Replace the vite-multiple-assets dev dependency with a small custom Vite plugin

[Keavon]

No description provided.

[gemini-code-assist]

Code Review

This pull request removes the vite-multiple-assets dependency, replacing it with custom Vite plugins to handle static asset serving and third-party license generation. It also updates several frontend dependencies, including typescript-eslint, rolldown, and svelte. Feedback suggests restoring error handling for the license generation command, refactoring the asset middleware to avoid redundant path calculations, and using the more idiomatic generateBundle hook for asset emission.

[cubic-dev-ai]

2 issues found across 3 files

Confidence score: 3/5

• There is some merge risk because both reported issues are medium severity (6/10) with high confidence (9/10), and they affect runtime/build safety in frontend/vite.config.ts.
• The path traversal guard in frontend/vite.config.ts is bypassable due to startsWith() prefix matching, which can incorrectly treat sibling paths as valid and weaken directory boundary checks.
• Pay close attention to frontend/vite.config.ts - fix the startsWith() traversal check and add try/catch around execSync so Vite builds do not crash on cargo failures.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="frontend/vite.config.ts">

<violation number="1" location="frontend/vite.config.ts:56">
P2: This path traversal guard is bypassable because `startsWith()` treats sibling paths with the same prefix as inside the asset directory.</violation>

<violation number="2" location="frontend/vite.config.ts:88">
P2: Wrap this `execSync` call in a try-catch block. If the `cargo` command fails (e.g., missing toolchain, compilation error), `execSync` throws an unhandled exception that crashes the entire Vite build. The previous implementation handled this gracefully by catching the error and reporting it via `this.error()`.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}