Method start

src/core/websocket-server.ts:196–338

* Start the HTTP + WebSocket server. * HTTP serves the plugin UI content; WebSocket handles plugin communication.

()

   * HTTP serves the plugin UI content; WebSocket handles plugin communication.
   */
  async start(): Promise<void> {
    if (this._isStarted) return;

    return new Promise((resolve, reject) => {
      let rejected = false;
      const rejectOnce = (error: any) => {
        if (!rejected) {
          rejected = true;
          reject(error);
        }
      };

      try {
        // Create HTTP server first — handles plugin UI requests
        this.httpServer = createHttpServer((req, res) => this.handleHttpRequest(req, res));

        // Attach WebSocket server to the HTTP server (shares the same port)
        this.wss = new WSServer({
          server: this.httpServer,
          maxPayload: 100 * 1024 * 1024, // 100MB — screenshots and large component data can be big
          verifyClient: (info, callback) => {
            // Mitigate Cross-Site WebSocket Hijacking (CSWSH):
            // Reject connections from unexpected browser origins.
            const origin = info.origin;
            // Exact match only — startsWith would let e.g.
            // https://www.figma.com.attacker.example through.
            const allowed =
              !origin ||                           // No origin — local process (e.g. Node.js client)
              origin === 'null' ||                  // Sandboxed iframe / Figma Desktop plugin UI
              origin === 'https://www.figma.com' ||
              origin === 'https://figma.com';
            if (allowed) {
              callback(true);
            } else {
              logger.warn({ origin }, 'Rejected WebSocket connection from unauthorized origin');
              callback(false, 403, 'Unauthorized Origin');
            }
          },
        });

        // Error handler for startup failures (EADDRINUSE, etc.)
        // Must be on BOTH httpServer and wss — the WSS re-emits HTTP server errors
        // and throws if no listener is attached.
        const onStartupError = (error: any) => {
          if (!this._isStarted) {
            try { if (this.wss) { this.wss.close(); this.wss = null; } } catch { /* ignore */ }
            try { if (this.httpServer) { this.httpServer.close(); this.httpServer = null; } } catch { /* ignore */ }
            rejectOnce(error);
          } else {
            logger.error({ error }, 'HTTP/WebSocket server error');
          }
        };

        this.httpServer.on('error', onStartupError);
        this.wss.on('error', onStartupError);

        // Start listening on the HTTP server (which also handles WS upgrades)
        this.httpServer.listen(this.options.port, this.options.host || 'localhost', () => {