@farhanic017/octocode 3.5.0

package/src/server/routes/instance/httpapi/handlers/reference.ts

@@ -0,0 +1,27 @@
+import { Reference } from "@/reference/reference"
+import { Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { InstanceHttpApi } from "../api"
+
+export const referenceHandlers = HttpApiBuilder.group(InstanceHttpApi, "reference", (handlers) =>
+  Effect.gen(function* () {
+    const reference = yield* Reference.Service
+
+    return handlers.handle("list", () =>
+      reference.list().pipe(
+        Effect.map((references) =>
+          references.map((item) => {
+            if (item.kind !== "git") return item
+            return {
+              name: item.name,
+              kind: item.kind,
+              repository: item.repository,
+              path: item.path,
+              ...(item.branch !== undefined ? { branch: item.branch } : {}),
+            }
+          }),
+        ),
+      ),
+    )
+  }),
+)

package/src/server/routes/instance/httpapi/handlers/sync.ts

@@ -0,0 +1,95 @@
+import { Workspace } from "@/control-plane/workspace"
+import * as InstanceState from "@/effect/instance-state"
+import { Session } from "@/session/session"
+import { Database } from "@octocode-ai/core/database/database"
+import { EventV2 } from "@octocode-ai/core/event"
+import { EventV2Bridge } from "@/event-v2-bridge"
+import { EventTable } from "@octocode-ai/core/event/sql"
+import { asc } from "drizzle-orm"
+import { and } from "drizzle-orm"
+import { eq } from "drizzle-orm"
+import { lte } from "drizzle-orm"
+import { not } from "drizzle-orm"
+import { or } from "drizzle-orm"
+import { Effect, Scope } from "effect"
+import { HttpApiBuilder, HttpApiError } from "effect/unstable/httpapi"
+import { InstanceHttpApi } from "../api"
+import { HistoryPayload, ReplayPayload, SessionPayload } from "../groups/sync"
+import * as Log from "@octocode-ai/core/util/log"
+
+const log = Log.create({ service: "server.sync" })
+
+export const syncHandlers = HttpApiBuilder.group(InstanceHttpApi, "sync", (handlers) =>
+  Effect.gen(function* () {
+    const workspace = yield* Workspace.Service
+    const session = yield* Session.Service
+    const scope = yield* Scope.Scope
+    const events = yield* EventV2Bridge.Service
+    const { db } = yield* Database.Service
+
+    const start = Effect.fn("SyncHttpApi.start")(function* () {
+      yield* workspace
+        .startWorkspaceSyncing((yield* InstanceState.context).project.id)
+        .pipe(Effect.ignore, Effect.forkIn(scope))
+      return true
+    })
+
+    const replay = Effect.fn("SyncHttpApi.replay")(function* (ctx: { payload: typeof ReplayPayload.Type }) {
+      const payload: EventV2.SerializedEvent[] = ctx.payload.events.map((event) => ({
+        id: event.id,
+        aggregateID: event.aggregateID,
+        seq: event.seq,
+        type: event.type,
+        data: { ...event.data },
+      }))
+      const source = payload[0].aggregateID
+      log.info("sync replay requested", {
+        sessionID: source,
+        events: payload.length,
+        first: payload[0]?.seq,
+        last: payload.at(-1)?.seq,
+        directory: ctx.payload.directory,
+      })
+      const ownerID = yield* InstanceState.workspaceID
+      yield* events.replayAll(payload, { ownerID, strictOwner: true })
+      log.info("sync replay complete", {
+        sessionID: source,
+        events: payload.length,
+        first: payload[0]?.seq,
+        last: payload.at(-1)?.seq,
+      })
+      return { sessionID: source }
+    })
+
+    const steal = Effect.fn("SyncHttpApi.steal")(function* (ctx: { payload: typeof SessionPayload.Type }) {
+      const workspaceID = yield* InstanceState.workspaceID
+      if (!workspaceID) return yield* new HttpApiError.BadRequest({})
+
+      yield* session.setWorkspace({ sessionID: ctx.payload.sessionID, workspaceID })
+
+      log.info("sync session stolen", {
+        sessionID: ctx.payload.sessionID,
+        workspaceID,
+      })
+
+      return { sessionID: ctx.payload.sessionID }
+    })
+
+    const history = Effect.fn("SyncHttpApi.history")(function* (ctx: { payload: typeof HistoryPayload.Type }) {
+      const exclude = Object.entries(ctx.payload)
+      return yield* db
+        .select()
+        .from(EventTable)
+        .where(
+          exclude.length > 0
+            ? not(or(...exclude.map(([id, seq]) => and(eq(EventTable.aggregate_id, id), lte(EventTable.seq, seq))))!)
+            : undefined,
+        )
+        .orderBy(asc(EventTable.seq))
+        .all()
+        .pipe(Effect.orDie)
+    })
+
+    return handlers.handle("start", start).handle("replay", replay).handle("steal", steal).handle("history", history)
+  }),
+)

package/src/server/routes/instance/httpapi/handlers/tui.ts

@@ -0,0 +1,131 @@
+import { EventV2Bridge } from "@/event-v2-bridge"
+import { TuiEvent } from "@/server/tui-event"
+import { Session } from "@/session/session"
+import { Effect } from "effect"
+import { HttpApiBuilder, HttpApiError } from "effect/unstable/httpapi"
+import { nextTuiRequest, submitTuiResponse } from "@/server/shared/tui-control"
+import { InstanceHttpApi } from "../api"
+import { CommandPayload, TuiPublishPayload } from "../groups/tui"
+import * as SessionError from "./session-errors"
+
+const commandAliases = {
+  session_new: "session.new",
+  session_share: "session.share",
+  session_interrupt: "session.interrupt",
+  session_compact: "session.compact",
+  messages_page_up: "session.page.up",
+  messages_page_down: "session.page.down",
+  messages_line_up: "session.line.up",
+  messages_line_down: "session.line.down",
+  messages_half_page_up: "session.half.page.up",
+  messages_half_page_down: "session.half.page.down",
+  messages_first: "session.first",
+  messages_last: "session.last",
+  agent_cycle: "agent.cycle",
+} as const
+
+export const tuiHandlers = HttpApiBuilder.group(InstanceHttpApi, "tui", (handlers) =>
+  Effect.gen(function* () {
+    const events = yield* EventV2Bridge.Service
+    const session = yield* Session.Service
+    const publishCommand = (command: typeof TuiEvent.CommandExecute.data.Type.command | undefined) =>
+      events.publish(TuiEvent.CommandExecute, { command } as typeof TuiEvent.CommandExecute.data.Type)
+
+    const appendPrompt = Effect.fn("TuiHttpApi.appendPrompt")(function* (ctx: {
+      payload: typeof TuiEvent.PromptAppend.data.Type
+    }) {
+      yield* events.publish(TuiEvent.PromptAppend, ctx.payload)
+      return true
+    })
+
+    const openHelp = Effect.fn("TuiHttpApi.openHelp")(function* () {
+      yield* publishCommand("help.show")
+      return true
+    })
+
+    const openSessions = Effect.fn("TuiHttpApi.openSessions")(function* () {
+      yield* publishCommand("session.list")
+      return true
+    })
+
+    const openThemes = Effect.fn("TuiHttpApi.openThemes")(function* () {
+      yield* publishCommand("session.list")
+      return true
+    })
+
+    const openModels = Effect.fn("TuiHttpApi.openModels")(function* () {
+      yield* publishCommand("model.list")
+      return true
+    })
+
+    const submitPrompt = Effect.fn("TuiHttpApi.submitPrompt")(function* () {
+      yield* publishCommand("prompt.submit")
+      return true
+    })
+
+    const clearPrompt = Effect.fn("TuiHttpApi.clearPrompt")(function* () {
+      yield* publishCommand("prompt.clear")
+      return true
+    })
+
+    const executeCommand = Effect.fn("TuiHttpApi.executeCommand")(function* (ctx: {
+      payload: typeof CommandPayload.Type
+    }) {
+      // Legacy only publishes known aliases; unknown commands become undefined.
+      yield* publishCommand(commandAliases[ctx.payload.command as keyof typeof commandAliases])
+      return true
+    })
+
+    const showToast = Effect.fn("TuiHttpApi.showToast")(function* (ctx: {
+      payload: typeof TuiEvent.ToastShow.data.Type
+    }) {
+      yield* events.publish(TuiEvent.ToastShow, ctx.payload)
+      return true
+    })
+
+    const publish = Effect.fn("TuiHttpApi.publish")(function* (ctx: { payload: typeof TuiPublishPayload.Type }) {
+      if (ctx.payload.type === TuiEvent.PromptAppend.type)
+        yield* events.publish(TuiEvent.PromptAppend, ctx.payload.properties)
+      if (ctx.payload.type === TuiEvent.CommandExecute.type)
+        yield* events.publish(TuiEvent.CommandExecute, ctx.payload.properties)
+      if (ctx.payload.type === TuiEvent.ToastShow.type)
+        yield* events.publish(TuiEvent.ToastShow, ctx.payload.properties)
+      if (ctx.payload.type === TuiEvent.SessionSelect.type)
+        yield* events.publish(TuiEvent.SessionSelect, ctx.payload.properties)
+      return true
+    })
+
+    const selectSession = Effect.fn("TuiHttpApi.selectSession")(function* (ctx: {
+      payload: typeof TuiEvent.SessionSelect.data.Type
+    }) {
+      if (!ctx.payload.sessionID.startsWith("ses")) return yield* new HttpApiError.BadRequest({})
+      yield* SessionError.mapStorageNotFound(session.get(ctx.payload.sessionID))
+      yield* events.publish(TuiEvent.SessionSelect, ctx.payload)
+      return true
+    })
+
+    const controlNext = Effect.fn("TuiHttpApi.controlNext")(function* () {
+      return yield* Effect.promise(() => nextTuiRequest())
+    })
+
+    const controlResponse = Effect.fn("TuiHttpApi.controlResponse")(function* (ctx: { payload: unknown }) {
+      submitTuiResponse(ctx.payload)
+      return true
+    })
+
+    return handlers
+      .handle("appendPrompt", appendPrompt)
+      .handle("openHelp", openHelp)
+      .handle("openSessions", openSessions)
+      .handle("openThemes", openThemes)
+      .handle("openModels", openModels)
+      .handle("submitPrompt", submitPrompt)
+      .handle("clearPrompt", clearPrompt)
+      .handle("executeCommand", executeCommand)
+      .handle("showToast", showToast)
+      .handle("publish", publish)
+      .handle("selectSession", selectSession)
+      .handle("controlNext", controlNext)
+      .handle("controlResponse", controlResponse)
+  }),
+)

package/src/server/routes/instance/httpapi/handlers/workspace.ts

@@ -0,0 +1,102 @@
+import { listAdapters } from "@/control-plane/adapters"
+import { Workspace } from "@/control-plane/workspace"
+import * as InstanceState from "@/effect/instance-state"
+import { Vcs } from "@/project/vcs"
+import { Cause, Effect } from "effect"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { InstanceHttpApi } from "../api"
+import { notFound } from "../errors"
+import { ApiVcsApplyError } from "../groups/instance"
+import { ApiWorkspaceCreateError, ApiWorkspaceWarpError, CreatePayload, WarpPayload } from "../groups/workspace"
+
+export const workspaceHandlers = HttpApiBuilder.group(InstanceHttpApi, "workspace", (handlers) =>
+  Effect.gen(function* () {
+    const workspace = yield* Workspace.Service
+
+    const adapters = Effect.fn("WorkspaceHttpApi.adapters")(function* () {
+      const instance = yield* InstanceState.context
+      return yield* Effect.sync(() => listAdapters(instance.project.id))
+    })
+
+    const list = Effect.fn("WorkspaceHttpApi.list")(function* () {
+      return yield* workspace.list((yield* InstanceState.context).project)
+    })
+
+    const create = Effect.fn("WorkspaceHttpApi.create")(function* (ctx: { payload: typeof CreatePayload.Type }) {
+      const instance = yield* InstanceState.context
+      return yield* workspace
+        .create({
+          ...ctx.payload,
+          extra: ctx.payload.extra ?? null,
+          projectID: instance.project.id,
+        })
+        .pipe(
+          Effect.catchCause((cause) => {
+            // Plugin throws surface as defects (because EffectBridge.fromPromise uses Effect.promise),
+            // bypassing Effect.mapError. Walk the cause to surface the real error to the client.
+            const die = cause.reasons.find(Cause.isDieReason)
+            const fail = cause.reasons.find(Cause.isFailReason)
+            const reason: unknown = die?.defect ?? fail?.error
+            const message = reason instanceof Error ? reason.message : "Workspace creation failed"
+            return Effect.fail(
+              new ApiWorkspaceCreateError({
+                name: "WorkspaceCreateError",
+                data: { message },
+              }),
+            )
+          }),
+        )
+    })
+
+    const syncList = Effect.fn("WorkspaceHttpApi.syncList")(function* () {
+      yield* workspace.syncList((yield* InstanceState.context).project)
+    })
+
+    const status = Effect.fn("WorkspaceHttpApi.status")(function* () {
+      const ids = new Set((yield* workspace.list((yield* InstanceState.context).project)).map((item) => item.id))
+      return (yield* workspace.status()).filter((item) => ids.has(item.workspaceID))
+    })
+
+    const remove = Effect.fn("WorkspaceHttpApi.remove")(function* (ctx: { params: { id: Workspace.Info["id"] } }) {
+      return yield* workspace.remove(ctx.params.id)
+    })
+
+    const warp = Effect.fn("WorkspaceHttpApi.warp")(function* (ctx: { payload: typeof WarpPayload.Type }) {
+      yield* workspace
+        .sessionWarp({
+          workspaceID: ctx.payload.id,
+          sessionID: ctx.payload.sessionID,
+          copyChanges: ctx.payload.copyChanges,
+        })
+        .pipe(
+          Effect.mapError((error) => {
+            if (error instanceof Workspace.WorkspaceNotFoundError) return notFound(error.message)
+            if (error instanceof Vcs.PatchApplyError) {
+              return new ApiVcsApplyError({
+                name: "VcsApplyError",
+                data: {
+                  message: error.message,
+                  reason: error.reason,
+                },
+              })
+            }
+            return new ApiWorkspaceWarpError({
+              name: "WorkspaceWarpError",
+              data: {
+                message: error.message,
+              },
+            })
+          }),
+        )
+    })
+
+    return handlers
+      .handle("adapters", adapters)
+      .handle("list", list)
+      .handle("create", create)
+      .handle("syncList", syncList)
+      .handle("status", status)
+      .handle("remove", remove)
+      .handle("warp", warp)
+  }),
+)

package/src/server/routes/instance/httpapi/lifecycle.ts

@@ -0,0 +1,57 @@
+import { EffectBridge } from "@/effect/bridge"
+import type { InstanceContext } from "@/project/instance-context"
+import { InstanceStore } from "@/project/instance-store"
+import * as Log from "@octocode-ai/core/util/log"
+import { Effect } from "effect"
+import { HttpEffect, HttpMiddleware, HttpServerRequest } from "effect/unstable/http"
+
+const log = Log.create({ service: "server" })
+
+type MarkedInstance = {
+  ctx: InstanceContext
+  store: InstanceStore.Interface
+  bridge: EffectBridge.Shape
+}
+
+// Disposal is requested by an endpoint handler, but must run from the outer
+// server middleware after the response has been produced. The original Request
+// object is the stable handoff key between those two phases.
+const disposeAfterResponse = new WeakMap<object, MarkedInstance>()
+
+const mark = (ctx: InstanceContext) =>
+  Effect.gen(function* () {
+    return { ctx, store: yield* InstanceStore.Service, bridge: yield* EffectBridge.make() }
+  })
+
+export const markInstanceForDisposal = (ctx: InstanceContext) =>
+  Effect.gen(function* () {
+    const marked = yield* mark(ctx)
+    return yield* HttpEffect.appendPreResponseHandler((request, response) =>
+      Effect.sync(() => {
+        // The response is sent before disposeMiddleware performs the teardown.
+        disposeAfterResponse.set(request.source, marked)
+        return response
+      }),
+    )
+  })
+
+export const markInstanceForReload = (ctx: InstanceContext, next: InstanceStore.LoadInput) =>
+  Effect.gen(function* () {
+    const marked = yield* mark(ctx)
+    return yield* HttpEffect.appendPreResponseHandler((_request, response) =>
+      Effect.as(Effect.uninterruptible(marked.bridge.run(marked.store.reload(next))), response),
+    )
+  })
+
+export const disposeMiddleware: HttpMiddleware.HttpMiddleware = (effect) =>
+  Effect.gen(function* () {
+    const response = yield* effect
+    const request = yield* HttpServerRequest.HttpServerRequest
+    const marked = disposeAfterResponse.get(request.source)
+    if (!marked) return response
+    disposeAfterResponse.delete(request.source)
+    yield* Effect.uninterruptible(marked.bridge.run(marked.store.dispose(marked.ctx))).pipe(
+      Effect.catchCause((cause) => Effect.sync(() => log.warn("instance disposal failed", { cause }))),
+    )
+    return response
+  })

package/src/server/routes/instance/httpapi/middleware/authorization.ts

@@ -0,0 +1,150 @@
+import { ServerAuth } from "@/server/auth"
+import { Effect, Encoding, Layer, Redacted } from "effect"
+import { HttpEffect, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+import { HttpApiError, HttpApiMiddleware } from "effect/unstable/httpapi"
+import { hasPtyConnectTicketURL } from "@/server/shared/pty-ticket"
+import { isPublicUIPath } from "@/server/shared/public-ui"
+export {
+  Authorization as ServerAuthorization,
+  authorizationLayer as serverAuthorizationLayer,
+} from "@octocode-ai/server/middleware/authorization"
+
+const AUTH_TOKEN_QUERY = "auth_token"
+const UNAUTHORIZED = 401
+const WWW_AUTHENTICATE = 'Basic realm="Secure Area"'
+
+// Avoid HttpApiSecurity alternatives here: Effect security middleware wraps the
+// full handler, so a downstream failure can make the next auth alternative run
+// and remap an authorized NotFound into Unauthorized.
+export class Authorization extends HttpApiMiddleware.Service<Authorization>()(
+  "@octocode/ExperimentalHttpApiAuthorization",
+  {
+    error: HttpApiError.UnauthorizedNoContent,
+  },
+) {}
+
+export class PtyConnectAuthorization extends HttpApiMiddleware.Service<PtyConnectAuthorization>()(
+  "@octocode/ExperimentalHttpApiPtyConnectAuthorization",
+  {
+    error: HttpApiError.UnauthorizedNoContent,
+  },
+) {}
+
+function emptyCredential() {
+  return {
+    username: "",
+    password: Redacted.make(""),
+  }
+}
+
+function validateCredential<A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+  credential: ServerAuth.DecodedCredentials,
+  config: ServerAuth.Info,
+) {
+  return Effect.gen(function* () {
+    if (!ServerAuth.required(config)) return yield* effect
+    if (!ServerAuth.authorized(credential, config)) {
+      yield* HttpEffect.appendPreResponseHandler((_request, response) =>
+        Effect.succeed(HttpServerResponse.setHeader(response, "www-authenticate", WWW_AUTHENTICATE)),
+      )
+      return yield* new HttpApiError.Unauthorized({})
+    }
+    return yield* effect
+  })
+}
+
+function decodeCredential(input: string) {
+  return Effect.fromResult(Encoding.decodeBase64String(input)).pipe(
+    Effect.match({
+      onFailure: emptyCredential,
+      onSuccess: (header) => {
+        const separator = header.indexOf(":")
+        if (separator === -1) return emptyCredential()
+        return {
+          username: header.slice(0, separator),
+          password: Redacted.make(header.slice(separator + 1)),
+        }
+      },
+    }),
+  )
+}
+
+function credentialFromRequest(request: HttpServerRequest.HttpServerRequest) {
+  return credentialFromURL(new URL(request.url, "http://localhost"), request)
+}
+
+function credentialFromURL(url: URL, request: HttpServerRequest.HttpServerRequest) {
+  const token = url.searchParams.get(AUTH_TOKEN_QUERY)
+  if (token) return decodeCredential(token)
+  const match = /^Basic\s+(.+)$/i.exec(request.headers.authorization ?? "")
+  if (match) return decodeCredential(match[1])
+  return Effect.succeed(emptyCredential())
+}
+
+function validateRawCredential<A, E, R>(
+  effect: Effect.Effect<A, E, R>,
+  credential: ServerAuth.DecodedCredentials,
+  config: ServerAuth.Info,
+) {
+  if (!ServerAuth.required(config)) return effect
+  if (!ServerAuth.authorized(credential, config))
+    return Effect.succeed(
+      HttpServerResponse.empty({
+        status: UNAUTHORIZED,
+        headers: { "www-authenticate": WWW_AUTHENTICATE },
+      }),
+    )
+  return effect
+}
+
+export const authorizationRouterMiddleware = HttpRouter.middleware()(
+  Effect.gen(function* () {
+    const config = yield* ServerAuth.Config
+    if (!ServerAuth.required(config)) return (effect) => effect
+
+    return (effect) =>
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest
+        const url = new URL(request.url, "http://localhost")
+        if (isPublicUIPath(request.method, url.pathname)) return yield* effect
+        return yield* credentialFromURL(url, request).pipe(
+          Effect.flatMap((credential) => validateRawCredential(effect, credential, config)),
+        )
+      })
+  }),
+)
+
+export const authorizationLayer = Layer.effect(
+  Authorization,
+  Effect.gen(function* () {
+    const config = yield* ServerAuth.Config
+    if (!ServerAuth.required(config)) return Authorization.of((effect) => effect)
+    return Authorization.of((effect) =>
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest
+        return yield* credentialFromRequest(request).pipe(
+          Effect.flatMap((credential) => validateCredential(effect, credential, config)),
+        )
+      }),
+    )
+  }),
+)
+
+export const ptyConnectAuthorizationLayer = Layer.effect(
+  PtyConnectAuthorization,
+  Effect.gen(function* () {
+    const config = yield* ServerAuth.Config
+    if (!ServerAuth.required(config)) return PtyConnectAuthorization.of((effect) => effect)
+    return PtyConnectAuthorization.of((effect) =>
+      Effect.gen(function* () {
+        const request = yield* HttpServerRequest.HttpServerRequest
+        const url = new URL(request.url, "http://localhost")
+        if (hasPtyConnectTicketURL(url)) return yield* effect
+        return yield* credentialFromURL(url, request).pipe(
+          Effect.flatMap((credential) => validateCredential(effect, credential, config)),
+        )
+      }),
+    )
+  }),
+)

package/src/server/routes/instance/httpapi/middleware/compression.ts

@@ -0,0 +1,64 @@
+import { deflateSync, gzipSync } from "node:zlib"
+import { Effect } from "effect"
+import { HttpBody, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+
+// Keep the server's compressible content-type set stable across HTTP backend changes.
+const COMPRESSIBLE_CONTENT_TYPE_REGEX =
+  /^\s*(?:text\/(?!event-stream(?:[;\s]|$))[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i
+
+const NO_TRANSFORM_REGEX = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i
+
+const STREAMING_PATHS = new Set(["/event", "/global/event"])
+const STREAMING_POST_REGEX = /^\/session\/[^/]+\/(?:message|prompt_async)$/
+
+const THRESHOLD_BYTES = 1024
+
+type Encoding = "gzip" | "deflate"
+
+function pickEncoding(acceptEncoding: string | undefined): Encoding | undefined {
+  if (!acceptEncoding) return undefined
+  const lower = acceptEncoding.toLowerCase()
+  if (lower.includes("gzip")) return "gzip"
+  if (lower.includes("deflate")) return "deflate"
+  return undefined
+}
+
+function pathOf(url: string): string {
+  const queryIndex = url.indexOf("?")
+  return queryIndex === -1 ? url : url.slice(0, queryIndex)
+}
+
+export const compressionLayer = HttpRouter.middleware<{ handles: unknown }>()((effect) =>
+  Effect.gen(function* () {
+    const response = yield* effect
+    const request = yield* HttpServerRequest.HttpServerRequest
+
+    if (request.method === "HEAD") return response
+    if (response.headers["content-encoding"]) return response
+    if (response.headers["transfer-encoding"]) return response
+
+    const body = response.body
+    if (body._tag !== "Uint8Array") return response
+    if (body.body.byteLength < THRESHOLD_BYTES) return response
+
+    const cacheControl = response.headers["cache-control"]
+    if (cacheControl && NO_TRANSFORM_REGEX.test(cacheControl)) return response
+
+    const path = pathOf(request.url)
+    if (STREAMING_PATHS.has(path)) return response
+    if (request.method === "POST" && STREAMING_POST_REGEX.test(path)) return response
+
+    const contentType = body.contentType
+    if (!COMPRESSIBLE_CONTENT_TYPE_REGEX.test(contentType)) return response
+
+    const encoding = pickEncoding(request.headers["accept-encoding"])
+    if (!encoding) return response
+
+    const compressed = encoding === "gzip" ? gzipSync(body.body) : deflateSync(body.body)
+    return HttpServerResponse.setHeader(
+      HttpServerResponse.setBody(response, HttpBody.uint8Array(compressed, contentType)),
+      "content-encoding",
+      encoding,
+    )
+  }),
+).layer

package/src/server/routes/instance/httpapi/middleware/cors-vary.ts

@@ -0,0 +1,29 @@
+import { Effect } from "effect"
+import { HttpRouter, HttpServerResponse } from "effect/unstable/http"
+
+// effect-smol's HttpMiddleware.cors builds OPTIONS preflight responses by
+// spreading allowOrigin() and allowHeaders() into the same record. Both set
+// the `vary` key, so allowHeaders' `Vary: Access-Control-Request-Headers`
+// overwrites allowOrigin's `Vary: Origin`. With dynamic origin echoing, the
+// missing `Vary: Origin` lets shared caches reuse a preflight cached for one
+// origin against a different origin.
+//
+// TODO: upstream a fix that merges Vary values in headersFromRequestOptions
+// (packages/effect/src/unstable/http/HttpMiddleware.ts ~line 332).
+export const corsVaryFix = HttpRouter.middleware(
+  (effect) =>
+    Effect.gen(function* () {
+      const response = yield* effect
+      const allowOrigin = response.headers["access-control-allow-origin"]
+      if (!allowOrigin || allowOrigin === "*") return response
+
+      const vary = response.headers["vary"]
+      if (!vary) return HttpServerResponse.setHeader(response, "vary", "Origin")
+
+      const tokens = vary.split(",").map((s) => s.trim().toLowerCase())
+      if (tokens.includes("origin") || tokens.includes("*")) return response
+
+      return HttpServerResponse.setHeader(response, "vary", `${vary}, Origin`)
+    }),
+  { global: true },
+)