DUNGEONS-34: add one-command app launcher

Co-authored-by: multica-agent <github@multica.ai>

scripts/dev-all.test.mjs

@@ -0,0 +1,28 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { parseArgs, addresses } from './dev-all.mjs';
+
+test('default and named host/port options', () => {
+  assert.deepEqual(parseArgs([]), { host: '127.0.0.1', port: 3000 });
+  assert.deepEqual(parseArgs(['--host', '0.0.0.0', '--port', '3002']), { host: '0.0.0.0', port: 3002 });
+  assert.deepEqual(parseArgs(['--port=3002', '--host=localhost']), { host: '127.0.0.1', port: 3002 });
+  for (const args of [['--port', '0'], ['--port', '65536'], ['--port', '3abc'], ['--host', 'evil.example'], ['--host'], ['—port', '3002'], ['--unknown']]) assert.throws(() => parseArgs(args));
+});
+const networks = { en0: [{ address: '192.168.1.23', family: 'IPv4', internal: false }], other: [{ address: '8.8.8.8', family: 'IPv4', internal: false }], lo: [{ address: '127.0.0.1', family: 'IPv4', internal: true }] };
+test('LAN listener keeps camera-capable loopback and explicit LAN origins', () => {
+  const result = addresses({ host: '0.0.0.0', port: 3002 }, networks, {});
+  assert.equal(result.origin, 'http://192.168.1.23:3002');
+  assert.equal(result.local, 'http://127.0.0.1:3002');
+  assert.deepEqual(result.allowed.sort(), ['http://192.168.1.23:3002', 'http://127.0.0.1:3002', 'http://localhost:3002'].sort());
+  assert.ok(!result.allowed.some(origin => origin.includes('0.0.0.0') || origin.includes('8.8.8.8')));
+});
+test('loopback default and IPv6 formatting', () => {
+  assert.equal(addresses(parseArgs([]), networks, {}).origin, 'http://localhost:3000');
+  assert.deepEqual(addresses({ host: '::1', port: 3002 }, {}, {}).allowed, ['http://localhost:3002', 'http://[::1]:3002']);
+});
+test('explicit HTTPS origin does not silently authorize HTTP aliases', () => {
+  const result = addresses({ host: '0.0.0.0', port: 3002 }, networks, { WEBKA_ORIGIN: 'https://webka.local' });
+  assert.deepEqual(result.allowed, ['https://webka.local']);
+  assert.throws(() => addresses(parseArgs([]), {}, { WEBKA_ORIGIN: 'https://webka.local/login' }));
+  assert.throws(() => addresses(parseArgs([]), {}, { WEBKA_ALLOWED_ORIGINS: '*' }));
+});