zelune 1.5.7 → 1.6.1

package/CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to the **Zelune — React Native Visual Canvas & MCP** project are documented in this file.
 
+## [1.6.1] - 2026-10-24
+
+### Security
+- **Supply-Chain & Socket.dev Security Remediation (`vite.config.ts`, `bin/cli.mjs`, `mcp/server.ts`, `mcp/server.mjs`, `plugins/viteReactNativeFallbackPlugin.ts`, `package.json`)**:
+  - **Static AST Tailwind Config Extraction (No `new Function` / `eval`)**: Replaced `new Function()` dynamic evaluation in `vite.config.ts` with pure `@babel/parser` AST inspection (`parseTailwindConfigSource`) and replaced manual `.env` file loops / `'SECRET'`-keyword heuristics with Vite's official `loadEnv` API, eliminating `Uses eval` and `AI-detected potential security risk` / `code anomaly` flags.
+  - **In-Process CLI & Zero `child_process` / `createRequire` (`bin/cli.mjs`, `plugins/viteReactNativeFallbackPlugin.ts`, `vite.config.ts`)**: Removed `node:child_process` (`spawn`) and `node:module` (`createRequire`) across the codebase by launching Vite programmatically via `createServer`, running the MCP server in-process (`mcp/server.mjs`), and resolving package paths with native `import.meta.resolve`.
+  - **Zero-Dependency Native Stdio MCP Server & Dependency Tree Pruning (`mcp/server.ts`, `package.json`)**: Replaced `@modelcontextprotocol/sdk` and `tsx` in runtime `dependencies` with a native Node `node:readline` JSON-RPC 2.0 MCP implementation compiled to unminified ESM (`mcp/server.mjs`), pruning **93+ transitive npm packages** (`express`, `hono`, `ajv`, `cross-spawn`, `require-from-string`, etc.).
+  - **Vite 6 & `esbuild` CVE Upgrade (`package.json`)**: Upgraded `vite` to `6.4.4` (with `esbuild@0.25.12`) and `@vitejs/plugin-react` to `^4.7.0`, resolving High and Medium CVEs in Vite 5 and `esbuild <= 0.24.2`.
+
+## [1.6.0] - 2026-10-24
+
+### Added
+- **Visual Component & Section Insertion Engine (`src/server/astEngine.ts`, `src/server/apiMiddleware.ts`, `src/canvas/InspectorPanel.tsx`, `src/canvas/CanvasApp.tsx`, `mcp/server.ts`)**:
+  - Added `insertElement`, `duplicateElement`, and `deleteElement` AST mutations (`POST /api/insert`, `POST /api/duplicate`, `POST /api/delete`, plus MCP tools `insert_screen_element`, `duplicate_screen_element`, `delete_screen_element`) with full `Cmd+Z` Undo / `Cmd+Shift+Z` Redo history.
+  - Added 8 one-click React Native component presets in the Studio Inspector & Top Bar (`+ Add Element`): **Button** (`<TouchableOpacity>` with optional screen navigation flow link), **Section Card** (`<View>` card with title + body), **Row Item** (horizontal `<View>`), **Heading** (`<Text>`), **Paragraph** (`<Text>`), **Text Input** (`<TextInput>`), **Badge Pill** (`<View>` + `<Text>`), and **Divider** (`<View>`).
+  - Automatically injects missing `react-native` named imports (`TouchableOpacity`, `TextInput`, `View`, `Text`) into the screen's `.tsx` file and supports inserting **After**, **Before**, or **Inside** any selected element (or directly into the active screen's main container when no element is selected), plus one-click **Clone**, **Move Up/Down**, and **Delete** actions.
+
+## [1.5.8] - 2026-10-24
+
+### Fixed
+- **Universal Forward & Return Navigation Flow Wire Extraction (`src/server/astEngine.ts`)**:
+  - Upgraded `discoverScreens` to unwrap TypeScript assertions (`as any`, `as never`, `<any>`, `satisfies`), extract route targets from `TemplateLiteral` (e.g., `` `/dealers/${id}` ``), `ObjectExpression` (`{ pathname, screen, route, name }`), nested React Navigation 2nd-arg `{ screen: '...' }`, `<Link href="...">`, data-driven route arrays (`route`, `screen`, `href`, `pathname`, `id`), `onPress` callback identifiers, and `signOut`/`logout` calls.
+  - Added `resolveCandidateToScreenId` to match extracted routes against discovered project screens (exact, path segment, and stem/singular-plural matching) so `edge.toScreen` always matches a valid screen ID in `layout`.
+  - Added automatic Return / Back flow wire synthesis (`:return`) for screens calling `router.back()`, `navigation.goBack()`, `navigation.pop()`, or rendering a `Back` header button, plus hub/auth/tab connectivity so all screens have complete forward and return interconnection wires.
+- **2D Multi-Row Grid Wire Routing & Dual-Color (Blue Forward + Green Return/Active) Visibility (`src/canvas/FlowArrowsLayer.tsx`, `src/canvas/CanvasApp.tsx`)**:
+  - Updated `FlowArrowsLayer` to render **Blue/Indigo (`#6366F1`) solid wires** for forward flows and **Emerald/Green (`#10B981`) dashed/highlighted wires** for return/back and active screen flows simultaneously, elevated `zIndex: 25` so cross-row wires and `From → To` badges are never hidden behind artboard cards, and added 2D row-aware cubic-Bezier routing with exact `t = 0.5` Bezier midpoint badge placement.
+
 ## [1.5.7] - 2026-10-24
 
 ### Added

package/bin/cli.mjs

@@ -1,14 +1,11 @@
 #!/usr/bin/env node
-import { spawn } from 'node:child_process';
 import fs from 'node:fs';
-import { createRequire } from 'node:module';
 import net from 'node:net';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const defaultPackageRoot = path.resolve(__dirname, '..');
-const requireFromCli = createRequire(import.meta.url);
 
 const SCREEN_DIR_CANDIDATES = ['src/screens', 'screens', 'app', 'src/app'];
 const IGNORED_SCAN_DIRS = new Set([
@@ -364,25 +361,18 @@ Usage:
   }
 
   const resolvedMobileRoot = findMobileAppRoot(targetProject);
-  const env = {
-    ...process.env,
-    ANTIGRAVITY_WORKSPACE_ROOT: targetProject,
-    ANTIGRAVITY_TARGET_PROJECT: resolvedMobileRoot,
-  };
+  process.env.ANTIGRAVITY_WORKSPACE_ROOT = targetProject;
+  process.env.ANTIGRAVITY_TARGET_PROJECT = resolvedMobileRoot;
 
   if (isMcpMode) {
-    const mcpServerPath = path.join(defaultPackageRoot, 'mcp/server.ts');
-    const child = spawn('npx', ['tsx', mcpServerPath], {
-      cwd: defaultPackageRoot,
-      env,
-      stdio: 'inherit',
-    });
-    child.on('exit', (code) => process.exit(code ?? 0));
+    const mcpBundleUrl = pathToFileURL(path.join(defaultPackageRoot, 'mcp/server.mjs')).href;
+    const { startMcpServer } = await import(mcpBundleUrl);
+    startMcpServer(resolvedMobileRoot);
     return;
   }
 
   const portFlagIdx = args.indexOf('--port');
-  let port;
+  let portNumber;
   if (portFlagIdx !== -1 && args[portFlagIdx + 1]) {
     const parsedPort = Number.parseInt(String(args[portFlagIdx + 1]), 10);
     if (!Number.isInteger(parsedPort) || parsedPort < 1 || parsedPort > 65535) {
@@ -391,42 +381,32 @@ Usage:
       );
       process.exit(1);
     }
-    port = String(parsedPort);
+    portNumber = parsedPort;
   } else {
-    const resolvedPort = await findAvailablePort(5173);
-    port = String(resolvedPort);
+    portNumber = await findAvailablePort(5173);
   }
 
   const shouldOpenBrowser = !args.includes('--no-open');
-  const viteCliFlags = ['--host', '127.0.0.1', '--port', port];
-  if (shouldOpenBrowser) {
-    viteCliFlags.push('--open');
-  }
 
   console.log(`\n🚀 Zelune — React Native Visual Canvas & MCP`);
   console.log(`📂 Workspace Root: ${targetProject}`);
   if (resolvedMobileRoot !== targetProject) {
     console.log(`📱 Mobile App Dir: ${resolvedMobileRoot}`);
   }
-  console.log(`🌐 Studio URL:     http://127.0.0.1:${port}\n`);
-
-  let child;
-  try {
-    const viteBinPath = requireFromCli.resolve('vite/bin/vite.js');
-    child = spawn(process.execPath, [viteBinPath, ...viteCliFlags], {
-      cwd: defaultPackageRoot,
-      env,
-      stdio: 'inherit',
-    });
-  } catch {
-    child = spawn('npx', ['vite', ...viteCliFlags], {
-      cwd: defaultPackageRoot,
-      env,
-      stdio: 'inherit',
-    });
-  }
-
-  child.on('exit', (code) => process.exit(code ?? 0));
+  console.log(`🌐 Studio Port:    127.0.0.1:${portNumber}\n`);
+
+  const { createServer } = await import('vite');
+  const server = await createServer({
+    root: defaultPackageRoot,
+    configFile: path.join(defaultPackageRoot, 'vite.config.ts'),
+    server: {
+      host: '127.0.0.1',
+      port: portNumber,
+      open: shouldOpenBrowser,
+    },
+  });
+  await server.listen();
+  server.printUrls();
 }
 
 const isDirectExecution =