Security (adversarial P0/P1/P2): - Path traversal: sanitize HMR trigger slug + new confinePath helper for daemon generate-viewer / visual-diff sessionDir/outputPath (P0 #1-3) - Origin-pin WS recording/HiFi proxies to the daemon's app port so a malicious page on a different localhost port can't trigger them (P0 #4) - jsonForScript() encoder for </script> breakout in viewer JSON-in-script blocks (P0 #5) - Lock checkRefStale->click against page navigation in click/fill/hover-ref handlers via pageNavigatedBetween (P1 #7) - Cap computeLCS allocation at 4M cells; oversized snapshots return human-readable summary instead of OOM (P1 #8) - Make pendingRequests a WeakMap<Request,_>: GC reclaims, parallel same-URL requests no longer overwrite (P1 #2) - cliClientQueues FIFO replaces single-slot cliClientMap; concurrent CLI requests no longer clobber each other (P1 #1) - recording.ts rolls back state if goto fails; rename->copy+unlink fallback so cross-device EXDEV doesn't orphan video file (P1 #3, #10) - safeRegex blocks alternation-with-quantifier patterns like (a|aa)+ (P1 #4); existing patterns already caught \w+/\d+ cases - Daemon writes state file inside listen() callback before resolve so external clients never observe "port open, state missing" (P1 #5) - acquireLock stores ${pid}:${token} format; PID-reuse defended via state-file cross-check; recovery is atomic via wx-write + read-back token verification (P1 #6) - ConsoleCapture.recomputeCounts derives counts from buffer instead of drift-prone increment/decrement bookkeeping (P1 #9) - Resource error filter anchored to package paths instead of bare url.includes('devbar'); legit user assets no longer silently dropped - Daemon viewer GET resolves against projectRoot (not CWD); server.js carries projectRoot from index.ts onListening callback - writeDaemonState pre-unlinks stale .tmp file; rename failure unlinks on the way out so token doesn't linger on disk - RingBuffer.sinceWithDropped surfaces overflow count - refs.ts uses exact name match (was substring "first hit wins") - Recording action drops while paused now logged + counted via droppedWhilePaused - captureFailure logs inner failure instead of swallowing - exec.ts toJsonSafe() walker handles BigInt/Error/Element/circular refs (was JSON.parse(JSON.stringify()) which throws on those) Composition / correctness: - diff.ts ref-name match anchored start-of-string with min-length cap instead of name.includes(slice(0,20)) Type-design tightening: - DaemonResponse: discriminated union {ok:true, data} | {ok:false, error} - DaemonRequest: keyed by action via DaemonActionParams map + mapped type - Save*Command / *ErrorCommand: collapsed to SaveCommand<T,P> / ErrorCommand<T> generics with payload narrowing - ConsoleLogLevel used in LogSubscribe/LogSubscription instead of inline union and string[] - daemonRequest action: string -> DaemonAction - ScreenshotOptions / RefreshOptions interfaces replace Record<string,unknown> escape hatches in the WS contract - ViewportName template-literal union (mobile|tablet|desktop|WxH) - AxeImpact alias used in violation count/group/color helpers - OutlineCategory literal union replaces category?: string - Export MicrodataItem/MetaImage/MissingTag/OutlineCategory through package indexes - DevBarState.consoleFilter now Extract<ConsoleLogLevel,…>|null so the link to the canonical level union is explicit - AccentColor alias documents intent on accentColor fields Code simplification: - ensureDir / pickMinimalEnv / git-branch detection / TAILWIND_BREAKPOINTS / positionStyles / DevBarControl shape / CDP-Playwright constants / graceful-shutdown handler all consolidated to single source of truth - findProjectRoot memoized - Logo SVG: single LOGO_CHILDREN descriptor walked by both DOM and string renderers - Deleted devbar shim files (earlyConsoleCapture.ts, outline.ts, schema.ts) — consumers import direct from sweetlink - Deleted unused exports in network.ts/accessibility.ts/storage.ts (and matching tests) - handleHifiScreenshot/handleDemoCommand inline daemon-state reads consolidated to findAnyDaemonState() + proxyToDaemon() helpers Other: - Add 3 truly-undocumented env vars (SWEETLINK_APP_PORT, SWEETLINK_APP_URL, PORTLESS_URL) to .env.example - Add vite@>=7.0.0 <7.3.2 override to patch dev-only path-traversal advisory (12 -> 3 residual deps in dev audit) - Delete unreferenced 145KB devbar-anim.gif Verified: pnpm typecheck + 2262/2262 tests + pnpm build all pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Make a plugin for Chrome Dev Tools #2

Description

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions