@hienlh/ppm 0.20.9 → 0.21.0

package/src/server/routes/static-fallback.ts

@@ -0,0 +1,51 @@
+/**
+ * Whether a request for a file that is not on disk should be answered with the
+ * app shell, or with a 404.
+ *
+ * Getting this wrong in one direction is the white screen. An upgrade replaces
+ * `dist/web` and Vite's `emptyOutDir` deletes the previous content hashes, so a
+ * tab that has been open across the upgrade asks for a lazy chunk that is gone.
+ * Answered with `index.html` at `200 text/html`, the browser refuses the module
+ * on its strict MIME check, the `import()` rejects, `React.lazy` throws, and
+ * React unmounts the whole tree — `#root` empties and the page shows nothing but
+ * the body's background. The service worker then made it permanent by caching
+ * that HTML under the chunk's own URL.
+ *
+ * Getting it wrong in the other direction breaks every deep link and every
+ * reload, so the rule has to be narrow. It cannot be written on the path's
+ * shape: PPM's routes embed file paths, so `/project/x/editor/src/main.js` is a
+ * navigation whose extension is `.js`.
+ *
+ * `Sec-Fetch-Dest` states the request's intent exactly and is the primary test.
+ * Browsers omit the Fetch Metadata headers on an insecure origin, though, and
+ * PPM is routinely reached over plain HTTP on a LAN — so the two directories
+ * that only ever hold build output are checked as well. No app route lives
+ * under either.
+ */
+
+/**
+ * Directories that hold build output and nothing else.
+ *
+ * `/monacoeditorwork/` no longer holds anything — Monaco is staged under `/assets/monaco/`
+ * and the route that served the other path is gone — but it stays here rather than being
+ * tidied away, because this list exists for the requests a *stale client* makes. A tab
+ * carrying the old service worker across the upgrade still asks for it, and on an insecure
+ * origin there is no `Sec-Fetch-Dest` to refuse it by; answering that with the shell at
+ * `200 text/html` is the white screen this file exists to prevent.
+ */
+const ASSET_ROOTS = ["/assets/", "/monacoeditorwork/"];
+
+/**
+ * `document` is a navigation. `empty` is `fetch`/XHR, which is left in the
+ * navigation bucket deliberately: an API path that falls through to here has
+ * always been answered with the shell, and narrowing that is a separate
+ * question from this bug. Everything else — `script`, `style`, `worker`,
+ * `font`, `image`, `serviceworker` — is a subresource, and a subresource is
+ * never satisfied by HTML.
+ */
+const NAVIGATION_DESTS = new Set(["document", "empty"]);
+
+export function shouldServeAppShell(urlPath: string, secFetchDest: string | undefined): boolean {
+  if (secFetchDest !== undefined && !NAVIGATION_DESTS.has(secFetchDest)) return false;
+  return !ASSET_ROOTS.some((root) => urlPath.startsWith(root));
+}

package/src/server/routes/static.ts

@@ -1,7 +1,10 @@
 import { Hono } from "hono";
+import type { Context } from "hono";
 import { existsSync, statSync } from "node:fs";
 import { resolve, join, extname, dirname } from "node:path";
 import { isCompiledBinary } from "../../services/autostart-generator.ts";
+import { chooseVariant } from "./static-encoding.ts";
+import { shouldServeAppShell } from "./static-fallback.ts";
 
 export const staticRoutes = new Hono();
 
@@ -34,8 +37,16 @@ const MIME_TYPES: Record<string, string> = {
  * Serve static files from dist/web/ using Bun.file() directly.
  * Avoids hono/bun serveStatic which has path issues on Windows.
  * Falls back to index.html for SPA routing.
+ *
+ * Built around the directory rather than reading `DIST_DIR` directly so the
+ * whole handler can be mounted on a temporary one. The white-screen rule below
+ * is decided per request from headers, which is not something the pure
+ * `shouldServeAppShell` test can reach: with that call replaced by a constant,
+ * the route tests were byte-identical, so the one line standing between an
+ * upgrade and a blank page had no coverage at all.
  */
-staticRoutes.get("*", async (c) => {
+export function createStaticHandler(DIST_DIR: string) {
+  return async (c: Context): Promise<Response> => {
   if (!existsSync(DIST_DIR)) {
     return c.text("Frontend not built. Run: bun run build:web", 404);
   }
@@ -53,25 +64,47 @@ staticRoutes.get("*", async (c) => {
     const file = Bun.file(filePath);
     // Only serve if it's actually a file (not directory)
     if (file.size > 0 || extname(filePath)) {
+      // The MIME type is the *original* file's even when a compressed copy is
+      // sent — `Content-Encoding` describes the transfer, `Content-Type` the
+      // content, and swapping them makes the browser download a file instead of
+      // running it.
       const mime = MIME_TYPES[extname(filePath).toLowerCase()] ?? "application/octet-stream";
+      const variant = chooseVariant(filePath, c.req.header("Accept-Encoding"), existsSync);
       const headers: Record<string, string> = { "Content-Type": mime };
+      if (variant.encoding) {
+        headers["Content-Encoding"] = variant.encoding;
+        // Without this a shared cache would hand a brotli body to a client that
+        // never asked for one.
+        headers["Vary"] = "Accept-Encoding";
+      }
       // Vite emits content-hashed filenames under /assets/ — safe to cache forever.
       // Everything else gets revalidation via ETag so upgrades propagate.
       if (urlPath.startsWith("/assets/")) {
         headers["Cache-Control"] = "public, max-age=31536000, immutable";
       } else {
-        const stat = statSync(filePath);
-        const etag = `"${stat.mtimeMs.toString(36)}-${stat.size.toString(36)}"`;
+        const stat = statSync(variant.path);
+        // The encoding is part of the identity: two variants of one file are
+        // different bytes, and an ETag they shared would let a cache answer a
+        // gzip request with a brotli body.
+        const suffix = variant.encoding ? `-${variant.encoding}` : "";
+        const etag = `"${stat.mtimeMs.toString(36)}-${stat.size.toString(36)}${suffix}"`;
         headers["Cache-Control"] = "no-cache";
         headers["ETag"] = etag;
         if (c.req.header("If-None-Match") === etag) {
           return new Response(null, { status: 304, headers });
         }
       }
-      return new Response(file, { headers });
+      return new Response(variant.encoding ? Bun.file(variant.path) : file, { headers });
     }
   }
 
+  // A missing file is answered with the app shell only when the request could
+  // plausibly be a navigation — answering a subresource with HTML is what
+  // empties the screen. See `static-fallback.ts` for why.
+  if (!shouldServeAppShell(urlPath, c.req.header("Sec-Fetch-Dest"))) {
+    return c.text("Not found", 404);
+  }
+
   // SPA fallback: serve index.html with revalidation so new asset hashes propagate
   const indexPath = resolve(DIST_DIR, "index.html");
   if (existsSync(indexPath)) {
@@ -85,4 +118,7 @@ staticRoutes.get("*", async (c) => {
     return c.html(await Bun.file(indexPath).text());
   }
   return c.text("Frontend not built. Run: bun run build:web", 404);
-});
+  };
+}
+
+staticRoutes.get("*", createStaticHandler(DIST_DIR));

package/src/server/ws/lsp.ts

@@ -0,0 +1,433 @@
+/**
+ * The bridge between a browser tab and the language servers.
+ *
+ * This is the seam VS Code puts between its renderer and its extension host,
+ * in the same place and for the same reason: the editor should not know that a
+ * server process exists, and the server should not know that a browser does.
+ *
+ * The browser speaks paths and this speaks URIs. That direction matters — the
+ * browser is untrusted input, so turning a path into a URI (and refusing one
+ * that leaves the project) has to happen here rather than being sent in
+ * pre-made. A language server will happily read any file it is pointed at.
+ *
+ * Document text is synchronised incrementally, as VS Code does, but every
+ * change carries the version it applies to. A dropped or reordered change
+ * otherwise desynchronises the server's copy of the file silently, and from
+ * then on every completion and diagnostic refers to lines that no longer exist
+ * — with nothing anywhere reporting a problem. On a version gap the bridge
+ * asks the browser to resend the whole document instead.
+ */
+import nodePath from "node:path";
+import { resolveProjectPath } from "../helpers/resolve-project.ts";
+import { isUnavailable, lspManager } from "../../services/lsp/lsp-manager.ts";
+import { pathToFileUri, uriKey } from "../../shared/lsp-uri.ts";
+
+interface OpenDoc {
+  /** Session key, for releasing the hold when the document closes. */
+  key: string;
+  languageId: string;
+  version: number;
+  /** `file:` URI the language server knows the document by. */
+  uri: string;
+  /**
+   * The URI the browser's Monaco model has.
+   *
+   * PPM mounts its editors with a value and no path, so Monaco names its models
+   * `inmemory://model/N`. A language server has never heard of that, and the
+   * `file:` URIs it answers with match no model, so neither side can use the
+   * other's name and this is the only place that knows both.
+   */
+  clientUri: string;
+}
+
+interface Client {
+  ws: WsLike;
+  /** Identifies this socket to the manager's reference counting. */
+  id: string;
+  projectPath: string;
+  docs: Map<string, OpenDoc>;
+  /**
+   * Requests this socket is still waiting on, by the id the browser gave them.
+   *
+   * A language server answers one request at a time, so a superseded one is not free — it
+   * sits in front of the one somebody is still waiting for.
+   */
+  inflight: Map<number, AbortController>;
+}
+
+interface WsLike {
+  data: { type: string; projectName?: string };
+  send: (data: string) => void;
+  close: (code?: number, reason?: string) => void;
+}
+
+const clients = new Map<WsLike, Client>();
+let nextClientId = 1;
+
+/** The parts of `node:path` this guard uses, so the tests can hand it the other platform's. */
+export interface PathFlavour {
+  resolve: (...parts: string[]) => string;
+  sep: string;
+}
+
+/**
+ * Resolve a project-relative path and refuse anything that leaves the project.
+ *
+ * The path arrives from the browser. Without this a document URI of
+ * `../../../.ssh/id_rsa` would be handed to a language server as something to
+ * read and report on.
+ *
+ * The base is resolved rather than trusted: a project path spelled with a
+ * trailing separator, or with forward slashes on Windows — which is how a
+ * pasted path usually arrives there — makes `startsWith(projectPath + sep)`
+ * false for *every* document, so the guard would refuse the whole project
+ * rather than let anything through. It fails closed, which is why it would have
+ * been reported as "the editor has no language server on Windows" and not as a
+ * path bug. `path` is injectable for the same reason `stopServerProcess` takes
+ * a platform: this is the only way a Linux CI run can prove the Windows
+ * behaviour.
+ */
+export function resolveDocumentPath(
+  projectPath: string,
+  relativePath: string,
+  path: PathFlavour = nodePath,
+): string {
+  if (!relativePath || /[\x00-\x1f]/.test(relativePath)) {
+    throw new Error(`Invalid document path: ${JSON.stringify(relativePath)}`);
+  }
+  const root = path.resolve(projectPath);
+  const absolute = path.resolve(root, relativePath);
+  if (absolute !== root && !absolute.startsWith(root + path.sep)) {
+    throw new Error(`Document path escapes the project: ${relativePath}`);
+  }
+  return absolute;
+}
+
+function send(client: Client, message: unknown): void {
+  try {
+    client.ws.send(JSON.stringify(message));
+  } catch {
+    // The socket went away between the check and the write; `close` cleans up.
+  }
+}
+
+function handleOpen(ws: WsLike): void {
+  const projectName = ws.data.projectName;
+  if (!projectName) {
+    ws.close(1008, "missing project");
+    return;
+  }
+  let projectPath: string;
+  try {
+    projectPath = resolveProjectPath(projectName);
+  } catch (e) {
+    ws.close(1008, e instanceof Error ? e.message : "unknown project");
+    return;
+  }
+  const client: Client = { ws, id: `lsp-${nextClientId++}`, projectPath, docs: new Map(), inflight: new Map() };
+  clients.set(ws, client);
+  // Announce the fresh socket. A reconnect gives the browser a server that has
+  // never heard of its open documents, and nothing else would tell it that:
+  // the socket layer replays queued messages, but a document opened before the
+  // drop was never queued. On `hello` the browser re-opens what it still has.
+  send(client, { t: "hello" });
+}
+
+async function handleMessage(ws: WsLike, raw: string | Buffer): Promise<void> {
+  const client = clients.get(ws);
+  if (!client) return;
+
+  let msg: Record<string, unknown>;
+  try {
+    msg = JSON.parse(typeof raw === "string" ? raw : raw.toString("utf8"));
+  } catch {
+    return;
+  }
+
+  try {
+    switch (msg.t) {
+      case "open":
+        await openDocument(client, msg);
+        break;
+      case "change":
+        changeDocument(client, msg);
+        break;
+      case "save":
+        saveDocument(client, msg);
+        break;
+      case "close":
+        closeDocument(client, msg);
+        break;
+      case "request":
+        await forwardRequest(client, msg);
+        break;
+      case "cancel":
+        cancelRequest(client, msg);
+        break;
+    }
+  } catch (e) {
+    const message = e instanceof Error ? e.message : String(e);
+    if (typeof msg.id === "number") send(client, { t: "error", id: msg.id, message });
+    else send(client, { t: "notice", message });
+  }
+}
+
+async function openDocument(client: Client, msg: Record<string, unknown>): Promise<void> {
+  const path = String(msg.path ?? "");
+  const text = String(msg.text ?? "");
+  const version = Number(msg.version ?? 1);
+  const absolute = resolveDocumentPath(client.projectPath, path);
+
+  const result = await lspManager.acquire(client.projectPath, absolute, client.id);
+  if (isUnavailable(result)) {
+    send(client, {
+      t: "unavailable",
+      path,
+      reason: result.reason,
+      server: result.server ?? null,
+      message: result.message,
+    });
+    return;
+  }
+
+  const uri = pathToFileUri(absolute);
+  const clientUri = String(msg.clientUri ?? uri);
+  const previous = client.docs.get(path);
+  // The same path can resolve to a different server between two opens — a `tsconfig.json`
+  // appearing in a subdirectory moves the root, and the browser re-opens every tab on
+  // reconnect. Overwriting the entry without letting go leaves this socket subscribed to the
+  // old key for as long as it lives, and the idle reaper never takes a server with a
+  // subscriber, so that one would stay resident until the tab was closed.
+  if (previous && previous.key !== result.key) lspManager.release(previous.key, client.id);
+  client.docs.set(path, { key: result.key, languageId: result.language, version, uri, clientUri });
+
+  result.session.notify("textDocument/didOpen", {
+    textDocument: { uri, languageId: result.language, version, text },
+  });
+
+  send(client, {
+    t: "ready",
+    path,
+    languageId: result.language,
+    server: {
+      id: result.session.definition.id,
+      displayName: result.session.definition.displayName,
+      rootPath: result.session.rootPath,
+    },
+    // The browser needs this to turn a `file:` URI the server reported into a
+    // project-relative path it can fetch and open.
+    projectPath: client.projectPath,
+    // The browser registers only the providers the server actually offers, so
+    // a feature the server lacks is absent rather than silently empty.
+    capabilities: result.session.serverCapabilities,
+  });
+}
+
+function changeDocument(client: Client, msg: Record<string, unknown>): void {
+  const path = String(msg.path ?? "");
+  const doc = client.docs.get(path);
+  if (!doc) return;
+  const session = sessionFor(doc);
+  if (!session) return;
+
+  const version = Number(msg.version ?? 0);
+  const full = typeof msg.text === "string";
+
+  // A change must apply to the version we last saw. Anything else means the
+  // stream skipped, and continuing would leave the server's copy quietly wrong.
+  if (!full && version !== doc.version + 1) {
+    send(client, { t: "resync", path });
+    return;
+  }
+
+  const contentChanges = full
+    ? [{ text: String(msg.text) }]
+    : (msg.changes as Array<{ range: unknown; text: string }> | undefined) ?? [];
+  if (contentChanges.length === 0) return;
+
+  doc.version = version;
+  session.notify("textDocument/didChange", {
+    textDocument: { uri: doc.uri, version },
+    contentChanges,
+  });
+}
+
+function saveDocument(client: Client, msg: Record<string, unknown>): void {
+  const doc = client.docs.get(String(msg.path ?? ""));
+  if (!doc) return;
+  sessionFor(doc)?.notify("textDocument/didSave", {
+    textDocument: { uri: doc.uri },
+    ...(typeof msg.text === "string" ? { text: msg.text } : {}),
+  });
+}
+
+function closeDocument(client: Client, msg: Record<string, unknown>): void {
+  const path = String(msg.path ?? "");
+  const doc = client.docs.get(path);
+  if (!doc) return;
+  client.docs.delete(path);
+  sessionFor(doc)?.notify("textDocument/didClose", { textDocument: { uri: doc.uri } });
+
+  // Only give up the hold when this socket has no other document on that
+  // session, or closing one of ten TypeScript tabs would start the reap timer.
+  if (![...client.docs.values()].some((other) => other.key === doc.key)) {
+    lspManager.release(doc.key, client.id);
+  }
+}
+
+async function forwardRequest(client: Client, msg: Record<string, unknown>): Promise<void> {
+  const id = Number(msg.id);
+  const path = String(msg.path ?? "");
+  const doc = client.docs.get(path);
+  if (!doc) {
+    send(client, { t: "error", id, message: `No language server is open for ${path}` });
+    return;
+  }
+  const session = sessionFor(doc);
+  if (!session) {
+    send(client, { t: "error", id, message: "The language server is no longer running" });
+    return;
+  }
+
+  // The browser addressed the document by its Monaco URI; the server only
+  // knows the `file:` one.
+  const params = withDocumentUri(msg.params, doc.uri);
+  const controller = new AbortController();
+  client.inflight.set(id, controller);
+  let result: unknown;
+  try {
+    result = await session.request(String(msg.method), params, undefined, controller.signal);
+  } catch (e) {
+    // A cancelled request has nobody waiting for it — Monaco dropped the provider's promise
+    // and the browser deleted its pending entry when it sent the cancel — so an error reply
+    // would name an id that no longer exists. Any other failure is real and goes back.
+    if (controller.signal.aborted) return;
+    throw e;
+  } finally {
+    client.inflight.delete(id);
+  }
+  // And back: a location in this file has to come home as the model's URI or
+  // Monaco treats its own file as a different one and tries to open an editor
+  // for it instead of jumping.
+  send(client, { t: "response", id, result: rewriteUris(result, uriMapFor(client)) });
+}
+
+/**
+ * Stop work the browser no longer wants the answer to.
+ *
+ * `$/cancelRequest` is the only thing that takes a request out of the server's queue; the
+ * session sends it, and until this arrived nothing ever asked it to. Typing eight characters
+ * into a large TypeScript file queued eight completions, and the list that finally opened was
+ * the one for a prefix several keystrokes old.
+ */
+function cancelRequest(client: Client, msg: Record<string, unknown>): void {
+  client.inflight.get(Number(msg.id))?.abort();
+}
+
+/** Replace `textDocument.uri` with the one the language server knows. */
+export function withDocumentUri(params: unknown, uri: string): unknown {
+  if (!params || typeof params !== "object") return params;
+  const source = params as Record<string, unknown>;
+  const textDocument = source.textDocument as Record<string, unknown> | undefined;
+  if (!textDocument) return params;
+  return { ...source, textDocument: { ...textDocument, uri } };
+}
+
+/** file: URI to the browser's model URI, for every document this socket has open. */
+function uriMapFor(client: Client): Map<string, string> {
+  const map = new Map<string, string>();
+  for (const doc of client.docs.values()) map.set(uriKey(doc.uri), doc.clientUri);
+  return map;
+}
+
+/**
+ * Rewrite every URI in a server response that names a document this socket has
+ * open.
+ *
+ * Walks the whole value because `uri` turns up in a dozen shapes — a location,
+ * a location link's `targetUri`, each key of a workspace edit's `changes`, a
+ * diagnostic's related information. A URI for a file that is *not* open is left
+ * alone: the browser turns that into a path and opens a tab for it.
+ */
+export function rewriteUris(value: unknown, map: Map<string, string>): unknown {
+  if (map.size === 0 || value == null) return value;
+  if (Array.isArray(value)) return value.map((entry) => rewriteUris(entry, map));
+  if (typeof value !== "object") return value;
+
+  const out: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(value as Record<string, unknown>)) {
+    // `data` is opaque by specification: a completion item, code action, code lens or inlay
+    // hint carries it so the server gets it back *verbatim* on the matching resolve request.
+    // rust-analyzer puts a whole `TextDocumentPositionParams` in a completion item's `data`,
+    // so rewriting it hands the server `inmemory://model/1` on resolve — and the auto-import
+    // edit and the documentation that resolve exists to fetch never arrive, with no error
+    // anywhere. The browser sends the item back unchanged, so this side must not change it.
+    if (key === "data") {
+      out[key] = entry;
+      continue;
+    }
+    if ((key === "uri" || key === "targetUri") && typeof entry === "string") {
+      out[key] = map.get(uriKey(entry)) ?? entry;
+      continue;
+    }
+    // A workspace edit keys its changes *by* URI, so the keys need it too.
+    if (key === "changes" && entry && typeof entry === "object" && !Array.isArray(entry)) {
+      const changes: Record<string, unknown> = {};
+      for (const [uri, edits] of Object.entries(entry as Record<string, unknown>)) {
+        changes[map.get(uriKey(uri)) ?? uri] = rewriteUris(edits, map);
+      }
+      out[key] = changes;
+      continue;
+    }
+    out[key] = rewriteUris(entry, map);
+  }
+  return out;
+}
+
+/** The live session behind a document, or null if it went away. */
+function sessionFor(doc: OpenDoc) {
+  const running = lspManager.sessionFor(doc.key);
+  return running && running.state === "ready" ? running : null;
+}
+
+function handleClose(ws: WsLike): void {
+  const client = clients.get(ws);
+  if (!client) return;
+  clients.delete(ws);
+  // Tell each server the documents are gone before dropping the holds, so a
+  // server does not keep diagnostics for files nobody has open.
+  for (const doc of client.docs.values()) {
+    lspManager.sessionFor(doc.key)?.notify("textDocument/didClose", { textDocument: { uri: doc.uri } });
+  }
+  client.docs.clear();
+  // A closed tab is not waiting for anything, and a server working on its questions is in
+  // front of the tabs that are still open.
+  for (const controller of client.inflight.values()) controller.abort();
+  client.inflight.clear();
+  lspManager.releaseAll(client.id);
+}
+
+/**
+ * Server-initiated traffic — diagnostics above all — fanned out to the tabs
+ * that have a document on that session.
+ *
+ * Registered once for the module rather than per socket: the manager shares one
+ * session between tabs, so a per-socket listener would deliver every other
+ * tab's diagnostics too.
+ */
+export function dispatchNotification(key: string, method: string, params: unknown): void {
+  for (const client of clients.values()) {
+    if (![...client.docs.values()].some((doc) => doc.key === key)) continue;
+    // Diagnostics name their document by URI; unrewritten, the browser cannot
+    // tell which model they belong to and would show none at all.
+    send(client, { t: "notification", method, params: rewriteUris(params, uriMapFor(client)) });
+  }
+}
+
+lspManager.onNotification(dispatchNotification);
+
+export const lspWebSocket = {
+  open: handleOpen,
+  message: (ws: WsLike, msg: string | Buffer) => void handleMessage(ws, msg),
+  close: handleClose,
+};