`, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_358":359,"_360":361},"routes/_app.x.$handle.$name",{"_101":100,"_32":46,"_109":91,"_27":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":-5,"_123":25,"_124":125,"_126":60,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",91,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","backend/auth.ts","latestPath","fileId","4a7b9674-9df8-11f1-9b87-1607ee4eb77e","name","auth.ts","fileType","script","content","const COOKIE = \"cursor_chat_auth\";\n\nexport function isConfigured() {\n return Boolean(Deno.env.get(\"CURSOR_API_KEY\") && Deno.env.get(\"APP_PASSWORD\"));\n}\n\nasync function tokenFromPassword(password: string) {\n const bytes = new TextEncoder().encode(password);\n const hash = await crypto.subtle.digest(\"SHA-256\", bytes);\n return [...new Uint8Array(hash)]\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\nexport async function expectedToken() {\n const password = Deno.env.get(\"APP_PASSWORD\");\n if (!password) return null;\n return await tokenFromPassword(password);\n}\n\nfunction cookieMap(req: Request) {\n const raw = req.headers.get(\"Cookie\") ?? \"\";\n const out = new Map();\n for (const part of raw.split(\";\")) {\n const [k, ...rest] = part.trim().split(\"=\");\n if (k) out.set(k, rest.join(\"=\"));\n }\n return out;\n}\n\nexport async function isAuthed(req: Request) {\n const expected = await expectedToken();\n if (!expected) return false;\n return cookieMap(req).get(COOKIE) === expected;\n}\n\nexport async function loginCookie(password: string) {\n const expected = await expectedToken();\n if (!expected) return null;\n const got = await tokenFromPassword(password);\n if (got !== expected) return null;\n return `${COOKIE}=${got}; Path=/; HttpOnly; SameSite=Lax; Max-Age=2592000`;\n}\n\nexport function logoutCookie() {\n return `${COOKIE}=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0`;\n}\n","import { timingSafeEqual } from \"node:crypto\";\nimport { createSession, deleteSession, hasSession } from \"./db.ts\";\n\nconst COOKIE = \"cursor_chat_auth\";\nconst MAX_AGE = 2_592_000;\n\nexport function isConfigured() {\n return Boolean(Deno.env.get(\"CURSOR_API_KEY\") && Deno.env.get(\"APP_PASSWORD\"));\n}\n\nfunction cookieFlags(maxAge: number) {\n return `Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`;\n}\n\nasync function hashPassword(password: string) {\n const bytes = new TextEncoder().encode(password);\n return new Uint8Array(await crypto.subtle.digest(\"SHA-256\", bytes));\n}\n\nfunction hashesEqual(a: Uint8Array, b: Uint8Array) {\n if (a.length !== b.length) return false;\n return timingSafeEqual(a, b);\n}\n\nfunction cookieMap(req: Request) {\n const raw = req.headers.get(\"Cookie\") ?? \"\";\n const out = new Map();\n for (const part of raw.split(\";\")) {\n const [k, ...rest] = part.trim().split(\"=\");\n if (k) out.set(k, rest.join(\"=\"));\n }\n return out;\n}\n\nexport async function isAuthed(req: Request) {\n const token = cookieMap(req).get(COOKIE);\n if (!token) return false;\n return await hasSession(token);\n}\n\nexport async function loginCookie(password: string) {\n const expectedPw = Deno.env.get(\"APP_PASSWORD\");\n if (!expectedPw) return null;\n const got = await hashPassword(password);\n const expected = await hashPassword(expectedPw);\n if (!hashesEqual(got, expected)) return null;\n const token = await createSession(MAX_AGE);\n return `${COOKIE}=${token}; ${cookieFlags(MAX_AGE)}`;\n}\n\nexport async function logoutCookie(req: Request) {\n const token = cookieMap(req).get(COOKIE);\n if (token) await deleteSession(token);\n return `${COOKIE}=; ${cookieFlags(0)}`;\n}\n","createdAt",["D",1787389142356],"branchVersion","branchId","6924747a-bd7f-44f6-8ed7-64b4b4bc8bc0","id","97ce4900-8329-43bb-b758-880f88637a91","cursor-chat",["D",1787382471418],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Mobile chat relay to Cursor + Val Town","imageUrl","96c2793d-57c8-41d2-a49a-d1ee82f9dd24","pinnedFileId","01a0284c-1b46-711a-b263-211c80180a34","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","93515af8-c7b7-459c-9bf2-3bb3df310a75","tursoName","97ce4900832943bbb758880f88637a91","tursoHostname","97ce4900832943bbb758880f88637a91-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789474853273],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_108":104},"org",{"_101":100,"_102":-5,"_103":104,"_18":56,"_105":106,"_107":25},"branch",{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"isOwned",376,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","yuxiaoy","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzJObXd1QWdCZmVtaUh0bGU5TkswOG1sM0xheiIsImluaXRpYWxzIjoiRlkifQ","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":353,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":354,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":355,"_85":356,"_87":357,"_89":25},"tree",[182,188,201,202,203],"files",[182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203],"counts",{"_172":64,"_173":150,"_174":64,"_175":176,"_177":178},"contents",[131,132,133,134,135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":166,"_32":167,"_30":168,"_138":-5,"_42":43,"_41":169,"_140":60,"_39":170,"_13":64,"_34":164,"_36":-5,"_24":25,"_145":-5,"_27":171},{"_44":160,"_32":161,"_30":162,"_138":-5,"_42":43,"_41":150,"_140":60,"_39":163,"_13":64,"_34":164,"_36":-5,"_24":25,"_145":-5,"_27":165},{"_44":154,"_32":155,"_30":156,"_138":-5,"_42":43,"_41":150,"_140":25,"_39":157,"_13":64,"_34":20,"_36":158,"_24":25,"_145":-5,"_27":159},{"_44":147,"_32":148,"_30":149,"_138":-5,"_42":43,"_41":150,"_140":25,"_39":151,"_13":64,"_34":20,"_36":152,"_24":25,"_145":-5,"_27":153},{"_44":136,"_32":137,"_30":58,"_138":-5,"_42":43,"_41":139,"_140":25,"_39":141,"_13":142,"_34":143,"_36":144,"_24":25,"_145":-5,"_27":146},"3ef7ff6e-e29b-47b4-af06-58aae3289fe0","index.ts","parentId",49,"latest",["D",1787385012320],10,"http","import { parseVal, serveFile, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\nimport { isAuthed, isConfigured, loginCookie, logoutCookie } from \"./backend/auth.ts\";\nimport { archiveAgent, cancelRun, getRun, listAgents, listModels, recover, startChat } from \"./backend/cursor.ts\";\nimport { addMessage, deleteChat, initDb, listLocalChats, listMessages, upsertChat } from \"./backend/db.ts\";\nimport { renderIconPng } from \"./backend/icon.ts\";\n\nconst app = new Hono();\nconst iconCache = new Map();\n\nasync function iconPng(size: number) {\n let png = iconCache.get(size);\n if (!png) {\n png = renderIconPng(size);\n iconCache.set(size, png);\n }\n return new Response(png, {\n headers: {\n \"Content-Type\": \"image/png\",\n \"Cache-Control\": \"public, max-age=86400\",\n },\n });\n}\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/apple-touch-icon.png\", () => iconPng(180));\napp.get(\"/icon-512.png\", () => iconPng(512));\napp.get(\"/manifest.webmanifest\", async () => {\n const res = await serveFile(\"/frontend/manifest.webmanifest\");\n return new Response(res.body, {\n headers: {\n \"Content-Type\": \"application/manifest+json\",\n \"Cache-Control\": \"no-cache\",\n },\n });\n});\napp.get(\"/sw.js\", async () => {\n const res = await serveFile(\"/frontend/sw.js\");\n return new Response(res.body, {\n headers: {\n \"Content-Type\": \"text/javascript; charset=utf-8\",\n \"Cache-Control\": \"no-cache\",\n \"Service-Worker-Allowed\": \"/\",\n },\n });\n});\n\nasync function requireUser(c: { req: { raw: Request } }) {\n if (!isConfigured()) return { error: \"先配置 CURSOR_API_KEY 和 APP_PASSWORD\", status: 503 as const };\n if (!await isAuthed(c.req.raw)) return { error: \"未登录\", status: 401 as const };\n return null;\n}\n\napp.get(\"/api/status\", async (c) => {\n return c.json({\n configured: isConfigured(),\n authed: await isAuthed(c.req.raw),\n });\n});\n\napp.post(\"/api/login\", async (c) => {\n const body = await c.req.json().catch(() => ({}));\n const cookie = await loginCookie(String(body.password ?? \"\"));\n if (!cookie) return c.json({ error: \"密码错误或未配置 APP_PASSWORD\" }, 401);\n c.header(\"Set-Cookie\", cookie);\n return c.json({ ok: true });\n});\n\napp.post(\"/api/logout\", (c) => {\n c.header(\"Set-Cookie\", logoutCookie());\n return c.json({ ok: true });\n});\n\napp.get(\"/api/models\", async (c) => {\n const denied = await requireUser(c);\n if (denied) return c.json({ error: denied.error }, denied.status);\n try {\n return c.json({ items: await listModels() });\n } catch (err) {\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.get(\"/api/chats\", async (c) => {\n const denied = await requireUser(c);\n if (denied) return c.json({ error: denied.error }, denied.status);\n try {\n await initDb();\n const [remote, local] = await Promise.all([listAgents(), listLocalChats()]);\n const localMap = new Map(local.map((row) => [row.agent_id, row]));\n const items = remote.map((agent) => {\n const row = localMap.get(agent.id);\n return {\n id: agent.id,\n title: row?.title || agent.name || \"未命名对话\",\n status: agent.status,\n updatedAt: row?.updated_at || agent.updatedAt || agent.createdAt,\n model: row?.model,\n mode: row?.mode || \"agent\",\n url: agent.url,\n };\n });\n return c.json({ items });\n } catch (err) {\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.get(\"/api/chats/:agentId/messages\", async (c) => {\n const denied = await requireUser(c);\n if (denied) return c.json({ error: denied.error }, denied.status);\n try {\n const items = await listMessages(c.req.param(\"agentId\"));\n return c.json({ items });\n } catch (err) {\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.delete(\"/api/chats/:agentId\", async (c) => {\n const denied = await requireUser(c);\n if (denied) return c.json({ error: denied.error }, denied.status);\n const agentId = c.req.param(\"agentId\");\n try {\n await archiveAgent(agentId).catch(() => undefined);\n await deleteChat(agentId);\n return c.json({ ok: true });\n } catch (err) {\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.post(\"/api/messages\", async (c) => {\n const denied = await requireUser(c);\n if (denied) return c.json({ error: denied.error }, denied.status);\n const body = await c.req.json().catch(() => ({}));\n const agentId = String(body.agentId ?? \"\");\n const role = String(body.role ?? \"\");\n const text = String(body.text ?? \"\");\n if (!agentId || !role || !text) return c.json({ error: \"missing fields\" }, 400);\n await addMessage(agentId, role, text);\n if (body.model) await upsertChat(agentId, undefined, String(body.model));\n return c.json({ ok: true });\n});\n\napp.post(\"/api/chat\", async (c) => {\n const denied = await requireUser(c);\n if (denied) return c.json({ error: denied.error }, denied.status);\n const body = await c.req.json().catch(() => ({}));\n const text = String(body.text ?? \"\").trim();\n if (!text) return c.json({ error: \"请输入内容\" }, 400);\n const agentId = body.agentId ? String(body.agentId) : undefined;\n const modelId = body.modelId ? String(body.modelId) : undefined;\n const mode = body.mode === \"plan\" ? \"plan\" as const : \"agent\" as const;\n try {\n const started = await startChat(text, agentId, modelId, mode);\n if (started.agentId) {\n await addMessage(started.agentId, \"user\", text);\n await upsertChat(started.agentId, text.slice(0, 48), modelId, mode);\n }\n return c.json(started);\n } catch (err) {\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.get(\"/api/recover\", async (c) => {\n const denied = await requireUser(c);\n if (denied) return c.json({ error: denied.error }, denied.status);\n const stamp = c.req.query(\"stamp\") ?? \"\";\n const agentId = c.req.query(\"agentId\") || undefined;\n if (!stamp && !agentId) return c.json({ error: \"missing stamp\" }, 400);\n try {\n return c.json(await recover(stamp, agentId));\n } catch (err) {\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.get(\"/api/run/:agentId/:runId\", async (c) => {\n const denied = await requireUser(c);\n if (denied) return c.json({ error: denied.error }, denied.status);\n try {\n const run = await getRun(c.req.param(\"agentId\"), c.req.param(\"runId\"));\n return c.json(run);\n } catch (err) {\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.post(\"/api/run/:agentId/:runId/cancel\", async (c) => {\n const denied = await requireUser(c);\n if (denied) return c.json({ error: denied.error }, denied.status);\n try {\n await cancelRun(c.req.param(\"agentId\"), c.req.param(\"runId\"));\n return c.json({ ok: true });\n } catch (err) {\n return c.json({ error: err instanceof Error ? err.message : String(err) }, 502);\n }\n});\n\napp.onError((err) => Promise.reject(err));\nexport default app.fetch;\n","label",[137],"bec3edd4-de87-44e1-8d87-e30ed84d02f0","README.md","01a0284c-1b46-711a-b263-1e3f3ba9965c",1,["D",1787382471418],"# React + Hono Starter\n\nA minimal starter template for building client-side React apps with a Hono\nbackend on Val Town. Click **Remix** to get your own copy.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| [`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter) | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| **[`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter)** *(you're here)* | Client-side React SPA with a Hono API backend. |\n\n**Want to build UI?** Start writing React components in\n[`frontend/components/`](/frontend/components/). Import them into `App.tsx` and\nyou're good to go. Styling is [Twind](https://twind.style/) — just use Tailwind\nutility classes, zero config.\n\n**Want to add an API?** Add routes in [`index.ts`](/index.ts) (there's a\ncommented-out example). Fetch them from your React components.\n\n## Architecture\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts
(Hono server)\"]\n Hono -->|serves| HTML[\"root.tsx\"]\n HTML -->|loads| Entry[\"index.tsx\"]\n Entry -->|renders| App[\"App.tsx\"]\n App -->|renders| Counter[\"Counter.tsx\"]\n```\n\n## File structure\n\n```\nindex.ts ← Hono backend (serves frontend + API routes)\nfrontend/\n root.tsx ← HTML shell (stamps immutable asset URLs)\n index.tsx ← React entrypoint (mounts )\n favicon.svg ← App icon\n components/\n App.tsx ← Root component (layout + view source link)\n Counter.tsx ← Example component with state\n```\n\n## How it works\n\n1. **`index.ts`** is the HTTP entrypoint — a Hono server that serves the\n frontend and any API routes you add.\n2. **`frontend/root.tsx`** is the HTML shell — it loads Twind and stamps\n immutable asset URLs for the favicon and React entrypoint.\n3. **`frontend/index.tsx`** mounts the React app.\n4. **`frontend/components/App.tsx`** is the root layout — add new components\n alongside it.\n5. **`frontend/components/Counter.tsx`** is an example stateful component —\n replace it with your own!\n\n## Next steps\n\n- Add API routes in `index.ts`\n- Add new components in `frontend/components/`\n- Add a SQLite database — see the\n [React Hono Example](https://www.val.town/x/stevekrouse/reactHonoExample) for\n a full-stack example with database, queries, and shared types\n\nTemplate updates and upgrade paths for existing remixes: [CHANGELOG.md](/CHANGELOG.md)\n",[148],"b5d3d126-3f9f-4e76-9dd6-b57a2130ef32","CHANGELOG.md","01a0284c-1b46-711a-b263-184ef9e69f49",["D",1787382471418],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n `)}\n

Diff · v91