mirror of
https://github.com/runbear-io/beardrive.git
synced 2026-08-25 08:08:08 +02:00
eef37fa89b
GET /llms.txt answered 200 with the sign-in page. So did /robots.txt, /sitemap.xml and every mistyped root file: the SPA fallback treated only api/, auth/ and s/ as genuine 404s, so a crawler probing any conventional path got a success status and a chunk of login HTML. In hub mode a first path segment is a project id (UUID or p-xxxxxxxx) or a reserved word, none of which contain a dot, so a single dotted segment with no embedded asset can only be a file that is not there. The check runs after the asset lookup, so a real root asset (share-mermaid.js today, favicon.ico whenever the build emits one) is unaffected with no allowlist to maintain. Gated on hub mode: the plain-folder viewer shares this handler and there /README.md IS the route for a file, so ungating this would make every top-level file in every `bdrive serve <dir>` unreachable. There is a test that fails if the gate is removed. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>