studio:        ${CLOUD_RELAY_URL}`);
+    console.log(`---------------------------------------------------------------\n`);
+    console.log(`Bridge is running.`);
+    console.log(`Open Web Studio in your browser to sync components to this workspace.`);
+    console.log(`Press Ctrl/Cmd+C to stop.\n`);
   });
 
   // Initial scan and Cloud Relay registration
   try {
     const initialContext = await scanCodebase(PROJECT_ROOT);
+    if (initialContext && initialContext.total_files_count === 0) {
+      console.log(`  ℹ️  Fresh workspace detected (0 code files).`);
+      console.log(`  Yap2App will automatically scaffold directories and write files when synced from Web Studio.\n`);
+    }
     await sendCloudRelayRequest('POST', '/api/v1/bridge/heartbeat', {
       pair_code: PAIR_CODE,
       project_name: path.basename(PROJECT_ROOT),
       project_root: PROJECT_ROOT,
       framework: initialContext.framework,
       context: initialContext,
-      version: '1.1.5'
+      version: '1.1.6'
     });
   } catch (e) {}
 
@@ -313,7 +335,7 @@ export async function startBridge(port = PORT) {
         project_root: PROJECT_ROOT,
         framework: context.framework,
         context: context,
-        version: '1.1.5'
+        version: '1.1.6'
       });
 
       // If pending write tasks, fetch and execute them on local disk
@@ -323,10 +345,10 @@ export async function startBridge(port = PORT) {
         for (const task of tasks) {
           const written = [];
           for (const file of (task.files || [])) {
-            const fullPath = path.join(PROJECT_ROOT, file.path);
+            const fullPath = safeResolvePath(PROJECT_ROOT, file.path);
             await fs.mkdir(path.dirname(fullPath), { recursive: true });
             await fs.writeFile(fullPath, file.content, 'utf8');
-            console.log(`[Yap2App Bridge] ✍️  Wrote approved file: ${file.path}`);
+            console.log(`  [bridge] Wrote ${file.path}`);
             written.push(file.path);
           }
           await sendCloudRelayRequest('POST', '/api/v1/bridge/complete-write', {

package/mcp.js

@@ -41,19 +41,6 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["componentName"]
         }
       },
-      {
-        name: "yap2app_mount_snippet",
-        description: "Generates the parent import statement and JSX mounting code snippet for integrating a new component into an existing page or parent component.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            componentName: { type: "string", description: "The component name" },
-            filePath: { type: "string", description: "The component's relative file path" },
-            parentFile: { type: "string", description: "Optional parent file (e.g. 'src/App.tsx' or 'src/app/page.tsx')" }
-          },
-          required: ["componentName", "filePath"]
-        }
-      },
       {
         name: "yap2app_write_component",
         description: "Safely writes a React/Tailwind component to the local filesystem, ensuring directories exist.",
@@ -106,7 +93,6 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const suggestion = {
       component_name: componentName,
       target_file_path: relativePath,
-      import_statement: `import { ${componentName} } from "${importPath}";`,
       usage_example: `<${componentName} />`
     };
 
@@ -115,22 +101,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     };
   }
 
-  // 3. yap2app_mount_snippet
-  if (name === "yap2app_mount_snippet") {
-    const { componentName, filePath, parentFile } = args;
-    const cleanImport = filePath.replace(/\.[^/.]+$/, '').replace(/^src\//, '@/');
-    const snippet = {
-      target_parent_file: parentFile || "src/App.tsx (or src/app/page.tsx)",
-      import_line: `import { ${componentName} } from "${cleanImport}";`,
-      jsx_insertion: `{/* Render ${componentName} */}\n<${componentName} />`
-    };
-
-    return {
-      content: [{ type: "text", text: JSON.stringify(snippet, null, 2) }]
-    };
-  }
-
-  // 4. yap2app_write_component
+  // 3. yap2app_write_component
   if (name === "yap2app_write_component") {
     const { filePath, code } = args;
     const fullPath = path.join(TARGET_DIR, filePath);
@@ -155,7 +126,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 export async function runMcpServer() {
   const transport = new StdioServerTransport();
   await server.connect(transport);
-  console.error("⚡ Yap2App MCP Server running on stdio");
+  console.error("Yap2App MCP Server running on stdio");
 }
 
 const isDirectRun = Boolean(typeof process !== 'undefined' && process.argv && process.argv[1] && (process.argv[1].endsWith('mcp.js') || process.argv[1].endsWith('mcp')));

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "yap2app",
-  "version": "1.1.5",
+  "version": "1.1.7",
+  "type": "module",
   "description": "Autonomous Vibe-to-Prod Localhost Bridge & Model Context Protocol (MCP) Server",
   "main": "bin/cli.bundle.js",
   "bin": {

package/scanner.js

@@ -106,6 +106,13 @@ function parsePackageJson(content) {
  * Returns null if no verified signature matches with high confidence.
  */
 function detectVerifiedFramework(manifests, allFiles, extensionHistogram) {
+  if (!allFiles || allFiles.length === 0) {
+    return {
+      framework: 'plain_html_css_js',
+      displayName: 'Plain HTML / CSS / JS (Fresh Workspace)'
+    };
+  }
+
   // 1. Google Brightspot CMS / Glue-Bundle / Handlebars Frontend
   const hasHbsFiles = (extensionHistogram['.hbs'] || 0) > 0 || (extensionHistogram['.handlebars'] || 0) > 0;
   const hasBrightspotConfigs = allFiles.some(f =>