The sql template literal '= ANY()' was causing 500 errors during
screenshot deletion in the PATCH edit endpoint. Replaced all 3 occurrences
with Drizzle's native inArray() which safely handles array parameters,
including empty arrays.
The PATCH /api/performance/:id/edit endpoint was passing raw
removedScreenshotIds from the client to an = ANY() SQL clause.
Empty strings or invalid values would crash the query. Added a filter
to ensure only non-empty string IDs are used.
- list_screenshots: bump limit 12 → 50 so users can scroll further back
- Add versionString + buildId to DeckyVaultImportV1, SessionData, and
buildImportPayload. Import endpoint now saves them on new game versions.
- Screenshot delete button in preset detail modal: owner/admin sees a
trash icon on hover that calls DELETE /api/performance/:id/screenshots/:sid
- Root workspace scripts for plugin workflow:
bun run plugin:build | plugin:zip | plugin:release | plugin:deploy
- Add deploy.sh (SSH scripts to push plugin to Deck)
The plugin can now attach up to 2 Steam Deck screenshots (Steam + R1)
to a performance entry, uploaded together in one Submit tap.
Backend:
- Screenshot upload/delete endpoints now accept API key auth via
requireRoleWithApiKeyFallback (was session-only), so the plugin's
x-api-key header works. The 2-screenshot limit was already enforced
server-side (MAX_SCREENSHOTS_PER_ENTRY = 2).
Plugin Python (main.py):
- list_screenshots(): scans ~/Pictures/Screenshots/ + Steam Client/
subfolder, skips the most_recent.jpg duplicate, returns recent shots
- upload_screenshots(): hard-caps at 2, builds multipart/form-data with
urllib, posts to /api/performance/:id/screenshots
Plugin UI (session-form.tsx):
- New Screenshots section (max 2) with a picker listing recent Steam
screenshots (time + size), selected shots as removable rows
- Submit flow: upload entry → get entry ID → upload selected screenshots
→ combined success message (partial-success if screenshots fail)
The old test hit /api/games/lookup which is a public endpoint with no auth,
so it never checked the key — any key (or a deleted one) reported as valid.
- Add GET /api/plugin/verify-key endpoint that uses authenticateWithApiKey
to properly verify the x-api-key header via Better Auth
- Plugin test_api_key now calls /api/plugin/verify-key instead of games-lookup
- Returns the linked user's name + avatar on success for richer feedback
- Add plugin_pairings table + migration (0028) for short-lived pairing sessions
- Add pairing API: POST /api/plugin/pair/initiate, GET /status/:token, POST /confirm
- Add /pair web page: user scans QR on phone, confirms, API key auto-created
- Plugin: 'Pair with Phone' button renders QR code (qrcode.react), polls for status, saves API key
- Plugin: new initiate_pair + check_pair_status Python RPCs
- Revise MangoHud Setup Guide into clean numbered steps
- Fix SteamOS version detection: read VERSION_ID + BUILD_ID (was just 'SteamOS')
adrianbonpin