@pixelbyte-software/pixcode 1.54.0 → 1.54.1

package/dist-server/server/routes/auth.js

@@ -1,11 +1,10 @@
 import express from 'express';
-// bcryptjs is a pure-JS drop-in (same hash/compare API, same output format)
-// — switching from native `bcrypt` here eliminated one C++ compile from
-// the install path. Existing $2a$/$2b$ hashes in the DB remain valid;
-// bcryptjs recognizes both prefixes so logins work across the swap.
 import bcrypt from 'bcryptjs';
 import { userDb, db } from '../database/db.js';
 import { generateToken, authenticateToken, requireAdmin } from '../middleware/auth.js';
+import { authRateLimiter } from '../middleware/rate-limiter.js';
+import { checkAccountLockout, recordFailedLogin, recordSuccessfulLogin, validatePasswordPolicy, validateUsername, } from '../middleware/account-lockout.js';
+import { securityLog, getClientIp } from '../utils/security-log.js';
 import { consumeQrLoginToken, createQrLoginToken, getQrLoginSettings, saveQrLoginSettings, } from '../services/qr-login.js';
 import { getPublicRemoteConnectionConfig, saveRemoteConnectionConfig, } from '../services/remote-connection.js';
 const router = express.Router();
@@ -36,7 +35,10 @@ router.get('/status', async (req, res) => {
 router.get('/connection-mode', (req, res) => {
     res.json({ success: true, connection: getPublicRemoteConnectionConfig() });
 });
-router.put('/connection-mode', (req, res) => {
+// Changing the connection mode is a state-changing operation that must
+// require authentication. Without auth, any unauthenticated caller could
+// redirect the app to a malicious remote server.
+router.put('/connection-mode', authenticateToken, requireAdmin, (req, res) => {
     try {
         res.json({ success: true, connection: saveRemoteConnectionConfig(req.body || {}) });
     }
@@ -55,7 +57,7 @@ router.put('/qr-login/settings', authenticateToken, requireAdmin, (req, res) =>
         res.status(400).json({ success: false, error: error.message });
     }
 });
-router.post('/qr-login/token', authenticateToken, requireAdmin, (req, res) => {
+router.post('/qr-login/token', authenticateToken, requireAdmin, authRateLimiter, (req, res) => {
     try {
         const baseUrl = typeof req.body?.baseUrl === 'string' && req.body.baseUrl.trim()
             ? req.body.baseUrl.trim()
@@ -67,11 +69,16 @@ router.post('/qr-login/token', authenticateToken, requireAdmin, (req, res) => {
         res.status(status).json({ success: false, error: error.message });
     }
 });
-router.post('/qr-login', (req, res) => {
+router.post('/qr-login', authRateLimiter, (req, res) => {
     try {
         const user = consumeQrLoginToken(req.body?.token);
         const token = generateToken(user);
         userDb.updateLastLogin(user.id);
+        securityLog('qr_login_success', {
+            ip: getClientIp(req),
+            userId: user.id,
+            username: user.username,
+        });
         res.json({
             success: true,
             user: publicUser(user),
@@ -80,19 +87,29 @@ router.post('/qr-login', (req, res) => {
     }
     catch (error) {
         const status = error?.code === 'QR_LOGIN_DISABLED' ? 409 : 401;
+        securityLog('qr_login_failed', {
+            ip: getClientIp(req),
+            reason: error?.code || 'unknown',
+        });
         res.status(status).json({ success: false, error: error.message });
     }
 });
 // User registration (setup) - only allowed if no users exist
-router.post('/register', async (req, res) => {
+router.post('/register', authRateLimiter, async (req, res) => {
     try {
         const { username, password } = req.body;
+        const clientIp = getClientIp(req);
         // Validate input
         if (!username || !password) {
             return res.status(400).json({ error: 'Username and password are required' });
         }
-        if (username.length < 3 || password.length < 6) {
-            return res.status(400).json({ error: 'Username must be at least 3 characters, password at least 6 characters' });
+        const usernameValidation = validateUsername(username);
+        if (!usernameValidation.valid) {
+            return res.status(400).json({ error: usernameValidation.error });
+        }
+        const passwordValidation = validatePasswordPolicy(password);
+        if (!passwordValidation.valid) {
+            return res.status(400).json({ error: passwordValidation.error });
         }
         // Use a transaction to prevent race conditions
         db.prepare('BEGIN').run();
@@ -113,6 +130,11 @@ router.post('/register', async (req, res) => {
             db.prepare('COMMIT').run();
             // Update last login (non-fatal, outside transaction)
             userDb.updateLastLogin(user.id);
+            securityLog('user_registered', {
+                ip: clientIp,
+                userId: user.id,
+                username: user.username,
+            });
             res.json({
                 success: true,
                 user: publicUser(user),
@@ -135,27 +157,64 @@ router.post('/register', async (req, res) => {
     }
 });
 // User login
-router.post('/login', async (req, res) => {
+router.post('/login', authRateLimiter, async (req, res) => {
     try {
         const { username, password } = req.body;
+        const clientIp = getClientIp(req);
         // Validate input
         if (!username || !password) {
             return res.status(400).json({ error: 'Username and password are required' });
         }
+        // Check account lockout before attempting login
+        const lockoutStatus = checkAccountLockout(String(username), clientIp);
+        if (lockoutStatus.locked) {
+            securityLog('login_blocked_locked', {
+                ip: clientIp,
+                username,
+                reason: 'Account locked due to failed attempts',
+            });
+            return res.status(423).json({ error: lockoutStatus.message });
+        }
         // Get user from database
         const user = userDb.getUserByUsername(username);
         if (!user) {
+            const failResult = recordFailedLogin(String(username), clientIp);
+            securityLog('login_failed', {
+                ip: clientIp,
+                username,
+                reason: 'User not found',
+            });
+            if (failResult.locked) {
+                return res.status(423).json({ error: failResult.message });
+            }
             return res.status(401).json({ error: 'Invalid username or password' });
         }
         // Verify password
         const isValidPassword = await bcrypt.compare(password, user.password_hash);
         if (!isValidPassword) {
+            const failResult = recordFailedLogin(String(username), clientIp);
+            securityLog('login_failed', {
+                ip: clientIp,
+                username,
+                userId: user.id,
+                reason: 'Invalid password',
+            });
+            if (failResult.locked) {
+                return res.status(423).json({ error: failResult.message });
+            }
             return res.status(401).json({ error: 'Invalid username or password' });
         }
+        // Clear failed attempts on successful login
+        recordSuccessfulLogin(String(username), clientIp);
         // Generate token
         const token = generateToken(user);
         // Update last login
         userDb.updateLastLogin(user.id);
+        securityLog('login_success', {
+            ip: clientIp,
+            userId: user.id,
+            username: user.username,
+        });
         res.json({
             success: true,
             user: publicUser(user),
@@ -175,8 +234,11 @@ router.get('/user', authenticateToken, (req, res) => {
 });
 // Logout (client-side token removal, but this endpoint can be used for logging)
 router.post('/logout', authenticateToken, (req, res) => {
-    // In a simple JWT system, logout is mainly client-side
-    // This endpoint exists for consistency and potential future logging
+    securityLog('user_logout', {
+        ip: getClientIp(req),
+        userId: req.user?.id,
+        username: req.user?.username,
+    });
     res.json({ success: true, message: 'Logged out successfully' });
 });
 export default router;

package/dist-server/server/routes/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../server/routes/auth.js"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,4EAA4E;AAC5E,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,OAAO,MAAM,MAAM,UAAU,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAEhC,SAAS,UAAU,CAAC,IAAI;IACtB,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,CAAC,QAAQ;YACrB,eAAe,EAAE,KAAK,CAAC,iDAAiD;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,yEAAyE;AACzE,6EAA6E;AAC7E,2CAA2C;AAC3C,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,+BAA+B,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC1C,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,0BAA0B,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC7E,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAC9E,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YACzB,CAAC,CAAC,IAAI,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACpC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;YACtB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAExC,iBAAiB;QACjB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wEAAwE,EAAE,CAAC,CAAC;QACnH,CAAC;QAED,+CAA+C;QAC/C,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,QAAQ,EAAE,CAAC;gBACb,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC7B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uEAAuE,EAAE,CAAC,CAAC;YAClH,CAAC;YAED,gBAAgB;YAChB,MAAM,UAAU,GAAG,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAE7D,cAAc;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAE1E,iBAAiB;YACjB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAElC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;YAE3B,qDAAqD;YACrD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEhC,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;gBACtB,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC;QACd,CAAC;IAEH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,aAAa;AACb,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAExC,iBAAiB;QACjB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,yBAAyB;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,kBAAkB;QAClB,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,iBAAiB;QACjB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAElC,oBAAoB;QACpB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhC,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;YACtB,KAAK;SACN,CAAC,CAAC;IAEL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,qCAAqC;AACrC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAClD,GAAG,CAAC,IAAI,CAAC;QACP,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACrD,uDAAuD;IACvD,oEAAoE;IACpE,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../server/routes/auth.js"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,MAAM,MAAM,UAAU,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,GACjB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAEhC,SAAS,UAAU,CAAC,IAAI;IACtB,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ;KAC5B,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC;YACP,UAAU,EAAE,CAAC,QAAQ;YACrB,eAAe,EAAE,KAAK,CAAC,iDAAiD;SACzE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,yEAAyE;AACzE,6EAA6E;AAC7E,2CAA2C;AAC3C,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,+BAA+B,EAAE,EAAE,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEH,uEAAuE;AACvE,yEAAyE;AACzE,iDAAiD;AACjD,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC3E,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,0BAA0B,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC9E,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC7E,IAAI,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,mBAAmB,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC5F,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAC9E,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YACzB,CAAC,CAAC,IAAI,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACrD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChC,WAAW,CAAC,kBAAkB,EAAE;YAC9B,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC;YACpB,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;YACtB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,EAAE,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/D,WAAW,CAAC,iBAAiB,EAAE;YAC7B,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC;YACpB,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS;SACjC,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IAC3D,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAElC,iBAAiB;QACjB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,+CAA+C;QAC/C,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,2EAA2E;YAC3E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,QAAQ,EAAE,CAAC;gBACb,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC7B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uEAAuE,EAAE,CAAC,CAAC;YAClH,CAAC;YAED,gBAAgB;YAChB,MAAM,UAAU,GAAG,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAE7D,cAAc;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAE1E,iBAAiB;YACjB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YAElC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC;YAE3B,qDAAqD;YACrD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAEhC,WAAW,CAAC,iBAAiB,EAAE;gBAC7B,EAAE,EAAE,QAAQ;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YAEH,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;gBACtB,KAAK;aACN,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,KAAK,CAAC;QACd,CAAC;IAEH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,aAAa;AACb,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACxD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QACxC,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAElC,iBAAiB;QACjB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,gDAAgD;QAChD,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;YACzB,WAAW,CAAC,sBAAsB,EAAE;gBAClC,EAAE,EAAE,QAAQ;gBACZ,QAAQ;gBACR,MAAM,EAAE,uCAAuC;aAChD,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,yBAAyB;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;YACjE,WAAW,CAAC,cAAc,EAAE;gBAC1B,EAAE,EAAE,QAAQ;gBACZ,QAAQ;gBACR,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,kBAAkB;QAClB,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;YACjE,WAAW,CAAC,cAAc,EAAE;gBAC1B,EAAE,EAAE,QAAQ;gBACZ,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,kBAAkB;aAC3B,CAAC,CAAC;YACH,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;gBACtB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,4CAA4C;QAC5C,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAElD,iBAAiB;QACjB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAElC,oBAAoB;QACpB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEhC,WAAW,CAAC,eAAe,EAAE;YAC3B,EAAE,EAAE,QAAQ;YACZ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC;YACtB,KAAK;SACN,CAAC,CAAC;IAEL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,qCAAqC;AACrC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAClD,GAAG,CAAC,IAAI,CAAC;QACP,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACrD,WAAW,CAAC,aAAa,EAAE;QACzB,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC;QACpB,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE;QACpB,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ;KAC7B,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist-server/server/routes/codex.js

@@ -11,7 +11,7 @@ router.delete('/sessions/:sessionId', async (req, res) => {
     }
     catch (error) {
         console.error(`Error deleting Codex session ${req.params.sessionId}:`, error);
-        res.status(500).json({ success: false, error: error.message });
+        res.status(500).json({ success: false, error: "Internal server error" });
     }
 });
 export default router;

package/dist-server/server/routes/codex.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../server/routes/codex.js"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAEhC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACpC,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../server/routes/codex.js"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAEhC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACpC,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist-server/server/routes/diagnostics.js

@@ -1,5 +1,6 @@
 import express from 'express';
 import { collectDiagnostics } from '../services/diagnostics.js';
+import { requireAdmin } from '../middleware/auth.js';
 const router = express.Router();
 function buildDiagnostics(req) {
     return collectDiagnostics({
@@ -12,10 +13,12 @@ function buildDiagnostics(req) {
         cache: req.app.locals.diagnosticsCache || {},
     });
 }
-router.get('/', (req, res) => {
+// Diagnostics expose internal system state (active sessions, errors,
+// provider health) — restrict to admins to prevent information leakage.
+router.get('/', requireAdmin, (req, res) => {
     res.json(buildDiagnostics(req));
 });
-router.post('/refresh', (req, res) => {
+router.post('/refresh', requireAdmin, (req, res) => {
     req.app.locals.diagnosticsCache = {
         ...(req.app.locals.diagnosticsCache || {}),
         diagnosticsUpdatedAt: new Date().toISOString(),
@@ -23,7 +26,7 @@ router.post('/refresh', (req, res) => {
     };
     res.json(buildDiagnostics(req));
 });
-router.get('/bundle', (req, res) => {
+router.get('/bundle', requireAdmin, (req, res) => {
     const diagnostics = buildDiagnostics(req);
     res.json({
         generatedAt: diagnostics.timestamp,

package/dist-server/server/routes/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../../server/routes/diagnostics.js"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAEhC,SAAS,gBAAgB,CAAC,GAAG;IAC3B,OAAO,kBAAkB,CAAC;QACxB,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW;QACvC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa;QAC3C,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QACvB,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE;QAC3C,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE;QAC/C,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE;QACnD,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC3B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACnC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,GAAG;QAChC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAC1C,oBAAoB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9C,aAAa,EAAE,IAAI;KACpB,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACjC,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC;QACP,WAAW,EAAE,WAAW,CAAC,SAAS;QAClC,QAAQ,EAAE,IAAI;QACd,WAAW;KACZ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../../server/routes/diagnostics.js"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAEhC,SAAS,gBAAgB,CAAC,GAAG;IAC3B,OAAO,kBAAkB,CAAC;QACxB,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW;QACvC,aAAa,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa;QAC3C,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG;QACvB,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE;QAC3C,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE;QAC/C,cAAc,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE;QACnD,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,wEAAwE;AACxE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACzC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACjD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,GAAG;QAChC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAC1C,oBAAoB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9C,aAAa,EAAE,IAAI;KACpB,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AAClC,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IAC/C,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC;QACP,WAAW,EAAE,WAAW,CAAC,SAAS;QAClC,QAAQ,EAAE,IAAI;QACd,WAAW;KACZ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist-server/server/routes/gemini.js

@@ -14,7 +14,7 @@ router.delete('/sessions/:sessionId', async (req, res) => {
     }
     catch (error) {
         console.error(`Error deleting Gemini session ${req.params.sessionId}:`, error);
-        res.status(500).json({ success: false, error: error.message });
+        res.status(500).json({ success: false, error: "Internal server error" });
     }
 });
 export default router;

package/dist-server/server/routes/gemini.js.map

@@ -1 +1 @@
-{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../../server/routes/gemini.js"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAEhC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACrD,IAAI,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEjC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5F,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9C,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}
+{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../../../server/routes/gemini.js"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AAE9B,OAAO,cAAc,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;AAEhC,MAAM,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACrD,IAAI,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEjC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5F,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC9C,cAAc,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;IAC7E,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,eAAe,MAAM,CAAC"}

package/dist-server/server/routes/git.js

@@ -752,7 +752,7 @@ router.post('/initial-commit', async (req, res) => {
                 details: 'No files found in the repository. Add some files first.'
             });
         }
-        res.status(500).json({ error: error.message });
+        res.status(500).json({ error: "Internal server error" });
     }
 });
 // Commit changes
@@ -777,7 +777,7 @@ router.post('/commit', async (req, res) => {
     }
     catch (error) {
         console.error('Git commit error:', error);
-        res.status(500).json({ error: error.message });
+        res.status(500).json({ error: "Internal server error" });
     }
 });
 // Revert latest local commit (keeps changes staged)
@@ -819,7 +819,7 @@ router.post('/revert-local-commit', async (req, res) => {
     }
     catch (error) {
         console.error('Git revert local commit error:', error);
-        res.status(500).json({ error: error.message });
+        res.status(500).json({ error: "Internal server error" });
     }
 });
 // Get list of branches
@@ -872,7 +872,7 @@ router.post('/checkout', async (req, res) => {
     }
     catch (error) {
         console.error('Git checkout error:', error);
-        res.status(500).json({ error: error.message });
+        res.status(500).json({ error: "Internal server error" });
     }
 });
 // Create new branch
@@ -890,7 +890,7 @@ router.post('/create-branch', async (req, res) => {
     }
     catch (error) {
         console.error('Git create branch error:', error);
-        res.status(500).json({ error: error.message });
+        res.status(500).json({ error: "Internal server error" });
     }
 });
 // Delete a local branch
@@ -912,7 +912,7 @@ router.post('/delete-branch', async (req, res) => {
     }
     catch (error) {
         console.error('Git delete branch error:', error);
-        res.status(500).json({ error: error.message });
+        res.status(500).json({ error: "Internal server error" });
     }
 });
 // Get recent commits
@@ -1038,7 +1038,7 @@ router.post('/generate-commit-message', async (req, res) => {
     }
     catch (error) {
         console.error('Generate commit message error:', error);
-        res.status(500).json({ error: error.message });
+        res.status(500).json({ error: "Internal server error" });
     }
 });
 /**
@@ -1513,7 +1513,7 @@ router.post('/discard', async (req, res) => {
     }
     catch (error) {
         console.error('Git discard error:', error);
-        res.status(500).json({ error: error.message });
+        res.status(500).json({ error: "Internal server error" });
     }
 });
 // Delete untracked file
@@ -1550,7 +1550,7 @@ router.post('/delete-untracked', async (req, res) => {
     }
     catch (error) {
         console.error('Git delete untracked error:', error);
-        res.status(500).json({ error: error.message });
+        res.status(500).json({ error: "Internal server error" });
     }
 });
 export default router;