Function openDev

ts/workflow-cli/cli/open.ts:77–128

* DEV: spawn Vite as a child process (NOT via createServer in-process — Vite's * config loader fights with the tsx loader powering this CLI), wait for the dev * server, then open the browser. Narrows the bridge's allowlist to the bound * file's directory via FH_BUILDER_ALLOW_ROOT.

(resolvedFile?: string, allowRoot?: string)

 * file's directory via FH_BUILDER_ALLOW_ROOT.
 */
async function openDev(resolvedFile?: string, allowRoot?: string): Promise<void> {
  const here = path.dirname(fileURLToPath(import.meta.url));
  const appRoot = path.resolve(here, "..");

  const env: NodeJS.ProcessEnv = { ...process.env };
  if (allowRoot) env.FH_BUILDER_ALLOW_ROOT = allowRoot;

  const port = 5173;
  const url = resolvedFile
    ? `http://localhost:${port}/?file=${encodeURIComponent(resolvedFile)}`
    : `http://localhost:${port}/`;

  const viteBin = locateViteBin(appRoot);
  // --no-open: this CLI is the sole opener — it builds the `?file=` URL and
  // opens it below. Without this, vite.config's `server.open: true` would also
  // open a tab, at the bare URL (no ?file=), so you'd get two tabs and the
  // wrong one focused. (CLI flag overrides config; `dev` still auto-opens.)
  const vite = spawn(viteBin, ["--port", String(port), "--host", "127.0.0.1", "--strictPort", "--no-open"], {
    cwd: appRoot,
    env,
    stdio: "inherit",
    shell: process.platform === "win32", // .cmd shims need a shell on Windows
  });

  vite.on("error", (err) => {
    process.stderr.write(`Failed to start vite: ${err.message}\n`);
    process.exit(1);
  });

  // Poll until the port answers, then open the browser. Bounded so we don't
  // hang forever if vite never starts.
  void (async () => {
    const ok = await waitForPort(port, 15000);
    if (!ok) {
      process.stderr.write("Vite didn't come up within 15s.\n");
      return;
    }
    process.stdout.write(`\nfh-workflow running at ${url}\n`);
    if (resolvedFile) process.stdout.write(`Bound to ${resolvedFile}\n`);
    process.stdout.write("Press Ctrl+C to stop.\n\n");
    openInBrowser(url);
  })();

  // Keep our process alive until vite exits (stdio is inherited, so Ctrl+C
  // goes straight to vite which then exits, then we exit).
  await new Promise<void>((resolve) => {
    vite.on("exit", (code) => {
      process.exit(code ?? 0);
      resolve();
    });
  });
}

function locateViteBin(appRoot: string): string {
  const cmd = process.platform === "win32" ? "vite.cmd" : "vite";