robodev 0.22.0 → 0.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "robodev",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "CLI for Robodev Starbase — create, auth, link, and deploy hosted apps",
   "type": "module",
   "license": "MIT",

package/templates/auth-chat/package.json

@@ -11,7 +11,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.22.0",
+    "robodev": "^0.23.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }

package/templates/backend/api/_lib.ts

@@ -342,6 +342,12 @@ export async function validateAlien(
 const ALLOWED_PLANET_IMAGE_TYPES = new Set(["image/jpeg", "image/png", "image/webp"]);
 const MAX_PLANET_IMAGE_BYTES = 2 * 1024 * 1024;
 
+/** Matches dashboard sanitizeFilename / KEY_RE. */
+function sanitizeFilename(name: string): string {
+  const base = name.split(/[/\\]/).pop() ?? "";
+  return base.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 80);
+}
+
 export async function savePlanetImage(
   ctx: ApiHandlerContext<unknown, unknown>,
   file: UploadedFile,
@@ -354,8 +360,9 @@ export async function savePlanetImage(
     return fail(400, "Unsupported image type");
   }
 
-  const fileName = (file.filename || "image").replaceAll("/", "-");
-  const key = `planet-images/${ctx.user!.id}/${crypto.randomUUID()}-${fileName}`;
+  const fileName = file.filename || "image";
+  const safe = sanitizeFilename(fileName) || "image";
+  const key = `planet-images/${ctx.user!.id}/${crypto.randomUUID()}-${safe}`;
   const [row] = await ctx.db
     .insert(media)
     .values({

package/templates/backend/package.json

@@ -10,7 +10,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.22.0",
+    "robodev": "^0.23.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/empty/package.json

@@ -10,7 +10,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.22.0",
+    "robodev": "^0.23.0",
     "typescript": "^5.9.2"
   }
 }

package/templates/space/api/_lib.ts

@@ -342,6 +342,12 @@ export async function validateAlien(
 const ALLOWED_PLANET_IMAGE_TYPES = new Set(["image/jpeg", "image/png", "image/webp"]);
 const MAX_PLANET_IMAGE_BYTES = 2 * 1024 * 1024;
 
+/** Matches dashboard sanitizeFilename / KEY_RE. */
+function sanitizeFilename(name: string): string {
+  const base = name.split(/[/\\]/).pop() ?? "";
+  return base.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 80);
+}
+
 export async function savePlanetImage(
   ctx: ApiHandlerContext<unknown, unknown>,
   file: UploadedFile,
@@ -354,8 +360,9 @@ export async function savePlanetImage(
     return fail(400, "Unsupported image type");
   }
 
-  const fileName = (file.filename || "image").replaceAll("/", "-");
-  const key = `planet-images/${ctx.user!.id}/${crypto.randomUUID()}-${fileName}`;
+  const fileName = file.filename || "image";
+  const safe = sanitizeFilename(fileName) || "image";
+  const key = `planet-images/${ctx.user!.id}/${crypto.randomUUID()}-${safe}`;
   const [row] = await ctx.db
     .insert(media)
     .values({

package/templates/space/package.json

@@ -11,7 +11,7 @@
     "@robodev-ai/sdk": "^0.6.0"
   },
   "devDependencies": {
-    "robodev": "^0.22.0",
+    "robodev": "^0.23.0",
     "rulesync": "^8.18.0",
     "typescript": "^5.9.2"
   }