block/check-safety
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(frontend): allowlist /.well-known/skills/ fetches

Browse Source 
The CMS skill-install card now reads the instance-derived skill name from
the public /.well-known/skills/index.json discovery index — a well-known
endpoint with no ConnectRPC surface, so it warns instead of failing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Alex Dunmow 2026-07-04 15:21:21 +08:00
parent 542324fe5c
commit 44d60b5f7b
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
frontend.go
View File

@ -67,6 +67,7 @@ var knownNonProtoFetches = map[string]bool{
"/api/ai/chat/stream": true, // AI chat SSE streaming (EventSource/fetch — ConnectRPC doesn't support SSE)
"/api/support/": true, // CMS helpdesk widget: multipart attachment upload to the Chi proxy — connect-query can't send FormData
"/api/helpdesk/upload": true, // Orchestrator helpdesk: multipart attachment upload — same FormData limitation
"/.well-known/skills/": true, // Public well-known skill discovery index (instance-derived skill name) — no proto service
}
var (