[m8sec]

updates

Summary

Dispatch admin and client delivery stay on separate listeners. This branch hardens the admin UI, file identity, and operator workflows.

• File ids exposed to the UI and API are UUID4 values. Integer ids are not accepted on external file routes.
• Client file requests are logged and shown on a live Activity feed (session SSE) with filters and aggregates.
• Download cradles include curl, wget, Python, PowerShell, certutil, BITS, encoded PowerShell, and covert chunked upload/download. Every snippet renders as a dark code block in both themes.
• Per-file download caps: 0 means unlimited, edited on the upload and edit forms (not on the file listing).
• Operators change file access from the listing. A recently expired session is renewed on the response so that update is not dropped.
• GET /api/files/list (and /api/files/minimal-list) is the API-key list. It returns only id, filename, alias, file_size, access, max_downloads, and download_count. The signed-in file page uses GET /api/files/listing, which requires a session cookie.
• API keys sent in X-Dispatch-Auth can list files, upload, and download by alias, filename, or file id, subject to the user's role. The Python and PowerShell decrypt cradles take an optional API key: a value is used as given, a blank flag prompts, and omitting it sends no key.
• Covert upload (/api/v1/health) is registered on both the admin listener and the client delivery listener.
• Activity stays with Cradles. Alerts sit under Settings and are available to operators. The settings nav label is Admin so it stays on one line.
• The script interface stays off unless --enable-script-interface is set. --disable-exec is removed.
• The UI is denser at 100% zoom (root font size 90%, tighter header and sidebar). Switches share one size and a single thumb. Listing action icons are black on their colored buttons.

API keys

Header: X-Dispatch-Auth.

• GET /api/files/list
• POST /api/file/upload
• GET /file/get/alias/<alias>
• GET /file/get/name/<filename>
• GET /file/get/<id>

GET /api/files/listing is session-only. Covert upload and download use GET or POST /api/v1/health on either listener.