Greptile Summary

This PR fixes a real bug where GET /api/* requests returned the Control UI SPA index.html (with a 200 status) instead of falling through to the API handler when gateway.controlUi.basePath is unset. The one-line guard added in src/gateway/control-ui.ts is minimal and correctly scoped to the !basePath branch.

Key observations:

• The fix is correct for GET and HEAD requests to /api/*.
• Incomplete coverage for mutating methods: The existing 405 Method Not Allowed guard (line 278) runs for every non-GET/HEAD request before the new /api check is reached. This means POST /api/sessions, PUT /api/..., PATCH /api/..., and DELETE /api/... are still intercepted by the Control UI handler and receive a 405 instead of being forwarded to the real API layer. The Discord integration referenced in the PR description typically issues POST requests, so those remain broken.
• The new test covers only GET paths, which is consistent with the fix's scope but leaves the mutating-method gap untested.
• Existing test suite (13 tests) still passes, confirming no regressions for covered paths.

Confidence Score: 3/5

• Safe to merge for GET/HEAD API traffic, but mutating API methods (POST, PUT, DELETE, PATCH) to /api/* remain broken by the pre-existing method guard that fires before the new check.
• The fix correctly resolves the stated GET-request issue and introduces no regressions. However, the method-not-allowed guard at line 278 still intercepts all non-GET/HEAD requests to /api/* with a 405 before the new early-return is reachable, leaving the broader "HTTP API endpoints" problem partially unresolved for mutating methods.
• src/gateway/control-ui.ts — the ordering of the method guard (line 278) relative to the new /api path check (line 295) needs attention to fully unblock non-GET/HEAD API requests.

_{Last reviewed commit: ab21f3e}

🔒 Aisle Security Analysis

✅ We scanned this PR and did not find any security vulnerabilities.

_{Aisle supplements but does not replace security review.}

Analyzed PR: #30333 at commit 12591f3

_{Last updated on: 2026-03-01T21:47:30Z}

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

1. 🟡 Control UI /api exclusion can be bypassed via protocol-relative paths and encoded separators (path confusion)

Description

The new /api exclusion in handleControlUiHttpRequest() relies on pathname derived from new URL(req.url, "http://localhost").pathname and then performs a simple string comparison:

• URL parsing treats request-targets beginning with // as scheme-relative URLs (authority present), not as an origin-form path. For example, req.url = "//api/sessions" is parsed as http://api/sessions, producing pathname === "/sessions", so the /api guard does not trigger.
• Percent-encoded path separators like %2F are preserved in URL.pathname, so /api%2Fsessions results in pathname === "/api%2Fsessions", which also bypasses the guard.

As a result, the Control UI handler may still return true and serve SPA HTML for paths that other components (reverse proxies, middleware, caches) may normalize/canonicalize to /api/..., creating risk of route confusion (e.g., serving HTML on intended API endpoints, cache poisoning/content-type confusion, or bypassing downstream API routing assumptions).

Vulnerable code:

const url = new URL(urlRaw, "http://localhost");
const pathname = url.pathname;
...
if (pathname === "/api" || pathname.startsWith("/api/")) {
  return false;
}

Recommendation

Harden request-target parsing and apply the /api exclusion to a canonicalized path representation.

1. Prevent //... from being interpreted as an authority component by building a full URL string explicitly (or rejecting such paths):

const urlRaw = req.url ?? "/";
if (!urlRaw.startsWith("/")) return false;
​// Avoid scheme-relative parsing quirks for leading "//"
const url = new URL(`http://localhost${urlRaw}`);

2. Canonicalize before matching /api (decode repeated encodings, collapse multiple slashes, resolve dot-segments), and fail closed for encoded-prefix variants:

import { canonicalizePathForSecurity } from "./security-path.js";

const { canonicalPath, candidates } = canonicalizePathForSecurity(url.pathname);
const isApi = candidates.some((p) => p === "/api" || p.startsWith("/api/"));
if (isApi) return false;

If you do not want to accept encoded separators at all, explicitly reject requests whose raw path contains %2f, %5c, or other encoded delimiter characters.

Analyzed PR: #30333 at commit e5b0f56

_{Last updated on: 2026-03-01T21:23:12Z}

Merged via squash.

• Prepared head SHA: 12591f3
• Merge commit: c1428e8

Thanks @Sid-Qin!