feat(obsidian): /api/v1/webdav file server (#3485 part 2)

CHANGELOG.md

@@ -11,6 +11,7 @@
 - **MiMoCode free-tier provider** ([#3659] — thanks @pizzav-xyz): new no-auth provider `mimocode` (alias `mcode`) exposing Xiaomi's `mimo-auto` model (1M context) via device-fingerprint bootstrap-JWT auth (`/api/free-ai/bootstrap` → Bearer JWT → `/api/free-ai/openai/chat`). Supports multiple accounts (N fingerprints → round-robin with exponential cooldown), re-bootstrap on 401/403, and cooldown on 429. Reuses a new generic `NoAuthAccountCard` dashboard component (also wired for `opencode`). 22 unit tests; upstream validated live during review. (Maintainer follow-up: added the required `authHeader: "none"` field to the registry entry.) Co-authored with @pizzav-xyz.
 - **Prefer Claude Code for unprefixed `claude-*` model IDs** ([#3540] — thanks @Witroch4): opt-in setting (default off) that routes bare `claude-*` model IDs from Claude Code clients through the Claude Code OAuth account instead of requiring a provider prefix. Configurable via the `OMNIROUTE_PREFER_CLAUDE_CODE_FOR_UNPREFIXED_CLAUDE_MODELS` env flag or a dashboard toggle on the Claude provider page; explicit provider prefixes still win. Full layer coverage (resolver + DB setting + zod schemas + types + UI) with 6 tests. Co-authored with @Witroch4.
 - **Codex Responses-WebSocket call history** ([#3616] — thanks @kkkayye): Codex `/v1/responses` WebSocket calls are now persisted to request history — success completions plus prepare-failures, upstream WS errors and premature closes — with `sanitizeErrorMessage` applied to the stored error. Two proxy-side integration tests cover the success and failure paths.
+- **Obsidian/WebDAV**: add the `/api/v1/webdav` file server (PROPFIND/GET/PUT/DELETE/MKCOL/MOVE, Basic-Auth, path-traversal hardened) so Obsidian mobile can sync the vault (#3485, part 2). Implemented in the custom server layer (`scripts/dev/webdav-handler.mjs`) — intercepted before Next.js to support non-standard HTTP methods (`PROPFIND`, `MKCOL`, `MOVE`, `LOCK`). Reads vault path and credentials (with enc:v1: AES-256-GCM decryption) directly from the SQLite `key_value` table; credentials configured via PR1's `/api/settings/obsidian/webdav` endpoint. 36 TDD unit tests covering traversal guard, constant-time auth, decrypt round-trip, XML generation, and full CRUD cycle.
 
 ### ♻️ Code Quality
 

scripts/dev/standalone-server-ws.mjs

@@ -2,6 +2,7 @@ import http from "node:http";
 import { randomUUID } from "node:crypto";
 import { createResponsesWsProxy } from "./responses-ws-proxy.mjs";
 import { ensurePeerStampToken, wrapRequestListenerWithPeerStamp } from "./peer-stamp.mjs";
+import { maybeHandleWebdav } from "./webdav-handler.mjs";
 
 const originalCreateServer = http.createServer.bind(http);
 const proxiesByPort = new Map();
@@ -48,12 +49,32 @@ function wrapUpgradeListener(server, listener) {
   };
 }
 
+/**
+ * Wrap a request listener so WebDAV requests at /api/v1/webdav are handled
+ * before the peer-stamp/Next.js layer sees them.
+ * Returns true if the request was handled; the wrapped listener is never called.
+ */
+function wrapRequestListenerWithWebdav(listener) {
+  return async function webdavAwareRequestHandler(req, res) {
+    try {
+      const handled = await maybeHandleWebdav(req, res);
+      if (handled) return;
+    } catch {
+      // Never block a request on WebDAV errors — fall through to Next
+    }
+    return listener.call(this, req, res);
+  };
+}
+
 http.createServer = function createServerWithResponsesWs(...args) {
   // Next's standalone server.js may pass its request listener directly to
   // createServer; wrap it so the real TCP peer IP is stamped before Next runs.
   const lastFnIdx = args.map((a) => typeof a === "function").lastIndexOf(true);
   if (lastFnIdx >= 0) {
-    args[lastFnIdx] = wrapRequestListenerWithPeerStamp(args[lastFnIdx]);
+    // WebDAV intercept wraps outermost (first to run), then peer-stamp, then Next.
+    args[lastFnIdx] = wrapRequestListenerWithWebdav(
+      wrapRequestListenerWithPeerStamp(args[lastFnIdx])
+    );
   }
 
   const server = originalCreateServer(...args);
@@ -66,7 +87,10 @@ http.createServer = function createServerWithResponsesWs(...args) {
     }
     // …or it may attach the handler via server.on("request"): wrap that too.
     if (eventName === "request" && typeof listener === "function") {
-      return originalOn(eventName, wrapRequestListenerWithPeerStamp(listener));
+      return originalOn(
+        eventName,
+        wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+      );
     }
     return originalOn(eventName, listener);
   };
@@ -76,7 +100,10 @@ http.createServer = function createServerWithResponsesWs(...args) {
       return originalAddListener(eventName, wrapUpgradeListener(server, listener));
     }
     if (eventName === "request" && typeof listener === "function") {
-      return originalAddListener(eventName, wrapRequestListenerWithPeerStamp(listener));
+      return originalAddListener(
+        eventName,
+        wrapRequestListenerWithWebdav(wrapRequestListenerWithPeerStamp(listener))
+      );
     }
     return originalAddListener(eventName, listener);
   };