Project Hub: one Node process on loopback Diagram

What the server refuses

Any Host header other than loopback or a listed allowedHosts name gets a 403, which stops DNS rebinding
resolveId() admits only paths under a mounted root, and never a secrets folder or a key or certificate file
/api/open, favorites and webmarks are same-origin only; mounting a root also needs a loopback Host

How the tree stays fresh

A worker thread walks the tree and runs git per repo, then hands back the payload, gzipped once and served to every tab
The watcher drops build output, git internals, the hub's own logs and bare directory events
After a burst it waits out a 30 s gap from the last scan, rescans first, then sends one change event, so no tab fetches a stale copy

Built only when asked

Pictures loads one folder at a time; its search index is built on the first query that needs it
Search inside documents builds its index on the first such query, never during a scan
HTML reports open through signed directory routes with a sandbox on every response

Outside the process

Watch-Hubs.ps1 runs every 15 minutes and restarts an unhealthy hub through Start-Hub.ps1
The demo build runs the real hub against demo/Workspace and captures every API response as a file
The hosted demo has no server, so launching files and searching inside documents are unavailable there