feat(queue): 404 on unknown hash, show error in UI

POST /api/queue/cancel answers 404 {"error":"hash not in queue"} for
untracked hashes instead of 200 ok:true. The UI surfaces the server's
error message instead of swallowing it.

src/index.js

@@ -6,6 +6,7 @@ const { caps, feed } = require('./torznab');
 const { makeTorrent } = require('./torrent');
 const qbt = require('./qbt');
 const { registerMcpHttp } = require('./mcp-http');
+const { registerUiApi } = require('./ui-api');
 
 const PORT = process.env.PORT || 3001;
 const BASE_URL = process.env.BASE_URL || `http://localhost:${PORT}`;
@@ -124,53 +125,7 @@ app.get('/resolve/:ident', async (req, res) => {
 });
 
 // ── UI API (before static so /api/* is never swallowed) ───────────────────
-app.get('/api/search', async (req, res) => {
-  const q = (req.query.q || '').trim();
-  if (!q) return res.json([]);
-  try {
-    const results = await client.search(q, {
-      limit: Math.min(parseInt(req.query.limit) || 30, 100),
-      offset: parseInt(req.query.offset) || 0,
-    });
-    res.json(results);
-  } catch (err) {
-    res.status(500).json({ error: err.message });
-  }
-});
-
-app.post('/api/queue/add', (req, res) => {
-  try {
-    const { ident, name, size } = req.body || {};
-    if (!ident) return res.status(400).json({ error: 'ident required' });
-    const ok = qbt.enqueueDirect(ident, name || ident, parseInt(size) || 0);
-    if (!ok) return res.status(409).json({ error: 'already in queue' });
-    res.json({ ok: true });
-  } catch (err) {
-    console.error('queue/add', err);
-    res.status(500).json({ error: err.message || 'queue add failed' });
-  }
-});
-
-app.get('/api/queue', (req, res) => {
-  try {
-    res.json(qbt.getQueue());
-  } catch (err) {
-    console.error('queue', err);
-    res.status(500).json({ error: err.message || 'queue failed' });
-  }
-});
-
-app.post('/api/queue/cancel', (req, res) => {
-  try {
-    const { hash } = req.body || {};
-    if (!hash) return res.status(400).json({ error: 'hash required' });
-    qbt.cancelDownload(hash);
-    res.json({ ok: true });
-  } catch (err) {
-    console.error('queue/cancel', err);
-    res.status(500).json({ error: err.message || 'cancel failed' });
-  }
-});
+registerUiApi(app, { qbt, client });
 
 app.get('/api/health', (req, res) => {
   res.json({ ok: true, guest: client.guest });

src/ui-api.js

@@ -0,0 +1,59 @@
+/**
+ * Mount the Web UI's JSON API on an Express app.
+ * Must be registered before static file serving so /api/* is never swallowed.
+ *
+ * @param {import('express').Express} app
+ * @param {{ qbt: import('./qbt'), client: import('./webshare').WebshareClient }} options
+ */
+function registerUiApi(app, { qbt, client }) {
+  app.get('/api/search', async (req, res) => {
+    const q = (req.query.q || '').trim();
+    if (!q) return res.json([]);
+    try {
+      const results = await client.search(q, {
+        limit: Math.min(parseInt(req.query.limit) || 30, 100),
+        offset: parseInt(req.query.offset) || 0,
+      });
+      res.json(results);
+    } catch (err) {
+      res.status(500).json({ error: err.message });
+    }
+  });
+
+  app.post('/api/queue/add', (req, res) => {
+    try {
+      const { ident, name, size } = req.body || {};
+      if (!ident) return res.status(400).json({ error: 'ident required' });
+      const ok = qbt.enqueueDirect(ident, name || ident, parseInt(size) || 0);
+      if (!ok) return res.status(409).json({ error: 'already in queue' });
+      res.json({ ok: true });
+    } catch (err) {
+      console.error('queue/add', err);
+      res.status(500).json({ error: err.message || 'queue add failed' });
+    }
+  });
+
+  app.get('/api/queue', (req, res) => {
+    try {
+      res.json(qbt.getQueue());
+    } catch (err) {
+      console.error('queue', err);
+      res.status(500).json({ error: err.message || 'queue failed' });
+    }
+  });
+
+  app.post('/api/queue/cancel', (req, res) => {
+    try {
+      const { hash } = req.body || {};
+      if (!hash) return res.status(400).json({ error: 'hash required' });
+      const ok = qbt.cancelDownload(hash);
+      if (!ok) return res.status(404).json({ error: 'hash not in queue' });
+      res.json({ ok: true });
+    } catch (err) {
+      console.error('queue/cancel', err);
+      res.status(500).json({ error: err.message || 'cancel failed' });
+    }
+  });
+}
+
+module.exports = { registerUiApi };