Function handleReload

design/src/serve.ts:184–235

(req: Request)

  }

  async function handleReload(req: Request): Promise<Response> {
    let body: any;
    try {
      body = await req.json();
    } catch {
      return Response.json({ error: "Invalid JSON" }, { status: 400 });
    }

    const newHtmlPath = body.html;
    if (!newHtmlPath || !fs.existsSync(newHtmlPath)) {
      return Response.json(
        { error: `HTML file not found: ${newHtmlPath}` },
        { status: 400 },
      );
    }

    // Security: resolve symlinks and validate the reload path is a FILE
    // inside the allowed directory (anchored to the initial HTML file's
    // parent). Prevents path traversal via /api/reload reading arbitrary
    // files. A path resolving to the allowedDir itself (a directory) used
    // to pass the guard and then crash readFileSync with EISDIR — reject
    // it explicitly with a clear 400 instead.
    const resolvedReload = fs.realpathSync(path.resolve(newHtmlPath));
    if (!resolvedReload.startsWith(allowedDir + path.sep)) {
      return Response.json(
        { error: `Path must be within: ${allowedDir}` },
        { status: 403 },
      );
    }
    if (!fs.statSync(resolvedReload).isFile()) {
      return Response.json(
        { error: `Path must be a file, not a directory: ${newHtmlPath}` },
        { status: 400 },
      );
    }

    // Swap the HTML content
    htmlContent = fs.readFileSync(resolvedReload, "utf-8");
    state = "serving";

    console.error(`SERVE_RELOADED: html=${newHtmlPath}`);

    // Reset timeout
    if (timeoutTimer) clearTimeout(timeoutTimer);
    timeoutTimer = setTimeout(() => {
      console.error(`SERVE_TIMEOUT: after=${timeout}s`);
      server.stop();
      process.exit(1);
    }, timeout * 1000);

    return Response.json({ reloaded: true });
  }

  // Keep the process alive
  await new Promise(() => {});