Skip to content

Navigation Menu

Appearance settings

View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
View all resources
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

VolvoxLLC / volvox-bot Public

Notifications You must be signed in to change notification settings
Fork 2
Star 4

Code
Issues 10
Pull requests 5
Actions
Projects
Security
Insights

Additional navigation options

Code
Issues
Pull requests
Actions
Projects
Security
Insights

feat: REST API layer for web dashboard#70

Merged

BillChirico merged 72 commits intomainVolvoxLLC/volvox-bot:mainfrom

feat/rest-apiVolvoxLLC/volvox-bot:feat/rest-apiCopy head branch name to clipboard

Feb 17, 2026

Conversation Commits72 (72)Checks Files changed

Merged

feat: REST API layer for web dashboard#70
BillChirico merged 72 commits intomainfrom
feat/rest-api

Commits

Commits on Feb 17, 2026

feat: REST API layer for web dashboard
BillChirico
committed
fix: use timing-safe comparison for API secret validation

BillChirico
and
claude
committed
fix: use safeSend for mention sanitization and validate content length

BillChirico
and
claude
committed
fix: filter sensitive data from config endpoints

BillChirico
and
claude
committed
fix: only send CORS preflight 204 when DASHBOARD_URL is configured

BillChirico
and
claude
committed
fix: close orphaned server before starting a new one

BillChirico
and
claude
committed
fix: use cursor-based pagination for guild members endpoint

BillChirico
and
claude
committed
fix: hide detailed memory usage behind auth on health endpoint

BillChirico
and
claude
committed
fix: prevent REST API startup failure from crashing the bot

BillChirico
and
claude
committed
fix: scope conversations stats query to guild channels
BillChirico
committed
fix: restore fake timers in afterEach to prevent test pollution

BillChirico
and
claude
committed
fix: centralize vi.unstubAllEnvs in afterEach for server tests

BillChirico
and
claude
committed
fix: scope conversations stats query to guild channel IDs

BillChirico
and
claude
committed
fix: remove redundant content length validation in sendMessage action

BillChirico
and
claude
committed
fix: return sent message content instead of echoing request body

BillChirico
and
claude
committed
fix: add destroy method to rate limiter for interval cleanup

BillChirico
and
claude
committed
fix: remove DELETE from CORS allowed methods

BillChirico
and
claude
committed
fix: move discord WebSocket details behind auth on health endpoint

BillChirico
and
claude
committed
fix: centralize vi.unstubAllEnvs in afterEach for health tests

BillChirico
and
claude
committed
fix: add guild_id column to conversations table for guild-scoped queries

BillChirico
and
claude
committed
fix: harden server startup and shutdown in server.js

BillChirico
and
claude
committed
fix: validate Discord message content length (2000 char limit)

BillChirico
and
claude
committed
fix: avoid reflecting user input in action error response

BillChirico
and
claude
committed
fix: remove 'logging' from SAFE_CONFIG_KEYS in guilds route

BillChirico
and
claude
committed
fix: handle CORS preflight without DASHBOARD_URL

BillChirico
and
claude
committed
refactor: extract shared isValidSecret helper, use in health route

BillChirico
and
claude
committed
refactor: use shared isValidSecret helper in health route

BillChirico
and
claude
committed
fix: guard against undefined req.body in actions endpoint

BillChirico
and
claude
committed
fix: raise content length limit to 10000 chars in actions endpoint

BillChirico
and
claude
committed
style: fix chain formatting in health tests

BillChirico
and
claude
committed
refactor: add isValidSecret helper to auth middleware

BillChirico
and
claude
committed
fix: add ALTER TABLE migration for guild_id column in conversations

BillChirico
and
claude
committed
fix: prevent moderation config writes via PATCH endpoint

BillChirico
and
claude
committed
fix: guard against undefined req.body in PATCH config endpoint

BillChirico
and
claude
committed
docs: note parsePagination is only used by moderation endpoint

BillChirico
and
claude
committed
fix: only send CORS preflight when DASHBOARD_URL is configured

BillChirico
and
claude
committed
fix: destroy rate limiter on server shutdown

BillChirico
and
claude
committed
Merge remote-tracking branch 'origin/feat/rest-api-batch-b' into feat/rest-api
BillChirico
committed
Merge branch 'main' into feat/rest-api
BillChirico
authored
fix: remove DELETE from CORS Allow-Methods and set header on all responses

BillChirico
and
claude
committed
fix: wrap ALTER TABLE guild_id backfill in try-catch for PG < 9.6

BillChirico
and
claude
committed
fix: document NULL guild_id caveat on stats conversations query

BillChirico
and
claude
committed
fix: extract content length limit to named constant

BillChirico
and
claude
committed
fix: sanitize mentions in API sendMessage before calling safeSend

BillChirico
and
claude
committed
fix: clarify config endpoint is global scope, not per-guild

BillChirico
and
claude
committed
fix: reject single-segment config paths in PATCH endpoint

BillChirico
and
claude
committed
fix: destroy leaked rate limiter on repeated createApp calls

BillChirico
and
claude
committed
chore: apply biome formatting fixes
BillChirico
committed
fix: remove redundant sanitizeMentions in actions route

BillChirico
and
claude
committed
docs: update JSDoc return type to include destroy method

BillChirico
and
claude
committed
fix: cap channel list in guild info response

BillChirico
and
claude
committed
fix: guard guild_id index creation against missing column

BillChirico
and
claude
committed
docs: add API files to AGENTS.md Key Files table

BillChirico
and
claude
committed
fix: use explicit columns in moderation query

BillChirico
and
claude
committed
test: assert capped limit forwarded to guild.members.list

BillChirico
and
claude
committed
test: use vi.stubEnv instead of delete process.env

BillChirico
and
claude
committed
fix(api): pass through error status codes in global error handler
BillChirico
committed
fix(api): reset server variable on listen failure
BillChirico
committed
fix(api): use err.status only for valid 4xx codes in error handler
BillChirico
committed
fix(api): use Buffer.byteLength for timingSafeEqual guard
BillChirico
committed
fix(db): ensure guild_id index is always created
BillChirico
committed
fix(api): move CORS middleware before body parser
BillChirico
committed
fix(api): validate BOT_API_PORT range (0-65535)
BillChirico
committed
fix(api): use once() for server startup error listener

BillChirico
and
claude
committed
fix(api): add timeout and force-close to prevent server.close() hanging

BillChirico
and
claude
committed
fix(api): add string type check for message content

BillChirico
and
claude
committed
fix(api): set CORS allow-headers on all responses not just preflight

BillChirico
and
claude
committed
fix(api): limit channel iteration instead of materializing full array

BillChirico
and
claude
committed
docs: update README to reflect new REST API server

BillChirico
and
claude
committed
fix(api): add trust proxy configuration for rate limiting behind reverse proxy

BillChirico
and
claude
committed
fix: address round 5 review comments
BillChirico
committed
fix: address round 6 review nitpicks
BillChirico
committed

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.