fix(config): harden CORS, addons, CSS, and artifact scans (#756)

Author: cssbruno

addons/tailwind/tailwind.go

@@ -75,9 +75,10 @@ func (p processor) ProcessCSS(context gowdk.CSSContext) (gowdk.CSSResult, error)
 	defer os.RemoveAll(tempDir)
 
 	tempOutput := filepath.Join(tempDir, "app.css")
-	input := options.Input
+	workingDir := cssWorkingDir(context)
+	input := resolveCSSPath(workingDir, options.Input)
 	if len(context.Sources) > 0 {
-		generatedInput, err := writeInputWithSources(tempDir, options.Input, context.Sources)
+		generatedInput, err := writeInputWithSources(tempDir, workingDir, input, context.Sources)
 		if err != nil {
 			return gowdk.CSSResult{}, err
 		}
@@ -91,6 +92,7 @@ func (p processor) ProcessCSS(context gowdk.CSSContext) (gowdk.CSSResult, error)
 	var stdout bytes.Buffer
 	var stderr bytes.Buffer
 	command := exec.Command(commandPath, args...)
+	command.Dir = workingDir
 	command.Stdout = &stdout
 	command.Stderr = &stderr
 	if err := command.Run(); err != nil {
@@ -111,11 +113,8 @@ func (p processor) ProcessCSS(context gowdk.CSSContext) (gowdk.CSSResult, error)
 	}, nil
 }
 
-func writeInputWithSources(tempDir string, input string, sources []gowdk.CSSSource) (string, error) {
-	inputPath, err := filepath.Abs(input)
-	if err != nil {
-		return "", err
-	}
+func writeInputWithSources(tempDir string, workingDir string, input string, sources []gowdk.CSSSource) (string, error) {
+	inputPath := resolveCSSPath(workingDir, input)
 	relInput, err := filepath.Rel(tempDir, inputPath)
 	if err != nil {
 		return "", err
@@ -130,10 +129,7 @@ func writeInputWithSources(tempDir string, input string, sources []gowdk.CSSSour
 			continue
 		}
 		seen[sourcePath] = true
-		absoluteSource, err := filepath.Abs(sourcePath)
-		if err != nil {
-			return "", err
-		}
+		absoluteSource := resolveCSSPath(workingDir, sourcePath)
 		relativeSource, err := filepath.Rel(tempDir, absoluteSource)
 		if err != nil {
 			return "", err
@@ -148,6 +144,28 @@ func writeInputWithSources(tempDir string, input string, sources []gowdk.CSSSour
 	return generatedInput, nil
 }
 
+func cssWorkingDir(context gowdk.CSSContext) string {
+	for _, candidate := range []string{context.WorkingDir, context.ConfigDir, context.ProjectRoot, context.SourceRoot} {
+		candidate = strings.TrimSpace(candidate)
+		if candidate != "" {
+			return candidate
+		}
+	}
+	return "."
+}
+
+func resolveCSSPath(workingDir string, path string) string {
+	path = strings.TrimSpace(path)
+	if filepath.IsAbs(path) {
+		return path
+	}
+	absolute, err := filepath.Abs(filepath.Join(workingDir, path))
+	if err != nil {
+		return filepath.Join(workingDir, path)
+	}
+	return absolute
+}
+
 func cssPath(path string) string {
 	path = filepath.ToSlash(path)
 	path = strings.ReplaceAll(path, `\`, `\\`)

addons/tailwind/tailwind_test.go

@@ -38,8 +38,10 @@ func TestProcessCSSRunsStandaloneCommand(t *testing.T) {
 		t.Fatal(err)
 	}
 	argsFile := filepath.Join(root, "args.txt")
+	cwdFile := filepath.Join(root, "cwd.txt")
 	inputCopy := filepath.Join(root, "generated-input.css")
 	t.Setenv("TAILWIND_ARGS_FILE", argsFile)
+	t.Setenv("TAILWIND_CWD_FILE", cwdFile)
 	t.Setenv("TAILWIND_INPUT_COPY", inputCopy)
 
 	result, err := Addon(Options{
@@ -66,6 +68,17 @@ func TestProcessCSSRunsStandaloneCommand(t *testing.T) {
 	if len(result.Stylesheets) != 1 || result.Stylesheets[0].Href != "/assets/site.css" {
 		t.Fatalf("unexpected stylesheets: %#v", result.Stylesheets)
 	}
+	wantCWD, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	cwd, err := os.ReadFile(cwdFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.TrimSpace(string(cwd)) != wantCWD {
+		t.Fatalf("expected tailwind command to run in %q, got %q", wantCWD, cwd)
+	}
 
 	args, err := os.ReadFile(argsFile)
 	if err != nil {
@@ -89,6 +102,63 @@ func TestProcessCSSRunsStandaloneCommand(t *testing.T) {
 	}
 }
 
+func TestProcessCSSResolvesRelativePathsFromContextWorkingDir(t *testing.T) {
+	root := t.TempDir()
+	if err := os.Mkdir(filepath.Join(root, "styles"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	input := filepath.Join(root, "styles", "app.css")
+	if err := os.WriteFile(input, []byte(`@import "tailwindcss";`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	argsFile := filepath.Join(root, "args.txt")
+	cwdFile := filepath.Join(root, "cwd.txt")
+	inputCopy := filepath.Join(root, "generated-input.css")
+	t.Setenv("TAILWIND_ARGS_FILE", argsFile)
+	t.Setenv("TAILWIND_CWD_FILE", cwdFile)
+	t.Setenv("TAILWIND_INPUT_COPY", inputCopy)
+
+	other := t.TempDir()
+	previous, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chdir(other); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if err := os.Chdir(previous); err != nil {
+			t.Fatal(err)
+		}
+	})
+
+	_, err = Addon(Options{
+		Input:   "styles/app.css",
+		Command: fakeTailwindCommand(t),
+	}).ProcessCSS(gowdk.CSSContext{
+		WorkingDir: root,
+		Sources:    []gowdk.CSSSource{{Path: "site.page.gwdk"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	cwd, err := os.ReadFile(cwdFile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.TrimSpace(string(cwd)) != root {
+		t.Fatalf("expected tailwind command to run in %q, got %q", root, cwd)
+	}
+	generatedInput, err := os.ReadFile(inputCopy)
+	if err != nil {
+		t.Fatal(err)
+	}
+	generated := string(generatedInput)
+	if !strings.Contains(generated, `styles/app.css`) {
+		t.Fatalf("expected generated input to reference context-relative input, got:\n%s", generated)
+	}
+}
+
 func TestProcessCSSReportsMissingExecutable(t *testing.T) {
 	input := filepath.Join(t.TempDir(), "app.css")
 	if err := os.WriteFile(input, []byte(`@import "tailwindcss";`), 0o644); err != nil {
@@ -195,6 +265,9 @@ func fakeTailwindCommand(t *testing.T) string {
 
 const fakeTailwindScript = `#!/bin/sh
 set -eu
+if [ "${TAILWIND_CWD_FILE:-}" != "" ]; then
+	pwd > "$TAILWIND_CWD_FILE"
+fi
 printf '%s\n' "$@" > "$TAILWIND_ARGS_FILE"
 out=""
 in=""

docs/engineering/security.md

@@ -66,15 +66,21 @@ diagnostic code, a `file:line`, and remediation; run `gowdk explain <code>` for
 details.
 
 `gowdk build` evaluates the same static baseline before writing output and scans
-the final emitted artifact files for bundled secrets after generation.
+text-like final emitted artifact files for bundled secrets after generation. The
+final scan is bounded to 1 MiB per text file and 16 MiB total text input; known
+binary artifact types such as WASM, images, archives, and generated binaries are
+not scanned as text, and oversized text artifacts produce warnings.
+
 Production builds fail on error-severity findings unless they are explicitly
 waived or scoped-bypassed (see below); non-production builds print a prominent
-warning summary without blocking local iteration. `gowdk audit` remains the
-explicit report and CI surface: it prints the full human/JSON report, reads
-declared `*.audit.gwdk` policies, checks frontend risks such as bundle secrets
-and raw-HTML sinks, can emit readable standalone runtime tests with `gowdk audit
---emit-tests`, can verify committed tests are current with `gowdk audit
---check-tests`, and can run generated-app runtime tests with `gowdk audit --run`.
+warning summary without blocking local iteration.
+
+`gowdk audit` remains the explicit report and CI surface: it prints the full
+human/JSON report, reads declared `*.audit.gwdk` policies, checks frontend risks
+such as bundle secrets and raw-HTML sinks, can emit readable standalone runtime
+tests with `gowdk audit --emit-tests`, can verify committed tests are current
+with `gowdk audit --check-tests`, and can run generated-app runtime tests with
+`gowdk audit --run`.
 
 ## CI-Native Output: JSON Schema, SARIF, Fingerprints, And Diff
 

docs/reference/cli.md

@@ -100,10 +100,12 @@ gowdk lsp [--config <file>] [--project-root <dir>] [--ssr]
   (`GOPROXY=off`, `GOTOOLCHAIN=local`). A failed expectation is reported as
   `audit_test_failed`; exceeding the deadline is reported distinctly as
   `audit_test_timeout`.
-  `gowdk build` runs the same baseline gate before writing output, scans the
-  final emitted artifact files for bundled secrets after generation, blocks
-  production builds on error-severity findings unless `--allow-insecure` is set,
-  and writes the
+  `gowdk build` runs the same baseline gate before writing output, scans
+  text-like final emitted artifact files for bundled secrets after generation
+  with a 1 MiB per-file limit and 16 MiB total text scan budget, skips known
+  binary artifact types such as WASM, images, archives, and binaries, reports
+  oversized text artifacts as warnings, blocks production builds on
+  error-severity findings unless `--allow-insecure` is set, and writes the
   posture alone to a non-served `.gowdk/reports/<output-name>/gowdk-security.json`
   path outside the selected output directory.
   `gowdk audit` exit codes form a stable CI contract; gate on the specific code

docs/reference/config.md

@@ -273,11 +273,18 @@ type CORSConfig struct {
 ```
 
 `AllowedOrigins` accepts literal `http` or `https` origins, or `"*"` only when
-`AllowCredentials` is false. Preflight requests must match a generated
-API/command/query route and must request a method and headers allowed by the
-policy. `AllowedMethods` is optional; when omitted, the matched route method is
-returned. `AllowedHeaders` must include non-simple request headers such as
-`Content-Type` for JSON APIs and any configured CSRF header.
+`AllowCredentials` is false. Origin validation canonicalizes host case, strips
+explicit default ports (`http:80`, `https:443`), strips a trailing DNS dot, and
+handles bracketed IPv6 hosts. Unicode hostnames are rejected; use ASCII
+punycode. Invalid ports, userinfo, paths, query strings, and fragments are
+rejected with the offending origin in the diagnostic. Runtime request matching
+uses the same canonical form as config validation.
+
+Preflight requests must match a generated API/command/query route and must
+request a method and headers allowed by the policy. `AllowedMethods` is
+optional; when omitted, the matched route method is returned. `AllowedHeaders`
+must include non-simple request headers such as `Content-Type` for JSON APIs and
+any configured CSRF header.
 
 `.gwdk` API declarations can attach endpoint-local CORS with a trailing `cors`
 clause:
@@ -732,6 +739,13 @@ output. Current validation uses feature registration for render-mode,
 realtime, and other compiler checks; SPA builds invoke addons that implement
 `gowdk.CSSProcessor` or `gowdk.SEOProvider`.
 
+Config loading rejects nil addons, empty addon names, duplicate addon names,
+empty feature IDs, addons with no features, and duplicate feature ownership
+except for the legacy `spa`/`static` `FeatureSPA` alias overlap. External addon
+feature names are allowed when they are non-empty. Behaviorful built-in features
+must provide their matching extension contract: `FeatureSEO` requires
+`gowdk.SEOProvider`, and `FeatureAuth` requires `gowdk.AuthSessionProvider`.
+
 DB helper usage is ordinary Go code around `database/sql`; see [db.md](db.md)
 for migrations, transactions, readiness, and sqlc usage.
 

docs/reference/css.md

@@ -230,6 +230,9 @@ type CSSProcessor interface {
 
 `CSSContext` includes:
 
+- `ProjectRoot`, `ConfigDir`, `SourceRoot`, and `WorkingDir`: explicit root
+  paths for processors that need deterministic relative path handling. In CLI
+  builds these point at the loaded project/config root.
 - `Sources`: discovered page/component source metadata.
 - `Sources[*].CSSClasses`: extracted literal class names from the current view
   subset.
@@ -296,7 +299,9 @@ Defaults:
 At build time the addon creates a temporary Tailwind input file that imports the
 configured `Input` CSS and adds `@source` declarations for discovered GOWDK
 source files. This follows Tailwind v4's CSS/source directive model. It then
-runs the standalone executable with `-i <temp-input> -o <temp-output>`.
+runs the standalone executable with `-i <temp-input> -o <temp-output>` from the
+CSS context working directory. Relative `Input` and source paths resolve from
+that directory instead of the caller's process working directory.
 
 The addon does not use npm, run `npx`, or run through a shell. If `Command` is
 omitted and `tailwindcss` is not available on `PATH`, `gowdk build` fails with