Repository navigation
nebo.files.url: show the owner's files from a granted folder - #11
Merged
Merged
Conversation
… granted A page shows the owner's own files (photos, renders, a project's project.json) through the app's own file route, /api/v1/apps/<id>/files/<path>, inside the folders its manifest grants with filesystem:read:<folder>. files.url builds that address in every place a page is open: the desktop window (its neboapp:// scheme, since a media element's address is never rewritten the way fetch is), a browser on the bot, the tunnel (/t/<bot>) and an app-view pass (/k/<pass>). Pages never build /api/v1 addresses themselves. Adds a zero-dependency node:test suite for every address form, run in CI. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015dw5RFwzdZPHuB2VsN3Mcx
Nebo now confines every app page to its own app (NeboLoop/nebo#1009): the page runs in an origin of its own and proves itself with its app's pass, which Nebo writes into the page's base (nebo-base-url, /k/<pass>). - getBaseUrl reads nebo-base-url first, on the desktop too, so the page's socket and the films files.url gives go to Nebo directly with the pass and stream. - getAppId finds the app under /t/<bot> and /k/<pass>. - files.url refuses a '.' or '..' part and encodes the app id. - README: where a page runs (sandbox, pass, localStorage kept in the app's store, grants and owner consent), and files.url as it is now: hidden folders are never served, installed apps need the owner's OK. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015dw5RFwzdZPHuB2VsN3Mcx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
nebo.files.url(path): the address of one of the owner's files (relative to~/NeboAI) for an<img>,<video>,<audio>orfetch(). The file must be inside a folder the app's manifest grants withfilesystem:read:<folder>; Nebo serves it read only, with byte ranges, through the app's own route/api/v1/apps/<id>/files/<path>(nebo PR, linked below).The address works in every place a page opens:
neboapp://<id>/api/v1/apps/<id>/files/...(a media element's address is never rewritten the wayfetch()is, so it uses the window's own scheme)http://localhost:27895/api/v1/apps/<id>/files/...https://neboai.com/t/<bot>/api/v1/apps/<id>/files/...http://127.0.0.1:27895/k/<pass>/api/v1/apps/<id>/files/...Each path part is percent-encoded; empty parts are dropped. Pages never build
/api/v1/...addresses.Also
nebo.files.url(grant, 403/404 rules, hidden folders).test/files.test.mjs: a zero-dependencynode:testsuite for every address form;pnpm test/npm test, now run in CI after the build.dist/rebuilt; nebo's served copy (app/static/sdk/nebo.global.js) is updated in the nebo PR.Tests
pnpm buildokpnpm test: 4/4 pass🤖 Generated with Claude Code
https://claude.ai/code/session_015dw5RFwzdZPHuB2VsN3Mcx