Description
as the title suggests.
Motivation
useful in scripts/automation tooling
Alternatives Considered
exporting the entire server and reading the files
Additional Context
Flagged as a hole in the API by Claude Opus 5:
"Craftbox v1 has no file-read endpoint. POST /servers/:id/edit-file is write-only, and I swept for the obvious read paths (/files, /browse, /download-file, /file-content, /logs, …) — all 404. The two routes that do emit file contents, GET /servers/:id/export and the backup download, are session-cookie auth and reject the bearer key (302 → /login). The WebSocket rejects bearer too, so console output isn't a workaround either. With an API key alone, those files are unreachable."
Description
as the title suggests.
Motivation
useful in scripts/automation tooling
Alternatives Considered
exporting the entire server and reading the files
Additional Context
Flagged as a hole in the API by Claude Opus 5:
"Craftbox v1 has no file-read endpoint. POST /servers/:id/edit-file is write-only, and I swept for the obvious read paths (/files, /browse, /download-file, /file-content, /logs, …) — all 404. The two routes that do emit file contents, GET /servers/:id/export and the backup download, are session-cookie auth and reject the bearer key (302 → /login). The WebSocket rejects bearer too, so console output isn't a workaround either. With an API key alone, those files are unreachable."