fix(ops): accept PUT on jellyfin passthrough + ensure plugin repo at startup

apex/gateway/main.py

@@ -1,14 +1,64 @@
 import os
+import asyncio
 import logging
+from contextlib import asynccontextmanager
 from fastapi import FastAPI, Request, WebSocket, WebSocketDisconnect
 from fastapi.responses import HTMLResponse, JSONResponse, FileResponse
 from gateway.utils import get_http_client, proxy_http_request, proxy_websocket_stream
-from gateway.ops import router as ops_router
+from gateway.ops import router as ops_router, _jellyfin_auth_header, _JELLYFIN_BASE
 
 logger = logging.getLogger("gateway.main")
 logging.basicConfig(level=logging.INFO)
 
-app = FastAPI(title="OpenCode Space Gateway", docs_url=None, redoc_url=None)
+# Default plugin catalog repository, guaranteed at startup so online plugins
+# always show up in the web UI after every boot/rebuild (Jellyfin reads the
+# repo list into memory at startup; the live config is mirrored to /data by
+# the write-back loop, so an API-set repo also survives restarts).
+DEFAULT_PLUGIN_REPO = {
+    "Name": "Jellyfin Stable",
+    "Url": "https://repo.jellyfin.org/files/plugin/manifest.json",
+    "Enabled": True,
+}
+
+async def ensure_jellyfin_plugin_repository() -> None:
+    """Idempotently configure the plugin repository on the live Jellyfin server."""
+    import aiohttp
+
+    for attempt in range(1, 61):
+        await asyncio.sleep(2)
+        headers = _jellyfin_auth_header()
+        if not headers:
+            continue
+        try:
+            async with aiohttp.ClientSession() as session:
+                async with session.get(
+                    f"{_JELLYFIN_BASE}/Repositories", headers=headers, timeout=5
+                ) as resp:
+                    if resp.status != 200:
+                        continue
+                    repos = await resp.json()
+                    if isinstance(repos, list) and any(
+                        isinstance(r, dict) and str(r.get("Url")) == DEFAULT_PLUGIN_REPO["Url"]
+                        for r in repos
+                    ):
+                        logger.info("[PLUGINS] Repository already configured.")
+                        return
+                async with session.post(
+                    f"{_JELLYFIN_BASE}/Repositories", headers=headers, json=[DEFAULT_PLUGIN_REPO], timeout=10
+                ) as resp:
+                    if resp.status in (200, 204):
+                        logger.info("[PLUGINS] Plugin repository configured via API (attempt %s).", attempt)
+                        return
+        except Exception:
+            continue
+    logger.warning("[PLUGINS] Could not ensure plugin repository during startup window.")
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    asyncio.create_task(ensure_jellyfin_plugin_repository())
+    yield
+
+app = FastAPI(title="OpenCode Space Gateway", docs_url=None, redoc_url=None, lifespan=lifespan)
 
 app.include_router(ops_router)
 

apex/gateway/ops.py

@@ -368,7 +368,7 @@ async def ops_jellyfin_theme(request: Request):
         })
 
 
-@router.api_route("/apex/ops/jellyfin/api", methods=["GET", "POST", "DELETE"])
+@router.api_route("/apex/ops/jellyfin/api", methods=["GET", "POST", "PUT", "DELETE"])
 async def ops_jellyfin_api(request: Request):
     """Admin-gated passthrough to the internal Jellyfin API.
 
@@ -390,8 +390,8 @@ async def ops_jellyfin_api(request: Request):
         return JSONResponse({"ok": False, "error": "No Jellyfin API key available"}, status_code=503)
 
     method = str(request.query_params.get("method") or request.method or "GET").upper()
-    if method not in ("GET", "POST", "DELETE"):
-        return JSONResponse({"ok": False, "error": "method must be GET, POST or DELETE"}, status_code=400)
+    if method not in ("GET", "POST", "PUT", "DELETE"):
+        return JSONResponse({"ok": False, "error": "method must be GET, POST, PUT or DELETE"}, status_code=400)
 
     api_path = str(request.query_params.get("path") or "").lstrip("/")
     if not api_path:
@@ -400,7 +400,7 @@ async def ops_jellyfin_api(request: Request):
         return JSONResponse({"ok": False, "error": "Invalid path"}, status_code=400)
 
     json_body = None
-    if method == "POST":
+    if method in ("POST", "PUT"):
         raw_body = request.query_params.get("body")
         if raw_body is None:
             try:
@@ -586,16 +586,14 @@ async def ops_jellyfin_cache_patch(request: Request):
 
 @router.post("/apex/ops/jellyfin/repositories")
 async def ops_jellyfin_repositories(request: Request):
-    """Write the plugin repository list straight into system.xml.
+    """Write the plugin repository list straight into the on-disk system.xml.
 
     Body: {"repositories": [{"Name": "...", "Url": "...", "Enabled": true}]}
 
-    Hardened Jellyfin builds strip POST /Repositories (the API returns 405,
-    which also breaks the web UI's add-repository dialog with a
-    'r.map is not a function' crash). The server reads the repo list from
-    the <PluginRepositories> element of system.xml at start-up, so this
-    writes that element directly on the /data volume. Jellyfin only picks
-    it up once the process (re)starts.
+    Fallback helper that edits the live <PluginRepositories> element so the
+    server reads it at the next start-up. Preferred path is the API
+    passthrough (POST /Repositories via /apex/ops/jellyfin/api), which Jellyfin
+    applies immediately and which its write-back loop also mirrors to /data.
     """
     if not _is_admin(request):
         return _denied()