Address comments

Author: minggangw

README.md

@@ -119,7 +119,7 @@ how much glue you want to write.
   capability runtime. One string generic per call gives request,
   response, and message types; a `web.json` allow-list is the public
   API surface; the same capabilities are also reachable over plain
-  HTTP for `curl`, Postman, and AI-agent tool-use. _New in `2.0.0`._
+  HTTP for `curl`, Postman, and AI-agent tool-use. _New in `2.0.0-beta.0`._
 
   ```ts
   import { connect } from 'rclnodejs/web';

demo/web/javascript/index.html

@@ -222,10 +222,17 @@ <h2>5. Same capability, no SDK — just <code>curl</code></h2>
       const host = location.hostname || 'localhost';
       const ENDPOINTS = {
         ws: `ws://${host}:9000/capability`,
-        // HTTP base — the SDK derives the WS sibling automatically for
-        // subscribe (see web/client.js _resolveUrls).
+        // HTTP base for call/publish.
         http: `http://${host}:9001`,
       };
+      // Pass Form C ({http, ws}) when the user picks HTTP so subscribe
+      // still reaches the WS runtime on :9000. The SDK's auto-derived
+      // sibling would land on :9001 instead and fail — this dev layout
+      // splits the two transports across separate ports.
+      const connectArg = (mode) =>
+        mode === 'http'
+          ? { http: ENDPOINTS.http, ws: ENDPOINTS.ws }
+          : ENDPOINTS.ws;
 
       const endpointEl = document.getElementById('endpoint');
       const statusEl = document.getElementById('status');
@@ -236,7 +243,7 @@ <h2>5. Same capability, no SDK — just <code>curl</code></h2>
       const setEndpoint = (mode) => {
         endpointEl.textContent =
           mode === 'http'
-            ? `${ENDPOINTS.http}  (subscribe lazily uses ws://${host}:9000/capability)`
+            ? `${ENDPOINTS.http}  (subscribe routed to ${ENDPOINTS.ws})`
             : ENDPOINTS.ws;
       };
 
@@ -270,14 +277,15 @@ <h2>5. Same capability, no SDK — just <code>curl</code></h2>
         setEndpoint(mode);
         setStatus(`connecting (${mode})…`);
         try {
-          ros = await connect(ENDPOINTS[mode]);
+          ros = await connect(connectArg(mode));
           setStatus(`connected (${mode})`, 'ok');
         } catch (e) {
           setStatus(`failed: ${e.message || e}`, 'err');
           return;
         }
         // Bind the always-on /web_demo_chatter subscription on every
-        // reconnect. Over HTTP this lazily opens the WS sibling.
+        // reconnect. Over HTTP the explicit { ws } in connectArg() makes
+        // this work — see comment above.
         try {
           await ros.subscribe('/web_demo_chatter', (msg) =>
             log('chatLog', `<- ${msg.data}`),

demo/web/javascript/server.js

@@ -19,6 +19,12 @@ const http = require('http');
 const fs = require('fs');
 
 const rclnodejs = require('../../../index.js');
+// In a downstream project this is the public, supported import:
+//   const { createRuntime, WebSocketTransport, HttpTransport } =
+//     require('rclnodejs/web/server');
+// Inside this in-repo demo we go through the relative path because the
+// `demo/web/javascript/` folder has its own package.json (so Node's
+// package self-reference doesn't see `rclnodejs` as resolvable here).
 const {
   createRuntime,
   WebSocketTransport,
@@ -128,7 +134,12 @@ async function main() {
       relPath = urlPath.replace(/^\/+/, '');
     }
     const filePath = path.resolve(baseDir, relPath);
-    if (!filePath.startsWith(baseDir)) {
+    // Confine reads to baseDir. `path.relative` collapses `..` segments,
+    // so any escape attempt either yields a result that starts with `..`
+    // or is absolute — reject both. (`startsWith(baseDir)` alone would
+    // false-positive on a sibling like `${baseDir}-other/...`.)
+    const rel = path.relative(baseDir, filePath);
+    if (rel.startsWith('..') || path.isAbsolute(rel)) {
       res.writeHead(403).end('forbidden');
       return;
     }

demo/web/typescript/src/main.ts

@@ -20,10 +20,18 @@ type Mode = 'ws' | 'http';
 const HOST = location.hostname || 'localhost';
 const ENDPOINTS: Record<Mode, string> = {
   ws: `ws://${HOST}:9000/capability`,
-  // HTTP base URL — the SDK derives the WS sibling automatically for
-  // subscribe (see web/client.js _resolveUrls).
+  // HTTP base for call/publish.
   http: `http://${HOST}:9001`,
 };
+// Pass Form C ({http, ws}) when the user picks HTTP so subscribe still
+// reaches the WS runtime on :9000. The SDK's auto-derived sibling would
+// land on :9001 instead and fail — this dev layout splits the two
+// transports across separate ports.
+function connectArg(mode: Mode): string | { http: string; ws: string } {
+  return mode === 'http'
+    ? { http: ENDPOINTS.http, ws: ENDPOINTS.ws }
+    : ENDPOINTS.ws;
+}
 
 function $<T extends HTMLElement>(id: string): T {
   const el = document.getElementById(id);
@@ -40,7 +48,7 @@ function setStatus(text: string, cls: 'ok' | 'err' | '' = ''): void {
 function setEndpoint(mode: Mode): void {
   $('endpoint').textContent =
     mode === 'http'
-      ? `${ENDPOINTS.http}  (subscribe lazily uses ws://${HOST}:9000/capability)`
+      ? `${ENDPOINTS.http}  (subscribe routed to ${ENDPOINTS.ws})`
       : ENDPOINTS.ws;
 }
 
@@ -83,15 +91,15 @@ async function main(): Promise<void> {
     setEndpoint(mode);
     setStatus(`connecting (${mode})…`);
     try {
-      ros = await connect(ENDPOINTS[mode]);
+      ros = await connect(connectArg(mode));
       setStatus(`connected (${mode})`, 'ok');
     } catch (e) {
       setStatus(`failed: ${String(e)}`, 'err');
       return;
     }
 
-    // Always-on chatter subscription; over HTTP this lazily opens
-    // the WS sibling endpoint (subscribe always uses WS).
+    // Always-on chatter subscription; subscribe always uses WS — the
+    // explicit { ws } in connectArg() makes this work in HTTP mode too.
     try {
       await ros.subscribe<'std_msgs/msg/String'>('/web_demo_chatter', (msg) =>
         log('chatLog', `<- ${msg.data}`)