# Contributing

Thanks for helping improve `dsh-tailscale-gateway`.

## Scope

Changes should preserve the project's core properties:

- DSH remains loopback-only; the gateway stays fixed to `127.0.0.1:3088` and
  forwards only to `127.0.0.1:3080`.
- Tailscale Serve is a private ingress. Do not add Funnel support, a direct
  LAN listener, or a mechanism that edits a user's tailnet policy. The optional
  Serve manager may only verify or create its one exact absent private route;
  it must never overwrite or automatically remove a route.
- Authorization must fail closed. Treat header parsing, Host/Origin checks,
  WebSocket upgrades, and proxy header rewrites as security-sensitive code.
- Keep runtime dependencies at zero unless a dependency has a clear security
  and maintenance justification.

## Local workflow

1. Use Node.js 20 or newer and pnpm 9.
2. Install dependencies with `pnpm install --frozen-lockfile`.
3. Add focused tests for behavior changes, especially authorization boundaries
   and malformed input.
4. Run the complete verification suite before proposing a change:

   ```sh
   pnpm run check
   pnpm test
   pnpm audit --prod
   npm pack --dry-run
   ```

Do not commit local DSH profiles, Tailscale state, credentials, certificates,
or personal hostnames and login identities. The supplied profile patch is a
placeholder-only example.

## Pull requests

Describe the user-visible change, security implications, tests run, and any
documentation updates. Keep unrelated reformatting separate from functional
changes. Vulnerabilities should follow [SECURITY.md](SECURITY.md), not be filed
as public issues.