nntrivi2001
8546748759
Dependencies
- Security: body-parser and multer DoS advisories fixed (npm audit: 0).
- Server: Express 5 (query parser kept "extended", req.body defaults to {},
SPA catch-all /{*splat}, send-file helper restores Express 4's dot-folder
rule for sendFile/download, alerts ack route without inline regex),
better-sqlite3 13, js-yaml 5 (server/lib/yaml.js keeps js-yaml 4's default
schema), uuid dropped for crypto.randomUUID, node-pty beta.18, multer 2.5.
- Client: React 19, xterm 6 (WebGL renderer replaces the removed canvas one,
DOM fallback on context loss; Alt+arrow word moves re-mapped), lucide-react 1,
TypeScript 7, i18next/react-i18next/codemirror minors.
Workspace rename step 4
- `agenthub lanes` and `--lane` exit 1 with "renamed: use …"; client api.ts,
the CLI and the MCP server call /api/workspaces; /api/lanes stays mounted.
Server mode (S3): members manage their own Claude Code config
- server/lib/cc-target.js resolves whose config a /cc-config request touches
and gates the router by allowlist; /profiles* and /plugins/update-all stay
admin-only. Member writes go through write-as, CLI calls through sudo as the
member (never -y), reads through openSafe; cc_config_changed reaches only
its owner. Not verified live on an S3 install yet.
Other
- Chat: an HTML file is an artifact only when written whole and not a project
page (index.html, or under src/, public/, templates/, …).
- OpenAPI covers every /api route; openapi-coverage.test.js guards it.
- read-pool test keeps its event loop alive (its worker is unref'd).
- Docs: plan statuses, checklists, CLI.md, LANES.md, SERVER-MODE.md, API.md.
27 lines
1.1 KiB
JavaScript
27 lines
1.1 KiB
JavaScript
/**
|
|
* @file send-file.js
|
|
* @description `res.sendFile` / `res.download` for an absolute path the server
|
|
* chose itself, with Express 4's dotfile rule. Express 5 (send 1.x) refuses
|
|
* with 404 any absolute path that has a dot-segment ANYWHERE — `~/.claude/…`
|
|
* (the plugin cache, the default data dir), `~/.local/…` — where Express 4
|
|
* looked only at the file's own name. Sending the basename against its
|
|
* directory as `root` makes send check that name alone again, so a dotfile is
|
|
* still refused and a dotted parent directory is not.
|
|
* @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
|
|
*/
|
|
|
|
const path = require("path");
|
|
|
|
/** `res.sendFile(abs, opts, cb)` with only the basename subject to `dotfiles`. */
|
|
function sendFile(res, abs, opts, cb) {
|
|
if (typeof opts === "function") [cb, opts] = [opts, undefined];
|
|
return res.sendFile(path.basename(abs), { ...opts, root: path.dirname(abs) }, cb);
|
|
}
|
|
|
|
/** `res.download(abs, name)` with only the basename subject to `dotfiles`. */
|
|
function download(res, abs, name, cb) {
|
|
return res.download(path.basename(abs), name, { root: path.dirname(abs) }, cb);
|
|
}
|
|
|
|
module.exports = { sendFile, download };
|