Function startStaticServer

ts/workflow-cli/server/staticServer.ts:38–82

(opts: StaticServerOptions)

 * 404 rather than falling back, so a bad asset never gets served as HTML.
 */
export async function startStaticServer(opts: StaticServerOptions): Promise<{ port: number }> {
  const spaRoot = path.resolve(opts.spaRoot);
  const indexHtml = path.join(spaRoot, "index.html");

  const server = createServer((req, res) => {
    void (async () => {
      if (await handleFileRequest(req, res, opts.allowedRoots)) return;

      const url = new URL(req.url ?? "/", "http://localhost");
      const pathname = decodeURIComponent(url.pathname);

      // Resolve under spaRoot; reject any traversal escape.
      const target = path.resolve(spaRoot, "." + pathname);
      const rel = path.relative(spaRoot, target);
      if (rel.startsWith("..") || path.isAbsolute(rel)) {
        res.statusCode = 403;
        res.end("forbidden");
        return;
      }

      const isAssetPath = pathname.startsWith("/assets/");
      const served = await serveFile(res, pathname === "/" ? indexHtml : target);
      if (served) return;

      // Real asset misses are 404s; anything else is an SPA route → index.html.
      if (isAssetPath) {
        res.statusCode = 404;
        res.end("not found");
        return;
      }
      if (!(await serveFile(res, indexHtml))) {
        res.statusCode = 404;
        res.end("not found");
      }
    })();
  });

  return new Promise((resolve, reject) => {
    server.on("error", reject);
    server.listen(0, "127.0.0.1", () => {
      const { port } = server.address() as AddressInfo;
      resolve({ port });
    });
  });
}

/** Write `file` to the response with a guessed content type. Returns false if it doesn't exist. */
async function serveFile(res: ServerResponseLike, file: string): Promise<boolean> {