@chibitek/chibi 0.1.170 → 0.1.171

package/dist-server/companion/src/routes.js

@@ -33,7 +33,7 @@ export const MESSAGE_FILE_ROUTE = {
 };
 export const CLOUD_DESKTOP_CONTROL_ROUTE = {
     method: "POST",
-    path: /^\/api\/bots\/[\w-]+\/computer\/(?:control|screenshot|viewer-close)$/,
+    path: /^\/api\/bots\/[\w-]+\/computer\/(?:control|screenshot|viewer-close|remote-frame|remote-input)$/,
 };
 export function isCloudDesktopJoin(method, path) {
     return method === CLOUD_DESKTOP_JOIN_ROUTE.method && CLOUD_DESKTOP_JOIN_ROUTE.path.test(path);
@@ -41,6 +41,28 @@ export function isCloudDesktopJoin(method, path) {
 export function isMessageFileDownload(method, path) {
     return method === MESSAGE_FILE_ROUTE.method && MESSAGE_FILE_ROUTE.path.test(path);
 }
+/** The desktop's broad bot and room edits. A phone reaches the harness as
+ * the owner, so the harness's own display-fields-only filter for clients
+ * never runs; the proxy opens these to the pin toggle alone by checking the
+ * body itself (isPinOnlyBody) and forwarding exactly the bytes it checked. */
+export const PIN_ONLY_ROUTE = {
+    method: "PATCH",
+    path: /^\/api\/(?:bots|groups)\/[\w-]+$/,
+};
+export function isPinOnlyRoute(method, path) {
+    return method === PIN_ONLY_ROUTE.method && PIN_ONLY_ROUTE.path.test(path);
+}
+/** `{"pinned": true|false}` and nothing else. */
+export function isPinOnlyBody(raw) {
+    try {
+        const body = JSON.parse(raw.toString("utf8"));
+        return Boolean(body) && typeof body === "object" && !Array.isArray(body)
+            && Object.keys(body).length === 1 && typeof body.pinned === "boolean";
+    }
+    catch {
+        return false;
+    }
+}
 export function isCloudDesktopAccess(method, path) {
     return isCloudDesktopJoin(method, path)
         || (method === CLOUD_DESKTOP_CONTROL_ROUTE.method && CLOUD_DESKTOP_CONTROL_ROUTE.path.test(path));
@@ -75,6 +97,8 @@ const ALLOWED = [
     // Pinned-row reorder: hands the viewer's own pin stamps back out in a new
     // order (server/pin-order.ts); it cannot pin, unpin or reach hidden bots.
     { method: "PUT", path: /^\/api\/pins\/order$/ },
+    // Pin or unpin one bot or room; the proxy refuses any other field.
+    PIN_ONLY_ROUTE,
     { method: "POST", path: /^\/api\/bots\/[\w-]+\/messages$/ },
     { method: "PATCH", path: /^\/api\/bots\/[\w-]+\/cards\/[\w-]+$/ },
     { method: "POST", path: /^\/api\/bots\/[\w-]+\/respond$/ },
@@ -185,6 +209,9 @@ const ALLOWED = [
     // on/off only. The full server list stays on the computer, since a local
     // server's arguments can carry anything.
     { method: "GET", path: /^\/api\/mcp\/defaults$/ },
+    // A marketplace connect card. The harness adds only Atomic's featured,
+    // vendor-run servers, threat-scans them and saves them switched off.
+    { method: "POST", path: /^\/api\/mcp\/registry\/add$/ },
 ];
 /** Route families worth naming in the refusal.
  *