@someonegg/codex-hub 0.1.8 → 0.2.0

package/dist/client/index.html

@@ -13,8 +13,8 @@
     <link rel="apple-touch-icon" href="/apple-touch-icon.png" sizes="180x180" />
     <link rel="manifest" href="/manifest.webmanifest" />
     <title>Codex Hub</title>
-    <script type="module" crossorigin src="/assets/index-5lzZNvZX.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-fx0H9Qr4.css">
+    <script type="module" crossorigin src="/assets/index-CrCuCnqn.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CODhVb8z.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/server/server/config.js

@@ -38,10 +38,14 @@ export function loadConfig(args = process.argv.slice(2)) {
             help: { type: "boolean" },
             "tmux-socket": { type: "string" },
             "upload-dir": { type: "string" },
+            hosting: { type: "boolean" },
+            "hosting-dir": { type: "string" },
         },
     });
     if (values.help)
         return { kind: "help" };
+    if (values["hosting-dir"] !== undefined && !values.hosting)
+        throw new Error("--hosting-dir requires --hosting");
     const host = nonEmptyOption("host", values.host) ?? LOOPBACK_HOST;
     const homes = parseHomes(values["codex-home"] ?? ["default=~/.codex"]);
     const certificatePath = nonEmptyOption("ssl-cert", values["ssl-cert"]);
@@ -76,8 +80,15 @@ export function loadConfig(args = process.argv.slice(2)) {
             clientDirectory: fileURLToPath(new URL("../../client/", import.meta.url)),
             tls,
             interactionEnabled: true,
+            ...(values.hosting
+                ? {
+                    hostingDirectory: values["hosting-dir"] !== undefined
+                        ? resolveDirectoryOption("hosting-dir", values["hosting-dir"])
+                        : resolve(homedir(), ".codex-hub/hosting"),
+                }
+                : {}),
             ...(values["upload-dir"] !== undefined
-                ? { uploadDirectory: resolveUploadDirectory(values["upload-dir"]) }
+                ? { uploadDirectory: resolveDirectoryOption("upload-dir", values["upload-dir"]) }
                 : {}),
             ...(values["tmux-socket"] !== undefined
                 ? { tmuxSocket: resolve(nonEmptyOption("tmux-socket", values["tmux-socket"])) }
@@ -88,7 +99,18 @@ export function loadConfig(args = process.argv.slice(2)) {
 export function commandLineHelp() {
     return `Usage: codex-hub [options]
 
+Resources:
+  codex-hub page list
+  codex-hub page delete <id>
+  codex-hub diff list
+  codex-hub diff delete <uuid>
+  All resource commands accept --hosting-dir <directory> and --json.
+Diff: codex-hub diff publish <file> [--title <title>] [--hosting-dir <directory>] [--json]
+Pages: codex-hub page publish <directory> --project <directory> [--name <name>] [--title <title>] [--hosting-dir <directory>] [--json]
+
 Options:
+  --hosting            Enable trusted same-origin static web hosting
+  --hosting-dir <path> Hosting storage (requires --hosting; default: ~/.codex-hub/hosting)
   --codex-home <nickname=path>
                        Codex home; repeat for multiple homes (default: default=~/.codex)
   --host <host>        Listen host (default: 127.0.0.1)
@@ -138,8 +160,8 @@ function parseHomes(values) {
         return { nickname, path };
     });
 }
-function resolveUploadDirectory(value) {
-    const path = nonEmptyOption("upload-dir", value);
+function resolveDirectoryOption(name, value) {
+    const path = nonEmptyOption(name, value);
     return resolve(path.startsWith("~/") ? resolve(homedir(), path.slice(2)) : path);
 }
 //# sourceMappingURL=config.js.map

package/dist/server/server/hosting/diff-store.js

@@ -0,0 +1,102 @@
+import { randomUUID } from "node:crypto";
+import { lstat, mkdir, readdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { HostingStore } from "./store.js";
+export const DIFF_ID = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/;
+export class DiffStore {
+    hosting;
+    constructor(root) {
+        this.hosting = new HostingStore(root);
+    }
+    directory(id) {
+        return join(this.hosting.root, "diffs", id);
+    }
+    async metadata(id) {
+        if (!DIFF_ID.test(id))
+            return null;
+        try {
+            const directory = this.directory(id);
+            const metadata = JSON.parse(await readFile(join(directory, "metadata.json"), "utf8"));
+            if (metadata.id !== id ||
+                metadata.url !== `/diffs/${id}` ||
+                typeof metadata.title !== "string" ||
+                !Number.isFinite(Date.parse(metadata.createdAt)))
+                throw new Error("Invalid diff metadata");
+            return metadata;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    async exists(id) {
+        if (!(await this.metadata(id)))
+            return false;
+        try {
+            return (await lstat(join(this.directory(id), "raw.diff"))).isFile();
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return false;
+            throw error;
+        }
+    }
+    async get(id) {
+        const metadata = await this.metadata(id);
+        if (!metadata)
+            return null;
+        try {
+            return { ...metadata, raw: await readFile(join(this.directory(id), "raw.diff"), "utf8") };
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
+    }
+    async list() {
+        let names;
+        try {
+            names = await readdir(join(this.hosting.root, "diffs"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        }
+        const entries = await Promise.all(names.filter((id) => DIFF_ID.test(id)).map((id) => this.metadata(id)));
+        return entries.filter((entry) => entry !== null);
+    }
+    async publish(file, title) {
+        if (!(await lstat(file)).isFile())
+            throw new Error("Diff source must be a regular file");
+        const raw = await readFile(file);
+        return this.hosting.locked(async () => {
+            const id = randomUUID();
+            const metadata = {
+                id,
+                title: title ?? basename(file),
+                createdAt: new Date().toISOString(),
+                url: `/diffs/${id}`,
+            };
+            const temporary = this.directory(`.tmp-${id}`);
+            await mkdir(temporary, { recursive: true });
+            try {
+                await writeFile(join(temporary, "raw.diff"), raw);
+                await writeFile(join(temporary, "metadata.json"), JSON.stringify(metadata));
+                await rename(temporary, this.directory(id));
+            }
+            finally {
+                await rm(temporary, { recursive: true, force: true });
+            }
+            return metadata;
+        });
+    }
+    async delete(id) {
+        if (!DIFF_ID.test(id))
+            throw new Error("Invalid diff UUID");
+        await this.hosting.locked(() => rm(this.directory(id), { recursive: true, force: true }));
+    }
+}
+//# sourceMappingURL=diff-store.js.map

package/dist/server/server/hosting/lock.js

@@ -0,0 +1,65 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+/** A complete owner directory is atomically installed; stale owners move to permanent tombstones.
+ * Keeping tombstones prevents a second reclaimer from renaming a new owner's lock. */
+export class HostingLock {
+    token = randomUUID();
+    attempt;
+    target;
+    held = false;
+    constructor(root, name) {
+        mkdirSync(root, { recursive: true });
+        this.target = join(root, name);
+        this.attempt = join(root, `${name}-attempt-${this.token}`);
+        mkdirSync(this.attempt);
+        writeFileSync(join(this.attempt, "owner.json"), JSON.stringify({ pid: process.pid, token: this.token }));
+    }
+    acquire() {
+        for (;;) {
+            try {
+                renameSync(this.attempt, this.target);
+                this.held = true;
+                return true;
+            }
+            catch (error) {
+                if (!["EEXIST", "ENOTEMPTY"].includes(String(error.code)))
+                    throw error;
+            }
+            let owner;
+            try {
+                owner = JSON.parse(readFileSync(join(this.target, "owner.json"), "utf8"));
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    continue;
+                throw error;
+            }
+            if (!Number.isInteger(owner.pid) || owner.pid <= 0 || !/^[a-f0-9-]{36}$/.test(owner.token))
+                throw new Error("Invalid hosting lock owner");
+            try {
+                process.kill(owner.pid, 0);
+                return false;
+            }
+            catch (error) {
+                if (error.code !== "ESRCH")
+                    throw error;
+            }
+            try {
+                renameSync(this.target, `${this.target}-dead-${owner.token}`);
+            }
+            catch (error) {
+                if (!["ENOENT", "EEXIST", "ENOTEMPTY"].includes(String(error.code)))
+                    throw error;
+            }
+        }
+    }
+    close() {
+        if (this.held) {
+            renameSync(this.target, this.attempt);
+            this.held = false;
+        }
+        rmSync(this.attempt, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=lock.js.map

package/dist/server/server/hosting/routes.js

@@ -0,0 +1,152 @@
+import { createReadStream } from "node:fs";
+import { realpath, stat } from "node:fs/promises";
+import { extname, join, resolve, sep } from "node:path";
+import { sendJson } from "../http/router.js";
+import { DiffStore } from "./diff-store.js";
+import { HostingStore } from "./store.js";
+const types = {
+    ".html": "text/html; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".json": "application/json",
+    ".svg": "image/svg+xml",
+    ".png": "image/png",
+    ".jpg": "image/jpeg",
+    ".jpeg": "image/jpeg",
+    ".gif": "image/gif",
+    ".webp": "image/webp",
+    ".avif": "image/avif",
+    ".ico": "image/x-icon",
+    ".woff": "font/woff",
+    ".woff2": "font/woff2",
+    ".ttf": "font/ttf",
+    ".otf": "font/otf",
+    ".wasm": "application/wasm",
+    ".xml": "application/xml",
+    ".pdf": "application/pdf",
+    ".webmanifest": "application/manifest+json",
+    ".wav": "audio/wav",
+    ".txt": "text/plain; charset=utf-8",
+    ".mp4": "video/mp4",
+    ".webm": "video/webm",
+    ".mp3": "audio/mpeg",
+};
+export function hostingRoutes(directory) {
+    const store = directory === undefined ? undefined : new HostingStore(directory);
+    const diffs = directory === undefined ? undefined : new DiffStore(directory);
+    return async (request, response) => {
+        const url = new URL(request.url ?? "/", "http://localhost");
+        const path = url.pathname;
+        const head = request.method === "HEAD";
+        if (path === "/api/v1/capabilities" && request.method === "GET") {
+            sendJson(response, 200, { hosting: !!store });
+            return true;
+        }
+        if (path.startsWith("/api/v1/diffs")) {
+            response.setHeader("Cache-Control", "private, no-store");
+            const match = /^\/api\/v1\/diffs\/([^/]+)$/.exec(path);
+            const entry = diffs && match && request.method === "GET" ? await diffs.get(match[1]) : null;
+            if (entry) {
+                sendJson(response, 200, entry);
+            }
+            else if (diffs && match && request.method === "DELETE" && (await diffs.exists(match[1]))) {
+                await diffs.delete(match[1]);
+                response.statusCode = 204;
+                response.end();
+            }
+            else {
+                sendJson(response, 404, {
+                    error: { code: "not_found", message: "Diff not found or already cleaned up" },
+                });
+            }
+            return true;
+        }
+        if (!path.startsWith("/web/") && !path.startsWith("/api/v1/artifacts"))
+            return false;
+        const missing = () => sendJson(response, 404, { error: { code: "not_found", message: "Artifact not found" } }, head);
+        if (!store) {
+            missing();
+            return true;
+        }
+        if (path === "/api/v1/artifacts" && request.method === "GET") {
+            const groups = new Map();
+            for (const { artifact } of await store.entries()) {
+                const list = groups.get(artifact.project) ?? [];
+                list.push(artifact);
+                groups.set(artifact.project, list);
+            }
+            sendJson(response, 200, {
+                projects: [...groups].map(([directory, artifacts]) => ({ directory, artifacts })),
+            });
+            return true;
+        }
+        const deletion = /^\/api\/v1\/artifacts\/([a-f0-9]{32})$/.exec(path);
+        if (deletion && request.method === "DELETE") {
+            if (await store.delete(deletion[1])) {
+                response.statusCode = 204;
+                response.end();
+            }
+            else
+                missing();
+            return true;
+        }
+        const match = /^\/web\/([a-f0-9]{32})\/(?:([a-f0-9]{32})\/(.*))?$/.exec(path);
+        if (!match || (request.method !== "GET" && !head)) {
+            missing();
+            return true;
+        }
+        response.removeHeader("Content-Security-Policy");
+        response.setHeader("Cache-Control", "private, no-store");
+        const entry = await store.get(match[1]);
+        if (!entry) {
+            missing();
+            return true;
+        }
+        if (!match[2]) {
+            response.statusCode = 302;
+            response.setHeader("Location", `/web/${entry.artifact.id}/${entry.artifact.snapshotId}/${url.search}`);
+            response.end();
+            return true;
+        }
+        try {
+            const relative = decodeURIComponent(match[3]);
+            if (relative.split(/[\\/]/).some((part) => part === "..") || relative.includes("\0"))
+                throw new Error("Invalid path");
+            const snapshotRoot = resolve(entry.directory, "snapshots", match[2]);
+            const root = await realpath(snapshotRoot);
+            if (root !== snapshotRoot)
+                throw new Error("Snapshot aliases are not allowed");
+            let file = await realpath(resolve(root, relative || "index.html"));
+            if (!file.startsWith(root + sep))
+                throw new Error("Invalid path");
+            if ((await stat(file)).isDirectory()) {
+                if (!path.endsWith("/")) {
+                    response.statusCode = 302;
+                    response.setHeader("Location", path + "/" + url.search);
+                    response.end();
+                    return true;
+                }
+                file = await realpath(join(file, "index.html"));
+            }
+            if (!file.startsWith(root + sep))
+                throw new Error("Invalid path");
+            const info = await stat(file);
+            if (!info.isFile())
+                throw new Error("Not a file");
+            response.setHeader("Content-Type", types[extname(file).toLowerCase()] ?? "application/octet-stream");
+            response.setHeader("Content-Length", info.size);
+            if (head)
+                response.end();
+            else
+                createReadStream(file)
+                    .on("error", () => response.destroy())
+                    .pipe(response);
+        }
+        catch {
+            missing();
+        }
+        return true;
+    };
+}
+//# sourceMappingURL=routes.js.map

package/dist/server/server/hosting/store.js

@@ -0,0 +1,158 @@
+import { randomUUID } from "node:crypto";
+import { constants } from "node:fs";
+import { copyFile, lstat, mkdir, readdir, readFile, realpath, rename, rm, writeFile, } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, join, resolve, sep } from "node:path";
+import { HostingLock } from "./lock.js";
+export const ID = /^[a-f0-9]{32}$/;
+export const defaultHostingDirectory = join(homedir(), ".codex-hub", "hosting");
+function parseArtifact(json) {
+    const value = JSON.parse(json);
+    if (!value ||
+        !ID.test(value.id) ||
+        !ID.test(value.snapshotId) ||
+        typeof value.project !== "string" ||
+        typeof value.source !== "string" ||
+        typeof value.name !== "string" ||
+        typeof value.title !== "string" ||
+        !Number.isFinite(Date.parse(value.createdAt)) ||
+        !Number.isFinite(Date.parse(value.updatedAt)) ||
+        value.url !== `/web/${value.id}/`)
+        throw new Error("Invalid artifact metadata");
+    return value;
+}
+async function copySnapshot(from, to) {
+    const info = await lstat(from);
+    if (info.isDirectory()) {
+        await mkdir(to);
+        for (const item of await readdir(from)) {
+            await copySnapshot(join(from, item), join(to, item));
+        }
+        return;
+    }
+    if (!info.isFile())
+        throw new Error(`Only regular files and directories can be published: ${from}`);
+    await copyFile(from, to, constants.COPYFILE_EXCL);
+}
+function inside(child, parent) {
+    return child === parent || child.startsWith(parent.endsWith(sep) ? parent : parent + sep);
+}
+export class HostingStore {
+    root;
+    constructor(root = defaultHostingDirectory) {
+        if (!root.trim())
+            throw new Error("Hosting directory must not be empty");
+        this.root = resolve(root.startsWith("~/") ? join(homedir(), root.slice(2)) : root);
+    }
+    async locked(action) {
+        const lock = new HostingLock(this.root, ".write-lock");
+        try {
+            while (!lock.acquire())
+                await new Promise((done) => setTimeout(done, 30));
+            return await action();
+        }
+        finally {
+            lock.close();
+        }
+    }
+    async get(id) {
+        if (!ID.test(id))
+            return undefined;
+        const directory = join(this.root, "artifacts", id);
+        let directoryExists = false;
+        try {
+            const canonicalDirectory = join(await realpath(this.root), "artifacts", id);
+            if ((await realpath(directory)) !== canonicalDirectory)
+                throw new Error("Artifact aliases are not allowed");
+            if (!(await lstat(directory)).isDirectory())
+                throw new Error("Invalid artifact directory");
+            directoryExists = true;
+            const artifact = parseArtifact(await readFile(join(directory, "artifact.json"), "utf8"));
+            if (artifact.id !== id)
+                throw new Error("Artifact identity does not match directory");
+            return { artifact, directory: canonicalDirectory };
+        }
+        catch (error) {
+            if (directoryExists || error.code !== "ENOENT")
+                console.warn(`Skipping damaged hosting entry ${directory}: ${String(error)}`);
+            return undefined;
+        }
+    }
+    async entries() {
+        let children;
+        try {
+            children = await readdir(join(this.root, "artifacts"), { withFileTypes: true });
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return [];
+            throw error;
+        }
+        const results = [];
+        for (const child of children) {
+            if (!child.isDirectory() || !ID.test(child.name))
+                continue;
+            const entry = await this.get(child.name);
+            if (entry)
+                results.push(entry);
+        }
+        return results;
+    }
+    async publish(sourcePath, projectPathInput, nameInput, title) {
+        const source = await realpath(resolve(sourcePath));
+        const project = await realpath(resolve(projectPathInput));
+        if (!(await lstat(source)).isDirectory() || !(await lstat(project)).isDirectory())
+            throw new Error("Source and project must be directories");
+        await mkdir(this.root, { recursive: true });
+        const root = await realpath(this.root);
+        if (inside(source, root) || inside(root, source))
+            throw new Error("Source must not overlap hosting storage");
+        const name = nameInput ?? basename(source);
+        if (!name.trim())
+            throw new Error("Artifact name must not be empty");
+        if (!(await lstat(join(source, "index.html"))).isFile())
+            throw new Error("Source requires index.html");
+        return this.locked(async () => {
+            const previous = (await this.entries()).find(({ artifact }) => artifact.project === project && artifact.name === name)?.artifact;
+            const id = previous?.id ?? randomUUID().replaceAll("-", "");
+            const directory = join(root, "artifacts", id);
+            await mkdir(join(directory, "snapshots"), { recursive: true });
+            const snapshotId = randomUUID().replaceAll("-", "");
+            const temp = join(directory, "snapshots", `.tmp-${snapshotId}`);
+            const metadataTemp = join(directory, `.artifact-${snapshotId}.json`);
+            try {
+                await copySnapshot(source, temp);
+                await rename(temp, join(directory, "snapshots", snapshotId));
+                const now = new Date().toISOString();
+                const artifact = {
+                    id,
+                    name,
+                    title: title ?? previous?.title ?? name,
+                    project,
+                    source,
+                    snapshotId,
+                    createdAt: previous?.createdAt ?? now,
+                    updatedAt: now,
+                    url: `/web/${id}/`,
+                };
+                await writeFile(metadataTemp, JSON.stringify(artifact));
+                await rename(metadataTemp, join(directory, "artifact.json"));
+                return artifact;
+            }
+            finally {
+                await rm(temp, { recursive: true, force: true });
+                await rm(metadataTemp, { force: true });
+            }
+        });
+    }
+    async delete(id) {
+        return this.locked(async () => {
+            const entry = await this.get(id);
+            if (!entry)
+                return false;
+            await rm(entry.directory, { recursive: true });
+            return true;
+        });
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/server/server/http/create-server.js

@@ -3,6 +3,9 @@ import { realpath, stat } from "node:fs/promises";
 import { createServer as createHttpServer, } from "node:http";
 import { createServer as createHttpsServer } from "node:https";
 import { extname, resolve, sep } from "node:path";
+import { DiffStore } from "../hosting/diff-store.js";
+import { HostingLock } from "../hosting/lock.js";
+import { hostingRoutes } from "../hosting/routes.js";
 import { emptyApiRouter, sendJson } from "./router.js";
 import { applySecurityHeaders } from "./security.js";
 const CONTENT_TYPES = {
@@ -21,12 +24,12 @@ function sendText(response, status, message, headOnly) {
     response.setHeader("Content-Length", Buffer.byteLength(message));
     response.end(headOnly ? undefined : message);
 }
-async function serveFile(response, filePath, headOnly) {
+async function serveFile(response, filePath, headOnly, status = 200) {
     try {
         const info = await stat(filePath);
         if (!info.isFile())
             return false;
-        response.statusCode = 200;
+        response.statusCode = status;
         response.setHeader("Content-Type", CONTENT_TYPES[extname(filePath)] ?? "application/octet-stream");
         response.setHeader("Content-Length", info.size);
         if (headOnly) {
@@ -45,11 +48,34 @@ async function serveFile(response, filePath, headOnly) {
 }
 export function createServer(config, apiRouter = emptyApiRouter, closeServices = () => { }, upgrades) {
     const clientRoot = realpathSync(config.clientDirectory);
+    const finish = (server) => {
+        const lock = config.hostingDirectory
+            ? new HostingLock(config.hostingDirectory, ".server-lock")
+            : undefined;
+        try {
+            if (lock && !lock.acquire())
+                throw new Error("Hosting directory is already used by another Hub server");
+        }
+        catch (error) {
+            lock?.close();
+            throw error;
+        }
+        server.once("close", () => lock?.close());
+        server.once("error", () => {
+            if (!server.listening)
+                lock?.close();
+        });
+        return attachLifecycle(server, closeServices, upgrades);
+    };
+    const hosting = hostingRoutes(config.hostingDirectory);
+    const diffs = config.hostingDirectory ? new DiffStore(config.hostingDirectory) : undefined;
     const clientRootPrefix = `${clientRoot}${sep}`;
     const requestListener = async (request, response) => {
         applySecurityHeaders(response, request);
         const headOnly = request.method === "HEAD";
         try {
+            if (await hosting(request, response))
+                return;
             if (await apiRouter(request, response))
                 return;
             if (request.method !== "GET" && !headOnly) {
@@ -62,7 +88,14 @@ export function createServer(config, apiRouter = emptyApiRouter, closeServices =
             const url = new URL(request.url ?? "/", "http://localhost");
             const decodedPath = decodeURIComponent(url.pathname);
             const sessionPage = /^\/sessions\/[A-Za-z0-9_-]{20,100}\/?$/.test(decodedPath);
-            const relativePath = decodedPath === "/" ? "index.html" : sessionPage ? "index.html" : decodedPath.slice(1);
+            const diffPage = /^\/diffs\/([a-f0-9-]{36})$/.exec(decodedPath);
+            const appPage = decodedPath === "/" ||
+                sessionPage ||
+                ((decodedPath === "/artifacts" || diffPage) && config.hostingDirectory);
+            const pageStatus = diffPage && diffs && !(await diffs.exists(diffPage[1])) ? 404 : 200;
+            if (diffPage)
+                response.setHeader("Cache-Control", "private, no-store");
+            const relativePath = appPage ? "index.html" : decodedPath.slice(1);
             const requestedPath = resolve(clientRoot, relativePath);
             let canonicalPath;
             try {
@@ -73,7 +106,7 @@ export function createServer(config, apiRouter = emptyApiRouter, closeServices =
                 return;
             }
             if (canonicalPath.startsWith(clientRootPrefix) &&
-                (await serveFile(response, canonicalPath, headOnly))) {
+                (await serveFile(response, canonicalPath, headOnly, pageStatus))) {
                 return;
             }
             sendText(response, 404, "Not found", headOnly);
@@ -84,7 +117,7 @@ export function createServer(config, apiRouter = emptyApiRouter, closeServices =
     };
     if (!config.tls.enabled) {
         const server = createHttpServer(requestListener);
-        return attachLifecycle(server, closeServices, upgrades);
+        return finish(server);
     }
     const requireClientCertificate = config.tls.certificateAuthorityPath !== undefined;
     const server = createHttpsServer({
@@ -97,7 +130,7 @@ export function createServer(config, apiRouter = emptyApiRouter, closeServices =
         requestCert: requireClientCertificate,
         rejectUnauthorized: requireClientCertificate,
     }, requestListener);
-    return attachLifecycle(server, closeServices, upgrades);
+    return finish(server);
 }
 /** Own startup cleanup as well as the server's pre-drain shutdown hook. */
 export async function startServer(config, apiRouter, closeServices, upgrades) {

package/dist/server/server/http/router.js

@@ -2,7 +2,7 @@ export function sendJson(response, status, body, headOnly = false) {
     const json = JSON.stringify(body);
     response.statusCode = status;
     response.setHeader("Content-Type", "application/json; charset=utf-8");
-    response.setHeader("Cache-Control", "no-store");
+    response.setHeader("Cache-Control", response.getHeader("Cache-Control") ?? "no-store");
     response.setHeader("Content-Length", Buffer.byteLength(json));
     response.end(headOnly ? undefined : json);
 }