@helloleo/plugins 0.2.0-beta.5 → 0.2.0-beta.6

package/dist/index.js

@@ -25629,6 +25629,7 @@ export interface SessionUser {
 }
 
 export async function getUser(): Promise<SessionUser | null> {
+  if (typeof window === 'undefined') return null
   const res = await fetch('/api/auth/me')
   if (!res.ok) return null
   const data = (await res.json()) as { user: SessionUser | null }

package/dist/templates/tanstack-start-2026-06-18/src/routes/README.md

@@ -30,13 +30,7 @@ TanStack Start offers two ways to run server-side code:
 - [Server routes](https://tanstack.com/start/latest/docs/framework/react/guide/server-routes) — files under `src/routes/api/` that export HTTP handlers.
 - [Server functions](https://tanstack.com/start/latest/docs/framework/react/guide/server-functions) — `createServerFn()` calls colocated with components.
 
-Prefer API routes. Create them under `src/routes/api/` following the same
-convention as `src/routes/api/health.ts` (one handler per HTTP method under
-`server.handlers`, returning `Response.json()`). This is more scalable and
-gives the user visually readable endpoints (`/api/todos`, `/api/todos/:id`)
-they can recognize in the network monitor. Server functions are served from
-generated URLs that read as random gibberish, which makes requests hard to
-identify and debug.
+Prefer API routes. Create them under `src/routes/api/` following the same convention as `src/routes/api/health.ts` (one handler per HTTP method under `server.handlers`, returning `Response.json()`). This is more scalable and gives the user visually readable endpoints (`/api/todos`, `/api/todos/:id`) they can recognize in the network monitor. Server functions are served from generated URLs that read as random gibberish, which makes requests hard to identify and debug.
 
 ## Authenticated routes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helloleo/plugins",
-  "version": "0.2.0-beta.5",
+  "version": "0.2.0-beta.6",
   "description": "OpenCode plugins for HelloLeo",
   "license": "UNLICENSED",
   "type": "module",

package/src/templates/tanstack-start-2026-06-18/src/routes/README.md

@@ -30,13 +30,7 @@ TanStack Start offers two ways to run server-side code:
 - [Server routes](https://tanstack.com/start/latest/docs/framework/react/guide/server-routes) — files under `src/routes/api/` that export HTTP handlers.
 - [Server functions](https://tanstack.com/start/latest/docs/framework/react/guide/server-functions) — `createServerFn()` calls colocated with components.
 
-Prefer API routes. Create them under `src/routes/api/` following the same
-convention as `src/routes/api/health.ts` (one handler per HTTP method under
-`server.handlers`, returning `Response.json()`). This is more scalable and
-gives the user visually readable endpoints (`/api/todos`, `/api/todos/:id`)
-they can recognize in the network monitor. Server functions are served from
-generated URLs that read as random gibberish, which makes requests hard to
-identify and debug.
+Prefer API routes. Create them under `src/routes/api/` following the same convention as `src/routes/api/health.ts` (one handler per HTTP method under `server.handlers`, returning `Response.json()`). This is more scalable and gives the user visually readable endpoints (`/api/todos`, `/api/todos/:id`) they can recognize in the network monitor. Server functions are served from generated URLs that read as random gibberish, which makes requests hard to identify and debug.
 
 ## Authenticated routes
 

package/src/tools/inspect-http.ts

@@ -213,16 +213,6 @@ function isPrivateHost(hostname: string): boolean {
 	return base !== null && hosts[base].private;
 }
 
-// leo-core's nginx preview gate returns a static 403 page (see
-// _PROXY_CONF_TMPL in sandbox/preview.py) when neither ?auth=<token>, the
-// leo_auth_* cookie, nor the LeoInspect UA match. Recognize that exact page
-// so a gated preview doesn't read as an app-level failure.
-function isPreviewGate403(status: number, body: string): boolean {
-	return (
-		status === 403 && body.includes("403 Forbidden") && body.includes("nginx/")
-	);
-}
-
 function hasHeader(headers: Record<string, string>, name: string): boolean {
 	const target = name.toLowerCase();
 	for (const key of Object.keys(headers)) {

package/src/tools/setup-password-auth.ts

@@ -328,6 +328,7 @@ export interface SessionUser {
 }
 
 export async function getUser(): Promise<SessionUser | null> {
+  if (typeof window === 'undefined') return null
   const res = await fetch('/api/auth/me')
   if (!res.ok) return null
   const data = (await res.json()) as { user: SessionUser | null }