cc-viewer 1.6.274 → 1.6.276

package/server/routes/git.js

@@ -0,0 +1,228 @@
+// Git routes (moved verbatim from server.js handleRequest).
+import { existsSync, readdirSync, realpathSync } from 'node:fs';
+import { join, basename, resolve, sep } from 'node:path';
+import { getGitDiffs, countUntrackedLines, getUnpushedCommits, isValidCommitHash } from '../lib/git-diff.js';
+
+const GIT_RESTORE_LOCK_CLEANUP_MS = 30000;
+
+function gitRepos(req, res) {
+  try {
+    const projectDir = process.env.CCV_PROJECT_DIR || process.cwd();
+    const repos = [];
+    if (existsSync(join(projectDir, '.git'))) {
+      repos.push({ name: basename(projectDir), path: '.', isRoot: true });
+    }
+    const entries = readdirSync(projectDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name.startsWith('.') || entry.name === 'node_modules') continue;
+      try {
+        if (existsSync(join(projectDir, entry.name, '.git'))) {
+          repos.push({ name: entry.name, path: entry.name, isRoot: false });
+        }
+      } catch {}
+    }
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ repos }));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message, repos: [] }));
+  }
+}
+
+function gitRestore(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', async () => {
+    let parsed;
+    try { parsed = JSON.parse(body); } catch {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid request body' }));
+      return;
+    }
+    try {
+      const { path: filePath, repo: repoParam } = parsed;
+      if (!filePath) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Missing path' }));
+        return;
+      }
+      if (filePath.startsWith('/') || filePath.includes('..')) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid path' }));
+        return;
+      }
+      const cwd = deps.resolveRepoCwd(repoParam);
+      if (!cwd) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Invalid repo parameter' }));
+        return;
+      }
+      const fullPath = join(cwd, filePath);
+      if (existsSync(fullPath)) {
+        const realFull = realpathSync(fullPath);
+        const realCwd = realpathSync(cwd);
+        if (!realFull.startsWith(realCwd + sep)) {
+          res.writeHead(400, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ error: 'Path traversal not allowed' }));
+          return;
+        }
+      }
+      // Per-file mutex 序列化「git status + checkout/clean」子命令对。多 tab 并发同文件
+      // revert 时不再有 race 让两个 checkout 交错执行（最终状态不可预测）。
+      // resolve() 规整 `./foo.js` / `foo.js` / `.//foo.js` 为同一 lockKey，防形变绕过。
+      const lockKey = resolve(join(cwd, filePath));
+      const prev = deps.gitRestoreLocks.get(lockKey) || Promise.resolve();
+      const current = prev.then(async () => {
+        const { stdout: statusOut } = await deps.execFileAsync('git', ['status', '--porcelain', '--', filePath], { cwd, encoding: 'utf-8', timeout: 5000 });
+        const isUntracked = statusOut.trim().startsWith('??');
+        if (isUntracked) {
+          await deps.execFileAsync('git', ['clean', '-fd', '--', filePath], { cwd, timeout: 10000 });
+        } else {
+          await deps.execFileAsync('git', ['checkout', '--', filePath], { cwd, timeout: 10000 });
+        }
+      }).finally(() => {
+        if (deps.gitRestoreLocks.get(lockKey) === current) deps.gitRestoreLocks.delete(lockKey);
+      });
+      deps.gitRestoreLocks.set(lockKey, current);
+      // setTimeout 兜底——防 finally 异常吞 entry 累积内存。
+      setTimeout(() => {
+        if (deps.gitRestoreLocks.get(lockKey) === current) deps.gitRestoreLocks.delete(lockKey);
+      }, GIT_RESTORE_LOCK_CLEANUP_MS).unref();
+      await current;
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true }));
+    } catch (err) {
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+  });
+}
+
+async function gitStatus(req, res, parsedUrl, isLocal, deps) {
+  try {
+    const repoParam = parsedUrl.searchParams.get('repo');
+    const cwd = deps.resolveRepoCwd(repoParam);
+    if (!cwd) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid repo parameter', changes: [] }));
+      return;
+    }
+    // `-uall` 让 git 把新增目录展开成具体文件，而不是收敛为 `?? path/`
+    // 否则前端树会把整个新目录当一个「空文件名」叶子渲染，且行数统计为 0。
+    // maxBuffer 拉到 10MB——默认 1MB 在 node_modules 未 gitignore 之类的极端
+    // 场景下会被截断，导致后续 split 解析错位。
+    const { stdout: output } = await deps.execFileAsync('git', ['status', '--porcelain', '-uall'], { cwd, encoding: 'utf-8', timeout: 5000, maxBuffer: 10 * 1024 * 1024 });
+    // Win 上 git stdout 是 CRLF；现状靠下文 .trim() 兜底，加正则更稳防未来 strict 比较破窗。
+    const lines = output.split(/\r?\n/).filter(line => line.trim());
+    const changes = lines.map(line => {
+      const status = line.substring(0, 2).trim();
+      let file = line.substring(3).trim();
+      // git status --porcelain quotes paths with non-ASCII chars using octal escapes
+      if (file.startsWith('"') && file.endsWith('"')) {
+        file = file.slice(1, -1)
+          .replace(/\\([0-7]{3})/g, (_, oct) => String.fromCharCode(parseInt(oct, 8)))
+          .replace(/\\t/g, '\t').replace(/\\n/g, '\n')
+          .replace(/\\\\/g, '\\').replace(/\\"/g, '"');
+        file = Buffer.from(file, 'latin1').toString('utf8');
+      }
+      return { status, file };
+    });
+
+    // Collect per-file insertions/deletions via git diff --numstat (tracked) + --cached --numstat (staged).
+    // Neither covers untracked files, so add their line counts separately via countUntrackedLines
+    // — matching git's numstat semantics (binary and >5MB files contribute 0).
+    let insertions = 0, deletions = 0;
+    try {
+      const [{ stdout: numstat }, { stdout: cachedNumstat }] = await Promise.all([
+        deps.execFileAsync('git', ['diff', '--numstat'], { cwd, encoding: 'utf-8', timeout: 5000 }),
+        deps.execFileAsync('git', ['diff', '--cached', '--numstat'], { cwd, encoding: 'utf-8', timeout: 5000 }),
+      ]);
+      for (const raw of [numstat, cachedNumstat]) {
+        for (const l of raw.split('\n')) {
+          const m = l.match(/^(\d+)\t(\d+)\t/);
+          if (m) { insertions += Number(m[1]); deletions += Number(m[2]); }
+        }
+      }
+    } catch { /* non-critical — stats just stay 0 */ }
+
+    // Cap untracked-file processing to keep the event loop responsive if a
+    // repo forgets to gitignore a huge directory (e.g. node_modules).
+    // 超限时仍继续计数，但不再调 countUntrackedLines——用 insertions_capped
+    // 通知前端"此数据被硬上限截断"，避免静默少算给用户造成误判。
+    const MAX_UNTRACKED = 5000;
+    let untrackedProcessed = 0;
+    let untrackedTotal = 0;
+    for (const c of changes) {
+      if (c.status !== '??') continue;
+      untrackedTotal++;
+      if (untrackedProcessed >= MAX_UNTRACKED) continue;
+      insertions += countUntrackedLines(cwd, c.file);
+      untrackedProcessed++;
+    }
+    const insertions_capped = untrackedTotal > MAX_UNTRACKED;
+
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ changes, insertions, deletions, insertions_capped }));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message, changes: [] }));
+  }
+}
+
+async function gitDiff(req, res, parsedUrl, isLocal, deps) {
+  try {
+    const repoParam = parsedUrl.searchParams.get('repo');
+    const cwd = deps.resolveRepoCwd(repoParam);
+    if (!cwd) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid repo parameter', diffs: [] }));
+      return;
+    }
+    const filesParam = parsedUrl.searchParams.get('files');
+
+    if (!filesParam) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Missing files parameter' }));
+      return;
+    }
+
+    const files = filesParam.split(',').map(f => f.trim()).filter(Boolean);
+    const commitParam = parsedUrl.searchParams.get('commit');
+    // Reject malformed commit hashes; falsy = working-tree mode
+    const commitHash = commitParam && isValidCommitHash(commitParam) ? commitParam : undefined;
+    const diffs = await getGitDiffs(cwd, files, commitHash);
+
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ diffs }));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message, diffs: [] }));
+  }
+}
+
+async function gitLogUnpushed(req, res, parsedUrl, isLocal, deps) {
+  try {
+    const repoParam = parsedUrl.searchParams.get('repo');
+    const cwd = deps.resolveRepoCwd(repoParam);
+    if (!cwd) {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid repo parameter', commits: [], hasUpstream: false }));
+      return;
+    }
+    const result = await getUnpushedCommits(cwd);
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(result));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message, commits: [], hasUpstream: false }));
+  }
+}
+
+export const gitRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/git-repos', handler: gitRepos },
+  { method: 'POST', match: 'exact', path: '/api/git-restore', handler: gitRestore },
+  { method: 'GET', match: 'exact', path: '/api/git-status', handler: gitStatus },
+  { method: 'GET', match: 'prefix', path: '/api/git-diff', handler: gitDiff },
+  { method: 'GET', match: 'prefix', path: '/api/git-log-unpushed', handler: gitLogUnpushed },
+];

package/server/routes/logs.js

@@ -0,0 +1,201 @@
+// Local log management routes (moved verbatim from server.js handleRequest).
+import { existsSync, realpathSync, statSync, createReadStream } from 'node:fs';
+import { join, basename } from 'node:path';
+import { LOG_DIR } from '../../findcc.js';
+import { _projectName } from '../interceptor.js';
+import { listLocalLogs, deleteLogFiles, mergeLogFiles, archiveLogFiles, validateLogPath } from '../lib/log-management.js';
+import { countLogEntries, streamRawEntriesAsync } from '../lib/log-stream.js';
+
+function localLogs(req, res) {
+  try {
+    const result = listLocalLogs(LOG_DIR, _projectName);
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(result));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function downloadLog(req, res, parsedUrl) {
+  const file = parsedUrl.searchParams.get('file');
+  if (!file || file.includes('..')) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid file name' }));
+    return;
+  }
+  if (!file.endsWith('.jsonl') && !file.endsWith('.jsonl.zip')) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid file type' }));
+    return;
+  }
+  const filePath = join(LOG_DIR, file);
+  try {
+    if (!existsSync(filePath)) {
+      res.writeHead(404, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'File not found' }));
+      return;
+    }
+    const realPath = realpathSync(filePath);
+    const realLogDir = realpathSync(LOG_DIR);
+    if (!realPath.startsWith(realLogDir)) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Access denied' }));
+      return;
+    }
+    const format = parsedUrl.searchParams.get('format');
+    // 默认下载重建后的 .jsonl；raw 下载原始字节（.zip 或 .jsonl 视实际而定）
+    const fileName = (format !== 'raw' && file.endsWith('.jsonl.zip'))
+      ? basename(file).slice(0, -4)
+      : basename(file);
+    // Delta storage: format=raw 下载原始文件；默认下载重建后的全量格式
+    if (format === 'raw') {
+      const stat = statSync(realPath);
+      res.writeHead(200, {
+        'Content-Type': 'application/octet-stream',
+        'Content-Disposition': `attachment; filename="${encodeURIComponent(fileName)}"`,
+        'Content-Length': stat.size,
+      });
+      const stream = createReadStream(realPath);
+      stream.pipe(res);
+    } else {
+      // 流式下载原始条目（不重建，保持 delta 格式），避免 OOM
+      res.writeHead(200, {
+        'Content-Type': 'application/octet-stream',
+        'Content-Disposition': `attachment; filename="${encodeURIComponent(fileName)}"`,
+        'Transfer-Encoding': 'chunked',
+      });
+      await streamRawEntriesAsync(realPath, (raw) => {
+        res.write(raw);
+        res.write('\n---\n');
+      });
+      res.end();
+    }
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function localLog(req, res, parsedUrl) {
+  const file = parsedUrl.searchParams.get('file');
+  if (!file || file.includes('..')) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid file name' }));
+    return;
+  }
+
+  // 验证文件类型：允许 .jsonl 或 .jsonl.zip
+  if (!file.endsWith('.jsonl') && !file.endsWith('.jsonl.zip')) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid file type. Only .jsonl(.zip) files are allowed.' }));
+    return;
+  }
+
+  try {
+    // 独立 SSE 流：直接向请求方返回 event-stream，不走 /events 广播
+    validateLogPath(LOG_DIR, file);
+    const filePath = join(LOG_DIR, file);
+    const total = countLogEntries(filePath);
+
+    res.writeHead(200, {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      'Connection': 'keep-alive',
+    });
+
+    res.write(`event: load_start\ndata: ${JSON.stringify({ total, incremental: false })}\n\n`);
+    await streamRawEntriesAsync(filePath, (raw) => {
+      res.write('event: load_chunk\ndata: [');
+      res.write(raw.includes('\n') ? raw.replace(/\n/g, '') : raw);
+      res.write(']\n\n');
+    });
+    res.write(`event: load_end\ndata: {}\n\n`);
+    res.end();
+  } catch (err) {
+    // 如果 headers 未发送，返回 JSON 错误；否则关闭连接
+    // 落 stderr 让用户在 ccv 终端能看到 .jsonl.zip 解压失败等具体原因（SSE onerror 在客户端
+    // 不携带错误明细，只能从服务端日志反查）
+    console.error('[local-log]', file, err && err.stack || err);
+    if (!res.headersSent) {
+      const status = err.code === 'NOT_FOUND' ? 404 : err.code === 'ACCESS_DENIED' ? 403 : 500;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    } else {
+      res.end();
+    }
+  }
+}
+
+function deleteLogs(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', () => {
+    try {
+      const { files } = JSON.parse(body);
+      if (!Array.isArray(files) || files.length === 0) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'No files specified' }));
+        return;
+      }
+      const results = deleteLogFiles(LOG_DIR, files);
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ results }));
+    } catch {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid JSON' }));
+    }
+  });
+}
+
+function mergeLogs(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', () => {
+    try {
+      const { files } = JSON.parse(body);
+      const merged = mergeLogFiles(LOG_DIR, files);
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, merged }));
+    } catch (err) {
+      const status = err.code === 'NOT_FOUND' ? 404 : err.code === 'INVALID_INPUT' ? 400 : 500;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+  });
+}
+
+function archiveLogs(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', () => {
+    try {
+      const { files } = JSON.parse(body);
+      if (!Array.isArray(files) || files.length === 0) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'No files specified' }));
+        return;
+      }
+      if (files.length > 50) {
+        res.writeHead(400, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: 'Too many files (max 50 per request)' }));
+        return;
+      }
+      const result = archiveLogFiles(LOG_DIR, files);
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(result));
+    } catch {
+      res.writeHead(400, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'Invalid JSON' }));
+    }
+  });
+}
+
+export const logsRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/local-logs', handler: localLogs },
+  { method: 'GET', match: 'exact', path: '/api/download-log', handler: downloadLog },
+  { method: 'GET', match: 'exact', path: '/api/local-log', handler: localLog },
+  { method: 'POST', match: 'exact', path: '/api/delete-logs', handler: deleteLogs },
+  { method: 'POST', match: 'exact', path: '/api/merge-logs', handler: mergeLogs },
+  { method: 'POST', match: 'exact', path: '/api/archive-logs', handler: archiveLogs },
+];

package/server/routes/misc.js

@@ -0,0 +1,22 @@
+// Miscellaneous small routes (moved verbatim from server.js handleRequest).
+import { getUserProfile } from '../lib/user-profile.js';
+import { runWaterfallHook } from '../lib/plugin-loader.js';
+
+async function userProfile(req, res) {
+  const profile = await getUserProfile();
+  res.writeHead(200, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify(profile));
+}
+
+async function localUrl(req, res, parsedUrl, isLocal, deps) {
+  const localIp = deps.getLocalIp();
+  const defaultUrl = `${deps.protocol}://${localIp}:${deps.actualPort}?token=${deps.ACCESS_TOKEN}`;
+  const hookResult = await runWaterfallHook('localUrl', { url: defaultUrl, ip: localIp, port: deps.actualPort, token: deps.ACCESS_TOKEN });
+  res.writeHead(200, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ url: hookResult.url }));
+}
+
+export const miscRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/user-profile', handler: userProfile },
+  { method: 'GET', match: 'exact', path: '/api/local-url', handler: localUrl },
+];

package/server/routes/plugins.js

@@ -0,0 +1,96 @@
+// Plugin management routes (moved verbatim from server.js handleRequest).
+import { existsSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { loadPlugins, getPluginsInfo, getPluginsDir } from '../lib/plugin-loader.js';
+import { uploadPlugins, installPluginFromUrl } from '../lib/plugin-manager.js';
+import { SERVER_LIB } from '../_paths.js';
+
+function pluginsList(req, res) {
+  const plugins = getPluginsInfo();
+  res.writeHead(200, { 'Content-Type': 'application/json' });
+  res.end(JSON.stringify({ plugins, pluginsDir: getPluginsDir() }));
+}
+
+async function pluginsDelete(req, res, parsedUrl) {
+  const file = parsedUrl.searchParams.get('file');
+  if (!file || file.includes('..') || file.includes('/') || file.includes('\\')) {
+    res.writeHead(400, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'Invalid file name' }));
+    return;
+  }
+  const filePath = join(getPluginsDir(), file);
+  try {
+    if (!existsSync(filePath)) {
+      res.writeHead(404, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: 'File not found' }));
+      return;
+    }
+    unlinkSync(filePath);
+    await loadPlugins();
+    const plugins = getPluginsInfo();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, plugins, pluginsDir: getPluginsDir() }));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+async function pluginsReload(req, res) {
+  try {
+    await loadPlugins();
+    const plugins = getPluginsInfo();
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ ok: true, plugins, pluginsDir: getPluginsDir() }));
+  } catch (err) {
+    res.writeHead(500, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: err.message }));
+  }
+}
+
+function pluginsUpload(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', async () => {
+    try {
+      const { files: fileList } = JSON.parse(body);
+      uploadPlugins(getPluginsDir(), fileList);
+      await loadPlugins();
+      const plugins = getPluginsInfo();
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, plugins, pluginsDir: getPluginsDir() }));
+    } catch (err) {
+      const status = err.statusCode || 500;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+  });
+}
+
+function pluginsInstallFromUrl(req, res, parsedUrl, isLocal, deps) {
+  let body = '';
+  req.on('data', chunk => { body += chunk; if (body.length > deps.MAX_POST_BODY) req.destroy(); });
+  req.on('end', async () => {
+    try {
+      const { url: fileUrl } = JSON.parse(body);
+      const extractScript = join(SERVER_LIB, 'extract-plugin-name.mjs');
+      await installPluginFromUrl(getPluginsDir(), fileUrl, extractScript);
+      await loadPlugins();
+      const plugins = getPluginsInfo();
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: true, plugins, pluginsDir: getPluginsDir() }));
+    } catch (err) {
+      const status = err.statusCode || 500;
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ error: err.message }));
+    }
+  });
+}
+
+export const pluginsRoutes = [
+  { method: 'GET', match: 'exact', path: '/api/plugins', handler: pluginsList },
+  { method: 'DELETE', match: 'exact', path: '/api/plugins', handler: pluginsDelete },
+  { method: 'POST', match: 'exact', path: '/api/plugins/reload', handler: pluginsReload },
+  { method: 'POST', match: 'exact', path: '/api/plugins/upload', handler: pluginsUpload },
+  { method: 'POST', match: 'exact', path: '/api/plugins/install-from-url', handler: pluginsInstallFromUrl },
+];