Subpath hosting and a Cursor plugin

Serve the server under a path prefix

BASE_URL can now carry a path, for example https://myorg.com/ota. Two routing modes are supported, depending on what your reverse proxy forwards:

• The proxy strips the prefix (default). The server keeps its routes at the root and the proxy rewrites the path before forwarding. Nothing to set besides BASE_URL.
• The server serves under the prefix. Set SERVE_FROM_SUB_PATH=true and every route is mounted under the full path (/ota/manifest, /ota/api/...). The proxy forwards paths untouched.

In both modes, every URL the server emits carries the full path: redirects, cookies, OAuth and MCP discovery documents, dashboard assets, update manifests. Health checks (/hc, /ready) stay at the process root.

The dashboard is built once with a relative base. The server injects <base href> at serve time, so a single build works under any prefix. eoas server:init detects a path in the submitted BASE_URL and asks which routing mode you use.

Root redirect is opt-in

GET / no longer redirects to /dashboard/ when the dashboard is enabled. The redirect sits behind DASHBOARD_ROOT_REDIRECT, off by default: the root returns a 404 unless you set it to true.

Official Cursor plugin

The repo now ships a Cursor plugin. It connects the xprem docs MCP with no auth, and optionally your own control plane at https://<host>/mcp through the XPREM_MCP_URL variable. Four skills (xprem-quickstart, xprem-configure-expo, xprem-publish, xprem-connect-mcp) point the agent at the live docs instead of its own memory.

Fixes

• Channels created from the dialog are mapped to their branch. Contributed by @hslls.
• The dashboard no longer errors on the requests view when device telemetry is disabled.
• The rollout device count label says what it counts.

Internal

Typed claims for the JWTs the server issues, a Platform type in place of a validated string, response structs instead of map literals in the API handlers, and one set of pgtype helpers instead of three.