@clawos-dev/clawd 0.2.86 → 0.2.87-beta.164.a38a7cd

package/dist/cli.cjs

@@ -27414,6 +27414,12 @@ var UPLOAD_MIME_ALLOW = /* @__PURE__ */ new Set([
 ]);
 var UPLOAD_MIME_ALLOW_PREFIX = ["text/"];
 var UPLOAD_MAX_BYTES = 25 * 1024 * 1024;
+var UPLOAD_CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "POST, OPTIONS",
+  "Access-Control-Allow-Headers": "Authorization, Content-Type",
+  "Access-Control-Max-Age": "86400"
+};
 function isUploadMimeAllowed(mime) {
   if (UPLOAD_MIME_ALLOW.has(mime)) return true;
   return UPLOAD_MIME_ALLOW_PREFIX.some((p2) => mime.startsWith(p2));
@@ -27441,6 +27447,11 @@ function createHttpRouter(deps) {
     if (!url.pathname.startsWith("/session/") && !url.pathname.startsWith("/files/") && url.pathname !== "/attachments/upload") {
       return false;
     }
+    if (url.pathname === "/attachments/upload" && req.method === "OPTIONS") {
+      res.writeHead(204, UPLOAD_CORS_HEADERS);
+      res.end();
+      return true;
+    }
     if (url.pathname.startsWith("/files/") && req.method === "GET") {
       const secret = deps.getSignSecret?.();
       if (!secret) {
@@ -27479,13 +27490,14 @@ function createHttpRouter(deps) {
       return true;
     }
     if (url.pathname === "/attachments/upload" && req.method === "POST") {
+      const sendUploadJson = (status, body) => sendJson(res, status, body, UPLOAD_CORS_HEADERS);
       if (ctx.role !== "owner") {
-        sendJson(res, 403, { code: "FORBIDDEN", message: "owner only" });
+        sendUploadJson(403, { code: "FORBIDDEN", message: "owner only" });
         return true;
       }
       const up = deps.attachmentUpload;
       if (!up) {
-        sendJson(res, 501, { code: "NOT_IMPLEMENTED", message: "attachment upload not wired" });
+        sendUploadJson(501, { code: "NOT_IMPLEMENTED", message: "attachment upload not wired" });
         return true;
       }
       const sessionId = url.searchParams.get("sessionId");
@@ -27493,14 +27505,14 @@ function createHttpRouter(deps) {
       const mimeType = url.searchParams.get("mimeType");
       const contentLengthRaw = req.headers["content-length"];
       if (!sessionId || !fileName || !mimeType || !contentLengthRaw) {
-        sendJson(res, 400, {
+        sendUploadJson(400, {
           code: "INVALID_PARAM",
           message: "missing sessionId/fileName/mimeType/Content-Length"
         });
         return true;
       }
       if (!isValidUploadFileName(fileName)) {
-        sendJson(res, 400, {
+        sendUploadJson(400, {
           code: "INVALID_FILENAME",
           message: `fileName must be a plain basename (no path separators, no dotfiles): ${fileName}`
         });
@@ -27508,18 +27520,18 @@ function createHttpRouter(deps) {
       }
       const contentLength = Number.parseInt(contentLengthRaw, 10);
       if (!Number.isFinite(contentLength) || contentLength < 0) {
-        sendJson(res, 400, { code: "INVALID_PARAM", message: "malformed Content-Length" });
+        sendUploadJson(400, { code: "INVALID_PARAM", message: "malformed Content-Length" });
         return true;
       }
       if (contentLength > UPLOAD_MAX_BYTES) {
-        sendJson(res, 413, {
+        sendUploadJson(413, {
           code: "FILE_TOO_LARGE",
           message: `max ${UPLOAD_MAX_BYTES} bytes`
         });
         return true;
       }
       if (!isUploadMimeAllowed(mimeType)) {
-        sendJson(res, 400, {
+        sendUploadJson(400, {
           code: "UNSUPPORTED_MIME",
           message: `mime ${mimeType} not allowed`
         });
@@ -27528,12 +27540,12 @@ function createHttpRouter(deps) {
       const sessionDir = up.getSessionDir(sessionId);
       const scope = up.getSessionScope(sessionId);
       if (!sessionDir || !scope) {
-        sendJson(res, 404, { code: "NOT_FOUND", message: `session ${sessionId} not found` });
+        sendUploadJson(404, { code: "NOT_FOUND", message: `session ${sessionId} not found` });
         return true;
       }
       const httpBaseUrl = up.getHttpBaseUrl();
       if (!httpBaseUrl) {
-        sendJson(res, 503, {
+        sendUploadJson(503, {
           code: "TUNNEL_NOT_READY",
           message: "httpBaseUrl unavailable"
         });
@@ -27541,7 +27553,7 @@ function createHttpRouter(deps) {
       }
       const secret = deps.getSignSecret?.();
       if (!secret) {
-        sendJson(res, 501, {
+        sendUploadJson(501, {
           code: "NOT_IMPLEMENTED",
           message: "sign secret unavailable (noAuth?)"
         });
@@ -27560,7 +27572,7 @@ function createHttpRouter(deps) {
         });
         const parts = signUrlParts(secret, result.absPath, null);
         const fullUrl = buildSignedFileUrl(httpBaseUrl, parts);
-        sendJson(res, 200, {
+        sendUploadJson(200, {
           attachmentId: result.attachmentId,
           url: fullUrl,
           relPath: result.relPath,
@@ -27570,10 +27582,10 @@ function createHttpRouter(deps) {
       } catch (err) {
         if (err instanceof UploadError) {
           const status = err.code === "SIZE_MISMATCH" ? 400 : 500;
-          sendJson(res, status, { code: err.code, message: err.message });
+          sendUploadJson(status, { code: err.code, message: err.message });
         } else {
           deps.logger?.warn("attachment upload failed", { err: err.message });
-          sendJson(res, 500, { code: "STORAGE_ERROR", message: err.message });
+          sendUploadJson(500, { code: "STORAGE_ERROR", message: err.message });
         }
       }
       return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.86",
+  "version": "0.2.87-beta.164.a38a7cd",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",