Blame · Line-by-line history
app.tsx
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 79136bb | 1 | import { Hono } from "hono"; |
| 4abf6f1 | 2 | import type { Context } from "hono"; |
| 79136bb | 3 | import { logger } from "hono/logger"; |
| 4 | import { cors } from "hono/cors"; | |
| 05b973e | 5 | import { compress } from "hono/compress"; |
| f1ffd50 | 6 | import { etag } from "hono/etag"; |
| c63b860 | 7 | // BLOCK O2 — shared error-page surface (404 / 500 / 403). |
| 8 | import { NotFoundPage, ServerErrorPage } from "./views/error-page"; | |
| 80bed05 | 9 | import { reportError } from "./lib/observability"; |
| 3ef4c9d | 10 | import { requestContext } from "./middleware/request-context"; |
| 11 | import { rateLimit } from "./middleware/rate-limit"; | |
| 79136bb | 12 | import gitRoutes from "./routes/git"; |
| 13 | import apiRoutes from "./routes/api"; | |
| 45e31d0 | 14 | import apiV2Routes from "./routes/api-v2"; |
| 15 | import apiDocsRoutes from "./routes/api-docs"; | |
| 4a80519 | 16 | import buildAgentSpecRoutes from "./routes/build-agent-spec"; |
| a6ff0f2 | 17 | import pullsDashboardRoutes from "./routes/pulls-dashboard"; |
| e9aa4d8 | 18 | import issuesDashboardRoutes from "./routes/issues-dashboard"; |
| 19 | import inboxRoutes from "./routes/inbox"; | |
| cc34156 | 20 | import digestRoutes from "./routes/digest"; |
| e9aa4d8 | 21 | import activityRoutes from "./routes/activity"; |
| 79136bb | 22 | import authRoutes from "./routes/auth"; |
| c63b860 | 23 | import passwordResetRoutes from "./routes/password-reset"; |
| 24 | import emailVerificationRoutes from "./routes/email-verification"; | |
| cd4f63b | 25 | import magicLinkRoutes from "./routes/magic-link"; |
| 79136bb | 26 | import settingsRoutes from "./routes/settings"; |
| 7298a17 | 27 | import settings2faRoutes from "./routes/settings-2fa"; |
| e75eddc | 28 | import settingsAgentsRoutes from "./routes/settings-agents"; |
| 1d4ff60 | 29 | import settingsIntegrationsRoutes from "./routes/settings-integrations"; |
| 30 | import integrationsChatRoutes from "./routes/integrations-chat"; | |
| e75eddc | 31 | import agentsRoutes from "./routes/agents"; |
| ef3fd93 | 32 | import agentPipelinesRoutes from "./routes/agent-pipelines"; |
| 79136bb | 33 | import issueRoutes from "./routes/issues"; |
| 85c4e13 | 34 | import milestonesRoutes from "./routes/milestones"; |
| f928118 | 35 | import shipAgentRoutes from "./routes/ship-agent"; |
| cb5a796 | 36 | import commentModerationRoutes from "./routes/comment-moderation"; |
| 79136bb | 37 | import repoSettings from "./routes/repo-settings"; |
| 479dcd9 | 38 | import automationSettingsRoutes from "./routes/automation-settings"; |
| 23d1a81 | 39 | import collaboratorRoutes from "./routes/collaborators"; |
| 04f6b7f | 40 | import teamCollaboratorRoutes from "./routes/team-collaborators"; |
| 41 | import invitesRoutes from "./routes/invites"; | |
| 42 | import liveEventsRoutes from "./routes/live-events"; | |
| 3c03977 | 43 | import prLiveRoutes from "./routes/pr-live"; |
| 79136bb | 44 | import compareRoutes from "./routes/compare"; |
| 0074234 | 45 | import pullRoutes from "./routes/pulls"; |
| 79ed944 | 46 | import prSandboxRoutes from "./routes/pr-sandbox"; |
| 9b3a183 | 47 | import devEnvRoutes from "./routes/dev-env"; |
| 0074234 | 48 | import editorRoutes from "./routes/editor"; |
| 6f2809f | 49 | import aiEditorRoutes from "./routes/ai-editor"; |
| c81ab7a | 50 | import forkRoutes from "./routes/fork"; |
| 51 | import webhookRoutes from "./routes/webhooks"; | |
| 52 | import exploreRoutes from "./routes/explore"; | |
| 53 | import tokenRoutes from "./routes/tokens"; | |
| 43de941 | 54 | import contributorRoutes from "./routes/contributors"; |
| 699e5c7 | 55 | import healthRoutes from "./routes/health-probe"; |
| 56 | import healthDashboardRoutes from "./routes/health"; | |
| 2316be6 | 57 | import statusRoutes from "./routes/status"; |
| b1be050 | 58 | import adminStatusRoutes from "./routes/admin-status"; |
| 80bed05 | 59 | import helpRoutes from "./routes/help"; |
| e1fc7db | 60 | import changelogRoutes from "./routes/changelog"; |
| e0e4219 | 61 | import docsRoutes from "./routes/docs"; |
| b0148e9 | 62 | import marketingRoutes from "./routes/marketing"; |
| 5f2e749 | 63 | import pricingRoutes from "./routes/pricing"; |
| 9f29b65 | 64 | import enterpriseRoutes from "./routes/enterprise"; |
| 5618f9a | 65 | import seoRoutes from "./routes/seo"; |
| 05cdb85 | 66 | import versionRoutes from "./routes/version"; |
| f295f78 | 67 | import { platformStatus } from "./routes/platform-status"; |
| 52ad8b1 | 68 | import publicStatsRoutes from "./routes/public-stats"; |
| 69 | import demoRoutes from "./routes/demo"; | |
| 16b325c | 70 | import insightRoutes from "./routes/insights"; |
| 8286942 | 71 | import engineeringInsightsRoutes from "./routes/engineering-insights"; |
| 8d1483c | 72 | import doraRoutes from "./routes/dora"; |
| f1ab587 | 73 | import dashboardRoutes from "./routes/dashboard"; |
| 36b4cbd | 74 | import legalRoutes from "./routes/legal"; |
| 4b66018 | 75 | import legalDmcaRoutes from "./routes/legal/dmca"; |
| 76 | import legalTermsRoutes from "./routes/legal/terms"; | |
| 77 | import legalPrivacyRoutes from "./routes/legal/privacy"; | |
| 78 | import legalAcceptableUseRoutes from "./routes/legal/acceptable-use"; | |
| bdbd0de | 79 | import importRoutes from "./routes/import"; |
| 14c3cc8 | 80 | import importBulkRoutes from "./routes/import-bulk"; |
| f390cfa | 81 | import importSecretsRoutes from "./routes/import-secrets"; |
| bb2dea9 | 82 | import actionsImporterRoutes from "./routes/actions-importer"; |
| 14c3cc8 | 83 | import migrationRoutes from "./routes/migrations"; |
| ba23fe2 | 84 | import migrationAssistantRoutes from "./routes/migration-assistant"; |
| 9a8b8de | 85 | import migrateRoutes from "./routes/migrate"; |
| 14c3cc8 | 86 | import specsRoutes from "./routes/specs"; |
| 23d0abf | 87 | import refactorRoutes from "./routes/refactors"; |
| b665cac | 88 | import codebaseMigratorRoutes from "./routes/codebase-migrator"; |
| 79136bb | 89 | import webRoutes from "./routes/web"; |
| 0316dbb | 90 | import hookRoutes from "./routes/hooks"; |
| 91 | import eventsRoutes from "./routes/events"; | |
| 92 | import passkeyRoutes from "./routes/passkeys"; | |
| 93 | import oauthRoutes from "./routes/oauth"; | |
| 369ad65 | 94 | import wellKnownRoutes from "./routes/well-known"; |
| 0316dbb | 95 | import developerAppsRoutes from "./routes/developer-apps"; |
| 96 | import themeRoutes from "./routes/theme"; | |
| 97 | import auditRoutes from "./routes/audit"; | |
| 98 | import reactionRoutes from "./routes/reactions"; | |
| 99 | import savedReplyRoutes from "./routes/saved-replies"; | |
| 100 | import deploymentRoutes from "./routes/deployments"; | |
| 2c61840 | 101 | import pipelineRoutes from "./routes/pipeline"; |
| 0316dbb | 102 | import orgRoutes from "./routes/orgs"; |
| 103 | import notificationRoutes from "./routes/notifications"; | |
| 104 | import onboardingRoutes from "./routes/onboarding"; | |
| 105 | import adminRoutes from "./routes/admin"; | |
| 7293c67 | 106 | import adminDeletionsRoutes from "./routes/admin-deletions"; |
| 107 | import adminStripeRoutes from "./routes/admin-stripe"; | |
| f764c07 | 108 | import adminDeploysRoutes from "./routes/admin-deploys"; |
| 109 | import adminDeploysPageRoutes from "./routes/admin-deploys-page"; | |
| 783dd46 | 110 | import adminServerTargetsRoutes from "./routes/admin-server-targets"; |
| 9aaa128 | 111 | import deployTargetsRoutes from "./routes/deploy-targets"; |
| 90c7531 | 112 | import claudeWebRoutes from "./routes/claude-web"; |
| 9dd96b9 | 113 | import adminOpsRoutes from "./routes/admin-ops"; |
| f2c00b4 | 114 | import adminSelfHostRoutes from "./routes/admin-self-host"; |
| 826eccf | 115 | import adminDiagnoseRoutes from "./routes/admin-diagnose"; |
| f9814d2 | 116 | import adminCommandRoutes from "./routes/admin-command"; |
| 509c376 | 117 | import adminIntegrationsRoutes from "./routes/admin-integrations"; |
| bc519ae | 118 | import adminEnvHealthRoutes from "./routes/admin-env-health"; |
| 79ed944 | 119 | import adminAdvancementRoutes from "./routes/admin-advancement"; |
| ba9e143 | 120 | import adminSecurityRoutes from "./routes/admin-security"; |
| 121 | import settingsSessionsRoutes from "./routes/settings-sessions"; | |
| 0316dbb | 122 | import advisoriesRoutes from "./routes/advisories"; |
| 123 | import aiChangelogRoutes from "./routes/ai-changelog"; | |
| 0a69faa | 124 | import explainRoutes from "./routes/explain"; |
| 0316dbb | 125 | import aiExplainRoutes from "./routes/ai-explain"; |
| 2be65d0 | 126 | import archaeologyRoutes from "./routes/ai-archaeology"; |
| 0316dbb | 127 | import aiTestsRoutes from "./routes/ai-tests"; |
| 128 | import askRoutes from "./routes/ask"; | |
| 38d31d3 | 129 | import repoChatRoutes from "./routes/repo-chat"; |
| ee7e577 | 130 | import personalChatRoutes from "./routes/personal-chat"; |
| 0316dbb | 131 | import billingRoutes from "./routes/billing"; |
| 8809b87 | 132 | import billingUsageRoutes from "./routes/billing-usage"; |
| 6778ad2 | 133 | import stripeWebhookRoutes from "./routes/stripe-webhook"; |
| 0316dbb | 134 | import codeScanningRoutes from "./routes/code-scanning"; |
| da3fc18 | 135 | import securityRoutes from "./routes/security"; |
| 0316dbb | 136 | import commitStatusesRoutes from "./routes/commit-statuses"; |
| 137 | import copilotRoutes from "./routes/copilot"; | |
| f5d020f | 138 | import { pairProgrammerRoutes } from "./routes/pair-programmer"; |
| 0316dbb | 139 | import depUpdaterRoutes from "./routes/dep-updater"; |
| 140 | import depsRoutes from "./routes/deps"; | |
| 141 | import discussionsRoutes from "./routes/discussions"; | |
| 142 | import environmentsRoutes from "./routes/environments"; | |
| 4bbacbe | 143 | import previewsRoutes from "./routes/previews"; |
| 79ed944 | 144 | import docsTrackingRoutes from "./routes/docs-tracking"; |
| 0316dbb | 145 | import followsRoutes from "./routes/follows"; |
| 146 | import gatesRoutes from "./routes/gates"; | |
| 147 | import gistsRoutes from "./routes/gists"; | |
| 148 | import graphqlRoutes from "./routes/graphql"; | |
| 2c2163e | 149 | import mcpRoutes from "./routes/mcp"; |
| 0316dbb | 150 | import marketplaceRoutes from "./routes/marketplace"; |
| 5ca514a | 151 | import marketplaceAgentsRoutes from "./routes/marketplace-agents"; |
| 0316dbb | 152 | import mergeQueueRoutes from "./routes/merge-queue"; |
| 153 | import mirrorsRoutes from "./routes/mirrors"; | |
| 154 | import orgInsightsRoutes from "./routes/org-insights"; | |
| 2be65d0 | 155 | import orgHealthRoutes from "./routes/org-health"; |
| 0316dbb | 156 | import packagesRoutes from "./routes/packages"; |
| 157 | import packagesApiRoutes from "./routes/packages-api"; | |
| 845fd8a | 158 | import ociRegistryRoutes from "./routes/oci-registry"; |
| 0316dbb | 159 | import pagesRoutes from "./routes/pages"; |
| 160 | import projectsRoutes from "./routes/projects"; | |
| 161 | import protectedTagsRoutes from "./routes/protected-tags"; | |
| 162 | import pwaRoutes from "./routes/pwa"; | |
| 46d6165 | 163 | import installRoutes from "./routes/install"; |
| cd4f63b | 164 | import dxtRoutes from "./routes/dxt"; |
| 662ce86 | 165 | import connectClaudeRoutes from "./routes/connect-claude"; |
| ebbb527 | 166 | import claudeDeployRoutes from "./routes/claude-deploy"; |
| f5b9ef5 | 167 | import claudeIntegration from "./routes/claude-integration"; |
| 168 | import connectRoutes from "./routes/connect"; | |
| 05ab9b1 | 169 | import pushWatchRoutes from "./routes/push-watch"; |
| 170 | import orgSecretsRoutes from "./routes/org-secrets"; | |
| 0316dbb | 171 | import releasesRoutes from "./routes/releases"; |
| 172 | import requiredChecksRoutes from "./routes/required-checks"; | |
| 173 | import rulesetsRoutes from "./routes/rulesets"; | |
| 174 | import searchRoutes from "./routes/search"; | |
| 175 | import semanticSearchRoutes from "./routes/semantic-search"; | |
| 77cf834 | 176 | import nlSearchRoutes from "./routes/nl-search"; |
| 0316dbb | 177 | import signingKeysRoutes from "./routes/signing-keys"; |
| 178 | import sponsorsRoutes from "./routes/sponsors"; | |
| 179 | import ssoRoutes from "./routes/sso"; | |
| 3a845e4 | 180 | import samlSsoRoutes from "./routes/saml-sso"; |
| 181 | import scimRoutes from "./routes/scim"; | |
| 182 | import orgSsoSettingsRoutes from "./routes/org-sso-settings"; | |
| 46d6165 | 183 | import githubOauthRoutes from "./routes/github-oauth"; |
| 582cdac | 184 | import googleOauthRoutes from "./routes/google-oauth"; |
| 0316dbb | 185 | import symbolsRoutes from "./routes/symbols"; |
| 186 | import templatesRoutes from "./routes/templates"; | |
| 187 | import trafficRoutes from "./routes/traffic"; | |
| 188 | import wikisRoutes from "./routes/wikis"; | |
| 189 | import workflowsRoutes from "./routes/workflows"; | |
| 5ff9cc2 | 190 | import workflowArtifactsRoutes from "./routes/workflow-artifacts"; |
| 191 | import workflowSecretsRoutes from "./routes/workflow-secrets"; | |
| 46d6165 | 192 | import sleepModeRoutes from "./routes/sleep-mode"; |
| 56801e1 | 193 | import standupRoutes from "./routes/standups"; |
| 52ad8b1 | 194 | import vsGithubRoutes from "./routes/vs-github"; |
| 45f3b73 | 195 | import voiceRoutes from "./routes/voice-to-pr"; |
| 3122762 | 196 | import blogRoutes from "./routes/blog"; |
| cd4f63b | 197 | import playgroundRoutes from "./routes/playground"; |
| a2b3e99 | 198 | import crossRepoSearchRoutes from "./routes/cross-repo-search"; |
| 199 | import pushNotifRoutes from "./routes/push-notifications"; | |
| 9fbe6cd | 200 | import velocityRoutes from "./routes/velocity"; |
| 201 | import { staleBranchRoutes } from "./routes/stale-branches"; | |
| 22f43f3 | 202 | import pulseRoutes from "./routes/pulse"; |
| 74d8c4d | 203 | import healthScoreRoutes from "./routes/health-score"; |
| 77cf834 | 204 | import repoHealthRoutes from "./routes/repo-health"; |
| 74d8c4d | 205 | import hotFilesRoutes from "./routes/hot-files"; |
| bcc4020 | 206 | import debtMapRoutes from "./routes/debt-map"; |
| 1d6db4d | 207 | import busFactorRoutes from "./routes/bus-factor"; |
| 2be65d0 | 208 | import testGapsRoutes from "./routes/test-gaps"; |
| f5d020f | 209 | import crossRepoImpactRoutes from "./routes/cross-repo-impact"; |
| adf5e18 | 210 | import developerProgramRoutes from "./routes/developer-program"; |
| 891efbe | 211 | import shareRoutes from "./routes/share"; |
| 70e3293 | 212 | import incidentHookRoutes from "./routes/incident-hooks"; |
| 77cf834 | 213 | import workspaceRoutes from "./routes/ai-workspace"; |
| 2c61840 | 214 | import workspaceHubRoutes from "./routes/workspace-hub"; |
| 4d4bd4b | 215 | import { apiRateLimit, authRateLimit, gitRateLimit, searchRateLimit } from "./middleware/rate-limit"; |
| 59b6fb2 | 216 | import { csrfToken, csrfProtect } from "./middleware/csrf"; |
| f5b9ef5 | 217 | import { noCache } from "./middleware/no-cache"; |
| 79136bb | 218 | |
| 2316901 | 219 | import type { AuthEnv } from "./middleware/auth"; |
| bf19c50 | 220 | import { softAuth } from "./middleware/auth"; |
| 2316901 | 221 | |
| 222 | const app = new Hono<AuthEnv>(); | |
| 79136bb | 223 | |
| 3ef4c9d | 224 | // Request context (request ID, start time) runs before everything else |
| 225 | app.use("*", requestContext); | |
| 05b973e | 226 | // Middleware — compression first (wraps all responses) |
| 227 | app.use("*", compress()); | |
| f1ffd50 | 228 | |
| 229 | // ETag middleware — returns 304 Not Modified on unchanged responses. | |
| 230 | // Saves ~95% bandwidth on repeat visits. Skipped on git protocol + | |
| 231 | // SSE + the API surface where it would interfere with streaming. | |
| 232 | app.use("*", async (c, next) => { | |
| 233 | const p = c.req.path; | |
| 234 | if ( | |
| 235 | p.includes(".git/") || | |
| 236 | p.startsWith("/live-events") || | |
| 237 | p.startsWith("/api/events/deploy") || | |
| 3c03977 | 238 | p.startsWith("/admin/status") || |
| 239 | // PR live co-editing SSE stream — never etag streaming responses. | |
| 240 | /^\/api\/v2\/pulls\/[^/]+\/live(\/|$)/.test(p) | |
| f1ffd50 | 241 | ) { |
| 242 | return next(); | |
| 243 | } | |
| 244 | return etag()(c, next); | |
| 245 | }); | |
| 246 | ||
| 247 | // Cache-Control middleware — sets sensible defaults on public, anonymous | |
| 9ecf5a4 | 248 | // requests. Vapron (when wired as our edge layer) and downstream |
| f1ffd50 | 249 | // browsers will honor these. Auth'd users get private,no-store |
| 250 | // automatically — we never cache responses tied to a session. | |
| 251 | app.use("*", async (c, next) => { | |
| 252 | await next(); | |
| 253 | // Don't overwrite explicit headers set by route handlers — BUT the | |
| 254 | // ETag middleware unconditionally sets "private, no-cache, must- | |
| 255 | // revalidate" so we have to treat that specific value as "no | |
| 256 | // policy chosen yet" and apply ours. Any route that explicitly set | |
| 257 | // a different cache-control wins. | |
| 258 | const existing = c.res.headers.get("cache-control"); | |
| 259 | const etagDefault = | |
| 260 | existing === "private, no-cache, must-revalidate" || | |
| 261 | existing === "no-cache"; | |
| 262 | if (existing && !etagDefault) return; | |
| 263 | // Anything past auth: private + no-store (avoid leaking session | |
| 264 | // content into shared caches). softAuth runs before this on the | |
| 265 | // request, but the response side is what we're stamping. | |
| 266 | const hasSession = c.req.header("cookie")?.includes("session=") ?? false; | |
| 267 | const p = c.req.path; | |
| 268 | // Always private for known-authed paths regardless of cookie. | |
| 269 | if ( | |
| 270 | p.startsWith("/admin") || | |
| 271 | p.startsWith("/settings") || | |
| 272 | p.startsWith("/dashboard") || | |
| 273 | p.startsWith("/notifications") || | |
| 274 | p.startsWith("/connect/") || | |
| 275 | hasSession | |
| 276 | ) { | |
| 277 | c.res.headers.set("cache-control", "private, no-store"); | |
| 278 | return; | |
| 279 | } | |
| 280 | // Public marketing surfaces — short edge cache, longer browser cache, | |
| 281 | // stale-while-revalidate so the user never waits on a stale fetch. | |
| 282 | const isMarketing = | |
| 283 | p === "/" || | |
| 284 | p === "/features" || | |
| 285 | p === "/pricing" || | |
| 286 | p === "/about" || | |
| 287 | p === "/vs-github" || | |
| 288 | p === "/explore" || | |
| 289 | p === "/help" || | |
| 290 | p === "/changelog" || | |
| 9f29b65 | 291 | p === "/enterprise" || |
| f1ffd50 | 292 | p.startsWith("/legal/") || |
| 293 | p === "/terms" || | |
| 294 | p === "/privacy" || | |
| 295 | p === "/acceptable-use" || | |
| 296 | p.startsWith("/docs/"); | |
| 297 | if (isMarketing) { | |
| 298 | c.res.headers.set( | |
| 299 | "cache-control", | |
| 300 | "public, max-age=60, s-maxage=300, stale-while-revalidate=86400" | |
| 301 | ); | |
| 302 | return; | |
| 303 | } | |
| 304 | // Public repo browse pages — cache aggressively. Edge invalidates | |
| 9ecf5a4 | 305 | // on push via the post-receive hook (future Vapron surge purge). |
| f1ffd50 | 306 | if (/^\/[^/]+\/[^/]+(\/.*)?$/.test(p) && c.req.method === "GET") { |
| 307 | c.res.headers.set( | |
| 308 | "cache-control", | |
| 309 | "public, max-age=30, s-maxage=120, stale-while-revalidate=600" | |
| 310 | ); | |
| 311 | return; | |
| 312 | } | |
| 313 | // Default: don't cache anything we haven't explicitly opted in. | |
| 314 | c.res.headers.set("cache-control", "private, no-store"); | |
| 315 | }); | |
| 05b973e | 316 | // Logger only on non-git routes to avoid overhead on clone/push |
| 317 | app.use("*", async (c, next) => { | |
| 318 | if (c.req.path.includes(".git/")) return next(); | |
| 319 | return logger()(c, next); | |
| 320 | }); | |
| 79136bb | 321 | app.use("/api/*", cors()); |
| bf19c50 | 322 | // Global softAuth — populates c.get("user") for every downstream middleware |
| 323 | // + route. This was previously per-route, which meant rate-limit middleware | |
| 324 | // (and anything else inspecting auth state) always saw a null user. Keep | |
| 325 | // individual routes free to add requireAuth on top for hard gating; this | |
| 326 | // just establishes the user object cheaply. | |
| 327 | app.use("*", softAuth); | |
| 290ea77 | 328 | |
| 36cc17a | 329 | // Force-revalidate HTML on every request — kills browser cache holding stale |
| 290ea77 | 330 | // pre-redesign markup. JSON / static assets keep their own cache rules; only |
| 331 | // text/html responses get the no-cache stamp. Without this, every push to | |
| 332 | // main left users staring at cached 80s-looking pages from before the design | |
| 333 | // landed. | |
| 36cc17a | 334 | // |
| 335 | // We deliberately use `private, no-cache, must-revalidate` rather than | |
| 336 | // `no-store`. `no-store` disables Safari/Chrome's back-forward cache (bfcache), | |
| 337 | // which makes every Back/Forward press a cold server round-trip — that | |
| 338 | // contributed to the "every nav feels like a fresh login" UX complaint. | |
| 339 | // `no-cache` still revalidates on direct fetch but lets bfcache hold the | |
| 340 | // page in memory between navigations. | |
| 290ea77 | 341 | app.use("*", async (c, next) => { |
| 342 | await next(); | |
| 343 | const ct = c.res.headers.get("content-type") || ""; | |
| 344 | if (ct.startsWith("text/html")) { | |
| 36cc17a | 345 | c.header("cache-control", "private, no-cache, must-revalidate"); |
| 290ea77 | 346 | } |
| 347 | }); | |
| 826eccf | 348 | // Rate-limit API + auth endpoints. |
| 349 | // | |
| a41e675 | 350 | // `/api/*`: 1000/min per IP — generous so an admin clicking around the |
| 351 | // operator console (or a CDN/proxy concentrating multiple users behind one | |
| 352 | // IP) doesn't hit the wall. Bot-resistant headroom comes from the auth | |
| 353 | // rate limits below, not this one. | |
| 354 | // | |
| 355 | // `authedMultiplier` is set but only fires when an upstream middleware has | |
| 356 | // already populated c.get("user") — most app.use() chains apply softAuth | |
| 357 | // per-route, so the multiplier is best-effort. Keep the anonymous base | |
| 358 | // high enough that humans never feel it. | |
| 359 | // | |
| 360 | // Skip-paths: dashboard plumbing endpoints that the layout polls on a | |
| 361 | // fixed cadence and that we don't want consuming any bucket: | |
| 362 | // /api/version — layout polls every 15s | |
| 826eccf | 363 | // /api/notifications/count — nav bell unread-count fetcher |
| 364 | // /pwa/vapid-public-key — fetched once per push-notification opt-in | |
| 365 | app.use( | |
| 366 | "/api/*", | |
| a41e675 | 367 | rateLimit(1000, 60_000, "api", { |
| 826eccf | 368 | authedMultiplier: 4, |
| 369 | skipPaths: ["/api/version", "/api/notifications/count", "/pwa/vapid-public-key"], | |
| 370 | }) | |
| 371 | ); | |
| 0316dbb | 372 | app.use("/login", rateLimit(20, 60_000, "login")); |
| 373 | app.use("/register", rateLimit(10, 60_000, "register")); | |
| c63b860 | 374 | // BLOCK P1 — throttle forgot-password to deter enumeration + mail spam. |
| 375 | app.use("/forgot-password", rateLimit(5, 60_000, "forgot-password")); | |
| cd4f63b | 376 | // BLOCK Q2 — throttle magic-link sign-in for the same reason. |
| 377 | app.use("/login/magic", rateLimit(5, 60_000, "magic-link")); | |
| 1d3a220 | 378 | // The second factor was the one auth endpoint with NO limit, which made it |
| 379 | // the cheapest thing on the platform to attack: an attacker who already has | |
| 380 | // the password reaches /login/2fa holding a valid half-authenticated session | |
| 381 | // and can grind a 6-digit TOTP (10^6) or a recovery code unthrottled. Tighter | |
| 382 | // than /login deliberately — a real person types one code from their phone, | |
| 383 | // occasionally mistypes it, and never needs ten attempts a minute. | |
| 384 | app.use("/login/2fa", rateLimit(5, 60_000, "login-2fa")); | |
| 79136bb | 385 | |
| 59b6fb2 | 386 | // CSRF protection — set token on all requests, validate on mutations |
| 387 | app.use("*", csrfToken); | |
| 388 | app.use("*", csrfProtect); | |
| 389 | ||
| 45e31d0 | 390 | // Rate limit auth routes |
| 391 | app.use("/login", authRateLimit); | |
| 392 | app.use("/register", authRateLimit); | |
| 393 | ||
| 59b6fb2 | 394 | // Rate limit git operations |
| 395 | app.use("/:owner/:repo.git/*", gitRateLimit); | |
| 396 | ||
| 397 | // Rate limit search | |
| 398 | app.use("/:owner/:repo/search", searchRateLimit); | |
| 399 | app.use("/explore", searchRateLimit); | |
| 79136bb | 400 | |
| 4d4bd4b | 401 | // Rate limit the v1 REST API and the MCP surface. api-v2 already applies its |
| 402 | // own apiRateLimit internally (this stacks harmlessly for /api/v2/*); v1 | |
| 403 | // (src/routes/api.ts) and /mcp had NO rate limiting at all despite /mcp | |
| 404 | // being the primary, anonymously-reachable AI-agent interface and able to | |
| 405 | // trigger expensive per-call work (e.g. gluecron_repo_health scans every | |
| 406 | // file in a repo). softAuth already runs on both, so the existing | |
| 407 | // authedMultiplier (4x for a signed-in caller) applies automatically. | |
| 408 | app.use("/api/*", apiRateLimit); | |
| 409 | app.use("/mcp", apiRateLimit); | |
| 410 | ||
| f5b9ef5 | 411 | // No-cache for HTML — ensures browsers and proxies never serve stale pages. |
| 412 | // The middleware only stamps text/html responses so static assets keep | |
| 413 | // their own cache policies unchanged. | |
| 414 | app.use("*", noCache); | |
| 415 | ||
| 8ed1b31 | 416 | /** |
| 417 | * Platform-wide private-repository gate for `/:owner/:repo/...` pages. | |
| 418 | * | |
| 419 | * Every repo subpage was responsible for its own privacy check, and that | |
| 420 | * drifted badly: a live probe of a private repo found 24 subpages rendering | |
| 421 | * 200 to an anonymous visitor — /actions, /deployments, /discussions, | |
| 422 | * /packages, /projects, /wiki, /insights, /contributors, /gates, /queue, | |
| 423 | * /previews, /pushes, /health, /coupling, /dependencies, /explain, | |
| 424 | * /archaeology, /cloud-deployments, /ai/changelog, /ai/tests, /docs/tracking, | |
| 425 | * /search/nl, /search/semantic, /insights/engineering — while the repo root | |
| 426 | * correctly 404'd. Each leaked names, history, CI logs or dependency data. | |
| 427 | * | |
| 428 | * Gating centrally is the point: ~20 route files each re-implementing the | |
| 429 | * check is what produced the drift, and a subpage added tomorrow inherits | |
| 430 | * this automatically. | |
| 431 | * | |
| 432 | * Safe against false positives. Paths like /settings/tokens or /orgs/new also | |
| 433 | * match `/:owner/:repo`, but loadRepoByPath returns null for them and the | |
| 434 | * request falls straight through — exactly as it does for a repo that does | |
| 435 | * not exist, so each handler keeps emitting its own 404. `/:owner/:repo.git/*` | |
| 436 | * (git Smart HTTP) resolves `:repo` as "name.git", also null, so the git | |
| 437 | * protocol's own auth is untouched. | |
| 438 | * | |
| 439 | * Registered before every repo router and after softAuth, so c.get("user") | |
| 440 | * is populated and owners/collaborators are unaffected. | |
| 441 | */ | |
| 442 | app.use("/:owner/:repo/*", async (c, next) => { | |
| 443 | const owner = c.req.param("owner"); | |
| 444 | const repo = c.req.param("repo"); | |
| 445 | if (!owner || !repo) return next(); | |
| 446 | ||
| 447 | let row: { id: string; isPrivate: boolean } | null = null; | |
| 448 | try { | |
| 449 | const { loadRepoByPath } = await import("./lib/namespace"); | |
| 450 | const found = await loadRepoByPath(owner, repo); | |
| 451 | row = found ? { id: found.id, isPrivate: found.isPrivate } : null; | |
| 452 | } catch { | |
| 453 | // Namespace resolution failed (DB blip) — do not invent a denial for | |
| 454 | // public content; the handler below will surface its own error. | |
| 455 | return next(); | |
| 456 | } | |
| 457 | if (!row || !row.isPrivate) return next(); | |
| 458 | ||
| 459 | const viewer = c.get("user"); | |
| 460 | const { resolveRepoAccess } = await import("./middleware/repo-access"); | |
| 461 | const access = await resolveRepoAccess({ | |
| 462 | repoId: row.id, | |
| 463 | userId: viewer?.id ?? null, | |
| 464 | isPublic: false, | |
| 465 | }); | |
| 466 | if (access !== "none") return next(); | |
| 467 | ||
| 468 | // 404, not 403 — a private repo must not confirm its own existence. Matches | |
| 469 | // what the repo root already does. | |
| 470 | const accepts = c.req.header("accept") ?? ""; | |
| 471 | if (accepts.includes("application/json") && !accepts.includes("text/html")) { | |
| 472 | return c.json({ error: "Not found" }, 404); | |
| 473 | } | |
| 474 | return c.html(<NotFoundPage user={viewer ?? null} method={c.req.method} path={c.req.path} />, 404); | |
| 475 | }); | |
| 476 | ||
| 79136bb | 477 | // Git Smart HTTP protocol routes (must be before web routes) |
| 478 | app.route("/", gitRoutes); | |
| 479 | ||
| 45e31d0 | 480 | // REST API v1 (legacy) |
| 79136bb | 481 | app.route("/", apiRoutes); |
| 482 | ||
| 52ad8b1 | 483 | // Block L3 — /demo + /api/v2/demo/* live demo endpoints. Mounted BEFORE |
| 484 | // apiV2Routes so the /api/v2/demo/* JSON endpoints win over the v2 base | |
| 485 | // router's catch-shape, and BEFORE adminRoutes so the live /demo page | |
| 486 | // wins over the legacy /demo redirect in src/routes/admin.tsx. | |
| 487 | app.route("/", demoRoutes); | |
| 488 | ||
| 0316dbb | 489 | // REST API v2 (basePath /api/v2) |
| 490 | app.route("/", apiV2Routes); | |
| 491 | ||
| e75eddc | 492 | // Agent multiplayer v1 — /api/v2/agents/* (sessions, leases, usage). |
| 493 | // Mounted alongside apiV2Routes (its own basePath, no path conflict). | |
| 494 | app.route("/", agentsRoutes); | |
| 495 | ||
| ef3fd93 | 496 | // Multi-agent pipeline UI — /:owner/:repo/agents (list, new, live view). |
| 497 | // Must be before webRoutes (the catch-all) so the /agents sub-paths are | |
| 498 | // resolved before the generic tree/blob route takes over. | |
| 499 | app.route("/", agentPipelinesRoutes); | |
| 500 | ||
| ad6d4ad | 501 | // Inbound API hooks (GateTest callback + backup PAT-authed /api/v1/gate-runs) |
| 502 | app.route("/", hookRoutes); | |
| 21f8dbd | 503 | app.route("/api/events", eventsRoutes); |
| ad6d4ad | 504 | |
| 45e31d0 | 505 | // API documentation |
| 506 | app.route("/", apiDocsRoutes); | |
| 4a80519 | 507 | app.route("/", buildAgentSpecRoutes); |
| a6ff0f2 | 508 | // PR command center — global PR dashboard with AI/GateTest/auto-merge signal |
| 509 | app.route("/", pullsDashboardRoutes); | |
| e9aa4d8 | 510 | // Issue command center — global issue dashboard with AI-triage + autopilot signal |
| 511 | app.route("/", issuesDashboardRoutes); | |
| 512 | // Personal activity timeline — every event across the user's repos, with | |
| 513 | // AI-driven events surfaced separately (the Gluecron differentiator). | |
| 514 | app.route("/", activityRoutes); | |
| 515 | // Unified inbox — mentions + review requests + CI failures + AI events in one timeline | |
| 516 | app.route("/", inboxRoutes); | |
| 56801e1 | 517 | // AI standup feed — daily / weekly Claude-generated team brief |
| 518 | app.route("/", standupRoutes); | |
| cc34156 | 519 | // Smart morning digest — AI-curated daily developer queue (/digest) |
| 520 | app.route("/", digestRoutes); | |
| 79136bb | 521 | |
| 522 | // Auth routes (register, login, logout) | |
| 523 | app.route("/", authRoutes); | |
| 524 | ||
| c63b860 | 525 | // BLOCK P1 — Password reset (forgot-password + reset-password) |
| 526 | app.route("/", passwordResetRoutes); | |
| 527 | ||
| 528 | // BLOCK P2 — Email verification (verify-email + resend) | |
| 529 | app.route("/", emailVerificationRoutes); | |
| 530 | ||
| cd4f63b | 531 | // BLOCK Q2 — Magic-link sign-in (/login/magic + callback) |
| 532 | app.route("/", magicLinkRoutes); | |
| 533 | ||
| 79136bb | 534 | // Settings routes (profile, SSH keys) |
| 535 | app.route("/", settingsRoutes); | |
| 536 | ||
| ba9e143 | 537 | // Session management (SOC 2 CC6.1 — /settings/sessions) |
| 538 | app.route("/", settingsSessionsRoutes); | |
| 539 | ||
| 7298a17 | 540 | // 2FA / TOTP settings (Block B4) |
| 541 | app.route("/", settings2faRoutes); | |
| 542 | ||
| e75eddc | 543 | // Agent multiplayer — /settings/agents management UI |
| 544 | app.route("/", settingsAgentsRoutes); | |
| 545 | ||
| 1d4ff60 | 546 | // Chat integrations — Slack / Discord / Teams (/settings/integrations |
| 547 | // + /api/v2/integrations/{slack,discord}/*). See src/lib/chat-bot.ts. | |
| 548 | app.route("/", settingsIntegrationsRoutes); | |
| 549 | app.route("/", integrationsChatRoutes); | |
| 4cd6791 | 550 | // Incident hooks — /settings/incident-hooks (page) + the inbound incident |
| 551 | // webhook receivers. Was imported but NEVER mounted, so the whole file was | |
| 552 | // dead and /settings/incident-hooks (linked from the settings nav) 404'd. | |
| 553 | app.route("/", incidentHookRoutes); | |
| 1d4ff60 | 554 | |
| 2df1f8c | 555 | // WebAuthn / passkey routes (Block B5) |
| 556 | app.route("/", passkeyRoutes); | |
| 557 | ||
| 058d752 | 558 | // OAuth 2.0 provider (Block B6) |
| 559 | app.route("/", oauthRoutes); | |
| 560 | app.route("/", developerAppsRoutes); | |
| 369ad65 | 561 | // OAuth / agent discovery metadata (RFC 8414 + RFC 9728) — lets claude.ai, |
| 562 | // Cursor, Copilot, etc. auto-discover how to authenticate. | |
| 563 | app.route("/", wellKnownRoutes); | |
| 058d752 | 564 | |
| 6fc53bd | 565 | // Theme toggle (dark/light cookie) |
| 566 | app.route("/", themeRoutes); | |
| 567 | ||
| 568 | // Audit log UI | |
| 569 | app.route("/", auditRoutes); | |
| 570 | ||
| 571 | // Reactions API (issues, PRs, comments) | |
| 572 | app.route("/", reactionRoutes); | |
| 573 | ||
| 24cf2ca | 574 | // Saved replies (per-user canned comment templates) |
| 575 | app.route("/", savedReplyRoutes); | |
| 576 | ||
| 577 | // Environments + deployment history UI | |
| 578 | app.route("/", deploymentRoutes); | |
| 2c61840 | 579 | // Unified CI/CD pipeline timeline |
| 580 | app.route("/", pipelineRoutes); | |
| 24cf2ca | 581 | |
| 6563f0a | 582 | // Organizations + teams (Block B1) |
| 583 | app.route("/", orgRoutes); | |
| 584 | ||
| c81ab7a | 585 | // API tokens |
| 586 | app.route("/", tokenRoutes); | |
| 587 | ||
| 59b6fb2 | 588 | // Notifications |
| 3ef4c9d | 589 | app.route("/", notificationRoutes); |
| 590 | ||
| 79136bb | 591 | // Repo settings (description, visibility, delete) |
| 592 | app.route("/", repoSettings); | |
| 479dcd9 | 593 | // Per-repo automation settings (off / suggest / auto) — migration 0106 |
| 594 | app.route("/", automationSettingsRoutes); | |
| 79136bb | 595 | |
| 23d1a81 | 596 | // Repo collaborators (add/list/remove) |
| 597 | app.route("/", collaboratorRoutes); | |
| 598 | ||
| 04f6b7f | 599 | // Team-based repo collaborators (invite a whole team) |
| 600 | app.route("/", teamCollaboratorRoutes); | |
| 601 | ||
| 602 | // Collaborator invite accept flow (token-based) | |
| 603 | app.route("/", invitesRoutes); | |
| 604 | ||
| 605 | // Real-time SSE endpoint (topic-based live updates) | |
| 606 | app.route("/", liveEventsRoutes); | |
| 607 | ||
| 3c03977 | 608 | // PR live co-editing — presence + cursors + content sync via SSE. |
| 609 | app.route("/", prLiveRoutes); | |
| 610 | ||
| c81ab7a | 611 | // Webhooks management |
| 612 | app.route("/", webhookRoutes); | |
| 613 | ||
| 79136bb | 614 | // Compare view (branch diffs) |
| 615 | app.route("/", compareRoutes); | |
| 616 | ||
| 617 | // Issue tracker | |
| 618 | app.route("/", issueRoutes); | |
| 619 | ||
| 85c4e13 | 620 | // Milestones — group issues + PRs toward a shared goal with due dates + progress tracking. |
| 621 | // Mounted after issueRoutes so /:owner/:repo/issues/* paths win before the milestone patterns. | |
| 622 | app.route("/", milestonesRoutes); | |
| 623 | ||
| f928118 | 624 | // Ship Agent — autonomous AI feature implementation |
| 625 | app.route("/", shipAgentRoutes); | |
| 626 | ||
| 77cf834 | 627 | // AI Copilot Workspace — issue-to-PR autonomous agent |
| 628 | app.route("/", workspaceRoutes); | |
| 2c61840 | 629 | app.route("/", workspaceHubRoutes); |
| 77cf834 | 630 | |
| cb5a796 | 631 | // Comment moderation queue — owner-only `/:owner/:repo/comments/pending` |
| 632 | // + per-row approve/reject/spam actions. Mounted before `pullRoutes` so | |
| 633 | // the `/:owner/:repo/comments/*` paths resolve before the broader PR | |
| 634 | // patterns kick in. | |
| 635 | app.route("/", commentModerationRoutes); | |
| 636 | ||
| 0074234 | 637 | // Pull requests |
| 638 | app.route("/", pullRoutes); | |
| 09d5f39 | 639 | |
| 2be65d0 | 640 | // Streaming PR review — SSE stream + embeddable widget |
| 641 | // Mounted immediately after pullRoutes so /:owner/:repo/pulls/:number/review/* | |
| 642 | // resolves before the webRoutes catch-all takes over. | |
| 643 | import streamingReviewRoutes from "./routes/streaming-review"; | |
| 644 | app.route("/", streamingReviewRoutes); | |
| 645 | ||
| 09d5f39 | 646 | // /stage PR preview — serve built static files from .stage-previews/{jobId}/ |
| 647 | // Registered immediately after pullRoutes so the path `/preview/:id/*` is | |
| 648 | // specific enough to never clash with repo browse routes (`/:owner/:repo/*`). | |
| 649 | app.get("/preview/:stageJobId/*", async (c) => { | |
| 650 | const { stageJobId } = c.req.param(); | |
| 651 | // Validate job ID format (UUID) | |
| 652 | if (!/^[0-9a-f-]{32,}$/i.test(stageJobId)) { | |
| 653 | return c.text("Not found", 404); | |
| 654 | } | |
| 655 | const { getPreviewDir, isPreviewExpired } = await import("./lib/pr-stage"); | |
| 656 | if (isPreviewExpired(stageJobId)) { | |
| 657 | return c.html( | |
| 658 | "<html><body style='font-family:sans-serif;padding:40px;color:#888'>" + | |
| 659 | "<h2>Preview expired</h2><p>This stage preview has expired (48h TTL). " + | |
| 660 | "Comment <code>/stage</code> on the PR to redeploy.</p></body></html>", | |
| 661 | 410 | |
| 662 | ); | |
| 663 | } | |
| 664 | const { join } = await import("path"); | |
| 665 | const previewDir = getPreviewDir(stageJobId); | |
| 666 | // Extract the wildcard path after /preview/:id/ | |
| 667 | const rawPath = c.req.path.replace(/^\/preview\/[^/]+/, "") || "/"; | |
| 668 | const filePath = rawPath === "/" || rawPath === "" ? "/index.html" : rawPath; | |
| 669 | const fullPath = join(previewDir, filePath); | |
| 670 | const file = Bun.file(fullPath); | |
| 671 | if (!(await file.exists())) { | |
| 672 | // Try index.html fallback (SPA behaviour) | |
| 673 | const indexFile = Bun.file(join(previewDir, "index.html")); | |
| 674 | if (await indexFile.exists()) { | |
| 675 | const html = await indexFile.text(); | |
| 676 | return c.html(html); | |
| 677 | } | |
| 678 | return c.text("Not found", 404); | |
| 679 | } | |
| 680 | const content = await file.arrayBuffer(); | |
| 681 | const ext = fullPath.split(".").pop()?.toLowerCase() ?? ""; | |
| 682 | const contentTypeMap: Record<string, string> = { | |
| 683 | html: "text/html; charset=utf-8", | |
| 684 | htm: "text/html; charset=utf-8", | |
| 685 | css: "text/css; charset=utf-8", | |
| 686 | js: "application/javascript; charset=utf-8", | |
| 687 | mjs: "application/javascript; charset=utf-8", | |
| 688 | json: "application/json; charset=utf-8", | |
| 689 | png: "image/png", | |
| 690 | jpg: "image/jpeg", | |
| 691 | jpeg: "image/jpeg", | |
| 692 | gif: "image/gif", | |
| 693 | svg: "image/svg+xml", | |
| 694 | ico: "image/x-icon", | |
| 695 | webp: "image/webp", | |
| 696 | woff: "font/woff", | |
| 697 | woff2: "font/woff2", | |
| 698 | ttf: "font/ttf", | |
| 699 | txt: "text/plain; charset=utf-8", | |
| 700 | xml: "application/xml", | |
| 701 | webmanifest: "application/manifest+json", | |
| 702 | }; | |
| 703 | const ct = contentTypeMap[ext] ?? "application/octet-stream"; | |
| 704 | return c.body(content, 200, { | |
| 705 | "content-type": ct, | |
| 706 | "cache-control": "public, max-age=300", | |
| 707 | "x-stage-job-id": stageJobId, | |
| 708 | }); | |
| 709 | }); | |
| 710 | ||
| 79ed944 | 711 | // PR sandboxes — runnable per-PR environments. Migration 0067. |
| 712 | app.route("/", prSandboxRoutes); | |
| 0074234 | 713 | |
| 9b3a183 | 714 | // Cloud dev environments — hosted VS Code in the browser. Migration 0072. |
| 715 | app.route("/", devEnvRoutes); | |
| 716 | ||
| c81ab7a | 717 | // Fork |
| 718 | app.route("/", forkRoutes); | |
| 719 | ||
| 0074234 | 720 | // Web file editor |
| 721 | app.route("/", editorRoutes); | |
| 722 | ||
| 6f2809f | 723 | // AI editor API routes (inline suggestions, explain, fix) |
| 724 | app.route("/", aiEditorRoutes); | |
| 725 | ||
| 43de941 | 726 | // Contributors |
| 727 | app.route("/", contributorRoutes); | |
| 728 | ||
| 699e5c7 | 729 | // Health liveness + metrics endpoints |
| 2c34075 | 730 | app.route("/", healthRoutes); |
| 731 | ||
| f295f78 | 732 | // Cross-product platform status (public, CORS-open — see docs/PLATFORM_STATUS.md) |
| 733 | app.route("/api/platform-status", platformStatus); | |
| 734 | ||
| 52ad8b1 | 735 | // Block L4 — Public stats counters (powers landing-page social proof) |
| 736 | app.route("/", publicStatsRoutes); | |
| 737 | ||
| 738 | // Block L3 — Live /demo page + /api/v2/demo/* endpoints | |
| 739 | app.route("/", demoRoutes); | |
| 740 | ||
| 2316be6 | 741 | // Public /status — human-readable platform health page |
| 742 | app.route("/", statusRoutes); | |
| 743 | ||
| b1be050 | 744 | // BLOCK S4 — Site-admin synthetic-monitor dashboard (/admin/status). |
| 745 | // Mounted near the public status route so the two surfaces are visible | |
| 746 | // side-by-side; routes are gated by isSiteAdmin internally. | |
| 747 | app.route("/", adminStatusRoutes); | |
| 748 | ||
| 80bed05 | 749 | // /help — quickstart + API cheatsheet |
| 750 | app.route("/", helpRoutes); | |
| 751 | ||
| e0e4219 | 752 | // /docs — expanded documentation site (getting started, workflow YAML, MCP, API, agents) |
| 753 | app.route("/", docsRoutes); | |
| 754 | ||
| 5f2e749 | 755 | // L8 — public /pricing page (free-tier polish). Mounted BEFORE marketing |
| 756 | // so the new editorial pricing layout wins the route; the legacy marketing | |
| 757 | // pricing remains as a safety net but is shadowed at the router. | |
| 758 | app.route("/", pricingRoutes); | |
| 759 | ||
| e1fc7db | 760 | // /changelog — manually curated platform release history |
| 761 | app.route("/", changelogRoutes); | |
| 762 | ||
| 9f29b65 | 763 | // Enterprise sales page + contact form lead capture. |
| 764 | app.route("/", enterpriseRoutes); | |
| 765 | ||
| b0148e9 | 766 | // /pricing, /features, /about — marketing surface |
| 767 | app.route("/", marketingRoutes); | |
| 768 | ||
| adf5e18 | 769 | // /developer-program — partner + marketplace revenue-share page |
| 770 | app.route("/", developerProgramRoutes); | |
| 771 | ||
| 5618f9a | 772 | // SEO: robots.txt + sitemap.xml |
| 773 | app.route("/", seoRoutes); | |
| 774 | ||
| 05cdb85 | 775 | // /api/version — live build SHA + uptime; client poller uses this to |
| 776 | // surface 'New version available — reload' banners on deploy. | |
| 777 | app.route("/", versionRoutes); | |
| 778 | ||
| ad189d6 | 779 | // Site-admin console (admin.tsx). MUST be mounted BEFORE healthDashboardRoutes |
| 780 | // — its generic GET `/:owner/:repo/health` (matching :owner=admin :repo=autopilot) | |
| 781 | // was shadowing `/admin/autopilot/health`, returning a real "repo not found" | |
| 782 | // 404 for a route that exists and works fine once actually reached. Same bug | |
| 783 | // class as the adminOpsRoutes/insightRoutes note below; found via a live | |
| 784 | // production HTTP sweep (curled all 201 static page routes) — the health | |
| 785 | // dashboard existing didn't stop this specific admin page being unreachable. | |
| 786 | app.route("/", adminRoutes); | |
| 787 | ||
| 76ee7bc | 788 | // Org health — MUST be mounted BEFORE healthDashboardRoutes. Its literal |
| 789 | // `/orgs/:slug/health` was shadowed by healthDashboardRoutes' generic | |
| 790 | // `/:owner/:repo/health` (matching :owner=orgs :repo=<slug>), so every | |
| 791 | // org-health page 404'd and the whole feature was dead. Mirrors the | |
| 792 | // orgInsightsRoutes-before-insightRoutes fix below. org-health only matches | |
| 793 | // the literal `/orgs/...` prefix, so mounting it first is safe. | |
| 794 | app.route("/", orgHealthRoutes); | |
| 795 | ||
| 699e5c7 | 796 | // Health dashboard (per-repo health page) |
| 797 | app.route("/", healthDashboardRoutes); | |
| 798 | ||
| 9dd96b9 | 799 | // Block R1 — site-admin operations console. MUST be mounted BEFORE |
| 800 | // insightRoutes because its POST `/:owner/:repo/rollback` catch-all would | |
| 801 | // otherwise intercept `/admin/ops/rollback` (matching :owner=admin :repo=ops). | |
| 802 | app.route("/", adminOpsRoutes); | |
| f2c00b4 | 803 | // BLOCK W — Self-host status + bootstrap dashboard. |
| 804 | app.route("/", adminSelfHostRoutes); | |
| 826eccf | 805 | // BLOCK X — AI health-scan diagnose page (/admin/diagnose). |
| 806 | app.route("/", adminDiagnoseRoutes); | |
| f9814d2 | 807 | // Unified admin command center — /admin/command |
| 808 | app.route("/", adminCommandRoutes); | |
| 9dd96b9 | 809 | |
| 6a645f0 | 810 | // Org insights — MUST be mounted BEFORE insightRoutes. insightRoutes' repo |
| 811 | // insights hub (GET /:owner/:repo/insights) would otherwise match | |
| 812 | // /orgs/:slug/insights (owner="orgs") and 404 it before the org router runs. | |
| 813 | // Same route-shadowing class as the adminOps/insights note above. org-insights | |
| 814 | // only matches the literal "/orgs/..." prefix, so mounting it first is safe. | |
| 815 | app.route("/", orgInsightsRoutes); | |
| 816 | ||
| 817 | // Insights (repo insights hub, time-travel, dependencies, rollback) | |
| 16b325c | 818 | app.route("/", insightRoutes); |
| 819 | ||
| 8286942 | 820 | // Engineering Intelligence Dashboard — /insights + /:owner/:repo/insights/engineering |
| 821 | app.route("/", engineeringInsightsRoutes); | |
| 822 | ||
| 8d1483c | 823 | // DORA metrics page (/:owner/:repo/insights/dora) |
| 824 | app.route("/", doraRoutes); | |
| 825 | ||
| f1ab587 | 826 | // Command center dashboard |
| 827 | app.route("/", dashboardRoutes); | |
| 828 | ||
| 36b4cbd | 829 | // Legal pages (terms, privacy, AUP) |
| 830 | app.route("/", legalRoutes); | |
| 4b66018 | 831 | // Long-form legal sub-pages — /legal/{terms,privacy,acceptable-use,dmca}. |
| 832 | // The main `legal.tsx` serves the short canonical paths (/terms, /privacy, | |
| 833 | // /acceptable-use); these are the formal versions that the legal pages | |
| 834 | // internally link to each other. | |
| 835 | app.route("/", legalTermsRoutes); | |
| 836 | app.route("/", legalPrivacyRoutes); | |
| 837 | app.route("/", legalAcceptableUseRoutes); | |
| 838 | app.route("/", legalDmcaRoutes); | |
| 36b4cbd | 839 | |
| bdbd0de | 840 | // GitHub import / migration |
| 841 | app.route("/", importRoutes); | |
| 14c3cc8 | 842 | app.route("/", importBulkRoutes); |
| f390cfa | 843 | app.route("/", importSecretsRoutes); |
| bb2dea9 | 844 | // GitHub Actions → Gluecron gates.yml importer (stateless converter) |
| 845 | app.route("/", actionsImporterRoutes); | |
| 14c3cc8 | 846 | app.route("/", migrationRoutes); |
| ba23fe2 | 847 | app.route("/", migrationAssistantRoutes); |
| 9a8b8de | 848 | // GitHub Org Migration Wizard — live progress bulk importer |
| 849 | app.route("/", migrateRoutes); | |
| 14c3cc8 | 850 | |
| 851 | // Spec-to-PR (experimental AI-generated draft PRs) | |
| 852 | app.route("/", specsRoutes); | |
| 23d0abf | 853 | app.route("/", refactorRoutes); |
| b665cac | 854 | app.route("/", codebaseMigratorRoutes); |
| bdbd0de | 855 | |
| c81ab7a | 856 | // Explore page |
| 857 | app.route("/", exploreRoutes); | |
| 858 | ||
| 59b6fb2 | 859 | // Onboarding |
| 860 | app.route("/", onboardingRoutes); | |
| 861 | ||
| ad189d6 | 862 | // Admin + feature routes (adminRoutes itself is mounted earlier — see the |
| 863 | // comment above healthDashboardRoutes) | |
| 7293c67 | 864 | app.route("/", adminDeletionsRoutes); |
| 865 | app.route("/", adminStripeRoutes); | |
| ba9e143 | 866 | |
| 867 | // SOC 2 security dashboard + readiness checklist (/admin/security, /admin/soc2) | |
| 868 | app.route("/", adminSecurityRoutes); | |
| 509c376 | 869 | app.route("/", adminIntegrationsRoutes); |
| bc519ae | 870 | app.route("/", adminEnvHealthRoutes); |
| 79ed944 | 871 | app.route("/", adminAdvancementRoutes); |
| f764c07 | 872 | app.route("/", adminDeploysRoutes); |
| 873 | app.route("/", adminDeploysPageRoutes); | |
| 783dd46 | 874 | app.route("/", adminServerTargetsRoutes); |
| 9aaa128 | 875 | app.route("/", deployTargetsRoutes); |
| 90c7531 | 876 | app.route("/", claudeWebRoutes); |
| 9dd96b9 | 877 | // Note: adminOpsRoutes is mounted earlier (before insightRoutes) — see comment above. |
| 0316dbb | 878 | app.route("/", advisoriesRoutes); |
| 879 | app.route("/", aiChangelogRoutes); | |
| 0a69faa | 880 | // "Explain This Repo" — rich structured AI analysis dashboard (mounted before |
| 881 | // the simpler aiExplainRoutes so the new routes win on /:owner/:repo/explain). | |
| 882 | app.route("/", explainRoutes); | |
| 0316dbb | 883 | app.route("/", aiExplainRoutes); |
| 2be65d0 | 884 | app.route("/", archaeologyRoutes); |
| 0316dbb | 885 | app.route("/", aiTestsRoutes); |
| 886 | app.route("/", askRoutes); | |
| 38d31d3 | 887 | app.route("/", repoChatRoutes); |
| ee7e577 | 888 | // Personal cross-repo chat — `/chat` (user-scoped). Mounted alongside |
| 889 | // repoChatRoutes so the two surfaces share the catch-all priority. | |
| 890 | app.route("/", personalChatRoutes); | |
| 0316dbb | 891 | app.route("/", billingRoutes); |
| 8809b87 | 892 | app.route("/", billingUsageRoutes); |
| 6778ad2 | 893 | app.route("/", stripeWebhookRoutes); |
| 0316dbb | 894 | app.route("/", codeScanningRoutes); |
| da3fc18 | 895 | // Dependency CVE scanner findings page — /:owner/:repo/security/vulnerabilities |
| 896 | app.route("/", securityRoutes); | |
| 0316dbb | 897 | app.route("/", commitStatusesRoutes); |
| 898 | app.route("/", copilotRoutes); | |
| f5d020f | 899 | app.route("/", pairProgrammerRoutes); |
| 0316dbb | 900 | app.route("/", depUpdaterRoutes); |
| 901 | app.route("/", depsRoutes); | |
| 902 | app.route("/", discussionsRoutes); | |
| 903 | app.route("/", environmentsRoutes); | |
| 4bbacbe | 904 | app.route("/", previewsRoutes); |
| 79ed944 | 905 | app.route("/", docsTrackingRoutes); |
| 0316dbb | 906 | app.route("/", followsRoutes); |
| 907 | app.route("/", gatesRoutes); | |
| 908 | app.route("/", gistsRoutes); | |
| 909 | app.route("/", graphqlRoutes); | |
| 2c2163e | 910 | app.route("/", mcpRoutes); |
| 8102dd4 | 911 | // marketplaceAgentsRoutes MUST precede marketplaceRoutes: the latter defines |
| 912 | // the generic `/marketplace/:slug`, which otherwise swallows the literal | |
| 913 | // `/marketplace/agents` (and `/marketplace/agents/publish`) and 404s them as | |
| 914 | // unknown app slugs. | |
| 5ca514a | 915 | app.route("/", marketplaceAgentsRoutes); |
| 8102dd4 | 916 | app.route("/", marketplaceRoutes); |
| 0316dbb | 917 | app.route("/", mergeQueueRoutes); |
| 918 | app.route("/", mirrorsRoutes); | |
| 76ee7bc | 919 | // orgInsightsRoutes + orgHealthRoutes are mounted earlier (before the generic |
| 920 | // repo routes) — see the notes there. | |
| 0316dbb | 921 | app.route("/", packagesRoutes); |
| 922 | app.route("/", packagesApiRoutes); | |
| 845fd8a | 923 | // OCI / Docker container registry — /v2/* (OCI Distribution Spec v1.0) |
| 924 | app.route("/", ociRegistryRoutes); | |
| 0316dbb | 925 | app.route("/", pagesRoutes); |
| 926 | app.route("/", projectsRoutes); | |
| 927 | app.route("/", protectedTagsRoutes); | |
| 928 | app.route("/", pwaRoutes); | |
| 46d6165 | 929 | app.route("/", installRoutes); |
| cd4f63b | 930 | // BLOCK Q1 — /gluecron.dxt download (Claude Desktop one-click extension) |
| 931 | app.route("/", dxtRoutes); | |
| 662ce86 | 932 | // Connect Claude — user-facing one-click MCP setup (/connect/claude). Mounted |
| 933 | // next to the other one-click flows (install.sh + .dxt) for surface symmetry. | |
| 934 | app.route("/", connectClaudeRoutes); | |
| f5b9ef5 | 935 | // Claude Code Integration Receiver — /api/claude/connect + /api/claude/session. |
| 936 | app.route("/", claudeIntegration); | |
| 937 | // Connect guide — public onboarding page (/connect/claude-guide). | |
| 938 | app.route("/", connectRoutes); | |
| 05ab9b1 | 939 | // Push Watch — per-commit live status (gates + deploy + latency) at /:owner/:repo/push/:sha |
| 940 | app.route("/", pushWatchRoutes); | |
| 941 | // Org Secrets Manager — BLOCK M2 — /orgs/:slug/settings/secrets | |
| 942 | app.route("/", orgSecretsRoutes); | |
| a2b3e99 | 943 | // Cross-repo code search — BLOCK M3 — /search/code + /api/search/code |
| 944 | app.route("/", crossRepoSearchRoutes); | |
| 945 | // Browser push notifications — BLOCK M4 — /settings/notifications/push + /api/push/* | |
| 946 | app.route("/", pushNotifRoutes); | |
| 9fbe6cd | 947 | // Developer Velocity Dashboard — BLOCK M9 — /:owner/:repo/insights/velocity |
| 948 | app.route("/", velocityRoutes); | |
| 949 | // Stale Branch Cleanup — BLOCK M10 — /:owner/:repo/branches/stale | |
| 950 | app.route("/", staleBranchRoutes); | |
| 22f43f3 | 951 | // Repository Pulse — BLOCK M12 — /:owner/:repo/pulse |
| 952 | app.route("/", pulseRoutes); | |
| 74d8c4d | 953 | // Repository Health Score — BLOCK M14 — /:owner/:repo/insights/health |
| 954 | app.route("/", healthScoreRoutes); | |
| 77cf834 | 955 | // Repository Health Score breakdown page — /:owner/:repo/health |
| 956 | app.route("/", repoHealthRoutes); | |
| 74d8c4d | 957 | // Hot Files Heatmap — BLOCK M16 — /:owner/:repo/insights/hotfiles |
| 958 | app.route("/", hotFilesRoutes); | |
| bcc4020 | 959 | // AI Technical Debt Map — /:owner/:repo/debt-map (visual debt graph + Claude analysis) |
| 960 | app.route("/", debtMapRoutes); | |
| 1d6db4d | 961 | // Bus Factor Analysis — /:owner/:repo/insights/bus-factor |
| 962 | app.route("/", busFactorRoutes); | |
| b02ce30 | 963 | // Test Gap Detector — /:owner/:repo/insights/test-gaps |
| 964 | app.route("/", testGapsRoutes); | |
| f5d020f | 965 | // Cross-Repo Dependency Impact Detection — /:owner/:repo/pulls/:number/cross-repo-impact |
| 966 | app.route("/", crossRepoImpactRoutes); | |
| ebbb527 | 967 | // Hosted Claude tool-use loops — paste loop, get endpoint, billing meter. |
| 968 | // See src/routes/claude-deploy.tsx + src/lib/hosted-claude-loop.ts. | |
| 969 | app.route("/", claudeDeployRoutes); | |
| 0316dbb | 970 | app.route("/", releasesRoutes); |
| 971 | app.route("/", requiredChecksRoutes); | |
| 972 | app.route("/", rulesetsRoutes); | |
| 973 | app.route("/", searchRoutes); | |
| 974 | app.route("/", semanticSearchRoutes); | |
| 77cf834 | 975 | app.route("/", nlSearchRoutes); |
| 0316dbb | 976 | app.route("/", signingKeysRoutes); |
| 977 | app.route("/", sponsorsRoutes); | |
| 978 | app.route("/", ssoRoutes); | |
| 3a845e4 | 979 | // Enterprise per-org SAML 2.0 + OIDC SSO routes |
| 980 | app.route("/", samlSsoRoutes); | |
| 981 | // SCIM 2.0 user provisioning endpoints | |
| 982 | app.route("/", scimRoutes); | |
| 983 | // Per-org SSO + SCIM admin settings UI | |
| 984 | app.route("/", orgSsoSettingsRoutes); | |
| 46d6165 | 985 | app.route("/", githubOauthRoutes); |
| 582cdac | 986 | app.route("/", googleOauthRoutes); |
| 0316dbb | 987 | app.route("/", symbolsRoutes); |
| 988 | app.route("/", templatesRoutes); | |
| 989 | app.route("/", trafficRoutes); | |
| 990 | app.route("/", wikisRoutes); | |
| 991 | app.route("/", workflowsRoutes); | |
| 5ff9cc2 | 992 | app.route("/", workflowArtifactsRoutes); |
| 993 | app.route("/", workflowSecretsRoutes); | |
| 46d6165 | 994 | app.route("/", sleepModeRoutes); |
| 52ad8b1 | 995 | app.route("/", vsGithubRoutes); |
| 0316dbb | 996 | |
| 45f3b73 | 997 | // Voice-to-PR — phone-first dictation → spec or issue |
| 998 | app.route("/", voiceRoutes); | |
| 999 | ||
| 3122762 | 1000 | // Blog / Devlog — public posts, no DB |
| 1001 | app.route("/", blogRoutes); | |
| 1002 | ||
| cd4f63b | 1003 | // Block Q3 — Anonymous playground (`/play`, `/play/claim`). Mounted |
| 1004 | // before the web catch-all so the bare `/play` literal wins over the | |
| 1005 | // `/:owner` user-profile route. | |
| 1006 | app.route("/", playgroundRoutes); | |
| 1007 | ||
| 891efbe | 1008 | // Shareable AI hours-saved OG image card + landing page. |
| 1009 | // /share/hours-saved?user=:username → 1200×630 SVG (og:image) | |
| 1010 | // /share/:username → HTML page with og:image meta + Twitter share | |
| 1011 | // Mounted BEFORE webRoutes so /share/* doesn't fall through to the /:owner profile route. | |
| 1012 | app.route("/", shareRoutes); | |
| 1013 | ||
| 4abf6f1 | 1014 | // Machine surfaces must fail in the format their clients parse. An |
| 1015 | // unmatched /api/* path used to fall through to the HTML 404 page, so a | |
| 1016 | // REST/MCP/registry client asking for JSON got a full HTML document and | |
| 1017 | // blew up on JSON.parse instead of seeing a readable error. Decided by | |
| 1018 | // path root (these mounts are JSON-only by contract) or by an Accept | |
| 1019 | // header that asks for JSON and not HTML. | |
| 1020 | const JSON_ROOTS = [ | |
| 1021 | "/api", | |
| 1022 | "/mcp", | |
| 1023 | "/graphql", | |
| 1024 | "/v2", // OCI registry — the spec mandates a JSON error envelope | |
| 1025 | "/npm", | |
| 1026 | "/scim", | |
| 1027 | "/.well-known", | |
| 1028 | ]; | |
| 1029 | ||
| 1030 | function wantsJson(c: { | |
| 1031 | req: { path: string; header: (n: string) => string | undefined }; | |
| 1032 | }) { | |
| 1033 | const path = c.req.path; | |
| 1034 | // Match the root exactly or as a path segment — "/mcp" and "/mcp/x" are | |
| 1035 | // machine surfaces, "/mcpanything" is not. | |
| 1036 | if (JSON_ROOTS.some((r) => path === r || path.startsWith(r + "/"))) return true; | |
| 1037 | const accept = c.req.header("accept") ?? ""; | |
| 1038 | return accept.includes("application/json") && !accept.includes("text/html"); | |
| 1039 | } | |
| 1040 | ||
| 1041 | function jsonNotFound(c: Context) { | |
| 1042 | return c.json( | |
| 1043 | { error: "Not found", path: c.req.path, method: c.req.method }, | |
| 1044 | 404 | |
| 1045 | ); | |
| 1046 | } | |
| 1047 | ||
| 1048 | // Machine-surface 404 fallback — MUST be registered before webRoutes. | |
| 1049 | // webRoutes owns the `/:owner/:repo` catch-all, so an unmatched two-segment | |
| 1050 | // path like `/api/nope` was being read as owner="api", repo="nope" and | |
| 1051 | // answered with the HTML "repository not found" page. REST/MCP/OCI clients | |
| 1052 | // then choked on HTML where they expected a JSON envelope. Terminating the | |
| 1053 | // machine roots here keeps them JSON-only by contract. | |
| 1054 | for (const root of JSON_ROOTS) { | |
| 1055 | app.all(root, (c) => jsonNotFound(c)); | |
| 1056 | app.all(`${root}/*`, (c) => jsonNotFound(c)); | |
| 1057 | } | |
| 1058 | ||
| 79136bb | 1059 | // Web UI (catch-all, must be last) |
| 1060 | app.route("/", webRoutes); | |
| 1061 | ||
| c63b860 | 1062 | // Global 404 — BLOCK O2 routes the shared `NotFoundPage` view so |
| 1063 | // the markup stays consistent with /500 and the admin /403 page. | |
| 79136bb | 1064 | app.notFound((c) => { |
| 4abf6f1 | 1065 | if (wantsJson(c)) { |
| 1066 | return c.json( | |
| 1067 | { error: "Not found", path: c.req.path, method: c.req.method }, | |
| 1068 | 404 | |
| 1069 | ); | |
| 1070 | } | |
| 36cc17a | 1071 | const user = c.get("user") ?? null; |
| 79136bb | 1072 | return c.html( |
| c63b860 | 1073 | <NotFoundPage user={user} method={c.req.method} path={c.req.path} />, |
| 79136bb | 1074 | 404 |
| 1075 | ); | |
| 1076 | }); | |
| 1077 | ||
| c63b860 | 1078 | // Global error handler — BLOCK O2 uses the shared `ServerErrorPage` |
| 1079 | // view. Trace block only shown outside production. | |
| 79136bb | 1080 | app.onError((err, c) => { |
| 80bed05 | 1081 | reportError(err, { |
| 1082 | requestId: c.get("requestId"), | |
| 1083 | path: c.req.path, | |
| 1084 | method: c.req.method, | |
| 1085 | }); | |
| c63b860 | 1086 | // Prefer the inbound `x-request-id` header (LB-supplied) and fall |
| 1087 | // back to the context value set by request-context middleware. | |
| 1088 | const requestId = | |
| 1089 | c.req.header("x-request-id") || | |
| 1090 | ((c.get("requestId" as never) as string | undefined) ?? undefined); | |
| 36cc17a | 1091 | const user = c.get("user") ?? null; |
| c63b860 | 1092 | const trace = |
| 1093 | process.env.NODE_ENV !== "production" && err && err.message | |
| 1094 | ? err.message | |
| 1095 | : undefined; | |
| 4abf6f1 | 1096 | // Same reasoning as the 404 above: an API/MCP client must get a JSON |
| 1097 | // envelope it can parse, not the HTML error page. | |
| 1098 | if (wantsJson(c)) { | |
| 1099 | return c.json( | |
| 1100 | { error: "Internal server error", requestId, ...(trace ? { trace } : {}) }, | |
| 1101 | 500 | |
| 1102 | ); | |
| 1103 | } | |
| 79136bb | 1104 | return c.html( |
| c63b860 | 1105 | <ServerErrorPage user={user} requestId={requestId} trace={trace} />, |
| 79136bb | 1106 | 500 |
| 1107 | ); | |
| 1108 | }); | |
| 1109 | ||
| 1110 | export default app; |