Author Server

Author Server

runtime/server/index.mjs

node <skill-root>/runtime/server/index.mjs <prototype.html> [--port=4178] [--snapshot=prototype/notes.snapshot.js]

• Binds to 127.0.0.1 only; default port 4178.
• --snapshot is resolved relative to the HTML directory and must stay inside it. Without it, Direct edit, Mark and Inspector work but notes cannot be saved (PUT /notes → 503).
• Loads <skill-root>/.env without overriding existing env vars.
• If the port already serves the same HTML+snapshot, prints that URL and exits 0; if it serves another page, prints it and exits 1. EADDRINUSE from another process exits 1.

Lifetime (session.mjs)

• Red Stop button → immediate shutdown.
• Last tab closed → 3-minute grace (reopening cancels it).
• No requests for 2 hours → exit.

Routes

Method	Path	Purpose
GET	/ or /<html-name>	Prototype HTML with Inspector targets injected and /__prototype-author/author/bootstrap.js appended
GET	/__prototype-author/session	{ htmlPath, snapshotPath, url }
POST	/__prototype-author/shutdown	Stop (trusted request)
POST	/__prototype-author/presence	Tab open/close heartbeat (trusted)
PUT	/__prototype-author/notes	Validate and write snapshot (trusted, 2 MB body limit)
POST	/__prototype-author/edit	Direct edit write-back into the HTML, atomic (trusted)
GET	/__prototype-author/inspector/open?file=&target=	Open source location in IDE
GET	/sketch/	Sketch Board
GET	/.html-prototype/packs/<path>	Pack files from project roots upward, then ~/.html-prototype/packs
GET	/__prototype-author/author/*, /__prototype-author/client/*	Author/client runtime assets only
GET	anything else	Static files inside the prototype directory

Write routes require isTrustedAuthorRequest (source-editor.mjs); path traversal is rejected with 403. Responses are cache-control: no-store.

Do not run the server or screenshots against untrusted HTML.