From 1693ced1122112ec5a5fba23eb3426c272605f89 Mon Sep 17 00:00:00 2001 From: Alex Dunmow Date: Sun, 5 Jul 2026 23:00:33 +0800 Subject: [PATCH] feat(frontend-check): allowlist /api/push/upload multipart fetch (restore wizard) Co-Authored-By: Claude Fable 5 --- frontend.go | 1 + 1 file changed, 1 insertion(+) diff --git a/frontend.go b/frontend.go index f87d7e5..960b0f6 100644 --- a/frontend.go +++ b/frontend.go @@ -78,6 +78,7 @@ var knownNonProtoFetches = map[string]bool{ "/api/ai/chat/stream": true, // AI chat SSE streaming (EventSource/fetch — ConnectRPC doesn't support SSE) "/api/support/": true, // CMS helpdesk widget: multipart attachment upload to the Chi proxy — connect-query can't send FormData "/api/helpdesk/upload": true, // Orchestrator helpdesk: multipart attachment upload — same FormData limitation + "/api/push/upload": true, // Orchestrator push/restore: multipart backup-zip upload — same FormData limitation "/.well-known/skills/": true, // Public well-known skill discovery index (instance-derived skill name) — no proto service }