Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

npm run dev is POSIX-only; the Windows fallback 403s on every save

オープン
  • 何か問題がありますか？
#54 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
76/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
node.js, typescript, vite
領域
backend, developer-experience

調査の方向性

Start with the dev script in package.json, then read the origin handling in src/server/index.ts and src/server/app.ts alongside the proxy in vite.config.ts. Check the Windows setup instructions in README.md and .env.example. Done means the documented one-command dev path works on Windows and saving through the Vite proxy no longer returns the reported 403.

索引モデルが issue の本文から書いたものです。

説明

Summary

npm run dev cannot run on Windows at all, and the natural workaround replaces that failure with a subtler one: the UI loads but every write returns 403 Cross-origin requests are not allowed.

Verified against c2569bb (2026-10-02).

1. The dev script uses POSIX-only syntax

package.json:11:

"dev": "concurrently -k \"NODE_ENV=development node --env-file-if-exists=.env --import tsx --watch src/server/index.ts\" \"vite\""

The VAR=value command form is interpreted by sh/bash/zsh only. In cmd.exe and PowerShell it is parsed as a program name, so npm run dev fails with 'NODE_ENV' is not recognized as an internal or external command.

There is no documented Windows path: grep -in "windows\|powershell\|cross-env" README.md docs/ CONTRIBUTING.md returns nothing. The Get started block (README.md:150-161) also uses cp .env.example .env, which does not exist in cmd.exe (PowerShell's cp alias happens to work).

2. Dropping NODE_ENV silently breaks the origin check

Running the same two processes without the env assignment starts both servers and the page loads, but saving a Space or page fails:

403 { "error": "Cross-origin requests are not allowed." }

This is because the dev origin allowlist is derived from NODE_ENV (src/server/index.ts:88-92):

origin:
  process.env.APP_ORIGIN ??
  (process.env.NODE_ENV === 'development'
    ? 'http://127.0.0.1:5173'
    : undefined),

and then compared against the server's own origin when unset (src/server/app.ts:49-52):

const expectedOrigin = origin ?? new URL(c.req.url).origin;
if (requestOrigin && requestOrigin !== expectedOrigin)
  return c.json({ error: 'Cross-origin requests are not allowed.' }, 403);

In development the browser talks to Vite on :5173, which proxies /api to :4310 (vite.config.ts:9) while preserving the browser's Origin: http://127.0.0.1:5173. With origin undefined, expectedOrigin becomes http://127.0.0.1:4310, so the check fails on every request.

Uncommenting APP_ORIGIN=http://127.0.0.1:5173 in .env does fix it — but that is a second manual step caused by the first failure, and .env.example ships it commented out (# APP_ORIGIN=http://127.0.0.1:5173) with a note saying "npm run dev allows http://127.0.0.1:5173", which is only true when NODE_ENV was actually set.

Setting the variable in the calling shell also works and needs no .env edit:

$env:NODE_ENV="development"; npx concurrently -k "node --env-file-if-exists=.env --import tsx --watch src/server/index.ts" "vite"

But neither of these is something a Windows user can discover from the README.

Suggested fix

Make the documented one-command path work everywhere, rather than documenting a workaround:

  • Add cross-env to devDependencies and prefix the inner command: cross-env NODE_ENV=development node --env-file-if-exists=.env .... One-line change, no behavior drift.

Optionally also decouple the dev origin from NODE_ENV so a missing env var can never produce this confusing 403 (e.g. pass APP_ORIGIN explicitly in the dev script), and add a short Windows note to Get started with a copy-command-neutral instruction.

Testing note

Mechanism verified by reading package.json, src/server/index.ts, src/server/app.ts and vite.config.ts. The POSIX-shell dependency and the origin comparison are unambiguous in source. The npm run dev error string itself was reported by someone running on Windows; my own full run of the app was on Linux, where npm run dev works as documented.

主要言語
TypeScript
スター
2.8k
フォーク
344
平均マージ
7時間 8分
マージ済み PR（30日）
10

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

CopilotKit/OpenDots のほかの issue

CopilotKit/OpenDots の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。