npm - openwriter - Versions diffs - 0.38.0 → 0.40.0 - Mend

openwriter 0.38.0 → 0.40.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (48) hide show

package/dist/client/assets/inter-latin-wght-italic-DpCbqKDY.woff2 ADDED Viewed

Binary file

package/dist/client/assets/inter-latin-wght-normal-Dx4kXJAl.woff2 ADDED Viewed

Binary file

package/dist/client/assets/libre-baskerville-latin-400-italic-Dx5Rrf3o.woff2 ADDED Viewed

Binary file

package/dist/client/assets/libre-baskerville-latin-400-normal-C42RasBZ.woff2 ADDED Viewed

Binary file

package/dist/client/assets/libre-baskerville-latin-700-normal-CLGq6Yj4.woff2 ADDED Viewed

Binary file

package/dist/client/assets/literata-latin-wght-italic-Bm_GJfSc.woff2 ADDED Viewed

Binary file

package/dist/client/assets/literata-latin-wght-normal-DLxlUchJ.woff2 ADDED Viewed

Binary file

package/dist/client/assets/newsreader-latin-wght-italic-Bxi8ein9.woff2 ADDED Viewed

Binary file

package/dist/client/assets/newsreader-latin-wght-normal-CCVVNp6i.woff2 ADDED Viewed

Binary file

package/dist/client/assets/playfair-display-latin-wght-italic-DmbndNpe.woff2 ADDED Viewed

Binary file

package/dist/client/assets/playfair-display-latin-wght-normal-BOwq7MWX.woff2 ADDED Viewed

Binary file

package/dist/client/assets/source-serif-4-latin-wght-italic-D2yaqPoE.woff2 ADDED Viewed

Binary file

package/dist/client/assets/source-serif-4-latin-wght-normal-D9elroTD.woff2 ADDED Viewed

Binary file

package/dist/client/assets/space-grotesk-latin-wght-normal-BhU9QXUp.woff2 ADDED Viewed

Binary file

package/dist/client/assets/space-mono-latin-400-italic-YylcN9Ay.woff2 ADDED Viewed

Binary file

package/dist/client/assets/space-mono-latin-400-normal-Rg4St2Dn.woff2 ADDED Viewed

Binary file

package/dist/client/assets/space-mono-latin-700-normal-mWgeinG7.woff2 ADDED Viewed

Binary file

package/dist/client/index.html CHANGED Viewed

@@ -7,11 +7,11 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16.png" />
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
     <title>OpenWriter</title>
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin />
-    <link href="https://fonts.googleapis.com/css2?family=Charter:ital,wght@0,400;0,700;1,400&family=Crimson+Pro:ital,wght@0,300;0,400;0,600;0,700;1,400&family=DM+Sans:ital,wght@0,400;0,500;0,600;0,700;1,400&family=DM+Serif+Display&family=IBM+Plex+Mono:wght@400;500;600&family=IBM+Plex+Sans:wght@400;500;600&family=Inter:wght@400;500;600;700&family=Libre+Baskerville:ital,wght@0,400;0,700;1,400&family=Literata:ital,opsz,wght@0,7..72,400;0,7..72,600;0,7..72,700;1,7..72,400&family=Newsreader:ital,opsz,wght@0,6..72,400;0,6..72,600;1,6..72,400&family=Playfair+Display:wght@400;600;700;900&family=Source+Serif+4:ital,opsz,wght@0,8..60,400;0,8..60,600;0,8..60,700;1,8..60,400&family=Space+Grotesk:wght@400;500;600;700&family=Space+Mono:wght@400;700&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/assets/index-C_Zb7mUx.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-2miZWC8D.css">
+    <!-- Fonts are self-hosted (bundled via @fontsource, imported in main.tsx →
+         themes/vendored-fonts.css). No external font CDN: a local-first editor
+         must work offline and behind content blockers. -->
+    <script type="module" crossorigin src="/assets/index-vmEPerKn.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-DiJrXBgV.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/plugins/github/dist/blog-tools.js CHANGED Viewed

@@ -11,10 +11,16 @@ import { randomUUID } from 'crypto';
 import { homedir } from 'os';
 import { getServerModules, listBlogSites, writeBlogSites, } from './helpers.js';
 const NETWORK_TIMEOUT = 60000;
+// SECURITY (MCP-1): no shell. `git`/`gh` are spawned directly via execFile
+// with an argv array, so every element — including attacker-influenced blog
+// config values (owner/repo/branch) and slugs — is passed to the program as a
+// single literal argument and is NEVER interpreted by a shell. Do NOT add
+// `shell: true` or hand-roll arg quoting here: that reintroduces OS command
+// injection. If a future call genuinely needs shell features, whitelist-
+// validate the inputs instead.
 function exec(cmd, args, cwd, timeout = NETWORK_TIMEOUT) {
-    const safeArgs = args.map(a => a.includes(' ') ? `"${a}"` : a);
     return new Promise((resolve, reject) => {
-        execFile(cmd, safeArgs, { cwd, shell: true, timeout, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+        execFile(cmd, args, { cwd, timeout, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
             if (err)
                 reject(new Error(stderr?.trim() || err.message));
             else

package/dist/plugins/github/dist/git-sync.d.ts CHANGED Viewed

@@ -2,7 +2,11 @@
  * Git sync module: all git/gh CLI interactions for GitHub docs backup.
  * Lifted from packages/openwriter/server/git-sync.ts into the github plugin.
  *
- * Uses child_process.execFile with shell:true (required on Windows).
+ * Uses child_process.execFile with an argv array and NO shell (MCP-1): values
+ * are passed to git/gh as literal arguments, never interpreted by a shell.
+ * The GitHub PAT is supplied to authenticated pushes out-of-band via an
+ * inline credential helper reading from an env var (MCP-3) — it is never
+ * embedded in the remote URL, written to .git/config, or placed in argv.
  * Server-internal modules (state, helpers, ws) accessed via getServerModules().
  */
 export type SyncState = 'unconfigured' | 'synced' | 'pending' | 'syncing' | 'error';
@@ -19,6 +23,12 @@ export interface SyncCapabilities {
     existingRepo: boolean;
     remoteUrl?: string;
 }
+/**
+ * Strip any embedded credentials (PAT / user:pass) from a git remote URL so a
+ * credential-bearing URL is never returned to a client or logged. SSH scp-style
+ * remotes (git@github.com:owner/repo.git) carry no secret and are left as-is.
+ */
+export declare function sanitizeRemoteUrl(url: string): string;
 export declare function isGitInstalled(): Promise<boolean>;
 export declare function isGhInstalled(): Promise<boolean>;
 export declare function isGhAuthenticated(): Promise<boolean>;

package/dist/plugins/github/dist/git-sync.js CHANGED Viewed

@@ -2,7 +2,11 @@
  * Git sync module: all git/gh CLI interactions for GitHub docs backup.
  * Lifted from packages/openwriter/server/git-sync.ts into the github plugin.
  *
- * Uses child_process.execFile with shell:true (required on Windows).
+ * Uses child_process.execFile with an argv array and NO shell (MCP-1): values
+ * are passed to git/gh as literal arguments, never interpreted by a shell.
+ * The GitHub PAT is supplied to authenticated pushes out-of-band via an
+ * inline credential helper reading from an env var (MCP-3) — it is never
+ * embedded in the remote URL, written to .git/config, or placed in argv.
  * Server-internal modules (state, helpers, ws) accessed via getServerModules().
  */
 import { execFile } from 'child_process';
@@ -13,10 +17,12 @@ const GITIGNORE_CONTENT = `config.json\n.versions/\n`;
 const NETWORK_TIMEOUT = 30000;
 let currentSyncState = 'unconfigured';
 let lastError;
-function exec(cmd, args, cwd, timeout = 10000) {
-    const safeArgs = args.map(a => a.includes(' ') ? `"${a}"` : a);
+// SECURITY (MCP-1): no shell. Arguments are passed to git/gh as an argv array,
+// so each element is a single literal argument with no shell interpretation.
+// The optional `env` is merged over the parent process env for that one call.
+function exec(cmd, args, cwd, timeout = 10000, env) {
     return new Promise((resolve, reject) => {
-        execFile(cmd, safeArgs, { cwd, shell: true, timeout }, (err, stdout, stderr) => {
+        execFile(cmd, args, { cwd, timeout, env: env ? { ...process.env, ...env } : process.env }, (err, stdout, stderr) => {
             if (err)
                 reject(new Error(stderr?.trim() || err.message));
             else
@@ -24,6 +30,42 @@ function exec(cmd, args, cwd, timeout = 10000) {
         });
     });
 }
+// ── Credential handling (MCP-3) ─────────────────────────────────────────────
+// The PAT is supplied to authenticated git pushes WITHOUT ever touching the
+// remote URL, .git/config, or argv. An inline credential helper (run by git
+// through its own sh) reads the token from the OW_GIT_PAT env var at call time;
+// only the variable *name* appears in arguments, never the secret itself.
+const PAT_CRED_HELPER = '!f() { test "$1" = get && printf "username=x-access-token\\npassword=%s\\n" "$OW_GIT_PAT"; }; f';
+/**
+ * Run a git command that needs the PAT for network auth (push/fetch against a
+ * private remote). The `-c credential.helper=` first resets any inherited
+ * helper so only ours answers; the token is passed via env, not argv. The
+ * remote URL stays credential-free.
+ */
+function execGitWithPat(args, cwd, pat, timeout = NETWORK_TIMEOUT) {
+    const authArgs = ['-c', 'credential.helper=', '-c', `credential.helper=${PAT_CRED_HELPER}`];
+    return exec('git', [...authArgs, ...args], cwd, timeout, { OW_GIT_PAT: pat });
+}
+/**
+ * Strip any embedded credentials (PAT / user:pass) from a git remote URL so a
+ * credential-bearing URL is never returned to a client or logged. SSH scp-style
+ * remotes (git@github.com:owner/repo.git) carry no secret and are left as-is.
+ */
+export function sanitizeRemoteUrl(url) {
+    try {
+        const u = new URL(url);
+        if (u.username || u.password) {
+            u.username = '';
+            u.password = '';
+        }
+        return u.toString();
+    }
+    catch {
+        // Not a parseable URL (e.g. ssh scp-like form) — defensively drop any
+        // userinfo that precedes an @ in a scheme://… authority.
+        return url.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^/@]*@/i, '$1');
+    }
+}
 async function dataDir() {
     return (await getServerModules()).getDataDir();
 }
@@ -127,7 +169,10 @@ export async function getCapabilities() {
     let remoteUrl;
     if (await isGitRepo()) {
         try {
-            remoteUrl = await exec('git', ['remote', 'get-url', 'origin'], await dataDir());
+            // MCP-3: never expose embedded credentials. Even though the remote is
+            // now stored credential-free, strip defensively so a legacy URL written
+            // by an older build (PAT-in-URL) can't leak through this route.
+            remoteUrl = sanitizeRemoteUrl(await exec('git', ['remote', 'get-url', 'origin'], await dataDir()));
         }
         catch { /* no remote */ }
     }
@@ -199,7 +244,9 @@ export async function setupWithPat(pat, repoName, isPrivate) {
         throw new Error(body.message || `GitHub API error: ${res.status}`);
     }
     const repo = await res.json();
-    const remoteUrl = `https://${pat}@github.com/${repo.full_name}.git`;
+    // MCP-3: store a credential-free remote. The PAT is supplied per-push via
+    // the credential helper (execGitWithPat), never embedded in the URL.
+    const remoteUrl = `https://github.com/${repo.full_name}.git`;
     await initRepo();
     await initialCommit();
     try {
@@ -207,7 +254,7 @@ export async function setupWithPat(pat, repoName, isPrivate) {
     }
     catch { /* no remote */ }
     await exec('git', ['remote', 'add', 'origin', remoteUrl], dir);
-    await exec('git', ['push', '-u', 'origin', 'main'], dir, NETWORK_TIMEOUT);
+    await execGitWithPat(['push', '-u', 'origin', 'main'], dir, pat, NETWORK_TIMEOUT);
     srv.saveConfig({
         gitConfigured: true,
         gitPat: pat,
@@ -222,20 +269,24 @@ export async function connectExisting(remoteUrl, pat) {
     const dir = await dataDir();
     await initRepo();
     await initialCommit();
-    let finalUrl = remoteUrl;
-    if (pat && remoteUrl.startsWith('https://')) {
-        finalUrl = remoteUrl.replace('https://', `https://${pat}@`);
-    }
+    // MCP-3: keep the remote credential-free; never splice the PAT into the URL.
+    // Strip any credentials the caller may have included before storing/using it.
+    const finalUrl = sanitizeRemoteUrl(remoteUrl);
     try {
         await exec('git', ['remote', 'remove', 'origin'], dir);
     }
     catch { /* no remote */ }
     await exec('git', ['remote', 'add', 'origin', finalUrl], dir);
-    await exec('git', ['push', '-u', 'origin', 'main'], dir, NETWORK_TIMEOUT);
+    if (pat) {
+        await execGitWithPat(['push', '-u', 'origin', 'main'], dir, pat, NETWORK_TIMEOUT);
+    }
+    else {
+        await exec('git', ['push', '-u', 'origin', 'main'], dir, NETWORK_TIMEOUT);
+    }
     srv.saveConfig({
         gitConfigured: true,
         gitPat: pat,
-        gitRemote: remoteUrl,
+        gitRemote: finalUrl,
         lastSyncTime: new Date().toISOString(),
     });
     currentSyncState = 'synced';
@@ -258,7 +309,15 @@ export async function pushSync(onStatus) {
             });
             await exec('git', ['commit', '-m', `Sync: ${timestamp}`], dir);
         }
-        await exec('git', ['push'], dir, NETWORK_TIMEOUT);
+        // MCP-3: the remote is credential-free. When configured via PAT, supply
+        // the token out-of-band per-push; gh-based / SSH remotes auth on their own.
+        const pat = srv.readConfig()?.gitPat;
+        if (pat) {
+            await execGitWithPat(['push'], dir, pat, NETWORK_TIMEOUT);
+        }
+        else {
+            await exec('git', ['push'], dir, NETWORK_TIMEOUT);
+        }
         const now = new Date().toISOString();
         srv.saveConfig({ lastSyncTime: now });
         currentSyncState = 'synced';

package/dist/plugins/github/dist/index.js CHANGED Viewed

@@ -32,12 +32,18 @@ const plugin = {
                 console.error('[GitHub Plugin] broadcast failed:', err.message);
             }
         };
+        // MCP-15: log the real error server-side; return a generic message to the
+        // client so internal details (paths, git output, tokens) never leak.
+        const fail = (res, where, err, extra = {}) => {
+            console.error(`[GitHub Plugin] ${where} failed:`, err?.message || err);
+            res.status(500).json({ error: 'Internal error', ...extra });
+        };
         ctx.app.get('/api/sync/status', async (_req, res) => {
             try {
                 res.json(await getSyncStatus());
             }
             catch (err) {
-                res.status(500).json({ state: 'error', error: err.message });
+                fail(res, 'sync/status', err, { state: 'error' });
             }
         });
         ctx.app.get('/api/sync/capabilities', async (_req, res) => {
@@ -45,7 +51,7 @@ const plugin = {
                 res.json(await getCapabilities());
             }
             catch (err) {
-                res.status(500).json({ error: err.message });
+                fail(res, 'sync/capabilities', err);
             }
         });
         ctx.app.get('/api/sync/pending', async (_req, res) => {
@@ -53,7 +59,7 @@ const plugin = {
                 res.json(await getPendingFiles());
             }
             catch (err) {
-                res.status(500).json({ error: err.message });
+                fail(res, 'sync/pending', err);
             }
         });
         ctx.app.post('/api/sync/setup', async (req, res) => {
@@ -85,7 +91,11 @@ const plugin = {
                 res.json({ success: true, status });
             }
             catch (err) {
-                res.status(500).json({ error: err.message });
+                // Setup surfaces GitHub's own API feedback (e.g. "name already exists",
+                // "bad credentials") which is user-actionable; the remote is now
+                // credential-free so this carries no secret. Still log the full error.
+                console.error('[GitHub Plugin] sync/setup failed:', err?.message || err);
+                res.status(500).json({ error: err?.message || 'Setup failed' });
             }
         });
         ctx.app.post('/api/sync/push', async (_req, res) => {
@@ -94,7 +104,7 @@ const plugin = {
                 res.json(result);
             }
             catch (err) {
-                res.status(500).json({ state: 'error', error: err.message });
+                fail(res, 'sync/push', err, { state: 'error' });
             }
         });
     },

package/dist/plugins/x-api/dist/index.js CHANGED Viewed

@@ -8,23 +8,48 @@ import { join, extname } from 'path';
 import { readFileSync, existsSync } from 'fs';
 import sharp from 'sharp';
 import twitter from 'twitter-text';
+import { getServerBridge } from './server-bridge.js';
 const { parseTweet } = twitter;
-function createXClient(config) {
+/** X Articles API base. Two-step: draft, then publish. */
+const X_API_BASE = 'https://api.x.com/2';
+/** Build the OAuth1 signer from plugin config / env. Returns null when any of
+ *  the four credentials is missing. Shared by the SDK client and the raw
+ *  Articles calls (which the SDK doesn't model). */
+function createOAuth1(config) {
     const apiKey = config['api-key'] || process.env.X_API_KEY || '';
     const apiSecret = config['api-secret'] || process.env.X_API_SECRET || '';
     const accessToken = config['access-token'] || process.env.X_ACCESS_TOKEN || '';
     const accessTokenSecret = config['access-token-secret'] || process.env.X_ACCESS_TOKEN_SECRET || '';
     if (!apiKey || !apiSecret || !accessToken || !accessTokenSecret)
         return null;
-    const oauth1 = new OAuth1({
+    return new OAuth1({
         apiKey,
         apiSecret,
         callback: 'oob',
         accessToken,
         accessTokenSecret,
     });
+}
+function createXClient(config) {
+    const oauth1 = createOAuth1(config);
+    if (!oauth1)
+        return null;
     return new Client({ oauth1 });
 }
+/** Make an OAuth1-signed JSON request to the X API. The SDK has no Articles
+ *  resource, so we sign + fetch directly. `buildRequestHeader` correctly
+ *  excludes a JSON body from the OAuth1 signature base string. */
+async function xApiFetch(oauth1, method, path, body) {
+    const url = `${X_API_BASE}${path}`;
+    const bodyStr = body ? JSON.stringify(body) : '';
+    const authHeader = await oauth1.buildRequestHeader(method, url, bodyStr);
+    const headers = { Authorization: authHeader };
+    if (body)
+        headers['Content-Type'] = 'application/json';
+    const res = await fetch(url, { method, headers, body: body ? bodyStr : undefined });
+    const data = await res.json().catch(() => ({}));
+    return { ok: res.ok, status: res.status, data };
+}
 const plugin = {
     name: '@openwriter/plugin-x-api',
     version: '0.1.0',
@@ -235,6 +260,109 @@ const plugin = {
                 res.status(500).json({ success: false, error: err.message });
             }
         });
+        // POST /api/x/post-article — publish the active document as a native X
+        // Article. Two-step X flow: draft, then publish. Reads the active server
+        // doc (same source the managed/publish path reads) and converts it to X's
+        // DraftJS content_state via the shared converter.
+        ctx.app.post('/api/x/post-article', async (_req, res) => {
+            try {
+                const oauth1 = createOAuth1(ctx.config);
+                if (!oauth1) {
+                    res.status(400).json({ success: false, error: 'X API credentials not configured' });
+                    return;
+                }
+                const bridge = await getServerBridge();
+                const doc = bridge.getDocument();
+                const title = (bridge.getTitle() || '').trim();
+                const metadata = bridge.getMetadata() || {};
+                if (!title || title === 'Untitled') {
+                    res.status(400).json({ success: false, error: 'Article needs a title before posting.' });
+                    return;
+                }
+                const contentState = bridge.tiptapToDraftjs(doc);
+                if (!contentState.blocks.some((b) => (b.text || '').trim().length > 0)) {
+                    res.status(400).json({ success: false, error: 'Article body is empty.' });
+                    return;
+                }
+                // Optional cover image — upload to X and attach as cover_media.
+                let coverMedia;
+                const coverSrc = metadata?.articleContext?.coverImage;
+                if (coverSrc && typeof coverSrc === 'string' && /^\/_images\/[^/\\]+$/.test(coverSrc)) {
+                    const client = createXClient(ctx.config);
+                    if (client) {
+                        const mediaId = await uploadCoverMedia(client, ctx.dataDir, coverSrc);
+                        if (mediaId)
+                            coverMedia = { media_category: 'TWEET_IMAGE', media_id: mediaId };
+                    }
+                }
+                // Step 1 — create the draft.
+                const draftBody = { title, content_state: contentState };
+                if (coverMedia)
+                    draftBody.cover_media = coverMedia;
+                const draft = await xApiFetch(oauth1, 'POST', '/articles/draft', draftBody);
+                if (!draft.ok) {
+                    const detail = draft.data?.detail || draft.data?.title || JSON.stringify(draft.data);
+                    console.error('[X Plugin] Article draft failed:', draft.status, detail);
+                    res.status(draft.status || 500).json({ success: false, error: `Draft failed: ${detail}` });
+                    return;
+                }
+                const articleId = draft.data?.data?.id;
+                if (!articleId) {
+                    res.status(500).json({ success: false, error: 'Draft created but no article id returned.' });
+                    return;
+                }
+                // Step 2 — publish the draft (makes it public). Surface any error
+                // verbatim — a draft is private until this succeeds.
+                const published = await xApiFetch(oauth1, 'POST', `/articles/${articleId}/publish`);
+                if (!published.ok) {
+                    const detail = published.data?.detail || published.data?.title || JSON.stringify(published.data);
+                    console.error('[X Plugin] Article publish failed:', published.status, detail);
+                    res.status(published.status || 500).json({ success: false, articleId, error: `Publish failed: ${detail}` });
+                    return;
+                }
+                const postId = published.data?.data?.post_id;
+                const articleUrl = postId ? `https://x.com/i/status/${postId}` : undefined;
+                console.log(`[X Plugin] Article published: ${articleId} -> ${articleUrl}`);
+                res.json({ success: true, articleId, postId, articleUrl });
+            }
+            catch (err) {
+                const detail = err.data ? JSON.stringify(err.data) : err.message;
+                console.error('[X Plugin] Post article failed:', detail);
+                res.status(500).json({ success: false, error: detail });
+            }
+        });
     },
 };
+/** Upload an article cover image to X, returning its media_id. Mirrors the
+ *  /api/x/upload-media compression rules (>3MB or PNG -> JPEG). Returns null on
+ *  any failure — the article still posts, just without a cover. */
+async function uploadCoverMedia(client, dataDir, src) {
+    try {
+        const filename = src.replace('/_images/', '');
+        const filePath = join(dataDir, '_images', filename);
+        if (!existsSync(filePath))
+            return null;
+        const ext = extname(filename).toLowerCase();
+        const mimeMap = {
+            '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+            '.png': 'image/png', '.webp': 'image/webp',
+            '.gif': 'image/jpeg', '.bmp': 'image/bmp',
+            '.tiff': 'image/tiff', '.tif': 'image/tiff',
+        };
+        let fileBuffer = readFileSync(filePath);
+        let uploadType = mimeMap[ext] || 'image/jpeg';
+        if (fileBuffer.length > 3 * 1024 * 1024 || ext === '.png') {
+            fileBuffer = Buffer.from(await sharp(fileBuffer).jpeg({ quality: 85 }).toBuffer());
+            uploadType = 'image/jpeg';
+        }
+        const uploadResult = await client.media.upload({
+            body: { media: fileBuffer.toString('base64'), mediaCategory: 'tweet_image', mediaType: uploadType },
+        });
+        return uploadResult?.data?.id || uploadResult?.media_id_string || null;
+    }
+    catch (err) {
+        console.error('[X Plugin] Cover upload failed:', err.message);
+        return null;
+    }
+}
 export default plugin;

package/dist/plugins/x-api/dist/server-bridge.d.ts ADDED Viewed

@@ -0,0 +1,22 @@
+/**
+ * Thin runtime bridge to the OpenWriter server modules this plugin needs for
+ * article publishing — the active document, its title/metadata, the data dir,
+ * and the shared TipTap -> DraftJS converter.
+ *
+ * The converter (server/tiptap-draftjs.ts) is shared with plugins/publish so
+ * both posting paths produce identical X content_state. We import the compiled
+ * server module at runtime rather than vendoring it, resolving both the npm
+ * package layout and the monorepo layout — the same dual-path trick the publish
+ * plugin's helpers use.
+ */
+export interface ServerBridge {
+    getDocument: () => any;
+    getTitle: () => string;
+    getMetadata: () => Record<string, any>;
+    getDataDir: () => string;
+    tiptapToDraftjs: (doc: any) => {
+        blocks: any[];
+        entities: any[];
+    };
+}
+export declare function getServerBridge(): Promise<ServerBridge>;

package/dist/plugins/x-api/dist/server-bridge.js ADDED Viewed

@@ -0,0 +1,43 @@
+/**
+ * Thin runtime bridge to the OpenWriter server modules this plugin needs for
+ * article publishing — the active document, its title/metadata, the data dir,
+ * and the shared TipTap -> DraftJS converter.
+ *
+ * The converter (server/tiptap-draftjs.ts) is shared with plugins/publish so
+ * both posting paths produce identical X content_state. We import the compiled
+ * server module at runtime rather than vendoring it, resolving both the npm
+ * package layout and the monorepo layout — the same dual-path trick the publish
+ * plugin's helpers use.
+ */
+// npm package: dist/plugins/x-api/dist/server-bridge.js -> dist/server/
+// monorepo:    plugins/x-api/dist/server-bridge.js      -> packages/openwriter/dist/server/
+const npmBase = new URL('../../../server/', import.meta.url).href;
+const monoBase = new URL('../../../packages/openwriter/dist/server/', import.meta.url).href;
+let cached = null;
+async function tryImport(base) {
+    const [state, helpers, draftjs] = await Promise.all([
+        import(base + 'state.js'),
+        import(base + 'helpers.js'),
+        import(base + 'tiptap-draftjs.js'),
+    ]);
+    return { state, helpers, draftjs };
+}
+export async function getServerBridge() {
+    if (cached)
+        return cached;
+    let state, helpers, draftjs;
+    try {
+        ({ state, helpers, draftjs } = await tryImport(npmBase));
+    }
+    catch {
+        ({ state, helpers, draftjs } = await tryImport(monoBase));
+    }
+    cached = {
+        getDocument: state.getDocument,
+        getTitle: state.getTitle,
+        getMetadata: state.getMetadata,
+        getDataDir: helpers.getDataDir,
+        tiptapToDraftjs: draftjs.tiptapToDraftjs,
+    };
+    return cached;
+}

package/dist/server/connection-routes.js CHANGED Viewed

@@ -3,7 +3,12 @@
  * Local app no longer stores connections.
  */
 import { Router } from 'express';
+import { readFileSync, existsSync } from 'fs';
+import { join, extname } from 'path';
 import { platformFetch, isAuthenticated } from './connections.js';
+import { getDocument, getTitle, getMetadata } from './state.js';
+import { getDataDir } from './helpers.js';
+import { tiptapToDraftjs } from './tiptap-draftjs.js';
 export function createConnectionRouter() {
     const router = Router();
     // Unified connections list (OAuth + newsletter domains)
@@ -376,5 +381,66 @@ export function createConnectionRouter() {
             res.status(500).json({ success: false, error: err.message });
         }
     });
+    // POST /api/x/post-article — publish the active doc as a native X Article.
+    // Platform connection first (managed path), then fall through to the x-api
+    // plugin (direct OAuth1). Mirrors the /api/x/post routing. The article body
+    // is read from the active server doc and converted to X content_state here;
+    // the cover image (articleContext.coverImage) is uploaded via the platform.
+    router.post('/api/x/post-article', async (req, res, next) => {
+        const conn = await getFirstXConnection();
+        if (!conn) {
+            next();
+            return;
+        } // No platform connection → direct plugin path
+        try {
+            const title = (getTitle() || '').trim();
+            if (!title || title === 'Untitled') {
+                res.status(400).json({ success: false, error: 'Article needs a title before posting.' });
+                return;
+            }
+            const contentState = tiptapToDraftjs(getDocument());
+            if (!contentState.blocks.some((b) => (b.text || '').trim().length > 0)) {
+                res.status(400).json({ success: false, error: 'Article body is empty.' });
+                return;
+            }
+            // Optional cover — upload through the platform, attach by media id.
+            let coverMediaId;
+            const coverSrc = getMetadata()?.articleContext?.coverImage;
+            if (coverSrc && typeof coverSrc === 'string' && /^\/_images\/[^/\\]+$/.test(coverSrc)) {
+                const filename = coverSrc.replace('/_images/', '');
+                const filePath = join(getDataDir(), '_images', filename);
+                if (existsSync(filePath)) {
+                    const ext = extname(filename).toLowerCase();
+                    const mimeMap = {
+                        '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',
+                        '.png': 'image/png', '.webp': 'image/webp',
+                        '.gif': 'image/gif', '.bmp': 'image/bmp',
+                    };
+                    const uploadRes = await platformFetch(`/connections/${conn.id}/upload-media`, {
+                        method: 'POST',
+                        body: JSON.stringify({ media_base64: readFileSync(filePath).toString('base64'), media_type: mimeMap[ext] || 'image/jpeg' }),
+                    });
+                    if (uploadRes.ok) {
+                        const data = await uploadRes.json();
+                        if (data.mediaId)
+                            coverMediaId = data.mediaId;
+                    }
+                }
+            }
+            const upstream = await platformFetch(`/connections/${conn.id}/post-article`, {
+                method: 'POST',
+                body: JSON.stringify({ title, content_state: contentState, cover_media_id: coverMediaId }),
+            });
+            const data = await upstream.json();
+            if (!upstream.ok || !data.success) {
+                res.status(upstream.status || 500).json({ success: false, error: data.error || 'Article publish failed' });
+                return;
+            }
+            res.json({ success: true, articleId: data.articleId, postId: data.postId, articleUrl: data.post_url });
+        }
+        catch (err) {
+            res.status(500).json({ success: false, error: err.message });
+        }
+    });
     return router;
 }