yap2app 1.1.6 → 1.1.8

package/bridge.js

@@ -17,6 +17,21 @@ const PORT = Number(process.env.YAP2APP_PORT) || 10420;
 const PROJECT_ROOT = process.cwd();
 const CLOUD_RELAY_URL = process.env.YAP2APP_CLOUD_URL || 'https://yap2app-dot-cybage-hackathon.uc.r.appspot.com';
 const PAIR_CODE = (process.env.YAP2APP_PAIR_CODE || ('CYB-' + Math.floor(100 + Math.random() * 900))).toUpperCase();
+const CLI_VERSION = '1.1.8';
+
+/**
+ * Validates and resolves relative file paths strictly inside PROJECT_ROOT.
+ * Prevents directory traversal attacks (e.g. ../../etc/passwd or absolute path escapes).
+ */
+function safeResolvePath(baseDir, relativePath) {
+  const cleanRel = (relativePath || '').replace(/^[\\\/]+/, '');
+  const resolved = path.resolve(baseDir, cleanRel);
+  const normalizedBase = path.resolve(baseDir);
+  if (!resolved.startsWith(normalizedBase + path.sep) && resolved !== normalizedBase) {
+    throw new Error(`Security Exception: Path traversal attempt blocked for path: "${relativePath}"`);
+  }
+  return resolved;
+}
 
 // Helper to send outbound HTTPS requests to the Yap2App Cloud Relay
 function sendCloudRelayRequest(method, endpoint, payload) {
@@ -32,7 +47,7 @@ function sendCloudRelayRequest(method, endpoint, payload) {
         headers: {
           'Content-Type': 'application/json',
           'Content-Length': Buffer.byteLength(body),
-          'User-Agent': 'yap2app-cli/1.1.5'
+          'User-Agent': `yap2app-cli/${CLI_VERSION}`
         },
         timeout: 6000
       }, (res) => {
@@ -149,7 +164,7 @@ const server = http.createServer(async (req, res) => {
     res.end(JSON.stringify({
       status: 'healthy',
       service: 'yap2app-bridge',
-      version: '1.1.6',
+      version: CLI_VERSION,
       port: PORT,
       pair_code: PAIR_CODE,
       project_root: PROJECT_ROOT,
@@ -163,7 +178,6 @@ const server = http.createServer(async (req, res) => {
   if (req.method === 'GET' && (pathname === '/api/context' || pathname === '/context')) {
     try {
       const promptQuery = searchParams.get('q') || '';
-      console.log(`  [bridge] Scanning codebase in ${path.basename(PROJECT_ROOT)}${promptQuery ? ` (query: "${promptQuery}")` : ''}`);
       const context = await scanCodebase(PROJECT_ROOT, promptQuery);
       res.writeHead(200, headers);
       res.end(JSON.stringify(context));
@@ -230,7 +244,7 @@ const server = http.createServer(async (req, res) => {
         const written = [];
 
         for (const file of files) {
-          const fullPath = path.join(PROJECT_ROOT, file.path);
+          const fullPath = safeResolvePath(PROJECT_ROOT, file.path);
           
           // Ensure parent directory exists
           await fs.mkdir(path.dirname(fullPath), { recursive: true });
@@ -266,11 +280,16 @@ const server = http.createServer(async (req, res) => {
 // Gracefully handle EADDRINUSE without crashing
 server.on('error', (err) => {
   if (err && err.code === 'EADDRINUSE') {
-    console.log(`\n  Yap2App Bridge\n`);
-    console.log(`  Port ${PORT} is active. Cloud Relay connected.`);
-    console.log(`  Workspace:   ${PROJECT_ROOT}`);
-    console.log(`  Pair Code:   ${PAIR_CODE}`);
-    console.log(`  Web Studio:  ${CLOUD_RELAY_URL}\n`);
+    console.log(`\n---------------------------------------------------------------`);
+    console.log(`Yap2App Bridge`);
+    console.log(`Port ${PORT} is active. Cloud Relay connected.`);
+    console.log(`Active Workspace:  ${PROJECT_ROOT}`);
+    console.log(`Pairing Code:      ${PAIR_CODE}`);
+    console.log(`Web Studio:        ${CLOUD_RELAY_URL}`);
+    console.log(`---------------------------------------------------------------\n`);
+    console.log(`Bridge is running.`);
+    console.log(`Open Web Studio in your browser to sync components to this workspace.`);
+    console.log(`Press Ctrl/Cmd+C to stop.\n`);
     return;
   }
   console.error('  [bridge] Error:', err.message || err);
@@ -278,24 +297,32 @@ server.on('error', (err) => {
 
 export async function startBridge(port = PORT) {
   server.listen(port, '0.0.0.0', () => {
-    console.log(`\n  Yap2App Bridge v1.1.6\n`);
-    console.log(`  Local:       http://127.0.0.1:${port}`);
-    console.log(`  Workspace:   ${PROJECT_ROOT}`);
-    console.log(`  Pair Code:   ${PAIR_CODE}`);
-    console.log(`  Web Studio:  ${CLOUD_RELAY_URL}\n`);
-    console.log(`  Ready for sync.\n`);
+    console.log(`\n---------------------------------------------------------------`);
+    console.log(`Yap2App Bridge v${CLI_VERSION}`);
+    console.log(`Local Endpoint:    http://127.0.0.1:${port}`);
+    console.log(`Active Workspace:  ${PROJECT_ROOT}`);
+    console.log(`Pairing Code:      ${PAIR_CODE}`);
+    console.log(`Web Studio:        ${CLOUD_RELAY_URL}`);
+    console.log(`---------------------------------------------------------------\n`);
+    console.log(`Bridge is running.`);
+    console.log(`Open Web Studio in your browser to sync components to this workspace.`);
+    console.log(`Press Ctrl/Cmd+C to stop.\n`);
   });
 
   // Initial scan and Cloud Relay registration
   try {
     const initialContext = await scanCodebase(PROJECT_ROOT);
+    if (initialContext && initialContext.total_files_count === 0) {
+      console.log(`  ℹ️  Fresh workspace detected (0 code files).`);
+      console.log(`  Yap2App will automatically scaffold directories and write files when synced from Web Studio.\n`);
+    }
     await sendCloudRelayRequest('POST', '/api/v1/bridge/heartbeat', {
       pair_code: PAIR_CODE,
       project_name: path.basename(PROJECT_ROOT),
       project_root: PROJECT_ROOT,
       framework: initialContext.framework,
       context: initialContext,
-      version: '1.1.6'
+      version: CLI_VERSION
     });
   } catch (e) {}
 
@@ -309,7 +336,7 @@ export async function startBridge(port = PORT) {
         project_root: PROJECT_ROOT,
         framework: context.framework,
         context: context,
-        version: '1.1.6'
+        version: CLI_VERSION
       });
 
       // If pending write tasks, fetch and execute them on local disk
@@ -319,7 +346,7 @@ export async function startBridge(port = PORT) {
         for (const task of tasks) {
           const written = [];
           for (const file of (task.files || [])) {
-            const fullPath = path.join(PROJECT_ROOT, file.path);
+            const fullPath = safeResolvePath(PROJECT_ROOT, file.path);
             await fs.mkdir(path.dirname(fullPath), { recursive: true });
             await fs.writeFile(fullPath, file.content, 'utf8');
             console.log(`  [bridge] Wrote ${file.path}`);

package/mcp.js

@@ -41,19 +41,6 @@ server.setRequestHandler(ListToolsRequestSchema, async () => {
           required: ["componentName"]
         }
       },
-      {
-        name: "yap2app_mount_snippet",
-        description: "Generates the parent import statement and JSX mounting code snippet for integrating a new component into an existing page or parent component.",
-        inputSchema: {
-          type: "object",
-          properties: {
-            componentName: { type: "string", description: "The component name" },
-            filePath: { type: "string", description: "The component's relative file path" },
-            parentFile: { type: "string", description: "Optional parent file (e.g. 'src/App.tsx' or 'src/app/page.tsx')" }
-          },
-          required: ["componentName", "filePath"]
-        }
-      },
       {
         name: "yap2app_write_component",
         description: "Safely writes a React/Tailwind component to the local filesystem, ensuring directories exist.",
@@ -106,7 +93,6 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const suggestion = {
       component_name: componentName,
       target_file_path: relativePath,
-      import_statement: `import { ${componentName} } from "${importPath}";`,
       usage_example: `<${componentName} />`
     };
 
@@ -115,22 +101,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     };
   }
 
-  // 3. yap2app_mount_snippet
-  if (name === "yap2app_mount_snippet") {
-    const { componentName, filePath, parentFile } = args;
-    const cleanImport = filePath.replace(/\.[^/.]+$/, '').replace(/^src\//, '@/');
-    const snippet = {
-      target_parent_file: parentFile || "src/App.tsx (or src/app/page.tsx)",
-      import_line: `import { ${componentName} } from "${cleanImport}";`,
-      jsx_insertion: `{/* Render ${componentName} */}\n<${componentName} />`
-    };
-
-    return {
-      content: [{ type: "text", text: JSON.stringify(snippet, null, 2) }]
-    };
-  }
-
-  // 4. yap2app_write_component
+  // 3. yap2app_write_component
   if (name === "yap2app_write_component") {
     const { filePath, code } = args;
     const fullPath = path.join(TARGET_DIR, filePath);

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "yap2app",
-  "version": "1.1.6",
+  "version": "1.1.8",
+  "type": "module",
   "description": "Autonomous Vibe-to-Prod Localhost Bridge & Model Context Protocol (MCP) Server",
   "main": "bin/cli.bundle.js",
   "bin": {

package/scanner.js

@@ -106,6 +106,13 @@ function parsePackageJson(content) {
  * Returns null if no verified signature matches with high confidence.
  */
 function detectVerifiedFramework(manifests, allFiles, extensionHistogram) {
+  if (!allFiles || allFiles.length === 0) {
+    return {
+      framework: 'plain_html_css_js',
+      displayName: 'Plain HTML / CSS / JS (Fresh Workspace)'
+    };
+  }
+
   // 1. Google Brightspot CMS / Glue-Bundle / Handlebars Frontend
   const hasHbsFiles = (extensionHistogram['.hbs'] || 0) > 0 || (extensionHistogram['.handlebars'] || 0) > 0;
   const hasBrightspotConfigs = allFiles.some(f =>