Function handlePublish

design/src/daemon.ts:278–356

(req: Request, origin: string)

}

async function handlePublish(req: Request, origin: string): Promise<Response> {
  let body: any;
  try {
    body = await req.json();
  } catch {
    return Response.json({ error: "Invalid JSON" }, { status: 400 });
  }
  if (!body || typeof body !== "object") {
    return Response.json({ error: "Expected JSON object" }, { status: 400 });
  }
  const htmlPath = typeof body.html === "string" ? body.html : "";
  if (!htmlPath) return Response.json({ error: "Missing 'html' field" }, { status: 400 });
  if (!fs.existsSync(htmlPath)) {
    return Response.json({ error: `HTML file not found: ${htmlPath}` }, { status: 400 });
  }
  let resolvedHtml: string;
  let sourceDir: string;
  try {
    resolvedHtml = fs.realpathSync(path.resolve(htmlPath));
    sourceDir = fs.realpathSync(path.dirname(resolvedHtml));
  } catch (e: any) {
    return Response.json({ error: `Cannot resolve path: ${e.message}` }, { status: 400 });
  }
  if (!fs.statSync(resolvedHtml).isFile()) {
    return Response.json(
      { error: `'html' must be a file, not a directory: ${htmlPath}` },
      { status: 400 },
    );
  }

  // sourceDir comes from realpath(html), not from the body — Codex finding:
  // body-supplied sourceDir is a local trust boundary the daemon shouldn't cross.
  const existing = findActiveBoardForSourceDir(sourceDir);
  if (existing) {
    return Response.json(
      {
        error: "Source directory already in use by an active board",
        existing: {
          id: existing.id,
          url: `${origin}/boards/${existing.id}/`,
          state: existing.state,
        },
      },
      { status: 409 },
    );
  }
  if (nonDoneCount() >= MAX_BOARDS) {
    return Response.json(
      {
        error: `Cannot publish: ${MAX_BOARDS} non-done boards already exist. Submit or close some first.`,
      },
      { status: 503 },
    );
  }

  const id = newBoardId();
  const htmlContent = fs.readFileSync(resolvedHtml, "utf-8");
  const now = Date.now();