From 44d60b5f7b4ddc632a82c3df37b246d9acb06b94 Mon Sep 17 00:00:00 2001 From: Alex Dunmow Date: Sat, 4 Jul 2026 15:21:21 +0800 Subject: [PATCH] feat(frontend): allowlist /.well-known/skills/ fetches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CMS skill-install card now reads the instance-derived skill name from the public /.well-known/skills/index.json discovery index — a well-known endpoint with no ConnectRPC surface, so it warns instead of failing. Co-Authored-By: Claude Fable 5 --- frontend.go | 1 + 1 file changed, 1 insertion(+) diff --git a/frontend.go b/frontend.go index daabfc0..316e4c2 100644 --- a/frontend.go +++ b/frontend.go @@ -67,6 +67,7 @@ var knownNonProtoFetches = map[string]bool{ "/api/ai/chat/stream": true, // AI chat SSE streaming (EventSource/fetch — ConnectRPC doesn't support SSE) "/api/support/": true, // CMS helpdesk widget: multipart attachment upload to the Chi proxy — connect-query can't send FormData "/api/helpdesk/upload": true, // Orchestrator helpdesk: multipart attachment upload — same FormData limitation + "/.well-known/skills/": true, // Public well-known skill discovery index (instance-derived skill name) — no proto service } var (