@oar-sh/oar 0.9.8 → 0.9.9

package/server/routes/messages-routes.mjs

@@ -5,7 +5,7 @@ import path from 'path';
 import { randomUUID } from 'crypto';
 import { stripRelayPromptContext } from '../services/relay-prompt-sanitizer.mjs';
 import { resolveUploadMimeType } from '../services/mime-sniffer.mjs';
-import { applySafeServedContentHeaders } from '../services/safe-served-content.mjs';
+import { fileVersionToken, serveFileWithRangeSupport, withFileVersion } from '../services/file-serving.mjs';
 import {
   shouldParkForRestart,
   parkPendingQueueForRestart,
@@ -71,6 +71,11 @@ const STRANDED_SESSION_HEARTBEAT_FRESH_MS = 15_000;
 const RELAY_QUESTION_FINALIZATION_HOLD_MS = 5_000;
 const AUTO_MODEL_SENTINEL = 'auto';
 const USAGE_FETCH_RETRY_DELAY_MS = 250;
+// Preview kinds whose bytes travel in the preview JSON; media and PDF are
+// fetched by the browser from the raw URL instead.
+const TEXT_PREVIEW_KINDS = new Set(['markdown', 'code', 'text']);
+// An upload's URL names its bytes (the sha256), so a kept answer stays right.
+const UPLOAD_CONTENT_CACHE_CONTROL = 'private, max-age=31536000, immutable';
 
 export function resolveOpenAIReasoningEffort(explicitReasoningEffort = '', model = '') {
   const explicit = String(explicitReasoningEffort || '').trim().toLowerCase();
@@ -1610,57 +1615,6 @@ export function cleanupPersistedGeneratedImagesForAssistantResponse({
   }
 }
 
-function serveFileWithRangeSupport(req, res, filePath, meta, { safeName, cacheDelete = null } = {}) {
-  const fileSize = meta.size;
-  const name = safeName || path.basename(filePath).replace(/"/g, '');
-  const rangeHeader = req.headers['range'];
-
-  res.setHeader('Accept-Ranges', 'bytes');
-  res.setHeader('Cache-Control', 'no-store');
-  // Neutralize browser-executable types (HTML/SVG/XML), force nosniff, and
-  // sandbox the response so a worker-written workspace file can't run as script
-  // on this origin. Media stays inline for preview; everything else downloads.
-  applySafeServedContentHeaders(res, meta.contentType, { fileName: name });
-
-  const onStreamError = (error) => {
-    if (cacheDelete) cacheDelete(filePath);
-    if (res.headersSent) { res.destroy(error); return; }
-    if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') {
-      res.status(404).json({ error: 'File not found' });
-      return;
-    }
-    res.status(500).json({ error: 'Failed to read file' });
-  };
-
-  if (rangeHeader) {
-    const match = /bytes=(\d+)-(\d*)/.exec(rangeHeader);
-    if (!match) {
-      res.setHeader('Content-Range', `bytes */${fileSize}`);
-      res.status(416).end();
-      return;
-    }
-    const start = parseInt(match[1], 10);
-    const end = match[2] ? parseInt(match[2], 10) : fileSize - 1;
-    if (start > end || start >= fileSize || end >= fileSize) {
-      res.setHeader('Content-Range', `bytes */${fileSize}`);
-      res.status(416).end();
-      return;
-    }
-    const chunkSize = end - start + 1;
-    res.setHeader('Content-Range', `bytes ${start}-${end}/${fileSize}`);
-    res.setHeader('Content-Length', String(chunkSize));
-    res.status(206);
-    const stream = fs.createReadStream(filePath, { start, end });
-    stream.on('error', onStreamError);
-    stream.pipe(res);
-  } else {
-    res.setHeader('Content-Length', String(fileSize));
-    const stream = fs.createReadStream(filePath);
-    stream.on('error', onStreamError);
-    stream.pipe(res);
-  }
-}
-
 // Structural sanitizer for the workflow-progress digest a Claude session
 // worker attaches to its background-task rows (docs/plans/workflow-progress-tree.md,
 // Phase 2). The relay never trusts worker JSON: strings are trimmed and
@@ -1769,6 +1723,10 @@ export function registerMessagesRoutes(app, deps) {
     fetchLinuxDirectoryEntries,
     mapLinuxDirectoryEntry,
     readWorkspaceFileMeta,
+    // The cache readWorkspaceFileMeta fills. The routes drop an entry when a
+    // read shows it is out of date; the name was used here without ever
+    // being handed in, so each of those paths threw a ReferenceError.
+    workspaceFileMetaCache,
     resolveWorkspaceFilePath,
     normalizeWorkspaceRelativePath,
     previewLanguageForWorkspaceFile,
@@ -3408,9 +3366,10 @@ export function registerMessagesRoutes(app, deps) {
     if (!file) return res.status(404).json({ error: 'Not found' });
     const filePath = uploadPathForSha(sha256);
     if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Missing file on disk' });
-    res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
-    applySafeServedContentHeaders(res, file.mime_type, { fileName: file.name || file.file_name || '' });
-    fs.createReadStream(filePath).pipe(res);
+    serveFileWithRangeSupport(req, res, filePath, { contentType: file.mime_type }, {
+      safeName: String(file.name || file.file_name || '').replace(/"/g, ''),
+      cacheControl: UPLOAD_CONTENT_CACHE_CONTROL,
+    });
   });
 
   app.get('/api/generated-image/:conversationId/:messageId/:imageId/content', auth, (req, res) => {
@@ -3483,6 +3442,9 @@ export function registerMessagesRoutes(app, deps) {
     const filePath = resolveWorkspaceFilePath(requestedPath, rootOverride);
     if (!filePath || !normalizedPath) return res.status(400).json({ error: 'Invalid file path' });
 
+    // The preview carries the version the download link is built from, so
+    // it reads the file's metadata fresh, not from the short-lived cache.
+    workspaceFileMetaCache.delete(filePath);
     let meta = null;
     try {
       meta = readWorkspaceFileMeta(filePath);
@@ -3538,10 +3500,12 @@ export function registerMessagesRoutes(app, deps) {
       size,
       truncated,
       previewBytes: contentBuffer.length,
-      rawUrl: `${remotePath}/api/files/${normalizedWebPath.split('/').map((part) => encodeURIComponent(part)).join('/')}${scopeSuffix}`,
+      mtimeMs: meta.mtimeMs ?? null,
+      version: fileVersionToken(meta),
+      rawUrl: withFileVersion(`${remotePath}/api/files/${normalizedWebPath.split('/').map((part) => encodeURIComponent(part)).join('/')}${scopeSuffix}`, fileVersionToken(meta)),
     };
 
-    if (kind !== 'binary' && kind !== 'image' && kind !== 'video') {
+    if (TEXT_PREVIEW_KINDS.has(kind)) {
       payload.content = contentBuffer.toString('utf8');
     }
 
@@ -3917,6 +3881,8 @@ export function registerMessagesRoutes(app, deps) {
       const filePath = normalizeLinuxAbsolutePath(requestedPath);
       if (!filePath) return res.status(400).json({ error: 'Invalid Linux file path' });
 
+      // Fresh metadata: the download link's version comes from this answer.
+      workspaceFileMetaCache.delete(filePath);
       let meta = null;
       try {
         meta = readWorkspaceFileMeta(filePath);
@@ -3969,10 +3935,12 @@ export function registerMessagesRoutes(app, deps) {
         size,
         truncated,
         previewBytes: contentBuffer.length,
-        rawUrl: `${remotePath}/api/drives/file?path=${encodeURIComponent(filePath)}`,
+        mtimeMs: meta.mtimeMs ?? null,
+        version: fileVersionToken(meta),
+        rawUrl: withFileVersion(`${remotePath}/api/drives/file?path=${encodeURIComponent(filePath)}`, fileVersionToken(meta)),
       };
 
-      if (kind !== 'binary' && kind !== 'image' && kind !== 'video') {
+      if (TEXT_PREVIEW_KINDS.has(kind)) {
         payload.content = contentBuffer.toString('utf8');
       }
 
@@ -3989,6 +3957,8 @@ export function registerMessagesRoutes(app, deps) {
         return res.status(400).json({ error: 'Invalid drive file path' });
       }
 
+      // Fresh metadata: the download link's version comes from this answer.
+      workspaceFileMetaCache.delete(filePath);
       let meta = null;
       try {
         meta = readWorkspaceFileMeta(filePath);
@@ -4043,10 +4013,12 @@ export function registerMessagesRoutes(app, deps) {
         size,
         truncated,
         previewBytes: contentBuffer.length,
-        rawUrl: `${remotePath}/api/drives/file?path=${encodeURIComponent(normalizedWebPath)}`,
+        mtimeMs: meta.mtimeMs ?? null,
+        version: fileVersionToken(meta),
+        rawUrl: withFileVersion(`${remotePath}/api/drives/file?path=${encodeURIComponent(normalizedWebPath)}`, fileVersionToken(meta)),
       };
 
-      if (kind !== 'binary' && kind !== 'image' && kind !== 'video') {
+      if (TEXT_PREVIEW_KINDS.has(kind)) {
         payload.content = contentBuffer.toString('utf8');
       }
 

package/server/routes/sessions-routes.mjs

@@ -7,8 +7,9 @@ import path from 'path';
 import { fileURLToPath } from 'url';
 import { randomUUID } from 'crypto';
 import { createSdkSessionSyncService } from '../services/sdk-session-sync-service.mjs';
-import { applySafeServedContentHeaders } from '../services/safe-served-content.mjs';
+import { serveFileWithRangeSupport } from '../services/file-serving.mjs';
 import { stripRelayPromptContext } from '../services/relay-prompt-sanitizer.mjs';
+import { MESSAGE_PIN_LIMIT, buildPinList } from '../services/message-pin-list.mjs';
 import { persistConversationPreferences } from '../services/conversation-preferences-service.mjs';
 import { parseAutoCompactWindow } from '../../shared/auto-compact-window.mjs';
 import { CLAUDE_ATTRIBUTION_MODES, DEFAULT_CLAUDE_ATTRIBUTION_MODE, claudeAttributionModelLabel, claudeAttributionTrailer, normalizeClaudeAttributionMode, resolveClaudeAttributionMode } from '../../shared/claude-attribution.mjs';
@@ -88,6 +89,9 @@ const SESSION_WORKER_STATUS_QUEUE_STATES = Object.freeze(['pending', 'processing
 // Registry statuses that mean "this worker is currently running" (same triple
 // as countActiveCliWorkers in server-runtime.mjs).
 const SESSION_WORKER_ACTIVE_STATUSES = Object.freeze(['starting', 'ready', 'processing']);
+// A shared attachment's URL names its bytes (sha256 or a fixed generated-image
+// path), so a kept answer stays right.
+const SHARED_CONTENT_CACHE_CONTROL = 'private, max-age=31536000, immutable';
 
 function normalizeWorkerStatusText(value, fallback = null) {
   const text = String(value || '').trim();
@@ -1834,6 +1838,7 @@ export function buildConversationMessages({
           attachments: message?.attachments || [],
           mode: message?.mode || undefined,
           hiddenFromShares: Number(message?.hidden_from_shares || 0) === 1,
+          pinned: !!message?.pinned_at,
           timestamp: message?.timestamp,
           sourceMessageId,
           executedProvider: message?.executed_provider || message?.executedProvider || undefined,
@@ -2218,6 +2223,23 @@ export function registerSessionsRoutes(app, deps) {
       AND (id = ? OR response_message_id = ?)
     LIMIT 1
   `);
+  function listConversationPins(conversationId) {
+    return buildPinList(stmts.listPinnedMessages?.all?.(conversationId) || []);
+  }
+  // Orders the pin lists a browser receives. A conversation load that left
+  // before a pin change can arrive after the change's own socket event; with
+  // the revision the browser can tell the older list from the newer one. In
+  // memory only: a restart starts above every revision handed out before.
+  const pinRevisionFloor = Date.now();
+  const pinRevisionByConversation = new Map();
+  function conversationPinRevision(conversationId) {
+    return pinRevisionByConversation.get(conversationId) || pinRevisionFloor;
+  }
+  function bumpConversationPinRevision(conversationId) {
+    const next = Math.max(Date.now(), conversationPinRevision(conversationId) + 1);
+    pinRevisionByConversation.set(conversationId, next);
+    return next;
+  }
   const listSessionWorkerQueueRows = db.prepare(`
     SELECT id, conversation_id, runtime_session_id, owner_sdk_session_id, status
     FROM queue
@@ -2712,7 +2734,9 @@ export function registerSessionsRoutes(app, deps) {
     });
     messages = messages.map((message) => {
       const sourceMessageId = responseMessageToSourceId.get(String(message.id || '').trim()) || message.sourceMessageId || undefined;
-      const withSource = sourceMessageId ? { ...message, sourceMessageId } : message;
+      // Pins are the owner's bookmarks: a public share never learns of them.
+      const { pinned: _pinned, ...unpinnedMessage } = message;
+      const withSource = sourceMessageId ? { ...unpinnedMessage, sourceMessageId } : unpinnedMessage;
       // A public share never shows another relay's address or ids.
       const nextMessage = withSource.origin
         ? { ...withSource, origin: publicRemoteRelayOrigin(withSource.origin) }
@@ -3600,6 +3624,9 @@ export function registerSessionsRoutes(app, deps) {
       cloud: conversationCloudPayload(conv, runtimeSession),
       messages: history.messages,
       pageInfo: history.pageInfo,
+      // A re-import can move a pin onto a new message id.
+      pins: listConversationPins(conversationId),
+      pinsRevision: conversationPinRevision(conversationId),
       refreshed: true,
     });
   });
@@ -3777,20 +3804,14 @@ export function registerSessionsRoutes(app, deps) {
     if (!file) return res.status(404).json({ error: 'Shared attachment not found' });
     const filePath = uploadPathForSha(sha256);
     if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Missing file on disk' });
-    // Unauthenticated share viewers: neutralize executable types (HTML/SVG),
-    // force nosniff + sandbox so an attachment can't run as script on this origin.
-    res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
+    // Unauthenticated share viewers: the serving helper neutralizes executable
+    // types (HTML/SVG) and forces nosniff + sandbox so an attachment can't run
+    // as script on this origin; ranges let a shared video seek.
     res.setHeader('X-Robots-Tag', 'noindex, nofollow, noarchive');
-    applySafeServedContentHeaders(res, file.mime_type, { fileName: file.name || file.file_name || '' });
-    const stream = fs.createReadStream(filePath);
-    stream.on('error', () => {
-      if (!res.headersSent) {
-        res.status(500).json({ error: 'Failed to stream shared attachment' });
-        return;
-      }
-      res.destroy();
+    serveFileWithRangeSupport(req, res, filePath, { contentType: file.mime_type }, {
+      safeName: String(file.name || file.file_name || '').replace(/"/g, ''),
+      cacheControl: SHARED_CONTENT_CACHE_CONTROL,
     });
-    stream.pipe(res);
   });
 
   app.get('/api/shared/:token/generated-image/:messageId/:imageId/content', (req, res) => {
@@ -3832,18 +3853,10 @@ export function registerSessionsRoutes(app, deps) {
       return res.status(404).json({ error: 'Shared attachment not found' });
     }
     if (!fs.existsSync(filePath)) return res.status(404).json({ error: 'Shared attachment not found' });
-    res.setHeader('Cache-Control', 'private, max-age=31536000, immutable');
     res.setHeader('X-Robots-Tag', 'noindex, nofollow, noarchive');
-    applySafeServedContentHeaders(res, attachment.type);
-    const stream = fs.createReadStream(filePath);
-    stream.on('error', () => {
-      if (!res.headersSent) {
-        res.status(500).json({ error: 'Failed to stream shared attachment' });
-        return;
-      }
-      res.destroy();
+    serveFileWithRangeSupport(req, res, filePath, { contentType: attachment.type }, {
+      cacheControl: SHARED_CONTENT_CACHE_CONTROL,
     });
-    stream.pipe(res);
   });
 
   // GET /api/conversation/:id — get paginated conversation history
@@ -4000,6 +4013,9 @@ export function registerSessionsRoutes(app, deps) {
       backgroundTasks: backgroundTaskStore?.get?.(resolvedConversationId) || [],
       usageLimitPause: usageLimitPauseService?.getPause?.(resolvedConversationId) || null,
       previews: listConversationPreviews?.(resolvedConversationId) || [],
+      // Every pin of the conversation, also those outside this history page.
+      pins: listConversationPins(resolvedConversationId),
+      pinsRevision: conversationPinRevision(resolvedConversationId),
       preferredRelayMode: preferences.preferredRelayMode,
       preferredModel: preferences.preferredModel,
       preferredReasoningEffort: preferences.preferredReasoningEffort,
@@ -4059,6 +4075,57 @@ export function registerSessionsRoutes(app, deps) {
     });
   });
 
+  // Pin or unpin one message. Unlike share visibility this may change while
+  // the message's turn runs (nothing public depends on it), and every open
+  // client learns of it through the socket instead of reloading.
+  app.patch('/api/conversation/:id/message/:messageId/pin', auth, (req, res) => {
+    const conversationId = String(req.params.id || '').trim();
+    const messageId = String(req.params.messageId || '').trim();
+    if (!conversationId || !messageId) {
+      return res.status(400).json({ error: 'Missing conversation or message id' });
+    }
+    if (typeof req.body?.pinned !== 'boolean') {
+      return res.status(400).json({ error: 'pinned must be a boolean' });
+    }
+
+    const conv = stmts.getConvAnyStatus.get(conversationId);
+    if (!conv || String(conv.status || '').trim().toLowerCase() === 'deleted') {
+      return res.status(404).json({ error: 'Conversation not found' });
+    }
+    const message = stmts.getMessageByConversation?.get(messageId, conversationId) || null;
+    if (!message) return res.status(404).json({ error: 'Message not found' });
+    if (!stmts.setMessagePinnedAt || !stmts.countPinnedMessages) {
+      return res.status(503).json({ error: 'Pinning messages is unavailable until the relay restarts' });
+    }
+
+    const pinned = req.body.pinned === true;
+    const currentlyPinned = !!message.pinned_at;
+    if (currentlyPinned !== pinned) {
+      if (pinned && Number(stmts.countPinnedMessages.get(conversationId)?.cnt || 0) >= MESSAGE_PIN_LIMIT) {
+        return res.status(409).json({
+          error: `This conversation already has ${MESSAGE_PIN_LIMIT} pinned messages. Unpin one first.`,
+          code: 'pin-limit',
+          limit: MESSAGE_PIN_LIMIT,
+        });
+      }
+      stmts.setMessagePinnedAt.run(pinned ? new Date().toISOString() : null, messageId, conversationId);
+    }
+
+    const pins = listConversationPins(conversationId);
+    if (currentlyPinned !== pinned) {
+      const revision = bumpConversationPinRevision(conversationId);
+      io?.emit?.('conversation_pins_updated', { conversationId, pins, revision });
+    }
+    return res.json({
+      ok: true,
+      conversationId,
+      messageId,
+      pinned,
+      pins,
+      pinsRevision: conversationPinRevision(conversationId),
+    });
+  });
+
   app.patch('/api/conversation/:id', auth, (req, res) => {
     const conversationId = String(req.params.id || '').trim();
     const result = persistConversationTitle({
@@ -5461,6 +5528,7 @@ export function registerSessionsRoutes(app, deps) {
         reconnectAttempts: runtimeState.cloudflaredTunnelState?.reconnectAttempts ?? 0,
         connectedSince: runtimeState.cloudflaredTunnelState?.connectedSince ?? null,
         lastError: runtimeState.cloudflaredTunnelState?.lastError ?? null,
+        binaryMissing: runtimeState.cloudflaredTunnelState?.binaryMissing ?? false,
         valid: runtimeState.cloudflaredTunnelState?.valid ?? true,
       },
       workerWebSocket: runtimeState.workerWebSocketStatus || null,

package/server/server-runtime.mjs

@@ -24,6 +24,7 @@ import {
   normalizeWorkspaceRootKey,
 } from './services/workspace-root-path-policy.mjs';
 import { stopSessionWorkerProcesses } from './services/session-worker-stop-service.mjs';
+import { applyCdnNoStoreHeaders } from './services/file-serving.mjs';
 import { pickLiveTurnRowId } from './services/live-turn-picker.mjs';
 import { buildSteerSettleFailure, steerAgentLabelForProvider } from '../shared/steer-settle-failure.mjs';
 import { sanitizeRelayQuestionContext as sanitizeRelayQuestionContextWith } from './services/relay-question-context.mjs';
@@ -1510,6 +1511,17 @@ const WORKSPACE_CONTENT_TYPES = Object.freeze({
   '.gif': 'image/gif',
   '.webp': 'image/webp',
   '.ico': 'image/x-icon',
+  '.bmp': 'image/bmp',
+  '.avif': 'image/avif',
+  '.mp3': 'audio/mpeg',
+  '.wav': 'audio/wav',
+  '.m4a': 'audio/mp4',
+  '.aac': 'audio/aac',
+  '.ogg': 'audio/ogg',
+  '.oga': 'audio/ogg',
+  '.opus': 'audio/ogg',
+  '.flac': 'audio/flac',
+  '.weba': 'audio/webm',
   '.mp4': 'video/mp4',
   '.m4v': 'video/mp4',
   '.mov': 'video/quicktime',
@@ -1650,6 +1662,7 @@ const WORKSPACE_CODE_EXTENSIONS = new Set(Object.keys(WORKSPACE_PREVIEW_LANGUAGE
   .filter((ext) => !WORKSPACE_MARKDOWN_EXTENSIONS.has(ext)));
 const WORKSPACE_IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg', '.ico', '.bmp', '.avif']);
 const WORKSPACE_VIDEO_EXTENSIONS = new Set(['.mp4', '.m4v', '.mov', '.webm', '.mkv', '.avi', '.ogv', '.wmv']);
+const WORKSPACE_AUDIO_EXTENSIONS = new Set(['.mp3', '.wav', '.m4a', '.aac', '.ogg', '.oga', '.opus', '.flac', '.weba']);
 const REPO_HEAVY_DIR_NAMES = new Set(['.git', 'node_modules']);
 const MAX_REPO_TREE_NODES = 20_000;
 const MAX_REPO_TREE_DEPTH = 64;
@@ -4148,6 +4161,7 @@ function readWorkspaceFileMeta(filePath) {
   return cacheWorkspaceFileMeta(filePath, {
     kind: 'file',
     size: Number(stat.size || 0),
+    mtimeMs: Number(stat.mtimeMs || 0),
     contentType: workspaceContentType(filePath),
   });
 }
@@ -4214,6 +4228,8 @@ function workspacePreviewKindForMeta(filePath, contentType) {
   if (WORKSPACE_MARKDOWN_EXTENSIONS.has(normalizedExt)) return 'markdown';
   if (WORKSPACE_IMAGE_EXTENSIONS.has(normalizedExt) || normalizedType.startsWith('image/')) return 'image';
   if (WORKSPACE_VIDEO_EXTENSIONS.has(normalizedExt) || normalizedType.startsWith('video/')) return 'video';
+  if (WORKSPACE_AUDIO_EXTENSIONS.has(normalizedExt) || normalizedType.startsWith('audio/')) return 'audio';
+  if (normalizedExt === '.pdf' || normalizedType === 'application/pdf') return 'pdf';
   if (WORKSPACE_CODE_EXTENSIONS.has(normalizedExt) || WORKSPACE_PREVIEW_LANGUAGE_BY_FILENAME[filename]) return 'code';
   if (isLikelyTextContentType(normalizedType)) return 'text';
   return 'binary';
@@ -6341,6 +6357,10 @@ app.use((req, _res, next) => {
   stripRequestPathPrefix(req, remotePath);
   next();
 });
+function isApiRequestPath(requestPath) {
+  return /^\/api(?:\/|$)/.test(String(requestPath || ''));
+}
+
 // Baseline security headers on every response. Served-file/attachment endpoints
 // layer a stricter sandbox CSP on top (see applySafeServedContentHeaders). A
 // global script-src CSP is intentionally omitted for now: the SPA relies on
@@ -6349,6 +6369,14 @@ app.use((req, res, next) => {
   res.setHeader('X-Content-Type-Options', 'nosniff');
   res.setHeader('X-Frame-Options', 'SAMEORIGIN');
   res.setHeader('Referrer-Policy', 'no-referrer');
+  // Nothing this relay answers belongs in a CDN's cache: it is all behind a
+  // login. These two headers bind the edge itself, whatever cache rule the
+  // zone in front of a tunnel has.
+  applyCdnNoStoreHeaders(res);
+  // An API answer is never stored by default, errors included (a 404 or a
+  // 401 for a file must not outlive the file's absence). A route that
+  // serves content-addressed bytes sets its own, longer-lived value.
+  if (isApiRequestPath(req.path)) res.setHeader('Cache-Control', 'no-store');
   next();
 });
 app.get('/socket.io/socket.io.js', (req, res, next) => {
@@ -6552,6 +6580,7 @@ const sharedRouteDeps = {
   compareRepoDirEntries,
   shouldSkipRepoEntryName,
   readWorkspaceFileMeta,
+  workspaceFileMetaCache,
   resolveWorkspaceFilePath,
   normalizeWorkspaceRelativePath,
   previewLanguageForWorkspaceFile,