- Shipped
- 3 Septemba 2026, 19:40 UTC
- Author
- Kamo
- Commit
- 971b448
The window fetched **************** and nothing served it. There is no catch-all under /api/security — every area is proxied by a route file of its own, and the socket's sibling desktop-sso is one of them — so the POST landed on kamo-internal's own 404 page. The terminal reported "Could not start a terminal (404)" and SecurityService's logs showed no request at all, which is a long walk from the symptom to the cause. Nothing could have caught it: a fetch to a string literal is valid TypeScript, the build has no opinion about which paths are served, and the unit tests mock the fetch. So there is now a guard that reads the path out of the client and asserts a route.ts exists at it and exports POST. It fails if the literal ever stops being findable, rather than passing vacuously. The handler is deliberately thin. Every decision — provision, enabled, machine health, the per-member cap — is SecurityService's, and a second opinion here could only ever disagree with the one that actually guards the shell. Refusals pass through with their status and their sentence intact, because the ones that reach here are all actionable. 409 test files / 5111 tests, tsc and the production build all clean; the route appears in the build's manifest.