nntrivi2001
8546748759
Dependencies
- Security: body-parser and multer DoS advisories fixed (npm audit: 0).
- Server: Express 5 (query parser kept "extended", req.body defaults to {},
SPA catch-all /{*splat}, send-file helper restores Express 4's dot-folder
rule for sendFile/download, alerts ack route without inline regex),
better-sqlite3 13, js-yaml 5 (server/lib/yaml.js keeps js-yaml 4's default
schema), uuid dropped for crypto.randomUUID, node-pty beta.18, multer 2.5.
- Client: React 19, xterm 6 (WebGL renderer replaces the removed canvas one,
DOM fallback on context loss; Alt+arrow word moves re-mapped), lucide-react 1,
TypeScript 7, i18next/react-i18next/codemirror minors.
Workspace rename step 4
- `agenthub lanes` and `--lane` exit 1 with "renamed: use …"; client api.ts,
the CLI and the MCP server call /api/workspaces; /api/lanes stays mounted.
Server mode (S3): members manage their own Claude Code config
- server/lib/cc-target.js resolves whose config a /cc-config request touches
and gates the router by allowlist; /profiles* and /plugins/update-all stay
admin-only. Member writes go through write-as, CLI calls through sudo as the
member (never -y), reads through openSafe; cc_config_changed reaches only
its owner. Not verified live on an S3 install yet.
Other
- Chat: an HTML file is an artifact only when written whole and not a project
page (index.html, or under src/, public/, templates/, …).
- OpenAPI covers every /api route; openapi-coverage.test.js guards it.
- read-pool test keeps its event loop alive (its worker is unref'd).
- Docs: plan statuses, checklists, CLI.md, LANES.md, SERVER-MODE.md, API.md.
100 lines
2.7 KiB
JavaScript
100 lines
2.7 KiB
JavaScript
/**
|
|
* @file pets.js (routes)
|
|
* @description `/api/pets` — the mascot's custom pets (`server/lib/pets.js`):
|
|
* the list plus the featured ones, a pet's sprite, importing a `.codex-pet.zip`,
|
|
* uploading an image, installing a featured pet from codex-pets.net by its
|
|
* fixed id, and deleting one. Every write is same-origin; no route takes a
|
|
* URL or a path.
|
|
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
|
*/
|
|
"use strict";
|
|
|
|
const express = require("express");
|
|
const pets = require("../lib/pets");
|
|
const { sameOriginGuard } = require("../lib/same-origin");
|
|
|
|
const router = express.Router();
|
|
|
|
const STATUS = {
|
|
ENOPET: 404,
|
|
ETOOBIG: 413,
|
|
ETOOMANY: 409,
|
|
EFETCH: 502,
|
|
EBADORIGIN: 403,
|
|
};
|
|
|
|
function sendError(res, err) {
|
|
if (err && typeof err.code === "string" && /^E[A-Z]+$/.test(err.code)) {
|
|
return res
|
|
.status(STATUS[err.code] || 400)
|
|
.json({ error: { code: err.code, message: err.message } });
|
|
}
|
|
return res
|
|
.status(500)
|
|
.json({ error: { code: "EINTERNAL", message: String(err?.message || err) } });
|
|
}
|
|
|
|
router.get("/", (_req, res) => {
|
|
try {
|
|
res.json({ pets: pets.listPets(), featured: pets.featured(), sheet: pets.SHEET });
|
|
} catch (err) {
|
|
sendError(res, err);
|
|
}
|
|
});
|
|
|
|
router.get("/:id/sprite", (req, res) => {
|
|
try {
|
|
const file = pets.spriteFile(req.params.id);
|
|
res.set("Content-Type", file.type);
|
|
res.set("X-Content-Type-Options", "nosniff");
|
|
res.set("Cache-Control", "private, max-age=3600");
|
|
require("../lib/send-file").sendFile(res, file.path);
|
|
} catch (err) {
|
|
sendError(res, err);
|
|
}
|
|
});
|
|
|
|
const raw = (limit) => express.raw({ type: () => true, limit });
|
|
|
|
router.post("/import", sameOriginGuard, raw(pets.MAX_BUNDLE_BYTES), (req, res) => {
|
|
try {
|
|
res.status(201).json({ pet: pets.importBundle(req.body) });
|
|
} catch (err) {
|
|
sendError(res, err);
|
|
}
|
|
});
|
|
|
|
router.post("/upload", sameOriginGuard, raw(pets.MAX_IMAGE_BYTES), (req, res) => {
|
|
try {
|
|
res.status(201).json({ pet: pets.addImage(req.body, req.query.name) });
|
|
} catch (err) {
|
|
sendError(res, err);
|
|
}
|
|
});
|
|
|
|
router.post("/featured/:id", sameOriginGuard, async (req, res) => {
|
|
try {
|
|
res.status(201).json({ pet: await pets.installFeatured(req.params.id) });
|
|
} catch (err) {
|
|
sendError(res, err);
|
|
}
|
|
});
|
|
|
|
router.delete("/:id", sameOriginGuard, (req, res) => {
|
|
try {
|
|
pets.removePet(req.params.id);
|
|
res.json({ ok: true });
|
|
} catch (err) {
|
|
sendError(res, err);
|
|
}
|
|
});
|
|
|
|
// An upload past its limit reaches here as express.raw's 413.
|
|
router.use((err, _req, res, next) => {
|
|
if (err && err.type === "entity.too.large")
|
|
return res.status(413).json({ error: { code: "ETOOBIG", message: "the file is too large" } });
|
|
return next(err);
|
|
});
|
|
|
|
module.exports = router;
|