@sandagent/daemon 0.9.7 → 0.9.9

package/dist/index.js

@@ -42939,7 +42939,7 @@ var require_verify_stream = __commonJS({
     function isObject(thing) {
       return Object.prototype.toString.call(thing) === "[object Object]";
     }
-    function safeJsonParse(thing) {
+    function safeJsonParse2(thing) {
       if (isObject(thing))
         return thing;
       try {
@@ -42950,7 +42950,7 @@ var require_verify_stream = __commonJS({
     }
     function headerFromJWS(jwsSig) {
       var encodedHeader = jwsSig.split(".", 1)[0];
-      return safeJsonParse(Buffer4.from(encodedHeader, "base64").toString("binary"));
+      return safeJsonParse2(Buffer4.from(encodedHeader, "base64").toString("binary"));
     }
     function securedInputFromJWS(jwsSig) {
       return jwsSig.split(".", 2).join(".");
@@ -74905,7 +74905,7 @@ var require_encodings = __commonJS({
       });
       return out;
     }
-    function formEncoder(sep6) {
+    function formEncoder(sep7) {
       return (key, value2, options2) => {
         let out = "";
         const pairs = options2?.explode ? explode(key, value2) : [[key, value2]];
@@ -74916,7 +74916,7 @@ var require_encodings = __commonJS({
           return options2?.charEncoding === "percent" ? encodeURIComponent(v2) : v2;
         };
         const encodeValue = (v2) => encodeString(serializeValue(v2));
-        const encodedSep = encodeString(sep6);
+        const encodedSep = encodeString(sep7);
         pairs.forEach(([pk, pv]) => {
           let tmp = "";
           let encValue = null;
@@ -164390,10 +164390,10 @@ var require_resolve_block_map = __commonJS({
       let offset = bm.offset;
       let commentEnd = null;
       for (const collItem of bm.items) {
-        const { start, key, sep: sep6, value: value2 } = collItem;
+        const { start, key, sep: sep7, value: value2 } = collItem;
         const keyProps = resolveProps.resolveProps(start, {
           indicator: "explicit-key-ind",
-          next: key ?? sep6?.[0],
+          next: key ?? sep7?.[0],
           offset,
           onError: onError2,
           parentIndent: bm.indent,
@@ -164407,7 +164407,7 @@ var require_resolve_block_map = __commonJS({
             else if ("indent" in key && key.indent !== bm.indent)
               onError2(offset, "BAD_INDENT", startColMsg);
           }
-          if (!keyProps.anchor && !keyProps.tag && !sep6) {
+          if (!keyProps.anchor && !keyProps.tag && !sep7) {
             commentEnd = keyProps.end;
             if (keyProps.comment) {
               if (map3.comment)
@@ -164431,7 +164431,7 @@ var require_resolve_block_map = __commonJS({
         ctx.atKey = false;
         if (utilMapIncludes.mapIncludes(ctx, map3.items, keyNode))
           onError2(keyStart, "DUPLICATE_KEY", "Map keys must be unique");
-        const valueProps = resolveProps.resolveProps(sep6 ?? [], {
+        const valueProps = resolveProps.resolveProps(sep7 ?? [], {
           indicator: "map-value-ind",
           next: value2,
           offset: keyNode.range[2],
@@ -164447,7 +164447,7 @@ var require_resolve_block_map = __commonJS({
             if (ctx.options.strict && keyProps.start < valueProps.found.offset - 1024)
               onError2(keyNode.range, "KEY_OVER_1024_CHARS", "The : indicator must be at most 1024 chars after the start of an implicit block mapping key");
           }
-          const valueNode = value2 ? composeNode(ctx, value2, valueProps, onError2) : composeEmptyNode(ctx, offset, sep6, null, valueProps, onError2);
+          const valueNode = value2 ? composeNode(ctx, value2, valueProps, onError2) : composeEmptyNode(ctx, offset, sep7, null, valueProps, onError2);
           if (ctx.schema.compat)
             utilFlowIndentCheck.flowIndentCheck(bm.indent, value2, onError2);
           offset = valueNode.range[2];
@@ -164538,7 +164538,7 @@ var require_resolve_end = __commonJS({
       let comment = "";
       if (end) {
         let hasSpace = false;
-        let sep6 = "";
+        let sep7 = "";
         for (const token of end) {
           const { source, type } = token;
           switch (type) {
@@ -164552,13 +164552,13 @@ var require_resolve_end = __commonJS({
               if (!comment)
                 comment = cb;
               else
-                comment += sep6 + cb;
-              sep6 = "";
+                comment += sep7 + cb;
+              sep7 = "";
               break;
             }
             case "newline":
               if (comment)
-                sep6 += source;
+                sep7 += source;
               hasSpace = true;
               break;
             default:
@@ -164601,18 +164601,18 @@ var require_resolve_flow_collection = __commonJS({
       let offset = fc.offset + fc.start.source.length;
       for (let i2 = 0; i2 < fc.items.length; ++i2) {
         const collItem = fc.items[i2];
-        const { start, key, sep: sep6, value: value2 } = collItem;
+        const { start, key, sep: sep7, value: value2 } = collItem;
         const props = resolveProps.resolveProps(start, {
           flow: fcName,
           indicator: "explicit-key-ind",
-          next: key ?? sep6?.[0],
+          next: key ?? sep7?.[0],
           offset,
           onError: onError2,
           parentIndent: fc.indent,
           startOnNewline: false
         });
         if (!props.found) {
-          if (!props.anchor && !props.tag && !sep6 && !value2) {
+          if (!props.anchor && !props.tag && !sep7 && !value2) {
             if (i2 === 0 && props.comma)
               onError2(props.comma, "UNEXPECTED_TOKEN", `Unexpected , in ${fcName}`);
             else if (i2 < fc.items.length - 1)
@@ -164666,8 +164666,8 @@ var require_resolve_flow_collection = __commonJS({
             }
           }
         }
-        if (!isMap && !sep6 && !props.found) {
-          const valueNode = value2 ? composeNode(ctx, value2, props, onError2) : composeEmptyNode(ctx, props.end, sep6, null, props, onError2);
+        if (!isMap && !sep7 && !props.found) {
+          const valueNode = value2 ? composeNode(ctx, value2, props, onError2) : composeEmptyNode(ctx, props.end, sep7, null, props, onError2);
           coll.items.push(valueNode);
           offset = valueNode.range[2];
           if (isBlock(value2))
@@ -164679,7 +164679,7 @@ var require_resolve_flow_collection = __commonJS({
           if (isBlock(key))
             onError2(keyNode.range, "BLOCK_IN_FLOW", blockMsg);
           ctx.atKey = false;
-          const valueProps = resolveProps.resolveProps(sep6 ?? [], {
+          const valueProps = resolveProps.resolveProps(sep7 ?? [], {
             flow: fcName,
             indicator: "map-value-ind",
             next: value2,
@@ -164690,8 +164690,8 @@ var require_resolve_flow_collection = __commonJS({
           });
           if (valueProps.found) {
             if (!isMap && !props.found && ctx.options.strict) {
-              if (sep6)
-                for (const st2 of sep6) {
+              if (sep7)
+                for (const st2 of sep7) {
                   if (st2 === valueProps.found)
                     break;
                   if (st2.type === "newline") {
@@ -164708,7 +164708,7 @@ var require_resolve_flow_collection = __commonJS({
             else
               onError2(valueProps.start, "MISSING_CHAR", `Missing , or : between ${fcName} items`);
           }
-          const valueNode = value2 ? composeNode(ctx, value2, valueProps, onError2) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep6, null, valueProps, onError2) : null;
+          const valueNode = value2 ? composeNode(ctx, value2, valueProps, onError2) : valueProps.found ? composeEmptyNode(ctx, valueProps.end, sep7, null, valueProps, onError2) : null;
           if (valueNode) {
             if (isBlock(value2))
               onError2(valueNode.range, "BLOCK_IN_FLOW", blockMsg);
@@ -164888,7 +164888,7 @@ var require_resolve_block_scalar = __commonJS({
           chompStart = i2 + 1;
       }
       let value2 = "";
-      let sep6 = "";
+      let sep7 = "";
       let prevMoreIndented = false;
       for (let i2 = 0; i2 < contentStart; ++i2)
         value2 += lines[i2][0].slice(trimIndent) + "\n";
@@ -164905,24 +164905,24 @@ var require_resolve_block_scalar = __commonJS({
           indent = "";
         }
         if (type === Scalar.Scalar.BLOCK_LITERAL) {
-          value2 += sep6 + indent.slice(trimIndent) + content;
-          sep6 = "\n";
+          value2 += sep7 + indent.slice(trimIndent) + content;
+          sep7 = "\n";
         } else if (indent.length > trimIndent || content[0] === "	") {
-          if (sep6 === " ")
-            sep6 = "\n";
-          else if (!prevMoreIndented && sep6 === "\n")
-            sep6 = "\n\n";
-          value2 += sep6 + indent.slice(trimIndent) + content;
-          sep6 = "\n";
+          if (sep7 === " ")
+            sep7 = "\n";
+          else if (!prevMoreIndented && sep7 === "\n")
+            sep7 = "\n\n";
+          value2 += sep7 + indent.slice(trimIndent) + content;
+          sep7 = "\n";
           prevMoreIndented = true;
         } else if (content === "") {
-          if (sep6 === "\n")
+          if (sep7 === "\n")
             value2 += "\n";
           else
-            sep6 = "\n";
+            sep7 = "\n";
         } else {
-          value2 += sep6 + content;
-          sep6 = " ";
+          value2 += sep7 + content;
+          sep7 = " ";
           prevMoreIndented = false;
         }
       }
@@ -165104,25 +165104,25 @@ var require_resolve_flow_scalar = __commonJS({
       if (!match2)
         return source;
       let res = match2[1];
-      let sep6 = " ";
+      let sep7 = " ";
       let pos = first.lastIndex;
       line.lastIndex = pos;
       while (match2 = line.exec(source)) {
         if (match2[1] === "") {
-          if (sep6 === "\n")
-            res += sep6;
+          if (sep7 === "\n")
+            res += sep7;
           else
-            sep6 = "\n";
+            sep7 = "\n";
         } else {
-          res += sep6 + match2[1];
-          sep6 = " ";
+          res += sep7 + match2[1];
+          sep7 = " ";
         }
         pos = line.lastIndex;
       }
       const last = /[ \t]*(.*)/sy;
       last.lastIndex = pos;
       match2 = last.exec(source);
-      return res + sep6 + (match2?.[1] ?? "");
+      return res + sep7 + (match2?.[1] ?? "");
     }
     function doubleQuotedValue(source, onError2) {
       let res = "";
@@ -165924,14 +165924,14 @@ var require_cst_stringify = __commonJS({
         }
       }
     }
-    function stringifyItem({ start, key, sep: sep6, value: value2 }) {
+    function stringifyItem({ start, key, sep: sep7, value: value2 }) {
       let res = "";
       for (const st2 of start)
         res += st2.source;
       if (key)
         res += stringifyToken(key);
-      if (sep6)
-        for (const st2 of sep6)
+      if (sep7)
+        for (const st2 of sep7)
           res += st2.source;
       if (value2)
         res += stringifyToken(value2);
@@ -167081,18 +167081,18 @@ var require_parser2 = __commonJS({
         if (this.type === "map-value-ind") {
           const prev = getPrevProps(this.peek(2));
           const start = getFirstKeyStartProps(prev);
-          let sep6;
+          let sep7;
           if (scalar.end) {
-            sep6 = scalar.end;
-            sep6.push(this.sourceToken);
+            sep7 = scalar.end;
+            sep7.push(this.sourceToken);
             delete scalar.end;
           } else
-            sep6 = [this.sourceToken];
+            sep7 = [this.sourceToken];
           const map3 = {
             type: "block-map",
             offset: scalar.offset,
             indent: scalar.indent,
-            items: [{ start, key: scalar, sep: sep6 }]
+            items: [{ start, key: scalar, sep: sep7 }]
           };
           this.onKeyLine = true;
           this.stack[this.stack.length - 1] = map3;
@@ -167245,15 +167245,15 @@ var require_parser2 = __commonJS({
                 } else if (isFlowToken(it2.key) && !includesToken(it2.sep, "newline")) {
                   const start2 = getFirstKeyStartProps(it2.start);
                   const key = it2.key;
-                  const sep6 = it2.sep;
-                  sep6.push(this.sourceToken);
+                  const sep7 = it2.sep;
+                  sep7.push(this.sourceToken);
                   delete it2.key;
                   delete it2.sep;
                   this.stack.push({
                     type: "block-map",
                     offset: this.offset,
                     indent: this.indent,
-                    items: [{ start: start2, key, sep: sep6 }]
+                    items: [{ start: start2, key, sep: sep7 }]
                   });
                 } else if (start.length > 0) {
                   it2.sep = it2.sep.concat(start, this.sourceToken);
@@ -167447,13 +167447,13 @@ var require_parser2 = __commonJS({
             const prev = getPrevProps(parent);
             const start = getFirstKeyStartProps(prev);
             fixFlowSeqItems(fc);
-            const sep6 = fc.end.splice(1, fc.end.length);
-            sep6.push(this.sourceToken);
+            const sep7 = fc.end.splice(1, fc.end.length);
+            sep7.push(this.sourceToken);
             const map3 = {
               type: "block-map",
               offset: fc.offset,
               indent: fc.indent,
-              items: [{ start, key: fc, sep: sep6 }]
+              items: [{ start, key: fc, sep: sep7 }]
             };
             this.onKeyLine = true;
             this.stack[this.stack.length - 1] = map3;
@@ -206435,12 +206435,13 @@ function resolveVolumeRoot(state, volume) {
 }
 function resolveUnderRoot(root, raw) {
   if (!raw.trim()) throw new AppError(400, "empty path");
+  const normalizedRoot = path.resolve(root);
   const normalized = path.normalize(raw);
-  if (path.isAbsolute(normalized) && !normalized.startsWith(root)) {
+  if (path.isAbsolute(normalized) && !normalized.startsWith(normalizedRoot + path.sep) && normalized !== normalizedRoot) {
     throw new AppError(400, `invalid path: ${raw}`);
   }
-  const resolved = path.resolve(root, normalized.replace(/^\/+/, ""));
-  if (!resolved.startsWith(root)) {
+  const resolved = path.resolve(normalizedRoot, normalized.replace(/^\/+/, ""));
+  if (resolved !== normalizedRoot && !resolved.startsWith(normalizedRoot + path.sep)) {
     throw new AppError(400, `path traversal rejected: ${raw}`);
   }
   return resolved;
@@ -206473,7 +206474,9 @@ async function fsList(state, q2) {
         name: e2.name,
         path: fullPath,
         is_dir: e2.isDirectory(),
-        size: stat6?.isFile() ? stat6.size : 0
+        size: stat6?.isFile() ? stat6.size : 0,
+        created_at: stat6?.birthtime?.toISOString() ?? null,
+        modified_at: stat6?.mtime?.toISOString() ?? null
       };
     })
   );
@@ -233002,7 +233005,7 @@ function wrapRegisteredTools(registeredTools, runner) {
 // ../../node_modules/.pnpm/@mariozechner+pi-coding-agent@0.61.0_ws@8.19.0_zod@4.3.6/node_modules/@mariozechner/pi-coding-agent/dist/core/prompt-templates.js
 import { existsSync as existsSync10, readdirSync as readdirSync5, readFileSync as readFileSync7, statSync as statSync5 } from "fs";
 import { homedir as homedir5 } from "os";
-import { basename as basename5, isAbsolute as isAbsolute3, join as join15, resolve as resolve5, sep } from "path";
+import { basename as basename5, isAbsolute as isAbsolute3, join as join15, resolve as resolve5, sep as sep2 } from "path";
 function parseCommandArgs(argsString) {
   const args = [];
   let current = "";
@@ -233145,7 +233148,7 @@ function loadPromptTemplates(options2 = {}) {
     if (target === normalizedRoot) {
       return true;
     }
-    const prefix = normalizedRoot.endsWith(sep) ? normalizedRoot : `${normalizedRoot}${sep}`;
+    const prefix = normalizedRoot.endsWith(sep2) ? normalizedRoot : `${normalizedRoot}${sep2}`;
     return target.startsWith(prefix);
   };
   const getSourceInfo = (resolvedPath) => {
@@ -233222,12 +233225,12 @@ var BUILTIN_SLASH_COMMANDS = [
 var import_ignore = __toESM(require_ignore(), 1);
 import { existsSync as existsSync11, readdirSync as readdirSync6, readFileSync as readFileSync8, realpathSync, statSync as statSync6 } from "fs";
 import { homedir as homedir6 } from "os";
-import { basename as basename6, dirname as dirname7, isAbsolute as isAbsolute4, join as join16, relative, resolve as resolve6, sep as sep2 } from "path";
+import { basename as basename6, dirname as dirname7, isAbsolute as isAbsolute4, join as join16, relative, resolve as resolve6, sep as sep3 } from "path";
 var MAX_NAME_LENGTH = 64;
 var MAX_DESCRIPTION_LENGTH = 1024;
 var IGNORE_FILE_NAMES = [".gitignore", ".ignore", ".fdignore"];
 function toPosixPath(p) {
-  return p.split(sep2).join("/");
+  return p.split(sep3).join("/");
 }
 function prefixIgnorePattern(line, prefix) {
   const trimmed = line.trim();
@@ -233500,7 +233503,7 @@ function loadSkills(options2 = {}) {
     if (target === normalizedRoot) {
       return true;
     }
-    const prefix = normalizedRoot.endsWith(sep2) ? normalizedRoot : `${normalizedRoot}${sep2}`;
+    const prefix = normalizedRoot.endsWith(sep3) ? normalizedRoot : `${normalizedRoot}${sep3}`;
     return target.startsWith(prefix);
   };
   const getSource = (resolvedPath) => {
@@ -245359,7 +245362,7 @@ import { spawn as spawn8, spawnSync as spawnSync6 } from "node:child_process";
 import { createHash } from "node:crypto";
 import { existsSync as existsSync18, mkdirSync as mkdirSync7, readdirSync as readdirSync9, readFileSync as readFileSync13, rmSync as rmSync2, statSync as statSync9, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir8, tmpdir as tmpdir4 } from "node:os";
-import { basename as basename8, dirname as dirname12, join as join22, relative as relative2, resolve as resolve9, sep as sep4 } from "node:path";
+import { basename as basename8, dirname as dirname12, join as join22, relative as relative2, resolve as resolve9, sep as sep5 } from "node:path";
 
 // ../../node_modules/.pnpm/balanced-match@4.0.4/node_modules/balanced-match/dist/esm/index.js
 var balanced = (a, b, str3) => {
@@ -246423,8 +246426,8 @@ var path14 = {
   win32: { sep: "\\" },
   posix: { sep: "/" }
 };
-var sep3 = defaultPlatform === "win32" ? path14.win32.sep : path14.posix.sep;
-minimatch.sep = sep3;
+var sep4 = defaultPlatform === "win32" ? path14.win32.sep : path14.posix.sep;
+minimatch.sep = sep4;
 var GLOBSTAR = /* @__PURE__ */ Symbol("globstar **");
 minimatch.GLOBSTAR = GLOBSTAR;
 var qmark2 = "[^/]";
@@ -247334,7 +247337,7 @@ var FILE_PATTERNS = {
 };
 var IGNORE_FILE_NAMES2 = [".gitignore", ".ignore", ".fdignore"];
 function toPosixPath3(p) {
-  return p.split(sep4).join("/");
+  return p.split(sep5).join("/");
 }
 function getHomeDir() {
   return process.env.HOME || homedir8();
@@ -248872,7 +248875,7 @@ var DefaultPackageManager = class {
 // ../../node_modules/.pnpm/@mariozechner+pi-coding-agent@0.61.0_ws@8.19.0_zod@4.3.6/node_modules/@mariozechner/pi-coding-agent/dist/core/resource-loader.js
 import { existsSync as existsSync19, readdirSync as readdirSync10, readFileSync as readFileSync14, statSync as statSync10 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
-import { join as join23, resolve as resolve10, sep as sep5 } from "node:path";
+import { join as join23, resolve as resolve10, sep as sep6 } from "node:path";
 function resolvePromptInput(input, description) {
   if (!input) {
     return void 0;
@@ -249226,7 +249229,7 @@ var DefaultResourceLoader = class {
       if (this.pathMetadata.has(normalizedResourcePath) || this.pathMetadata.has(resourcePath)) {
         continue;
       }
-      const match2 = normalized.find((entry) => normalizedResourcePath === entry.path || normalizedResourcePath.startsWith(`${entry.path}${sep5}`));
+      const match2 = normalized.find((entry) => normalizedResourcePath === entry.path || normalizedResourcePath.startsWith(`${entry.path}${sep6}`));
       if (match2) {
         this.pathMetadata.set(normalizedResourcePath, match2.metadata);
       }
@@ -249445,7 +249448,7 @@ var DefaultResourceLoader = class {
     if (target === normalizedRoot) {
       return true;
     }
-    const prefix = normalizedRoot.endsWith(sep5) ? normalizedRoot : `${normalizedRoot}${sep5}`;
+    const prefix = normalizedRoot.endsWith(sep6) ? normalizedRoot : `${normalizedRoot}${sep6}`;
     return target.startsWith(prefix);
   }
   detectExtensionConflicts(extensions2) {
@@ -250380,8 +250383,8 @@ var ConfigSelectorHeader = class {
   }
   render(width) {
     const title = theme.bold("Resource Configuration");
-    const sep6 = theme.fg("muted", " \xB7 ");
-    const hint = rawKeyHint("space", "toggle") + sep6 + rawKeyHint("esc", "close");
+    const sep7 = theme.fg("muted", " \xB7 ");
+    const hint = rawKeyHint("space", "toggle") + sep7 + rawKeyHint("esc", "close");
     const hintWidth = visibleWidth(hint);
     const titleWidth = visibleWidth(title);
     const spacing = Math.max(1, width - titleWidth - hintWidth);
@@ -251414,8 +251417,8 @@ var SessionSelectorHeader = class {
       hintLine2 = "";
     } else {
       const pathState = this.showPath ? "(on)" : "(off)";
-      const sep6 = theme.fg("muted", " \xB7 ");
-      const hint1 = keyHint("tui.input.tab", "scope") + sep6 + theme.fg("muted", 're:<pattern> regex \xB7 "phrase" exact');
+      const sep7 = theme.fg("muted", " \xB7 ");
+      const hint1 = keyHint("tui.input.tab", "scope") + sep7 + theme.fg("muted", 're:<pattern> regex \xB7 "phrase" exact');
       const hint2Parts = [
         keyHint("app.session.toggleSort", "sort"),
         keyHint("app.session.toggleNamedFilter", "named"),
@@ -251425,7 +251428,7 @@ var SessionSelectorHeader = class {
       if (this.showRenameHint) {
         hint2Parts.push(keyHint("app.session.rename", "rename"));
       }
-      const hint2 = hint2Parts.join(sep6);
+      const hint2 = hint2Parts.join(sep7);
       hintLine1 = truncateToWidth(hint1, width, "\u2026");
       hintLine2 = truncateToWidth(hint2, width, "\u2026");
     }
@@ -262471,47 +262474,93 @@ function createDaemon(config) {
     volumesRoot: `${config.root}/volumes`
   };
   return http3.createServer(async (req, res) => {
-    const method = req.method ?? "GET";
-    const url = new URL2(
-      req.url ?? "/",
-      `http://${req.headers.host ?? "localhost"}`
-    );
-    const pathname = url.pathname;
-    if (method === "POST" && pathname === "/api/coding/run") {
-      const body2 = JSON.parse(await readBody(req) || "{}");
-      return sandagentRun(body2, res, env2);
-    }
-    if (method === "POST" && pathname === "/api/fs/upload") {
-      try {
+    try {
+      const method = req.method ?? "GET";
+      const url = new URL2(
+        req.url ?? "/",
+        `http://${req.headers.host ?? "localhost"}`
+      );
+      const pathname = url.pathname;
+      if (method === "POST" && pathname === "/api/coding/run") {
+        const body2 = safeJsonParse(await readBody(req));
+        return sandagentRun(
+          body2,
+          res,
+          env2
+        );
+      }
+      if (method === "POST" && pathname === "/api/fs/upload") {
+        try {
+          const ct2 = req.headers["content-type"] ?? "";
+          if (!ct2.includes("multipart/form-data")) {
+            res.writeHead(400, { "Content-Type": "application/json" });
+            res.end(
+              JSON.stringify(fail("content-type must be multipart/form-data"))
+            );
+            return;
+          }
+          const raw = await readBodyRaw(req);
+          const parts = parseMultipart(ct2, raw);
+          const result2 = await fsUpload(state, parts);
+          res.writeHead(200, { "Content-Type": "application/json" });
+          res.end(JSON.stringify(result2));
+        } catch (err) {
+          const status2 = err instanceof AppError ? err.status : 500;
+          const msg = err instanceof Error ? err.message : String(err);
+          res.writeHead(status2, { "Content-Type": "application/json" });
+          res.end(JSON.stringify(fail(msg)));
+        }
+        return;
+      }
+      let params;
+      if (method === "GET") {
+        params = Object.fromEntries(url.searchParams);
+      } else {
         const ct2 = req.headers["content-type"] ?? "";
-        if (!ct2.includes("multipart/form-data")) {
-          res.writeHead(400, { "Content-Type": "application/json" });
-          res.end(
-            JSON.stringify(fail("content-type must be multipart/form-data"))
+        if (ct2.includes("multipart/form-data") || ct2.includes("application/x-www-form-urlencoded")) {
+          sendJson(
+            res,
+            400,
+            fail(
+              `Endpoint ${pathname} expects JSON body (content-type: application/json)`
+            )
           );
           return;
         }
-        const raw = await readBodyRaw(req);
-        const parts = parseMultipart(ct2, raw);
-        const result2 = await fsUpload(state, parts);
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(result2));
-      } catch (err) {
-        const status2 = err instanceof AppError ? err.status : 500;
-        const msg = err instanceof Error ? err.message : String(err);
-        res.writeHead(status2, { "Content-Type": "application/json" });
-        res.end(JSON.stringify(fail(msg)));
+        params = safeJsonParse(await readBody(req));
+      }
+      const result = await router.handle(method, pathname, params);
+      const status = result?.status ?? 404;
+      const body = result?.body ?? fail(`not found: ${method} ${pathname}`);
+      sendJson(res, status, body);
+    } catch (err) {
+      if (!res.headersSent) {
+        if (err instanceof AppError) {
+          sendJson(res, err.status, fail(err.message));
+        } else {
+          console.error("Unhandled request error:", err);
+          const msg = err instanceof Error ? err.message : String(err);
+          sendJson(res, 500, fail(`Internal server error: ${msg}`));
+        }
+      } else {
+        console.error("Unhandled request error (headers already sent):", err);
       }
-      return;
     }
-    const params = method === "GET" ? Object.fromEntries(url.searchParams) : JSON.parse(await readBody(req) || "{}");
-    const result = await router.handle(method, pathname, params);
-    const status = result?.status ?? 404;
-    const body = result?.body ?? fail(`not found: ${method} ${pathname}`);
-    res.writeHead(status, { "Content-Type": "application/json" });
-    res.end(JSON.stringify(body));
   });
 }
+function sendJson(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+function safeJsonParse(text) {
+  const trimmed = (text || "").trim();
+  if (!trimmed) return {};
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    throw new AppError(400, `Invalid JSON body: ${trimmed.slice(0, 120)}`);
+  }
+}
 function readBody(req) {
   return new Promise((resolve14, reject) => {
     const chunks = [];