@civilization/dsh-drawio 0.1.0 → 0.2.1

package/src/index.js

@@ -6,9 +6,11 @@ import { defineTool } from '@deepseek-ai/dsh-tools'
 import { editDrawio, inspectDrawio, normalizeDrawio } from './xml.js'
 
 export const name = 'dsh-drawio'
-export const inject = ['tools', 'fs', 'sandbox', 'webServer']
+export const inject = ['tools', 'fs', 'webServer']
 
 const runtimeRoot = fileURLToPath(new URL('../vendor/drawio/', import.meta.url))
+const MAX_DIAGRAM_BYTES = 10 * 1024 * 1024
+const MAX_REQUEST_BYTES = MAX_DIAGRAM_BYTES + 64 * 1024
 const output = {
   schema: { type: 'object', additionalProperties: true, properties: {} },
   render: (_args, value) => [{ type: 'text', text: JSON.stringify(value, null, 2) }],
@@ -17,6 +19,7 @@ const pathParameter = { type: 'string', required: true, description: 'Path to a
 
 export function apply(ctx) {
   ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: '/dsh-drawio/runtime', handler: serveRuntime }))
+  ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: '/dsh-drawio/api', handler: (req, res) => serveCanvasApi(ctx, req, res) }))
   register(ctx, defineTool({
     name: 'drawio_inspect',
     description: 'Read a Draw.io file as structured pages, nodes, edges and geometry. Use this before editing an existing diagram. Set include_xml only when raw XML details are required.',
@@ -51,7 +54,8 @@ export function apply(ctx) {
     async execute(args, exec) {
       const { text, target } = await readDiagram(ctx, args.path, exec)
       const xml = editDrawio(text, args.operations, args.page)
-      const outcome = await writeDiagram(ctx, target, xml, args, exec)
+      const policy = await resolvePolicy(ctx, 'drawio_edit', args, exec)
+      const outcome = await writeDiagram(ctx, target, xml, args, exec, policy)
       return { path: target.displayPath, operation: outcome.operation, operationsApplied: args.operations.length, ...inspectDrawio(xml, false) }
     },
   }))
@@ -62,7 +66,7 @@ export function apply(ctx) {
     output,
     async execute(args, exec) {
       assertDrawioPath(args.path)
-      const policy = await ctx.sandbox.resolvePolicy('write', args, exec)
+      const policy = await resolvePolicy(ctx, 'drawio_write', args, exec)
       const target = await ctx.fs.resolve(args.path, resolveOptions(exec, args.path, policy?.workspaceRoot))
       const xml = normalizeDrawio(args.xml)
       const outcome = await writeDiagram(ctx, target, xml, args, exec, policy)
@@ -71,6 +75,67 @@ export function apply(ctx) {
   }))
 }
 
+async function serveCanvasApi(ctx, req, res) {
+  if (req.method === 'OPTIONS') {
+    res.statusCode = 204
+    res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS')
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type')
+    res.end()
+    return
+  }
+  if (req.method !== 'POST') return respondJson(res, 405, { ok: false, error: { message: 'Method Not Allowed' } })
+  try {
+    const pathname = new URL(req.url || '/', 'http://dsh.internal').pathname
+    const method = pathname.slice('/dsh-drawio/api/'.length)
+    if (!['read', 'write'].includes(method)) return respondJson(res, 404, { ok: false, error: { message: 'Unknown Draw.io operation.' } })
+    const payload = await readJsonBody(req)
+    const target = await resolveCanvasTarget(ctx, payload.cwd, payload.path)
+    const info = await ctx.fs.stat(target)
+    if (!info || info.type !== 'file') throw new Error('Draw.io file was not found.')
+    if (Number(info.size) > MAX_DIAGRAM_BYTES) throw new Error('Draw.io file is too large to open safely.')
+    if (method === 'read') return respondJson(res, 200, { ok: true, value: { content: await ctx.fs.readText(target) } })
+    if (typeof payload.content !== 'string' || Buffer.byteLength(payload.content) > MAX_DIAGRAM_BYTES) throw new Error('Draw.io content is too large to save safely.')
+    const xml = normalizeDrawio(payload.content)
+    const sandboxPolicy = { mode: 'workspace-write', workspaceRoot: payload.cwd }
+    await ctx.fs.writeText(target, xml, { kind: 'replaceIfVersion', version: info.version }, undefined, sandboxPolicy)
+    return respondJson(res, 200, { ok: true, value: { ok: true } })
+  } catch (error) {
+    return respondJson(res, 400, { ok: false, error: { message: String(error?.message || error).slice(0, 500) } })
+  }
+}
+
+async function resolveCanvasTarget(ctx, cwd, path) {
+  if (typeof cwd !== 'string' || !cwd.trim()) throw new Error('A workspace is required.')
+  assertDrawioPath(path)
+  const [root, target] = await Promise.all([ctx.fs.resolve(cwd), ctx.fs.resolve(path, { cwd })])
+  if (!ctx.fs.contains(root, target)) throw new Error('Draw.io file must stay inside the current workspace.')
+  return target
+}
+
+async function readJsonBody(req) {
+  const declared = Number(req.headers?.['content-length'])
+  if (Number.isFinite(declared) && declared > MAX_REQUEST_BYTES) throw new Error('Request body is too large.')
+  const chunks = []; let size = 0
+  for await (const chunk of req) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    size += buffer.length
+    if (size > MAX_REQUEST_BYTES) throw new Error('Request body is too large.')
+    chunks.push(buffer)
+  }
+  const text = Buffer.concat(chunks).toString('utf8')
+  const value = text ? JSON.parse(text) : {}
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('Request body must be a JSON object.')
+  return value
+}
+
+function respondJson(res, status, value) {
+  const body = JSON.stringify(value)
+  res.statusCode = status
+  res.setHeader('Content-Type', 'application/json; charset=utf-8')
+  res.setHeader('Content-Length', Buffer.byteLength(body))
+  res.end(body)
+}
+
 function register(ctx, tool) {
   ctx.effect(() => ctx.tools.register(tool))
 }
@@ -86,8 +151,24 @@ async function readDiagram(ctx, requestedPath, exec) {
   return { target, text }
 }
 
+async function resolvePolicy(ctx, toolName, args, exec) {
+  const sandbox = ctx.get?.('sandbox')
+  if (sandbox?.resolvePolicy) {
+    try {
+      return await sandbox.resolvePolicy(toolName, args, exec)
+    } catch {}
+  }
+  const policyService = ctx.get?.('sandboxPolicy')
+  if (policyService?.resolve) {
+    try {
+      return policyService.resolve({ ...(exec?.agent ? { session: exec.agent.session } : {}) })
+    } catch {}
+  }
+  return undefined
+}
+
 async function writeDiagram(ctx, target, xml, args, exec, resolvedPolicy) {
-  const policy = resolvedPolicy ?? await ctx.sandbox.resolvePolicy('write', args, exec)
+  const policy = resolvedPolicy ?? await resolvePolicy(ctx, 'write', args, exec)
   const intent = await ctx.waterfall('fs/write-intent', target, exec, () => undefined)
   const outcome = await ctx.fs.writeText(target, xml, intent, exec.signal, policy)
   ctx.emit('fs/observed', target, { kind: 'present', version: outcome.version }, exec)

package/vendor/drawio/js/PreConfig.js

@@ -8,10 +8,16 @@ window.DRAW_MATH_URL = null;
 window.DRAWIO_CONFIG = {
   compressXml: false,
   enableCssDarkMode: true,
-  defaultLibraries: 'general;flowchart;basic;arrows2',
-  enabledLibraries: ['general', 'flowchart', 'basic', 'arrows2']
+  defaultLibraries: 'general;uml;er;bpmn;flowchart;basic;arrows2',
+  enabledLibraries: null
 };
 urlParams['sync'] = 'manual';
 urlParams['offline'] = '1';
 urlParams['local'] = '1';
 urlParams['plugins'] = '0';
+
+if (typeof navigator !== 'undefined' && 'serviceWorker' in navigator) {
+  navigator.serviceWorker.getRegistrations().then(function(regs) {
+    for (var i = 0; i < regs.length; i++) regs[i].unregister();
+  }).catch(function() {});
+}