Sites: serve directly from FastAPI — no per-wolt servers, no ports

[woltspace-jerpint]

What

Deletes the per-wolt site server processes and all port machinery. /wolt/{name}/site/* now serves straight from disk. Net −425 lines.

Why

The per-wolt livereload subprocesses were vestigial: the server already proxied every request, stripped livereload's own reload script, and injected its own — wired to a watchfiles WebSocket the server serves itself. Each subprocess was a static file server behind a proxy, dragging along a port (6001–6999), a site_port in wolt.json, a .state/site.json liveness file, and a bind-gap that needed the "waking up" fallback page.

How

• serve_wolt_site: direct disk serving. HTML gets the reload script injected at serve time; everything else via FileResponse (ETag + Range — video on sites works now, the buffering proxy broke it). Livereload WS unchanged.
• Path traversal guard (new responsibility — the subprocess used to clamp paths): resolve() + relative_to before any read, same idiom as _serve_static. Tested against literal ../, encoded, deep, and symlink escapes.
• sites.py gutted to site_dir() + ensure_site() (lazy starter-site scaffold, same semantics as before).
• Directory URLs 308-redirect to trailing slash (parity with the old tornado server — relative links inside subdir pages).
• Gone: port allocation, site_port at creation (existing keys inert, zero migration), POST /sites/{name}/start|stop, the waking-up page, the livereload dependency, orphaned create-wakeup.html, the perma-flaky PID-liveness test.

Review

Built by uxwolt (fable), then adversarially reviewed by an independent fable agent, which found: a blocker (create-creature-wolt still imported the deleted start_site — my greps missed it, no .py extension), the missing directory redirect, missing asset no-cache, HEAD 405, and stale ARCHITECTURE.md lines (one told contributors to import the deleted function). All fixed in the second commit. The reviewer explicitly cleared: traversal guard (8 attack shapes), iframe headers (nothing adds X-Frame-Options), no downstream readers of removed fields, no circular imports, non-rodent scaffold-on-GET is pre-existing behavior.

Tests

461 passed — test_wolt_sites.py rewritten to exercise the real ASGI route via TestClient (serving, injection, scaffold-on-request, traversal/symlink attacks, redirect, caching, HEAD). The one remaining failure (test_sessions_all_dead) is the pre-existing environment failure, unrelated; its perma-flaky sibling test_stale_state_cleaned is deleted along with the code it tested.

Behavior notes

• First paint of a new wolt's site is now instant (no subprocess bind gap).
• /sites lists wolts with site dirs (no more running/port fields — nothing consumed them).
• New-wolt flow unchanged: scaffold at creation → starter site in viewport → wolt redesigns → livereload.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
woltspace	Building	Preview	Aug 4, 2026 1:34am