Initial save server

app.py

@@ -0,0 +1,59 @@
+from flask import Flask, request, jsonify, send_from_directory, abort
+from flask_cors import CORS
+import os
+import re
+
+app = Flask(__name__)
+CORS(app)
+
+SAVES_DIR = os.environ.get("SAVES_DIR", "/saves")
+os.makedirs(SAVES_DIR, exist_ok=True)
+
+def safe_filename(name):
+    name = re.sub(r"[^\w\-. ]", "", name).strip()
+    if not name:
+        abort(400, "Invalid save name")
+    return name + ".puC"
+
+
+@app.route("/saves", methods=["GET"])
+def list_saves():
+    files = [
+        f[:-4] for f in os.listdir(SAVES_DIR)
+        if f.endswith(".puC")
+    ]
+    return jsonify(sorted(files))
+
+
+@app.route("/saves/<name>", methods=["GET"])
+def get_save(name):
+    filename = safe_filename(name)
+    path = os.path.join(SAVES_DIR, filename)
+    if not os.path.exists(path):
+        abort(404)
+    return send_from_directory(SAVES_DIR, filename, as_attachment=True)
+
+
+@app.route("/saves/<name>", methods=["POST"])
+def store_save(name):
+    filename = safe_filename(name)
+    data = request.get_data()
+    if not data:
+        abort(400, "No data")
+    with open(os.path.join(SAVES_DIR, filename), "wb") as f:
+        f.write(data)
+    return jsonify({"ok": True, "name": name})
+
+
+@app.route("/saves/<name>", methods=["DELETE"])
+def delete_save(name):
+    filename = safe_filename(name)
+    path = os.path.join(SAVES_DIR, filename)
+    if not os.path.exists(path):
+        abort(404)
+    os.remove(path)
+    return jsonify({"ok": True})
+
+
+if __name__ == "__main__":
+    app.run(host="0.0.0.0", port=5000)