@hienlh/ppm 0.23.13 → 0.23.15

package/src/server/routes/design-share-guest-comments.ts

@@ -0,0 +1,120 @@
+import type { Context, Hono } from "hono";
+import { err, ok } from "../../types/api.ts";
+import { crossOriginRefusal } from "./cross-origin-guard.ts";
+import { GUEST_KEY_HEADER, GUEST_WRITE_MAX_BYTES } from "../../shared/design-share-guest-types.ts";
+import type { DesignCommentGuestView } from "../../shared/design-comment-thread-types.ts";
+import type { ResolvedShareLink } from "../../services/design/share/design-share-resolve.ts";
+import { guestLinkOpen, resolveGuestLink } from "../../services/design/share/design-share-guest-link.ts";
+import {
+  checkShareClientWrite, takeShareRead, takeShareWrite,
+} from "../../services/design/share/design-share-rate-limit.ts";
+import {
+  addGuestComment, addGuestReply, deleteGuestComment, deleteGuestReply, guestCommentsEtag, guestKeyHash,
+  listGuestThreads, updateGuestComment, updateGuestReply,
+} from "../../services/design/share/design-share-comments.service.ts";
+import { notifyGuestWrite } from "../../services/design/share/design-share-notifier.ts";
+import { clientKeyOf, guestFail, invalidJson, readCappedText, tooManyRequests } from "./design-share-guest-shared.ts";
+
+/**
+ * `/s/<code>/comments…`: a reviewer's threads on the link, and their writes.
+ *
+ * A read needs no key (without one nothing is "mine"); `If-None-Match` is answered from the
+ * ETag before the file is read. A write needs the reviewer's key and passes the cross-origin
+ * header pair: there is no `cors()` in front of these routes, so a page on another origin
+ * cannot get the browser to send either. The client's write budget is checked before the
+ * code is looked up, and the write is counted against the client and the link before the
+ * body is read, so a stream of refused writes still costs the sender.
+ */
+
+type Body = Record<string, unknown>;
+type GuestWrite = (resolved: ResolvedShareLink, keyHash: string, body: Body) => Promise<Response>;
+
+async function guestWrite(c: Context, run: GuestWrite): Promise<Response> {
+  const refusal = crossOriginRefusal(c);
+  if (refusal) return c.json(err(refusal), 403);
+  const keyHash = guestKeyHash(c.req.header(GUEST_KEY_HEADER));
+  if (!keyHash) return c.json(err("A reviewer key is needed"), 400);
+  const clientKey = clientKeyOf(c);
+  // Write spacing is per reviewer, not per address: behind the supervisor every LAN reviewer
+  // shares one address, and a reply sent right after a colleague's comment is not a flood.
+  // The per-link cap still bounds a sender that invents keys.
+  const writerKey = `${clientKey}:${keyHash}`;
+  const early = checkShareClientWrite(writerKey);
+  if (early) return tooManyRequests(c, early);
+  const resolved = await resolveGuestLink(c.req.param("code") ?? "");
+  if (!resolved) {
+    // A code that opens nothing still costs a read, so guessing has a price.
+    takeShareRead("api", clientKey);
+    return invalidJson(c);
+  }
+  const retry = takeShareWrite(writerKey, resolved.link.id);
+  if (retry) return tooManyRequests(c, retry);
+  let body: unknown;
+  try {
+    const text = await readCappedText(c.req.raw, GUEST_WRITE_MAX_BYTES);
+    if (text === null) return c.json(err("Request too large"), 413);
+    body = text.trim() ? JSON.parse(text) : {};
+  } catch {
+    return c.json(err("Expected a JSON object"), 400);
+  }
+  if (!body || typeof body !== "object" || Array.isArray(body)) return c.json(err("Expected a JSON object"), 400);
+  try {
+    return await run(resolved, keyHash, body as Body);
+  } catch (e) {
+    return guestFail(c, e, resolved.link.id);
+  }
+}
+
+/**
+ * Tell the owner, unless the link closed between the write and now: a revoked link's last
+ * write is not news worth a notification, and a notification would carry its threads' text.
+ */
+function notifyIfOpen(r: ResolvedShareLink, thread: DesignCommentGuestView, kind: "comment" | "reply"): void {
+  if (guestLinkOpen(r)) notifyGuestWrite(r, thread, kind);
+}
+
+export function registerGuestCommentRoutes(app: Hono): void {
+  app.get("/:code/comments", async (c) => {
+    const clientKey = clientKeyOf(c);
+    const retry = takeShareRead("api", clientKey);
+    if (retry) return tooManyRequests(c, retry);
+    const resolved = await resolveGuestLink(c.req.param("code"));
+    if (!resolved) return invalidJson(c);
+    const keyHash = guestKeyHash(c.req.header(GUEST_KEY_HEADER));
+    try {
+      const etag = await guestCommentsEtag(resolved, keyHash);
+      if (c.req.header("if-none-match") === etag) return new Response(null, { status: 304, headers: { ETag: etag } });
+      const { threads, versionId, etag: current } = await listGuestThreads(resolved, keyHash);
+      return c.json(ok({ threads, versionId }), 200, { ETag: current });
+    } catch (e) {
+      return guestFail(c, e, resolved.link.id);
+    }
+  });
+
+  // New comments and replies tell the owner; edits and deletes do not.
+  app.post("/:code/comments", (c) => guestWrite(c, async (r, key, body) => {
+    const thread = await addGuestComment(r, key, body);
+    notifyIfOpen(r, thread, "comment");
+    return c.json(ok({ thread }), 201);
+  }));
+
+  app.post("/:code/comments/:id/replies", (c) => guestWrite(c, async (r, key, body) => {
+    const thread = await addGuestReply(r, key, c.req.param("id"), body);
+    notifyIfOpen(r, thread, "reply");
+    return c.json(ok({ thread }), 201);
+  }));
+
+  app.patch("/:code/comments/:id", (c) => guestWrite(c, async (r, key, body) =>
+    c.json(ok({ thread: await updateGuestComment(r, key, c.req.param("id"), body) }))));
+
+  app.delete("/:code/comments/:id", (c) => guestWrite(c, async (r, key) => {
+    await deleteGuestComment(r, key, c.req.param("id"));
+    return c.json(ok({ deleted: c.req.param("id") }));
+  }));
+
+  app.patch("/:code/comments/:id/replies/:replyId", (c) => guestWrite(c, async (r, key, body) =>
+    c.json(ok({ thread: await updateGuestReply(r, key, c.req.param("id"), c.req.param("replyId"), body) }))));
+
+  app.delete("/:code/comments/:id/replies/:replyId", (c) => guestWrite(c, async (r, key) =>
+    c.json(ok({ thread: await deleteGuestReply(r, key, c.req.param("id"), c.req.param("replyId")) }))));
+}

package/src/server/routes/design-share-guest-files.ts

@@ -0,0 +1,99 @@
+import type { Hono } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { stat } from "node:fs/promises";
+import { err } from "../../types/api.ts";
+import { browserFacingHost } from "../helpers/preview-asset-guard.ts";
+import { rangeFileResponse } from "../helpers/range-file-response.ts";
+import { BRIDGE_NONCE_RE } from "../../shared/design-bridge-protocol.ts";
+import { SHARE_PATH_PREFIX } from "../../shared/design-share-types.ts";
+import { readDesignFileSafe } from "../../services/design/design-safe-walk.ts";
+import { MAX_DESIGN_SOURCE_BYTES } from "../../services/design/source/design-source-file.ts";
+import { buildDesignCsp } from "../../services/design/preview/design-csp.ts";
+import { renderDesignHtml } from "../../services/design/preview/design-preview-html.ts";
+import {
+  resolveSnapshotScopedPath, SYSTEMS_DIR_ALIAS, TOKENS_CSS_ALIAS, type ScopedAsset,
+} from "../../services/design/preview/design-preview-scope.ts";
+import { resolveGuestAlias } from "../../services/design/preview/design-guest-alias.ts";
+import { GUEST_BRIDGE_JS } from "../../services/design/bridge/guest-bridge.ts";
+import { guestSnapshotManifest, resolveGuestLink } from "../../services/design/share/design-share-guest-link.ts";
+import type { ResolvedShareLink } from "../../services/design/share/design-share-resolve.ts";
+import { takeShareRead } from "../../services/design/share/design-share-rate-limit.ts";
+import { clientKeyOf, invalidJson, invalidPage, tooManyRequests } from "./design-share-guest-shared.ts";
+
+/**
+ * `GET /s/<code>/f/<path>`: the files of the version a share link pins, for the reviewer's
+ * design frame.
+ *
+ * `<slug>/<rest>` is read from the pinned snapshot only — never the live design folder, and
+ * never another design. `tokens.css` and `systems/<id>/…` go through the guest allow-list
+ * (the design's own app's tokens and kit, served live), never through the canvas's general
+ * alias, which for the default app reaches every design. HTML gets element ids and the
+ * reviewer's bridge, which proposes no writes; everything is served under the design CSP
+ * with this link's own file root as its only source.
+ */
+
+const isHtml = (path: string): boolean => /\.html?$/i.test(path);
+
+function errorStatus(error: unknown): ContentfulStatusCode {
+  const status = (error as { status?: number }).status;
+  return status === 403 || status === 413 ? status : 404;
+}
+
+async function resolveGuestFile(resolved: ResolvedShareLink, path: string): Promise<ScopedAsset> {
+  const { link } = resolved;
+  if (path === TOKENS_CSS_ALIAS || path === SYSTEMS_DIR_ALIAS || path.startsWith(`${SYSTEMS_DIR_ALIAS}/`)) {
+    return resolveGuestAlias(link, (await guestSnapshotManifest(resolved)).system, path);
+  }
+  return resolveSnapshotScopedPath(link, link.snapshotId, path);
+}
+
+export function registerGuestFileRoutes(app: Hono): void {
+  app.get("/:code/f/*", async (c) => {
+    const code = c.req.param("code");
+    const url = new URL(c.req.url);
+    const prefix = `${SHARE_PATH_PREFIX}${code}/f/`;
+    if (!url.pathname.startsWith(prefix)) return invalidPage();
+    const encoded = url.pathname.slice(prefix.length);
+    const retry = takeShareRead("assets", clientKeyOf(c));
+    if (retry) return tooManyRequests(c, retry);
+    const resolved = await resolveGuestLink(code);
+    if (!resolved) return isHtml(encoded) ? invalidPage() : invalidJson(c);
+
+    const n = url.searchParams.get("n");
+    const nonce = n && BRIDGE_NONCE_RE.test(n) ? n : null;
+    try {
+      let path: string;
+      try {
+        path = decodeURIComponent(encoded);
+      } catch {
+        return c.json(err("Access denied"), 403);
+      }
+      const asset = await resolveGuestFile(resolved, path);
+      if (!(await stat(asset.abs)).isFile()) return c.json(err("File not found"), 404);
+      // Scheme-less, so the source follows the document's real scheme through a tunnel.
+      const source = `${browserFacingHost(c.req.header("host"), c.req.url)}${prefix}`;
+      const headers: Record<string, string> = {
+        // The sandboxed frame is an opaque origin and sends `Origin: null` for module scripts
+        // and fonts; `null` answers exactly that, where `*` would answer every site.
+        "Access-Control-Allow-Origin": "null",
+        "Content-Security-Policy": buildDesignCsp(source),
+      };
+      const head = c.req.method === "HEAD";
+      if (isHtml(asset.abs)) {
+        const page = await renderDesignHtml(resolved.link, asset, {
+          nonce, withBridge: true, bridgeScript: GUEST_BRIDGE_JS, skipCssGens: true,
+        });
+        return new Response(head ? null : page.body, { headers: { ...headers, "Content-Type": "text/html; charset=utf-8" } });
+      }
+      if (/\.css$/i.test(asset.abs)) {
+        const bytes = await readDesignFileSafe(asset.abs, MAX_DESIGN_SOURCE_BYTES);
+        return new Response(head ? null : new Uint8Array(bytes), { headers: { ...headers, "Content-Type": "text/css; charset=utf-8" } });
+      }
+      return rangeFileResponse(asset.abs, c.req.raw, headers);
+    } catch (error) {
+      const status = errorStatus(error);
+      const message = status === 403 ? "Access denied" : status === 413 ? "File too large to preview" : "File not found";
+      return c.json(err(message), status);
+    }
+  });
+}

package/src/server/routes/design-share-guest-shared.ts

@@ -0,0 +1,95 @@
+import type { Context } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { err } from "../../types/api.ts";
+import { isDesignError } from "../../services/design/design-error.ts";
+import { shareClientKey } from "../../services/design/share/design-share-client-key.ts";
+import { GUEST_LINK_CLOSED } from "../../services/design/share/design-share-guest-link.ts";
+import {
+  INVALID_LINK_MESSAGE, INVALID_PAGE_CSP, INVALID_PAGE_HTML,
+} from "../../services/design/share/design-share-guest-page.ts";
+
+/** Responses and request facts every `/s` route shares. */
+
+/** The client this request is counted against (see `design-share-client-key.ts`). */
+export function clientKeyOf(c: Context): string {
+  return shareClientKey({
+    req: c.req.raw, env: c.env, host: c.req.header("host"), cfConnectingIp: c.req.header("cf-connecting-ip"),
+  });
+}
+
+/** The one page every refused code, and every path that is not a share route, answers with. */
+export function invalidPage(): Response {
+  return new Response(INVALID_PAGE_HTML, {
+    status: 404,
+    headers: { "Content-Type": "text/html; charset=utf-8", "Content-Security-Policy": INVALID_PAGE_CSP },
+  });
+}
+
+export function invalidJson(c: Context): Response {
+  return c.json(err(INVALID_LINK_MESSAGE), 404);
+}
+
+/** 429 with `Retry-After` in whole seconds, at least one. */
+export function tooManyRequests(c: Context, retryMs: number): Response {
+  const seconds = String(Math.max(1, Math.ceil(retryMs / 1000)));
+  return c.json(err("Too many requests; wait a moment and try again"), 429, { "Retry-After": seconds });
+}
+
+/** Errors a reviewer causes by naming a file the shared version does not have (or may not serve). */
+const MISSING_FILE_CODES = new Set(["ENOENT", "ENOTDIR", "EISDIR", "ELOOP", "ENAMETOOLONG"]);
+
+function reviewerFileMistake(e: unknown): boolean {
+  const raw = e as { code?: unknown; status?: unknown } | null;
+  return !!raw && (MISSING_FILE_CODES.has(String(raw.code)) || raw.status === 403 || raw.status === 404);
+}
+
+/** An error for the log: its kind, and its message with absolute host paths taken out. */
+function describeForLog(e: unknown): string {
+  const raw = e as { code?: unknown; name?: unknown; message?: unknown } | null;
+  const kind = String(raw?.code ?? raw?.name ?? "Error");
+  const message = typeof raw?.message === "string" ? raw.message : String(e);
+  return `${kind}: ${message.replace(/(?<![\w.])(?:[A-Za-z]:[\\/]|\\\\|\/)[^\s'"]*/g, "<path>")}`;
+}
+
+/**
+ * A service refusal as the reviewer sees it: the message and code the comment services
+ * wrote for them. A link closed while the write waited answers exactly as a dead code does.
+ * A file the reviewer named that the version does not have is their mistake: a 400 and a
+ * warning. Anything else is the server's fault and is answered without detail. Nothing
+ * logged names the code or a host path, only the link id.
+ */
+export function guestFail(c: Context, e: unknown, linkId: string): Response {
+  if (isDesignError(e) && e.code === GUEST_LINK_CLOSED) return invalidJson(c);
+  if (isDesignError(e) && e.status >= 400 && e.status < 500) {
+    return c.json({ ...err(e.message), code: e.code }, e.status as ContentfulStatusCode);
+  }
+  if (reviewerFileMistake(e)) {
+    console.warn(`[design-share] ${c.req.method} link=${linkId}: refused a file not in the shared version (${describeForLog(e)})`);
+    return c.json({ ...err("That page is not part of the shared version"), code: "EBADFILE" }, 400);
+  }
+  console.error(`[design-share] ${c.req.method} link=${linkId}: ${describeForLog(e)}`);
+  return c.json(err("Something went wrong; try again"), 500);
+}
+
+/**
+ * The body as text, or null when it is over `maxBytes`. Counted as it arrives, so a body
+ * sent without a `Content-Length` is refused without being read to its end.
+ */
+export async function readCappedText(req: Request, maxBytes: number): Promise<string | null> {
+  if (Number(req.headers.get("content-length") ?? "0") > maxBytes) return null;
+  if (!req.body) return "";
+  const reader = req.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > maxBytes) {
+      await reader.cancel().catch(() => {});
+      return null;
+    }
+    chunks.push(value);
+  }
+  return new TextDecoder().decode(Buffer.concat(chunks));
+}

package/src/server/routes/design-share-guest.ts

@@ -0,0 +1,77 @@
+import { Hono } from "hono";
+import { DIST_DIR } from "./static.ts";
+import { ok } from "../../types/api.ts";
+import type { DesignShareGuestInfo } from "../../shared/design-share-guest-types.ts";
+import { guestSnapshotManifest, resolveGuestLink } from "../../services/design/share/design-share-guest-link.ts";
+import { takeShareRead } from "../../services/design/share/design-share-rate-limit.ts";
+import {
+  GUEST_PAGE_CSP, readGuestPageHtml, SHARE_COMMON_HEADERS,
+} from "../../services/design/share/design-share-guest-page.ts";
+import { registerGuestFileRoutes } from "./design-share-guest-files.ts";
+import { registerGuestCommentRoutes } from "./design-share-guest-comments.ts";
+import { clientKeyOf, guestFail, invalidJson, invalidPage, tooManyRequests } from "./design-share-guest-shared.ts";
+
+/**
+ * `/s/*`, the public surface of a design share link: the reviewer's page, the link's info,
+ * the pinned version's files and its comment threads.
+ *
+ * Mounted ahead of the global `cors()`, `/api` authentication and the static fallback. So
+ * cors never answers `*` or re-wraps a response here (a range body survives), the PPM token
+ * is never asked for or seen, and no `/s` path — `/s`, `/s/`, a trailing slash, an unknown
+ * sub-path — falls through to the app shell or its service worker: the catch-all at the end
+ * answers each of them with the invalid page. A share code grants exactly what these routes
+ * serve and nothing else.
+ */
+
+export function createDesignShareGuestRoutes(opts: { distDir: string }): Hono {
+  const app = new Hono();
+
+  app.use("*", async (c, next) => {
+    await next();
+    for (const [name, value] of Object.entries(SHARE_COMMON_HEADERS)) c.res.headers.set(name, value);
+  });
+
+  registerGuestFileRoutes(app);
+  registerGuestCommentRoutes(app);
+
+  app.get("/:code/info", async (c) => {
+    const retry = takeShareRead("api", clientKeyOf(c));
+    if (retry) return tooManyRequests(c, retry);
+    const resolved = await resolveGuestLink(c.req.param("code"));
+    if (!resolved) return invalidJson(c);
+    try {
+      const manifest = await guestSnapshotManifest(resolved);
+      const info: DesignShareGuestInfo = {
+        linkId: resolved.link.id,
+        slug: resolved.link.slug,
+        title: manifest.title,
+        kind: manifest.kind,
+        entry: manifest.entry,
+        variants: manifest.variants,
+        expiresAt: resolved.link.expiresAt,
+        versionCreatedAt: resolved.snapshot.createdAt,
+        versionId: resolved.link.snapshotId,
+      };
+      return c.json(ok(info));
+    } catch (e) {
+      return guestFail(c, e, resolved.link.id);
+    }
+  });
+
+  app.get("/:code", async (c) => {
+    const retry = takeShareRead("api", clientKeyOf(c));
+    if (retry) return tooManyRequests(c, retry);
+    if (!(await resolveGuestLink(c.req.param("code")))) return invalidPage();
+    const html = await readGuestPageHtml(opts.distDir);
+    if (html === null) return c.text("The review page is not built on this server. Run: bun run build:web", 503);
+    return new Response(c.req.method === "HEAD" ? null : html, {
+      headers: { "Content-Type": "text/html; charset=utf-8", "Content-Security-Policy": GUEST_PAGE_CSP },
+    });
+  });
+
+  app.all("/", () => invalidPage());
+  app.all("/*", () => invalidPage());
+  return app;
+}
+
+export const designShareGuestRoutes = createDesignShareGuestRoutes({ distDir: DIST_DIR });

package/src/server/routes/design-shares.ts

@@ -0,0 +1,90 @@
+import { Hono, type Context } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import { ok, err } from "../../types/api.ts";
+import { isDesignError } from "../../services/design/design-error.ts";
+import {
+  createShareLink, deleteShareLink, listShareLinks, previewShareRepin, updateShareLink,
+} from "../../services/design/share/design-share-links.service.ts";
+import { deleteThreadsOfLink } from "../../services/design/design-comment-replies.service.ts";
+import { designFail, designJsonBody as jsonBody, type DesignRouteEnv } from "./design-route-helpers.ts";
+
+/**
+ * `/api/project/:projectName/designs/:slug/shares` — the owner's share links of one design.
+ *
+ * Responses carry each link's `path` (`/s/<code>`), re-derived on every read; the stored
+ * hash never leaves the server. A refusal the share service decided carries a `code`
+ * beside the message (`signin-off`, `limit`, `revoked`…) so the dialog can say what to do.
+ */
+
+export const designShareRoutes = new Hono<DesignRouteEnv>();
+
+function fail(c: Context<DesignRouteEnv>, e: unknown): Response {
+  if (isDesignError(e) && e.status < 500) {
+    return c.json({ ...err(e.message), code: e.code }, e.status as ContentfulStatusCode);
+  }
+  return designFail(c, e);
+}
+
+const slugOf = (c: Context<DesignRouteEnv>) => c.req.param("slug") ?? "";
+
+designShareRoutes.get("/", async (c) => {
+  try {
+    return c.json(ok({ links: await listShareLinks(c.get("projectPath"), slugOf(c)) }));
+  } catch (e) {
+    return fail(c, e);
+  }
+});
+
+designShareRoutes.post("/", async (c) => {
+  const body = await jsonBody(c);
+  if (!body) return c.json(err("Expected a JSON object"), 400);
+  try {
+    return c.json(ok({ link: await createShareLink(c.get("projectPath"), slugOf(c), body) }), 201);
+  } catch (e) {
+    return fail(c, e);
+  }
+});
+
+/**
+ * What "Update to latest" would change for this link's reviewers, before it is done:
+ * `{ changedFiles }`, the pinned snapshot against the live files, or null when the pinned
+ * snapshot is gone.
+ */
+designShareRoutes.get("/:id/changes", async (c) => {
+  try {
+    return c.json(ok({ changedFiles: await previewShareRepin(c.get("projectPath"), slugOf(c), c.req.param("id")) }));
+  } catch (e) {
+    return fail(c, e);
+  }
+});
+
+designShareRoutes.patch("/:id", async (c) => {
+  const body = await jsonBody(c);
+  if (!body) return c.json(err("Expected a JSON object"), 400);
+  try {
+    return c.json(ok(await updateShareLink(c.get("projectPath"), slugOf(c), c.req.param("id"), body)));
+  } catch (e) {
+    return fail(c, e);
+  }
+});
+
+/**
+ * Every comment thread reviewers on this link started, replies included. Answers how many
+ * went. Accepted for a link whose row is already deleted: its threads outlive it.
+ */
+designShareRoutes.delete("/:id/comments", async (c) => {
+  try {
+    return c.json(ok({ deleted: await deleteThreadsOfLink(c.get("projectPath"), slugOf(c), c.req.param("id")) }));
+  } catch (e) {
+    return fail(c, e);
+  }
+});
+
+designShareRoutes.delete("/:id", (c) => {
+  try {
+    deleteShareLink(c.get("projectPath"), slugOf(c), c.req.param("id"));
+    return c.json(ok({ deleted: c.req.param("id") }));
+  } catch (e) {
+    return fail(c, e);
+  }
+});

package/src/server/routes/designs.ts

@@ -9,6 +9,7 @@ import { designUndoRoutes } from "./design-undo.ts";
 import { designExportRoutes } from "./design-export.ts";
 import { designCheckRoutes } from "./design-check.ts";
 import { designSystemRoutes } from "./design-systems.ts";
+import { designShareRoutes } from "./design-shares.ts";
 import { createDesign, deleteDesign, getDesign, listDesigns, renameDesign } from "../../services/design/design-store.service.ts";
 import { listDesignSystems } from "../../services/design/design-systems.service.ts";
 import { listSnapshots } from "../../services/design/design-snapshots.service.ts";
@@ -104,3 +105,4 @@ designRoutes.route("/:slug/style", designStyleRoutes);
 designRoutes.route("/:slug/undo", designUndoRoutes);
 designRoutes.route("/:slug/export", designExportRoutes);
 designRoutes.route("/:slug/check", designCheckRoutes);
+designRoutes.route("/:slug/shares", designShareRoutes);

package/src/server/routes/settings.ts

@@ -15,6 +15,7 @@ import {
 import { ok, err } from "../../types/api.ts";
 import { isDbExplorerPrefs } from "../../shared/db-explorer-prefs.ts";
 import { isLookupDescriptions } from "../../shared/db-lookup-prefs.ts";
+import { isPpmTool, type PpmToolSwitches } from "../../shared/ppm-tools.ts";
 import type { PPMBotTelegramStatus } from "../../shared/ppmbot-telegram.ts";
 import { proxyService } from "../../services/proxy.service.ts";
 import { clearIndexCache } from "../../services/file-list-index.service.ts";
@@ -123,6 +124,7 @@ const UI_PREFS_KEY = "ui_prefs";
 const UI_PREF_VALIDATORS: Record<string, (v: unknown) => boolean> = {
   wordWrap: (v) => typeof v === "boolean",
   inlineBlame: (v) => typeof v === "boolean",
+  designWindows: (v) => typeof v === "boolean",
   tabWrap: (v) => typeof v === "boolean",
   sidebarCollapsed: (v) => typeof v === "boolean",
   remoteDesktopStatsVisible: (v) => typeof v === "boolean",
@@ -191,6 +193,7 @@ settingsRoutes.put("/ai", async (c) => {
       new_chat_provider_mode?: NewChatProviderMode;
       share_provider_context?: boolean;
       tab_tools?: boolean;
+      ppm_tools?: PpmToolSwitches;
       providers?: Record<string, Partial<AIProviderConfig>>;
     }>();
 
@@ -209,6 +212,13 @@ settingsRoutes.put("/ai", async (c) => {
     if ("tab_tools" in body && typeof body.tab_tools !== "boolean") {
       return c.json(err("tab_tools must be a boolean"), 400);
     }
+    if ("ppm_tools" in body) {
+      const tools = body.ppm_tools as unknown;
+      if (!tools || typeof tools !== "object" || Array.isArray(tools)
+          || !Object.entries(tools).every(([name, on]) => isPpmTool(name) && typeof on === "boolean")) {
+        return c.json(err("ppm_tools must map PPM's tool names to booleans"), 400);
+      }
+    }
 
     // Validate each provider config
     if (body.providers) {
@@ -233,6 +243,8 @@ settingsRoutes.put("/ai", async (c) => {
       new_chat_provider_mode: body.new_chat_provider_mode ?? currentAi.new_chat_provider_mode ?? "default",
       share_provider_context: body.share_provider_context ?? currentAi.share_provider_context ?? true,
       ...(typeof body.tab_tools === "boolean" && { tab_tools: body.tab_tools }),
+      // One switch at a time: the tools the body does not name keep theirs.
+      ...(body.ppm_tools && { ppm_tools: { ...currentAi.ppm_tools, ...body.ppm_tools } }),
       ...(body.default_provider && { default_provider: body.default_provider }),
     };
     if (body.providers) {

package/src/server/routes/static.ts

@@ -1,16 +1,17 @@
 import { Hono } from "hono";
 import type { Context } from "hono";
 import { existsSync, statSync } from "node:fs";
-import { resolve, join, extname, dirname } from "node:path";
+import { resolve, join, extname, dirname, relative, sep } from "node:path";
 import { isCompiledBinary } from "../../services/autostart-generator.ts";
 import { chooseVariant } from "./static-encoding.ts";
 import { shouldServeAppShell } from "./static-fallback.ts";
+import { GUEST_PAGE_DIR } from "../../services/design/share/design-share-guest-page.ts";
 
 export const staticRoutes = new Hono();
 
 // Compiled binary: look for web/ next to the binary itself
 // Dev mode: resolve relative to source file
-const DIST_DIR = isCompiledBinary()
+export const DIST_DIR = isCompiledBinary()
   ? resolve(dirname(process.execPath), "web")
   : resolve(import.meta.dir, "../../../dist/web");
 
@@ -60,6 +61,13 @@ export function createStaticHandler(DIST_DIR: string) {
     return c.text("Forbidden", 403);
   }
 
+  // The share reviewer's page is served only from `/s/<code>`, under its own CSP. Decided on
+  // the joined path, lower-cased, so `//design-share-page/` or another case on a
+  // case-insensitive disk cannot reach the file without that policy.
+  if (relative(DIST_DIR, filePath).split(sep)[0]!.toLowerCase() === GUEST_PAGE_DIR) {
+    return c.text("Not found", 404);
+  }
+
   if (existsSync(filePath) && !filePath.endsWith("/") && !filePath.endsWith("\\")) {
     const file = Bun.file(filePath);
     // Only serve if it's actually a file (not directory)