phase 1 of 4: safe by default, open in editor and cheap shell wins #310

Goal

Close the security gaps, make setup lighter and pick up the shell features devframe already gives us. This is the first of four phases from a comparison against the official Angular DevTools, Vue, Nuxt and Vite DevTools, React tooling and agent MCP servers (October 2026). Rough size: 2 to 3 weeks.

Items marked (to confirm) come from a code audit and haven't been reproduced yet. Check each one before fixing it.

Security

• vite: check the Host header against loopback or allowedHosts. Today isAllowedHubRequest checks the socket address and Origin only, and isAllowedHubOrigin returns true when there is no Origin, so same-origin GETs after a DNS rebind are not refused. Require Sec-Fetch-Site when Origin is missing, and add a test with Host: evil.test (packages/devtools/src/vite.ts:43-60, 146-156).
• hub: share one gate between the Vite plugin and initPangularHub(), so the Express hub gets the same loopback and Host check (hub.ts:114-144).
• hub: add enabled, defaulting to NODE_ENV !== 'production'. When off, return a no-op middleware; when forced on, log a loud warning. Gate the demo src/server.ts:16-23. The docs already say the hub has no production switch (getting-started/express.md:138-141).
• hub: turn the one-time code and the MCP token on by default, the Vite hub included. Write the token to a file only the user can read instead of printing it (vite.ts:118-120, hub.ts:97-101) (to confirm).
• mcp: stop devframe_state_read and devframe://state from exposing data of inspectors turned off for agents (mcp: agent.tools.<inspector>=false still exposes the inspector's data through devframe_state_read #238).
• mcp: three safety tiers (read, action, destructive). agent.readOnly drops every tool that is not read. Fill ACTION_TOOLS.router. Reclassify highlight (read), plus record-pipes and change-detection with record (action) (config.ts, devframe.ts).
• overlay: refuse a write without page when more than one page is connected, so an NgRx dispatch or form action can't reach every tab (devframe.ts:1582, ngrx-overlay.ts:107, forms-actions.ts:676) (to confirm).
• analog: limit analog-call-api to API routes, /_analog and page URLs, so it can't fetch /@fs/… or ?raw (rpc/analog-register.ts:82-128) (to confirm).
• extension: drop the <all_urls> content scripts, including the MAIN-world one, and correct the "Host access" text in chrome-extension.md (extension/manifest.json).
• extension: give the panel iframe a title (axe frame-title) (extension/panel.html).

Wiring and shell

• Open in editor from every file:line through @devframes/service-open, with its workspace-root check. Add Alt+click in pick mode to open the picked component's file (component-pick.ts, component-tree.ts). Today a source jump exists only in the extension, through the Sources panel.
• vite: inject the overlay with transformIndexHtml (serve only), with an overlay: false opt-out, so a Vite setup takes one step.
• hub: put the docks in one "Pangular" group, and hide the Capacitor placeholder until feat(overlay): add manual overlay initialization and support for Capacitor apps #21 lands.
• hub: post agent writes, NG errors and hydration mismatches through ctx.messages, and show counts as dock badges.
• mcp: pass server instructions (for example "call list-pages first"), and add pangular mcp --print-config claude|cursor|vscode.
• overlay: make the NativeScript overlay respect config.inspectors (overlay-nativescript.ts:157, 264) (to confirm).

Bugs the audit found

• injectors: with no selector or token, inspect-providers slices its JSON at MAX_TOOL_CHARS. Agents get invalid JSON and lose the environment injectors. Return an outline, or drop whole nodes and say how many (rpc/injector-tools.ts:25-29, 95-101).
• pipes: pipes seen only at runtime (translate, ngrxPush, Material) never appear in the panel list (app/src/pages/pipes-inspector.ts) (to confirm).
• ui: the DI and Signals pages show an empty state when loading fails. Show an alert with Retry instead (di-inspector.ts, signal-inspector.ts) (to confirm).

Done when

• Tests cover a foreign Host, a missing Origin and a production start.
• A Vite user needs one setup step.
• A file:line in the hub opens in the editor.