Peruse does not support window.eval() used in webpack-dev-server. Turning off hot reloading has no effect.

[Folaht]

neutrino version: 8.3.0
preset: vue, 8.3.0
client: yarn 1.9.4
nodejs: 8.11.4
OS: Arch Linux
Did:

SAFE Web App Tutorial

and got

Peruse error

Uncaught Error: Sorry, peruse does not support window.eval().
    at window.eval.global.eval (/opt/Maidsafe/Peruse/resources/app.asar/webPreload.js:9:83345)
    at Object../node_modules/webpack-dev-server/client/index.js?http://localhost:5000 (http://localhost:5000/index.js:962:1)
    at __webpack_require__ (http://localhost:5000/index.js:679:30)
    at fn (http://localhost:5000/index.js:89:20)
    at Object.0 (http://localhost:5000/index.js:1057:1)
    at __webpack_require__ (http://localhost:5000/index.js:679:30)
    at http://localhost:5000/index.js:725:37
    at http://localhost:5000/index.js:728:100:

and the Peruse developer said:

"window.eval() is not available in Peruse for security reasons."

So I try turning off hot reloading:

neutrinorc.js

module.exports = {
  use: [
    [
      '@neutrinojs/vue',
      {
        hot: false,
        html: {
          title: 'SAFE Web App'
        },
        devServer: {
          hot: false,
          hotOnly: false
       }
      }
    ]
  ]
};

Expected: Turning off hot reloading in neutrinorc.js magically makes the error go away.
Result: No change.

[edmorley]

Hi!

I've just compared the Neutrino 8 generated webpack config (which can be displayed by running yarn start --inspect) for the default preset options vs hot: false, and it is making the changes I would expect (ie: not appending to entrypoints, not including HotModuleReplacementPlugin() and setting devServer: { hot: false }).

I believe the reason you're seeing webpack-dev-server in the traceback is that it actually has two modes:

1. hot module replacement mode
2. live reload mode (ie just refresh the whole page)

...and that devServer: { hot: false } just means webpack-dev-server uses (2) instead of (1). However for (2) code is still injected by webpack-dev-server, since otherwise it wouldn't be able to control the page (see webpack/webpack-dev-server#1251 (comment)).

Looking through the docs I see there is an inline option which might prevent scripts being injected entirely:
https://webpack.js.org/configuration/dev-server/#devserver-inline
https://github.com/webpack/webpack-dev-server/blob/f37f0a251c6e1815e1ca2a9dc24fe306bb789f1d/lib/utils/addEntries.js#L12

However it might be that the eval() is not coming from webpack-dev-server at all (or at least, webpack-dev-server definitely isn't the only source of eval), since the default source map mode used by @neutrinojs/web (which the Vue preset inherits from) is cheap-module-eval-source-map:
https://github.com/neutrinojs/neutrino/blob/v8.3.0/packages/web/index.js#L191

You would need to override that to a non-eval mode (which are slower for incremental rebuilds; see docs), like so:

module.exports = {
  use: [
    ['@neutrinojs/vue', {
      // Existing options
    }],
    (neutrino) => {
      if (process.env.NODE_ENV === 'development') {
        // Override the default development source map of 'cheap-module-eval-source-map'
        // to one that doesn't use `eval` (reduces incremental build performance).
        neutrino.config.devtool('cheap-module-source-map');
      }
    }
  ]
};

[Folaht]

Thank you! Thank you very much!

My code is working now.
I will try to understand what this all means later, but for now I know that the source of the problem lies in cheap-module-eval-source-map