8da96a84d3
The initial fix added ~16 lines to server.py, tripping test_server_py_under_750_lines (server.py must stay a thin dispatcher; logic belongs in api/). Moved the whole preflight-response into apply_cors_preflight_headers(handler) in api/routes.py; server.py's do_OPTIONS is now a 4-line dispatcher. server.py 764 -> 746 lines. Same security behavior (same-origin/allowlist echo, Vary: Origin, no wildcard, header-less denial); test rewritten to the header-emitting API + added Vary and no-header-on-denial assertions and a routes.py wildcard regression guard. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| agent_health.py | ||
| agent_sessions.py | ||
| auth.py | ||
| auth_oidc.py | ||
| background.py | ||
| background_process.py | ||
| clarify.py | ||
| commands.py | ||
| compression_anchor.py | ||
| config.py | ||
| crash_visibility.py | ||
| dashboard_probe.py | ||
| extensions.py | ||
| gateway_chat.py | ||
| gateway_restart.py | ||
| gateway_watcher.py | ||
| goals.py | ||
| helpers.py | ||
| kanban_bridge.py | ||
| metering.py | ||
| models.py | ||
| oauth.py | ||
| office_documents.py | ||
| onboarding.py | ||
| passkeys.py | ||
| paths.py | ||
| plugin_providers.py | ||
| plugins.py | ||
| profiles.py | ||
| providers.py | ||
| request_diagnostics.py | ||
| rollback.py | ||
| route_approvals.py | ||
| route_session_list_cache.py | ||
| routes.py | ||
| run_journal.py | ||
| runner_client.py | ||
| runtime_adapter.py | ||
| session_discoverability.py | ||
| session_events.py | ||
| session_export_html.py | ||
| session_lifecycle.py | ||
| session_ops.py | ||
| session_recovery.py | ||
| skill_usage.py | ||
| sse_chunked.py | ||
| startup.py | ||
| state_sync.py | ||
| streaming.py | ||
| system_health.py | ||
| terminal.py | ||
| todo_state.py | ||
| turn_journal.py | ||
| updates.py | ||
| upload.py | ||
| usage.py | ||
| webui_session_db.py | ||
| workspace.py | ||
| workspace_git.py | ||
| worktrees.py | ||