nolo-cli 0.1.23 → 0.1.29

package/server/desktopRuntimeRoutes.ts

@@ -0,0 +1,120 @@
+import {
+  handleDesktopLlamaRuntimeGet,
+  handleDesktopLlamaRuntimePost,
+} from "./handlers/desktopLlamaRuntimeHandler";
+import { handleDesktopAgentRuntimeStatusGet } from "./handlers/desktopAgentRuntimeStatusHandler";
+import { handleDesktopAgentRuntimeTurnPost } from "./handlers/desktopAgentRuntimeTurnHandler";
+import {
+  handleDesktopUpdaterGet,
+  handleDesktopUpdaterPost,
+} from "./handlers/desktopUpdaterHandler";
+import { handleDesktopClipboardPost } from "./handlers/desktopClipboardHandler";
+import type { DesktopFilesRoute } from "./handlers/desktopFiles/handler";
+import { createApiRouteFamily } from "./apiRouteAdapter";
+
+async function handleDesktopLocalConnectorStartRoute(req: Request) {
+  const { handleDesktopLocalConnectorStart } = await import(
+    "./handlers/desktopLocalConnectorHandler"
+  );
+  return handleDesktopLocalConnectorStart(req);
+}
+
+async function handleDesktopFilesRoute(req: Request, route: DesktopFilesRoute) {
+  const { handleDesktopFilesRequest } = await import("./handlers/desktopFiles/handler");
+  return handleDesktopFilesRequest(req, { route });
+}
+
+export const desktopRuntimeRoutes: Record<string, any> = createApiRouteFamily([
+  {
+    path: "/api/desktop-updater",
+    handlers: {
+      GET: handleDesktopUpdaterGet,
+      POST: handleDesktopUpdaterPost,
+    },
+  },
+  {
+    path: "/api/desktop/clipboard",
+    handlers: {
+      POST: handleDesktopClipboardPost,
+    },
+  },
+  {
+    path: "/api/desktop/provider-runtime",
+    handlers: {
+      GET: handleDesktopLlamaRuntimeGet,
+      POST: handleDesktopLlamaRuntimePost,
+    },
+  },
+  {
+    path: "/api/desktop/agent-runtime/status",
+    handlers: {
+      GET: handleDesktopAgentRuntimeStatusGet,
+    },
+  },
+  {
+    path: "/api/desktop/agent-runtime/turn",
+    handlers: {
+      POST: handleDesktopAgentRuntimeTurnPost,
+    },
+  },
+  {
+    path: "/api/desktop/local-connector/start",
+    handlers: {
+      POST: handleDesktopLocalConnectorStartRoute,
+    },
+  },
+  {
+    path: "/api/desktop/files/roots",
+    handlers: {
+      GET: (req: Request) => handleDesktopFilesRoute(req, "roots"),
+    },
+  },
+  {
+    path: "/api/desktop/files/roots/request",
+    handlers: {
+      POST: (req: Request) => handleDesktopFilesRoute(req, "requestRoot"),
+    },
+  },
+  {
+    path: "/api/desktop/files/list",
+    handlers: {
+      POST: (req: Request) => handleDesktopFilesRoute(req, "list"),
+    },
+  },
+  {
+    path: "/api/desktop/files/read",
+    handlers: {
+      POST: (req: Request) => handleDesktopFilesRoute(req, "read"),
+    },
+  },
+  {
+    path: "/api/desktop/files/plan",
+    handlers: {
+      POST: (req: Request) => handleDesktopFilesRoute(req, "plan"),
+    },
+  },
+  {
+    path: "/api/desktop/files/approve",
+    handlers: {
+      POST: (req: Request) => handleDesktopFilesRoute(req, "approve"),
+    },
+  },
+  {
+    path: "/api/desktop/files/execute",
+    handlers: {
+      POST: (req: Request) => handleDesktopFilesRoute(req, "execute"),
+    },
+  },
+  {
+    path: "/api/desktop/files/undo",
+    handlers: {
+      POST: (req: Request) => handleDesktopFilesRoute(req, "undo"),
+    },
+  },
+  {
+    path: "/api/desktop/files/history",
+    handlers: {
+      GET: (req: Request) => handleDesktopFilesRoute(req, "history"),
+    },
+  },
+]);

package/server/devBuildInfo.ts

@@ -0,0 +1,51 @@
+import { readFileSync } from "node:fs";
+import { resolvePublicPath } from "./publicPaths";
+
+const FILE_PATH = resolvePublicPath(".dev-reload-version");
+
+export type BuildInfo = {
+  version: string;
+  builtAt: number;
+  buildMs?: number;
+};
+
+export const parseBuildInfo = (rawValue: string, fallbackBuiltAt = Date.now()): BuildInfo | null => {
+  const raw = rawValue.trim();
+  if (!raw) return null;
+
+  if (!raw.startsWith("{")) {
+    const builtAt = Number(raw) || fallbackBuiltAt;
+    return { version: String(raw), builtAt };
+  }
+
+  const obj = JSON.parse(raw);
+  if (!obj || typeof obj.version !== "string") return null;
+
+  const info: BuildInfo = {
+    version: obj.version,
+    builtAt: typeof obj.builtAt === "number" ? obj.builtAt : 0,
+  };
+
+  if (typeof obj.buildMs === "number") {
+    info.buildMs = obj.buildMs;
+  }
+
+  return info;
+};
+
+export const readBuildInfoSync = (): BuildInfo | null => {
+  try {
+    return parseBuildInfo(readFileSync(FILE_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+};
+
+export const readBuildInfo = async (): Promise<BuildInfo | null> => {
+  try {
+    const raw = await Bun.file(FILE_PATH).text();
+    return parseBuildInfo(raw);
+  } catch {
+    return null;
+  }
+};

package/server/devReload.ts

@@ -0,0 +1,161 @@
+// packages/server/devReload.ts
+//
+// - /dev-reload SSE
+// - esbuild 在 dev 构建成功后写 public/.dev-reload-version（JSON {version,builtAt,buildMs}）
+// - server 用 fs.watch 监听变化，变化即广播 reload（快）
+// - 用轮询做兜底（稳）
+// - SSE 连接建立时做版本对账（cv != sv 立刻 reload）
+// - SSE 设置 retry: 200，断线后更快重连（降低 buildToEventMs）
+
+import { isProduction } from "../app/utils/env";
+import { watch } from "node:fs";
+import { readBuildInfoSync, type BuildInfo } from "./devBuildInfo";
+
+export const ENABLE_LIVE_RELOAD =
+  !isProduction ||
+  (typeof process !== "undefined" && process.env.ENABLE_LIVE_RELOAD === "1");
+
+const encoder = new TextEncoder();
+const enc = (s: string) => encoder.encode(s);
+
+const PUBLIC_DIR = "public";
+const FILE_NAME = ".dev-reload-version";
+
+const clients = new Set<WritableStreamDefaultWriter<Uint8Array>>();
+
+// background
+let fsWatcher: ReturnType<typeof watch> | null = null;
+let pollTimer: Timer | null = null;
+let keepAliveTimer: Timer | null = null;
+
+let lastVersion: string | null = null;
+
+const broadcastReload = (info: BuildInfo, reason: string) => {
+  const payload =
+    `event: reload\n` + `data: ${JSON.stringify({ ...info, reason })}\n\n`;
+
+  for (const writer of clients) {
+    writer.write(enc(payload)).catch(() => {
+      clients.delete(writer);
+      try {
+        writer.close();
+      } catch { }
+    });
+  }
+};
+
+const handleMaybeChanged = (reason: string) => {
+  const info = readBuildInfoSync();
+  if (!info) return;
+
+  if (info.version !== lastVersion) {
+    lastVersion = info.version;
+    console.log("🔁 dev-reload changed:", info, "reason:", reason);
+    broadcastReload(info, reason);
+  }
+};
+
+const startBackgroundIfNeeded = () => {
+  if (fsWatcher || pollTimer || keepAliveTimer) return;
+
+  lastVersion = readBuildInfoSync()?.version ?? null;
+
+  fsWatcher = watch(PUBLIC_DIR, (eventType, filename) => {
+    if (!filename || filename === FILE_NAME) {
+      handleMaybeChanged(`fs.watch:${eventType}`);
+    }
+  });
+
+  pollTimer = setInterval(() => handleMaybeChanged("poll"), 1000);
+
+  keepAliveTimer = setInterval(() => {
+    const ping = enc(`: ping\n\n`);
+    for (const writer of clients) {
+      writer.write(ping).catch(() => {
+        clients.delete(writer);
+        try {
+          writer.close();
+        } catch { }
+      });
+    }
+  }, 15_000);
+};
+
+const stopBackgroundIfIdle = () => {
+  if (clients.size > 0) return;
+
+  if (fsWatcher) {
+    try {
+      fsWatcher.close();
+    } catch { }
+    fsWatcher = null;
+  }
+  if (pollTimer) {
+    clearInterval(pollTimer);
+    pollTimer = null;
+  }
+  if (keepAliveTimer) {
+    clearInterval(keepAliveTimer);
+    keepAliveTimer = null;
+  }
+};
+
+const createSseResponse = (
+  req: Request,
+  onStart: (writer: WritableStreamDefaultWriter<Uint8Array>) => void
+) => {
+  const { readable, writable } = new TransformStream<Uint8Array, Uint8Array>();
+  const writer = writable.getWriter();
+
+  // 关键：让浏览器断线后更快重连（默认可能是几秒）
+  writer.write(enc(`retry: 200\n`)).catch(() => { });
+
+  // 让浏览器尽快认为连接建立
+  writer.write(enc(`: connected\n\n`)).catch(() => { });
+
+  onStart(writer);
+
+  // 客户端断开时尽量关掉 writer
+  req.signal.addEventListener("abort", () => {
+    try {
+      writer.close();
+    } catch { }
+  });
+
+  return new Response(readable, {
+    status: 200,
+    headers: {
+      "Content-Type": "text/event-stream",
+      "Cache-Control": "no-cache",
+      Connection: "keep-alive",
+      "Access-Control-Allow-Origin": "*",
+    },
+  });
+};
+
+export const devReloadRoute = (req: Request) => {
+  if (!ENABLE_LIVE_RELOAD)
+    return new Response("live reload disabled", { status: 404 });
+
+  const url = new URL(req.url);
+  const clientVersion = url.searchParams.get("cv") || "";
+
+  return createSseResponse(req, (writer) => {
+    clients.add(writer);
+    startBackgroundIfNeeded();
+
+    // 连接对账：客户端落后就立刻补 reload（根治 server 重启错过边沿）
+    const info = readBuildInfoSync();
+    if (info?.version && clientVersion && info.version !== clientVersion) {
+      const payload =
+        `event: reload\n` +
+        `data: ${JSON.stringify({ ...info, reason: "mismatch" })}\n\n`;
+      writer.write(enc(payload)).catch(() => { });
+    }
+
+    req.signal.addEventListener("abort", () => {
+      clients.delete(writer);
+      stopBackgroundIfIdle();
+    });
+  });
+};

package/server/devToolPathPolicy.ts

@@ -0,0 +1,59 @@
+import { realpathSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { isAbsolute, resolve, sep } from "node:path";
+
+export const envList = (value: string | undefined): string[] =>
+    String(value ?? "")
+        .split(",")
+        .map((item) => item.trim())
+        .filter(Boolean);
+
+export const normalizeRoots = (roots: string[]): string[] =>
+    roots.map((root) => resolve(root)).filter(Boolean);
+
+export const pathInsideRoot = (candidate: string, root: string): boolean => {
+    const normalizedRoot = root.endsWith(sep) ? root.slice(0, -1) : root;
+    return candidate === normalizedRoot || candidate.startsWith(`${normalizedRoot}${sep}`);
+};
+
+const realpathIfExists = (path: string): string | null => {
+    try {
+        return realpathSync.native(path);
+    } catch {
+        return null;
+    }
+};
+
+export function getDefaultDevToolAllowedRoots(
+    env: NodeJS.ProcessEnv = process.env
+): string[] {
+    const roots = [process.cwd(), "/tmp", "/private/tmp", tmpdir()];
+    if (env.NOLO_DESKTOP === "1") {
+        roots.push(homedir());
+    }
+
+    const expanded = new Set<string>();
+    for (const root of roots) {
+        const resolved = resolve(root);
+        expanded.add(resolved);
+        const real = realpathIfExists(resolved);
+        if (real) expanded.add(real);
+    }
+    return [...expanded];
+}
+
+export function resolveDevToolPathWithinRoots(
+    rawPath: string,
+    allowedRoots: string[]
+): string {
+    const candidate = resolve(isAbsolute(rawPath) ? rawPath : resolve(process.cwd(), rawPath));
+    const roots = normalizeRoots(allowedRoots);
+    if (!roots.some((root) => pathInsideRoot(candidate, root))) {
+        throw new Error(`Forbidden: path outside allowed roots: ${rawPath}`);
+    }
+    return candidate;
+}
+
+export function resolveProjectFilePath(filePath: string): string {
+    return resolveDevToolPathWithinRoots(filePath, [process.cwd()]);
+}

package/server/devToolRoutes.ts

@@ -0,0 +1,274 @@
+import { handleWriteFile } from "./handlers/writeFileHandler";
+import { handleActivityStats } from "./handlers/activityStatsHandler";
+import { handleReadFile } from "./handlers/readFileHandler";
+import { handleExecShell } from "./handlers/execShellHandler";
+import { handleCodeSearch } from "./handlers/codeSearchHandler";
+import { handleSearchRepo } from "./handlers/searchRepoHandler";
+import { handleListFiles } from "./handlers/listFilesHandler";
+import { handleApplyEdit } from "./handlers/applyEditHandler";
+import { handleApplyLineEdits } from "./handlers/applyLineEditsHandler";
+import { handleCheckEnv } from "./handlers/checkEnvHandler";
+import { isAbsolute, resolve, sep } from "node:path";
+
+const CORS_HEADERS: Record<string, string> = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "POST, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Nolo-Agent-Key, X-Nolo-Desktop-Tool",
+  "Access-Control-Max-Age": "86400",
+};
+
+const options = () => new Response(null, { status: 204, headers: CORS_HEADERS });
+const forbidden = () =>
+  new Response("Forbidden: dev tools disabled in production", { status: 403 });
+
+const DEFAULT_ALLOWED_AGENT_KEYS = [
+  "agent-b2e06f801f-01FRONTENDAG0000000115N4E1",
+  "agent-b2e06f801f-01NOLOFULLSTK00000001J740Q",
+];
+
+const DEFAULT_ALLOWED_AGENT_KEY_PREFIXES = [
+  // Private benchmark agents inherit a coding-agent model config but use
+  // scenario-specific prompts/tools. They need the same local dev tool access
+  // so token/tool regressions measure agent behavior instead of allowlist noise.
+  "agent-b2e06f801f-01AGTBENCH",
+];
+
+const DEFAULT_ALLOWED_AGENT_KEY_SUFFIXES = [
+  // Built-in Nolo is copied into each user's private namespace but keeps this
+  // stable id suffix. Desktop mode gives that default entry local file/bash tools.
+  "01NOLOAPPBLD000000019KCKT0",
+];
+
+export type DevToolPolicy = {
+  requireAgentKey?: boolean;
+  allowedAgentKeys?: string[];
+  allowedAgentKeyPrefixes?: string[];
+  allowedAgentKeySuffixes?: string[];
+  allowedRoots?: string[];
+};
+
+const envList = (value: string | undefined): string[] =>
+  String(value ?? "")
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+
+const normalizeRoots = (roots: string[]): string[] =>
+  roots.map((root) => resolve(root)).filter(Boolean);
+
+const pathInsideRoot = (candidate: string, root: string): boolean => {
+  const normalizedRoot = root.endsWith(sep) ? root.slice(0, -1) : root;
+  return candidate === normalizedRoot || candidate.startsWith(`${normalizedRoot}${sep}`);
+};
+
+const resolvePolicy = (policy?: DevToolPolicy): Required<DevToolPolicy> => {
+  const envAllowedAgentKeys = envList(process.env.DEV_TOOL_ALLOWED_AGENT_KEYS);
+  const envAllowedAgentKeyPrefixes = envList(
+    process.env.DEV_TOOL_ALLOWED_AGENT_KEY_PREFIXES
+  );
+  const envAllowedAgentKeySuffixes = envList(
+    process.env.DEV_TOOL_ALLOWED_AGENT_KEY_SUFFIXES
+  );
+  const envAllowedRoots = envList(process.env.DEV_TOOL_ALLOWED_ROOTS);
+  const defaultAndEnvAllowedAgentKeys = Array.from(
+    new Set([...DEFAULT_ALLOWED_AGENT_KEYS, ...envAllowedAgentKeys])
+  );
+  return {
+    requireAgentKey:
+      policy?.requireAgentKey ??
+      (process.env.DEV_TOOL_REQUIRE_AGENT === "1" ||
+        process.env.NOLO_DESKTOP === "1" ||
+        process.env.NODE_ENV === "production"),
+    allowedAgentKeys:
+      policy?.allowedAgentKeys ??
+      (envAllowedAgentKeys.length > 0
+        ? defaultAndEnvAllowedAgentKeys
+        : DEFAULT_ALLOWED_AGENT_KEYS),
+    allowedAgentKeyPrefixes:
+      policy?.allowedAgentKeyPrefixes ??
+      Array.from(
+        new Set([
+          ...DEFAULT_ALLOWED_AGENT_KEY_PREFIXES,
+          ...envAllowedAgentKeyPrefixes,
+        ])
+      ),
+    allowedAgentKeySuffixes:
+      policy?.allowedAgentKeySuffixes ??
+      Array.from(
+        new Set([
+          ...DEFAULT_ALLOWED_AGENT_KEY_SUFFIXES,
+          ...envAllowedAgentKeySuffixes,
+        ])
+      ),
+    allowedRoots: normalizeRoots(
+      policy?.allowedRoots ??
+        (envAllowedRoots.length > 0
+          ? envAllowedRoots
+          : process.env.NOLO_DESKTOP === "1" && process.env.HOME
+            ? [process.cwd(), process.env.HOME, "/tmp"]
+            : [process.cwd(), "/tmp"])
+    ),
+  };
+};
+
+const readJsonBody = async (req: Request): Promise<Record<string, any>> => {
+  try {
+    const value = await req.clone().json();
+    return value && typeof value === "object" ? value as Record<string, any> : {};
+  } catch {
+    return {};
+  }
+};
+
+const extractPathValues = (body: Record<string, any>): string[] => {
+  const values: string[] = [];
+  for (const key of ["filePath", "cwd", "path", "pathScope", "root", "dir", "dirPath"]) {
+    const value = body[key];
+    if (typeof value === "string" && value.trim()) values.push(value.trim());
+  }
+  if (Array.isArray(body.edits)) {
+    for (const edit of body.edits) {
+      const filePath = edit?.filePath;
+      if (typeof filePath === "string" && filePath.trim()) values.push(filePath.trim());
+    }
+  }
+  return values;
+};
+
+const isBlockedShellCommand = (body: Record<string, any>): boolean => {
+  const command = typeof body.command === "string" ? body.command : "";
+  return /\b(rm\s+-rf|git\s+reset\s+--hard|mkfs|sudo|curl\b[^|;&]*\|\s*(sh|bash)|wget\b[^|;&]*\|\s*(sh|bash))\b/i.test(
+    command
+  );
+};
+
+const isLoopbackRequest = (req: Request): boolean => {
+  try {
+    const hostname = new URL(req.url).hostname.toLowerCase();
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1";
+  } catch {
+    return false;
+  }
+};
+
+const isTrustedDesktopSameOriginRequest = (req: Request): boolean => {
+  if (process.env.NOLO_DESKTOP !== "1" || !isLoopbackRequest(req)) return false;
+  const secFetchSite = (req.headers.get("sec-fetch-site") ?? "").toLowerCase();
+  if (secFetchSite === "same-origin") return true;
+  if ((req.headers.get("x-nolo-desktop-tool") ?? "") === "1") return true;
+
+  let requestOrigin = "";
+  try {
+    requestOrigin = new URL(req.url).origin;
+  } catch {
+    return false;
+  }
+
+  const origin = req.headers.get("origin");
+  if (origin && origin === requestOrigin) return true;
+
+  const referer = req.headers.get("referer");
+  if (referer) {
+    try {
+      return new URL(referer).origin === requestOrigin;
+    } catch {
+      return false;
+    }
+  }
+
+  return false;
+};
+
+async function guardDevToolRequest(
+  req: Request,
+  routePath: string,
+  policy?: DevToolPolicy
+): Promise<Response | null> {
+  const resolvedPolicy = resolvePolicy(policy);
+  if (!resolvedPolicy.requireAgentKey) return null;
+
+  const agentKey = (req.headers.get("x-nolo-agent-key") ?? "").trim();
+  const allowsAnyAgent = resolvedPolicy.allowedAgentKeys.includes("*");
+  const agentAllowed =
+    !!agentKey &&
+    (allowsAnyAgent ||
+      resolvedPolicy.allowedAgentKeys.includes(agentKey) ||
+      resolvedPolicy.allowedAgentKeyPrefixes.some((prefix) =>
+        agentKey.startsWith(prefix)
+      ) ||
+      resolvedPolicy.allowedAgentKeySuffixes.some((suffix) =>
+        agentKey.endsWith(suffix) || agentKey.endsWith(`-${suffix}`)
+      ));
+
+  const authorization = req.headers.get("authorization") ?? "";
+  const hasBearerAuth = authorization.toLowerCase().startsWith("bearer ");
+  const trustedDesktopSameOrigin = isTrustedDesktopSameOriginRequest(req);
+  if (!hasBearerAuth && !(agentAllowed && isLoopbackRequest(req)) && !trustedDesktopSameOrigin) {
+    return new Response("Forbidden: dev tool auth required", { status: 403 });
+  }
+
+  if (!agentAllowed && !trustedDesktopSameOrigin) {
+    return new Response("Forbidden: dev tool agent not allowed", { status: 403 });
+  }
+
+  const body = await readJsonBody(req);
+  if (routePath === "/api/exec-shell") {
+    if (isBlockedShellCommand(body)) {
+      return new Response("Forbidden: destructive shell command blocked", { status: 403 });
+    }
+  }
+
+  for (const rawPath of extractPathValues(body)) {
+    const candidate = resolve(isAbsolute(rawPath) ? rawPath : resolve(process.cwd(), rawPath));
+    if (!resolvedPolicy.allowedRoots.some((root) => pathInsideRoot(candidate, root))) {
+      return new Response(`Forbidden: path outside allowed roots: ${rawPath}`, { status: 403 });
+    }
+  }
+
+  console.info("[dev-tool] allowed", { routePath, agentKey });
+  return null;
+}
+
+const devOnly =
+  (
+    devToolsEnabled: boolean,
+    handler: (req: Request) => Response | Promise<Response>,
+    routePath: string,
+    policy?: DevToolPolicy
+  ) =>
+  async (req: Request) => {
+    if (!devToolsEnabled) return forbidden();
+    const blocked = await guardDevToolRequest(req, routePath, policy);
+    if (blocked) return blocked;
+    return handler(req);
+  };
+
+export function createDevToolRoutes({
+  devToolsEnabled,
+  devToolPolicy,
+}: {
+  devToolsEnabled: boolean;
+  devToolPolicy?: DevToolPolicy;
+}): Record<string, any> {
+  const post = (routePath: string, handler: (req: Request) => Response | Promise<Response>) => ({
+    POST: devOnly(devToolsEnabled, handler, routePath, devToolPolicy),
+    OPTIONS: options,
+  });
+  const get = (routePath: string, handler: (req: Request) => Response | Promise<Response>) => ({
+    GET: devOnly(devToolsEnabled, handler, routePath, devToolPolicy),
+    OPTIONS: options,
+  });
+
+  return {
+    "/api/write-file": post("/api/write-file", handleWriteFile),
+    "/api/read-file": post("/api/read-file", handleReadFile),
+    "/api/exec-shell": post("/api/exec-shell", handleExecShell),
+    "/api/code-search": post("/api/code-search", handleCodeSearch),
+    "/api/search-repo": post("/api/search-repo", handleSearchRepo),
+    "/api/list-files": post("/api/list-files", handleListFiles),
+    "/api/apply-edit": post("/api/apply-edit", handleApplyEdit),
+    "/api/apply-line-edits": post("/api/apply-line-edits", handleApplyLineEdits),
+    "/api/check-env": post("/api/check-env", handleCheckEnv),
+    "/api/admin/activity-stats": get("/api/admin/activity-stats", handleActivityStats),
+  };
+}