refactor: v1 raw file response + embeddings helpers

[steipete]

Small followup refactors.

• httpApiV1: centralize safe raw text-file response headers/CSP in shared helper
• skills: centralize skillEmbeddings visibility loops (soft-delete, ban/unban restore, approvals, latest tag)

Gate:

• bun run lint
• bun run build
• bun run test

Greptile Overview

Greptile Summary

This PR successfully extracts duplicate code into reusable helpers, improving maintainability without changing functionality.

HTTP API Changes:

• Centralized safe text-file response headers and CSP (Content Security Policy) into safeTextFileResponse() helper in convex/httpApiV1/shared.ts:18
• Applied to both skills and souls file serving endpoints, eliminating ~20 lines of duplicated header logic in each handler

Skills Embedding Updates:

• Consolidated 5 separate patterns of updating skillEmbeddings visibility into 4 focused helper functions:
  • listSkillEmbeddingsForSkill() - query helper
  • setSkillEmbeddingsSoftDeleted() - handles soft delete/restore flow
  • setSkillEmbeddingsLatestVersion() - updates latest tag visibility
  • setSkillEmbeddingsApproved() - updates approval visibility
• Removes ~60 lines of repetitive embedding query/update loops across 6 call sites
• Maintains exact same visibility logic via embeddingVisibilityFor() helper

Confidence Score: 5/5

• This PR is safe to merge with no risk - it's a pure refactoring that extracts duplicate code into helpers
• The changes are mechanical refactorings that consolidate duplicate code patterns without modifying logic. All security headers, CSP policies, and embedding visibility rules remain identical. The new helpers make the code more maintainable and reduce the risk of divergence between similar operations.
• No files require special attention

_{Last reviewed commit: 14de4cb}

[cursor]

PR Summary

Low Risk
Mostly refactoring into shared helpers with intended header/visibility behavior preserved. Risk is limited to subtle regressions in raw file response headers (esp. SVG handling) or embedding visibility updates if helper logic is applied incorrectly.

Overview
HTTP API v1 raw file responses: Extracts the “safe text file” response logic (CSP, anti-sniffing/iframe headers, SVG-as-attachment handling, cache + content metadata headers) into safeTextFileResponse in httpApiV1/shared.ts, and switches both skillsV1 and soulsV1 file endpoints to use it.

Skill embeddings maintenance: Replaces repeated skillEmbeddings query-and-loop blocks with shared helpers in skills.ts to consistently update embedding visibility, isLatest, isApproved, and ownerId during auto-hide, soft-delete/undelete, ban/unban restore, tag latest updates, and redaction approval changes (also normalizing to a single now timestamp per operation).

^{Written by Cursor Bugbot for commit 14de4cb. This will update automatically on new commits. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Ready	Preview, Comment	Feb 15, 2026 2:39am