@langify-org/dsh-code-server 0.0.0-stage → 0.1.1

package/dist/index.mjs

@@ -0,0 +1,839 @@
+import { chmod, mkdtemp, realpath, rm } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import Schema from "@deepseek-ai/schemastery";
+import { z } from "zod";
+import { randomUUID } from "node:crypto";
+import { createServer } from "node:net";
+import { STATUS_CODES, get, request } from "node:http";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import { clientRequestSchema } from "@deepseek-ai/dsh-client-connection";
+import { SessionId } from "@deepseek-ai/dsh-session/types";
+import { parseFileAddress } from "@deepseek-ai/dsh-util-workspace-path";
+// src/rpc.ts
+/** DSH's shared RPC channel, and the prefix of the endpoints this plugin owns on it. */
+const RPC_CHANNEL = "/api";
+const RPC_PREFIX = "langify-code-server/";
+/**
+* Why the extension could not open a file. `outcome_unknown` means the editor
+* was already asked and may still show the file later.
+*/
+const OPEN_ERROR_CODES = [
+	"invalid_path",
+	"deadline_exceeded",
+	"outcome_unknown",
+	"open_failed",
+	"show_failed"
+];
+/** Failures the host finds itself. */
+const HOST_ERROR_CODES = [
+	"invalid_request",
+	"session_not_found",
+	"session_migration_required",
+	"not_a_directory",
+	"not_a_file",
+	"not_a_local_file",
+	"different_host",
+	"code_server_not_found",
+	"code_server_failed",
+	"unknown_binding",
+	"not_ready",
+	"binding_disconnected",
+	"binding_expired",
+	"binding_closed",
+	"internal_error"
+];
+const id = z.string().min(1).max(256).refine((value) => !value.includes("\0"));
+const position$1 = z.int().min(1).max(1e6);
+const binding = {
+	sessionId: id,
+	bindingId: z.uuid()
+};
+const requestSchemas = {
+	create: z.strictObject({
+		sessionId: id,
+		ownerId: id
+	}),
+	watch: z.strictObject({
+		...binding,
+		revision: z.int().min(-1)
+	}),
+	close: z.strictObject(binding),
+	open: z.strictObject({
+		...binding,
+		address: z.string().min(1).max(16384),
+		line: position$1.optional()
+	})
+};
+z.strictObject({
+	bindingId: z.uuid(),
+	cwd: z.string(),
+	url: z.string()
+}), z.strictObject({
+	state: z.enum([
+		"pending",
+		"ready",
+		"disconnected",
+		"expired",
+		"closed"
+	]),
+	revision: z.int().nonnegative(),
+	reconnect: z.boolean()
+}), z.strictObject({ state: z.literal("closed") }), z.strictObject({
+	path: z.string(),
+	line: position$1
+});
+const METHODS = [
+	"create",
+	"watch",
+	"close",
+	"open"
+];
+/** Environment variable of the code-server DSH starts, naming the bridge socket every window shares. */
+const SOCKET_ENV = "DSH_CODE_BRIDGE_SOCKET";
+/**
+* Key in the editor window's URL fragment that names its binding. The fragment
+* never reaches a server; the extension reads it back through `asExternalUri`.
+*/
+const BINDING_FRAGMENT = "dsh-binding";
+const absolutePath = z.string().max(4096).refine((path) => isAbsolute(path) && !path.includes("\0"));
+const position = z.int().min(1).max(1e6);
+const requestId = z.uuid();
+const helloSchema = z.strictObject({
+	type: z.literal("hello"),
+	bindingId: z.uuid(),
+	cwd: absolutePath
+});
+z.discriminatedUnion("type", [z.strictObject({
+	type: z.literal("accepted"),
+	bindingId: z.uuid()
+}), z.strictObject({
+	type: z.literal("rejected"),
+	code: z.string(),
+	message: z.string()
+})]);
+const openRequestSchema = z.strictObject({
+	type: z.literal("open"),
+	requestId,
+	path: absolutePath,
+	line: position,
+	deadline: z.int().nonnegative()
+});
+const openResultSchema = z.discriminatedUnion("ok", [z.strictObject({
+	type: z.literal("result"),
+	requestId,
+	ok: z.literal(true),
+	path: absolutePath,
+	line: position
+}), z.strictObject({
+	type: z.literal("result"),
+	requestId,
+	ok: z.literal(false),
+	error: z.strictObject({
+		code: z.enum(OPEN_ERROR_CODES),
+		message: z.string().max(2048)
+	})
+})]);
+z.union([
+	openRequestSchema,
+	z.strictObject({
+		type: z.literal("cwd-changed"),
+		cwd: absolutePath
+	}),
+	z.strictObject({
+		type: z.literal("notice"),
+		code: z.enum([...OPEN_ERROR_CODES, ...HOST_ERROR_CODES]),
+		message: z.string().max(2048)
+	})
+]);
+const editorFrameSchema = z.union([openResultSchema, z.strictObject({ type: z.literal("reconnect") })]);
+/** Serialize one frame. */
+function frame(value) {
+	return `${JSON.stringify(value)}\n`;
+}
+/**
+* Split a stream into JSON frames. Stops at the first frame that is too large
+* or not UTF-8 JSON and reports it once; the caller closes the stream.
+*/
+function readFrames(stream, onFrame, onInvalid) {
+	const decoder = new TextDecoder("utf-8", { fatal: true });
+	let buffered = Buffer.alloc(0);
+	let failed = false;
+	stream.on("data", (chunk) => {
+		if (failed) return;
+		try {
+			buffered = Buffer.concat([buffered, chunk]);
+			for (let end = buffered.indexOf(10); end !== -1; end = buffered.indexOf(10)) {
+				if (end + 1 > 65536) throw new Error("frame exceeds 64 KiB");
+				const text = decoder.decode(buffered.subarray(0, end));
+				buffered = buffered.subarray(end + 1);
+				onFrame(JSON.parse(text));
+				if (stream.destroyed) return;
+			}
+			if (buffered.length >= 65536) throw new Error("frame exceeds 64 KiB");
+		} catch (error) {
+			failed = true;
+			onInvalid(error instanceof Error ? error : new Error(String(error)));
+		}
+	});
+}
+// src/host/errors.ts
+/** A failure the page can explain: `code` selects its translated message. */
+var CodeServerError = class extends Error {
+	code;
+	constructor(code, message, options) {
+		super(message, options);
+		this.code = code;
+	}
+};
+// src/host/bridge.ts
+/** An unclaimed binding expires this long after creation. */
+const CONNECT_TIMEOUT_MS = 6e4;
+/** A binding expires this long after the page last watched it. */
+const LEASE_MS = 12e4;
+/** An open request without an answer by then has an unknown outcome. */
+const OPEN_TIMEOUT_MS = 15e3;
+/** The longest a watch waits for a change. */
+const WATCH_MS = 2e4;
+const HELLO_TIMEOUT_MS = 5e3;
+const finalError = {
+	disconnected: "binding_disconnected",
+	expired: "binding_expired",
+	closed: "binding_closed"
+};
+var Bridge = class Bridge {
+	#bindings = /* @__PURE__ */ new Map();
+	#sockets = /* @__PURE__ */ new Set();
+	#server;
+	/** Where extensions connect; every code-server window learns it from its environment. */
+	socketPath;
+	constructor(server, socketPath) {
+		this.#server = server;
+		this.socketPath = socketPath;
+		server.on("connection", (socket) => this.#accept(socket));
+	}
+	/** Listen on `socketPath`, which must sit in a directory only this user can enter. */
+	static async listen(socketPath) {
+		const server = createServer();
+		await new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(socketPath, () => {
+				server.off("error", reject);
+				resolve();
+			});
+		});
+		await chmod(socketPath, 384);
+		return new Bridge(server, socketPath);
+	}
+	/**
+	* Start a binding for a window that will open `cwd`, a canonical path the
+	* extension must match, and return its id.
+	*/
+	create(sessionId, ownerId, cwd) {
+		for (const binding of this.#bindings.values()) if (binding.sessionId === sessionId && binding.ownerId === ownerId) this.#finish(binding, "closed");
+		const now = Date.now();
+		const binding = {
+			id: randomUUID(),
+			sessionId,
+			ownerId,
+			cwd,
+			connectBy: now + CONNECT_TIMEOUT_MS,
+			state: "pending",
+			revision: 0,
+			reconnect: false,
+			announcedCwd: cwd,
+			leaseUntil: now + LEASE_MS,
+			opens: /* @__PURE__ */ new Map(),
+			watchers: /* @__PURE__ */ new Set()
+		};
+		this.#bindings.set(binding.id, binding);
+		this.#schedule(binding);
+		return binding.id;
+	}
+	/**
+	* Extend a live binding's lease, then wait until its revision differs from
+	* `revision` or {@link WATCH_MS} passes, and report it.
+	*/
+	async watch(sessionId, bindingId, revision, signal) {
+		const binding = this.#get(sessionId, bindingId);
+		if (binding.state === "pending" || binding.state === "ready") {
+			binding.leaseUntil = Date.now() + LEASE_MS;
+			this.#schedule(binding);
+		}
+		if (binding.revision === revision) await new Promise((resolve) => {
+			const done = () => {
+				clearTimeout(timer);
+				binding.watchers.delete(done);
+				signal.removeEventListener("abort", done);
+				resolve();
+			};
+			const timer = setTimeout(done, WATCH_MS);
+			binding.watchers.add(done);
+			signal.addEventListener("abort", done, { once: true });
+		});
+		return {
+			state: binding.state,
+			revision: binding.revision,
+			reconnect: binding.reconnect
+		};
+	}
+	close(sessionId, bindingId) {
+		const binding = this.#bindings.get(bindingId);
+		if (binding?.sessionId === sessionId) this.#finish(binding, "closed");
+	}
+	/** Tell a connected editor that the session's working folder is now `cwd`, once per new folder. */
+	announceCwd(sessionId, bindingId, cwd) {
+		const binding = this.#get(sessionId, bindingId);
+		if (cwd === binding.announcedCwd) return;
+		binding.announcedCwd = cwd;
+		if (cwd !== binding.cwd) this.#send(binding, {
+			type: "cwd-changed",
+			cwd
+		});
+	}
+	/** Show a failure the host found for this window in its editor, when it is connected. */
+	report(sessionId, bindingId, error) {
+		const binding = this.#bindings.get(bindingId);
+		if (binding?.sessionId !== sessionId) return;
+		this.#send(binding, {
+			type: "notice",
+			code: error.code,
+			message: error.message
+		});
+	}
+	/**
+	* Ask the window to show a file. Never retried: a lost answer is
+	* `outcome_unknown`. The editor reports its own failures; a timeout found
+	* here is reported to it too.
+	*/
+	open(sessionId, bindingId, location) {
+		const binding = this.#get(sessionId, bindingId);
+		const peer = binding.peer;
+		if (binding.state === "pending" || peer === void 0) throw new CodeServerError("not_ready", "The editor window has not connected yet");
+		if (binding.state !== "ready") throw new CodeServerError(finalError[binding.state], `The binding is ${binding.state}`);
+		const requestId = randomUUID();
+		const request = {
+			type: "open",
+			requestId,
+			...location,
+			deadline: Date.now() + OPEN_TIMEOUT_MS
+		};
+		return new Promise((resolve, reject) => {
+			const timer = setTimeout(() => {
+				binding.opens.delete(requestId);
+				const error = new CodeServerError("outcome_unknown", "No answer from the editor window");
+				this.#send(binding, {
+					type: "notice",
+					code: error.code,
+					message: error.message
+				});
+				reject(error);
+			}, OPEN_TIMEOUT_MS);
+			binding.opens.set(requestId, {
+				resolve,
+				reject,
+				timer
+			});
+			peer.write(frame(request));
+		});
+	}
+	async dispose() {
+		for (const binding of this.#bindings.values()) {
+			this.#finish(binding, "closed");
+			clearTimeout(binding.timer);
+		}
+		this.#bindings.clear();
+		const closed = new Promise((resolve) => this.#server.close(() => resolve()));
+		for (const socket of this.#sockets) socket.destroy();
+		await closed;
+	}
+	#get(sessionId, bindingId) {
+		const binding = this.#bindings.get(bindingId);
+		if (binding?.sessionId !== sessionId) throw new CodeServerError("unknown_binding", "No such binding for this session");
+		return binding;
+	}
+	#send(binding, message) {
+		if (binding.state === "ready") binding.peer?.write(frame(message));
+	}
+	/** Wake the page's watch. */
+	#changed(binding) {
+		binding.revision += 1;
+		for (const wake of binding.watchers) wake();
+	}
+	/** Arm the binding's single timer for its next deadline. */
+	#schedule(binding) {
+		clearTimeout(binding.timer);
+		const deadline = binding.state === "pending" ? Math.min(binding.connectBy, binding.leaseUntil) : binding.leaseUntil;
+		binding.timer = setTimeout(() => this.#finish(binding, "expired"), deadline - Date.now());
+	}
+	/** Enter a final state once; the record stays for a lease so watches can read it. */
+	#finish(binding, state) {
+		if (binding.state !== "pending" && binding.state !== "ready") return;
+		binding.state = state;
+		binding.peer?.destroy();
+		for (const open of binding.opens.values()) {
+			clearTimeout(open.timer);
+			open.reject(new CodeServerError("outcome_unknown", `The binding was ${state} before the editor answered`));
+		}
+		binding.opens.clear();
+		clearTimeout(binding.timer);
+		binding.timer = setTimeout(() => this.#bindings.delete(binding.id), LEASE_MS);
+		this.#changed(binding);
+	}
+	#accept(socket) {
+		let binding;
+		let refused = false;
+		const helloTimer = setTimeout(() => socket.destroy(), HELLO_TIMEOUT_MS);
+		const reject = (code, message) => {
+			refused = true;
+			socket.end(frame({
+				type: "rejected",
+				code,
+				message
+			}));
+		};
+		this.#sockets.add(socket);
+		socket.on("error", () => socket.destroy());
+		socket.on("close", () => {
+			this.#sockets.delete(socket);
+			clearTimeout(helloTimer);
+			if (binding?.peer === socket) this.#finish(binding, "disconnected");
+		});
+		readFrames(socket, (value) => {
+			if (refused) return;
+			if (binding === void 0) {
+				clearTimeout(helloTimer);
+				const hello = helloSchema.safeParse(value);
+				if (!hello.success) return reject("invalid_hello", "Expected a hello frame");
+				const candidate = this.#bindings.get(hello.data.bindingId);
+				if (candidate?.state !== "pending") return reject("binding_unavailable", "The binding cannot be claimed");
+				if (candidate.cwd !== hello.data.cwd) return reject("cwd_mismatch", "The window opened another folder");
+				binding = candidate;
+				binding.peer = socket;
+				binding.state = "ready";
+				this.#schedule(binding);
+				socket.write(frame({
+					type: "accepted",
+					bindingId: binding.id
+				}));
+				this.#changed(binding);
+				return;
+			}
+			const message = editorFrameSchema.safeParse(value);
+			if (!message.success) return void socket.destroy();
+			if (message.data.type === "reconnect") {
+				binding.reconnect = true;
+				this.#changed(binding);
+				return;
+			}
+			const result = message.data;
+			const open = binding.opens.get(result.requestId);
+			if (open === void 0) return;
+			binding.opens.delete(result.requestId);
+			clearTimeout(open.timer);
+			if (result.ok) open.resolve({
+				path: result.path,
+				line: result.line
+			});
+			else open.reject(new CodeServerError(result.error.code, result.error.message));
+		}, () => socket.destroy());
+	}
+};
+// src/host/code-server.ts
+const STARTUP_TIMEOUT_MS = 3e4;
+const OUTPUT = { maxBytes: 65536 };
+var CodeServer = class {
+	#subprocess;
+	#options;
+	#socketPath;
+	#extension;
+	#onStarted;
+	#starting;
+	#child;
+	#disposed = false;
+	/**
+	* @param extension - VSIX installed before every start.
+	* @param onStarted - called once per process; its disposer runs when the process exits.
+	*/
+	constructor(subprocess, options, socketPath, extension, onStarted) {
+		this.#subprocess = subprocess;
+		this.#options = options;
+		this.#socketPath = socketPath;
+		this.#extension = extension;
+		this.#onStarted = onStarted;
+	}
+	/** The running server, started on first use and again after it exits or fails to start. */
+	ensure() {
+		this.#starting ??= this.#start().catch((error) => {
+			this.#starting = void 0;
+			throw error;
+		});
+		return this.#starting;
+	}
+	async dispose() {
+		this.#disposed = true;
+		const child = this.#child;
+		this.#child = void 0;
+		this.#starting = void 0;
+		child?.terminate();
+		await child?.waitForExit();
+	}
+	async #start() {
+		let command;
+		try {
+			command = await this.#subprocess.resolveExecutable(this.#options.command);
+		} catch (error) {
+			throw new CodeServerError("code_server_not_found", `Cannot find ${this.#options.command}`, { cause: error });
+		}
+		const directories = [...this.#options.userDataDir === void 0 ? [] : ["--user-data-dir", this.#options.userDataDir], ...this.#options.extensionsDir === void 0 ? [] : ["--extensions-dir", this.#options.extensionsDir]];
+		const version = await this.#run([command, "--version"]);
+		const commit = /^\S+ ([0-9a-f]{40}) /.exec(version)?.[1];
+		if (commit === void 0) throw new CodeServerError("code_server_failed", `Unrecognized code-server version: ${version}`);
+		await this.#run([
+			command,
+			...directories,
+			"--install-extension",
+			this.#extension,
+			"--force"
+		]);
+		await rm(this.#socketPath, { force: true });
+		if (this.#disposed) throw new CodeServerError("code_server_failed", "The plugin has stopped");
+		const child = this.#subprocess.spawn({
+			argv: [
+				command,
+				...directories,
+				"--socket",
+				this.#socketPath,
+				"--socket-mode",
+				"600",
+				"--auth",
+				"none",
+				"--disable-telemetry",
+				"--disable-update-check",
+				"--disable-proxy"
+			],
+			cwd: homedir(),
+			env: this.#options.env,
+			graceMs: 5e3,
+			stdio: {
+				stdin: "ignore",
+				stdout: OUTPUT,
+				stderr: OUTPUT
+			}
+		});
+		this.#child = child;
+		const running = {
+			socketPath: this.#socketPath,
+			commit
+		};
+		const stopped = this.#onStarted(running);
+		const exited = () => {
+			stopped();
+			if (this.#child !== child) return;
+			this.#child = void 0;
+			this.#starting = void 0;
+		};
+		child.done.then(exited, exited);
+		await waitUntilListening(this.#socketPath, child);
+		return running;
+	}
+	/** Run a short code-server CLI command and return its stdout. */
+	async #run(argv) {
+		const child = this.#subprocess.spawn({
+			argv,
+			cwd: homedir(),
+			graceMs: 1e3,
+			signal: AbortSignal.timeout(12e4),
+			stdio: {
+				stdin: "ignore",
+				stdout: OUTPUT,
+				stderr: OUTPUT
+			}
+		});
+		const outcome = await child.done;
+		await child.waitForExit();
+		if (outcome.exitCode !== 0) throw new CodeServerError("code_server_failed", `${argv.join(" ")} failed: ${output(child, "stderr")}`);
+		return output(child, "stdout");
+	}
+};
+function output(child, stream) {
+	return child.collected[stream]?.readFrom(0).text.trim() ?? "";
+}
+async function waitUntilListening(socketPath, child) {
+	let exited = false;
+	const stop = () => {
+		exited = true;
+	};
+	child.done.then(stop, stop);
+	for (const deadline = Date.now() + STARTUP_TIMEOUT_MS; Date.now() < deadline; await setTimeout$1(100)) {
+		if (exited) throw new CodeServerError("code_server_failed", `code-server exited: ${output(child, "stderr")}`);
+		if (await healthy(socketPath)) return;
+	}
+	child.terminate();
+	throw new CodeServerError("code_server_failed", "code-server did not start within 30 seconds");
+}
+function healthy(socketPath) {
+	return new Promise((resolve) => {
+		get({
+			socketPath,
+			path: "/healthz"
+		}, (response) => {
+			response.resume();
+			resolve(response.statusCode === 200);
+		}).on("error", () => resolve(false));
+	});
+}
+// src/host/relay.ts
+/** Path prefix code-server is served under, relative to the DSH page. */
+const RELAY_PREFIX = "/code-server";
+/** DSH's credentials are not code-server's business. */
+const PRIVATE_HEADERS = /* @__PURE__ */ new Set(["cookie", "authorization"]);
+function upstreamHeaders(headers) {
+	return Object.fromEntries(Object.entries(headers).filter(([name]) => !PRIVATE_HEADERS.has(name)));
+}
+function upstreamPath(url = "/") {
+	const path = url.slice(12);
+	return path.startsWith("/") ? path : `/${path}`;
+}
+/** Handler for HTTP requests below {@link RELAY_PREFIX}. */
+function relayRequests(admission, start) {
+	return async (req, res) => {
+		const rejection = admission({ headers: req.headers });
+		if (rejection !== void 0) {
+			res.writeHead(rejection).end();
+			return;
+		}
+		let server;
+		try {
+			server = await start();
+		} catch (error) {
+			res.writeHead(502, { "content-type": "text/plain; charset=utf-8" });
+			res.end(error instanceof Error ? error.message : "code-server is unavailable");
+			return;
+		}
+		const upstream = request({
+			socketPath: server.socketPath,
+			method: req.method,
+			path: upstreamPath(req.url),
+			headers: upstreamHeaders(req.headers)
+		}, (response) => {
+			res.writeHead(response.statusCode ?? 502, response.statusMessage, response.headers);
+			response.pipe(res);
+		});
+		upstream.on("error", () => {
+			if (res.headersSent) res.destroy();
+			else res.writeHead(502).end();
+		});
+		res.on("close", () => upstream.destroy());
+		req.pipe(upstream);
+	};
+}
+/** Handler for code-server's WebSocket upgrades, which arrive on one exact path. */
+function relayUpgrades(admission, socketPath) {
+	return (req, socket, head) => {
+		const rejection = admission({ headers: req.headers });
+		if (rejection !== void 0) {
+			socket.end(`HTTP/1.1 ${rejection} ${STATUS_CODES[rejection] ?? ""}\r\n\r\n`);
+			return;
+		}
+		const upstream = request({
+			socketPath,
+			method: req.method,
+			path: upstreamPath(req.url),
+			headers: upstreamHeaders(req.headers)
+		});
+		upstream.on("upgrade", (response, upstreamSocket, upstreamHead) => {
+			const lines = [`HTTP/1.1 ${response.statusCode ?? 101} ${response.statusMessage ?? ""}`];
+			for (let index = 0; index < response.rawHeaders.length; index += 2) lines.push(`${response.rawHeaders[index] ?? ""}: ${response.rawHeaders[index + 1] ?? ""}`);
+			socket.write(`${lines.join("\r\n")}\r\n\r\n`);
+			if (upstreamHead.length > 0) socket.write(upstreamHead);
+			if (head.length > 0) upstreamSocket.write(head);
+			upstreamSocket.pipe(socket).pipe(upstreamSocket);
+			upstreamSocket.on("error", () => socket.destroy());
+			upstreamSocket.on("close", () => socket.destroy());
+			socket.on("close", () => upstreamSocket.destroy());
+		});
+		upstream.on("response", (response) => {
+			response.resume();
+			socket.end(`HTTP/1.1 ${response.statusCode ?? 502} ${response.statusMessage ?? ""}\r\n\r\n`);
+		});
+		upstream.on("error", () => socket.destroy());
+		socket.on("error", () => upstream.destroy());
+		upstream.end();
+	};
+}
+// src/host/handlers.ts
+/**
+* One exact route per method on DSH's shared RPC channel. DSH authenticates the
+* browser before a request reaches these routes.
+*/
+function rpcRoutes(services, bridge, codeServer) {
+	const handlers = {
+		async create({ sessionId, ownerId }, signal) {
+			const { cwd } = await sessionFolders(services, sessionId, signal);
+			const folder = await localPath(services, cwd, cwd, "directory", signal);
+			await codeServer.ensure();
+			signal.throwIfAborted();
+			const bindingId = bridge.create(sessionId, ownerId, folder);
+			return {
+				bindingId,
+				cwd: folder,
+				url: editorUrl(bindingId, folder)
+			};
+		},
+		async watch({ sessionId, bindingId, revision }, signal) {
+			const { cwd } = await sessionFolders(services, sessionId, signal);
+			bridge.announceCwd(sessionId, bindingId, await realpath(cwd).catch(() => cwd));
+			return bridge.watch(sessionId, bindingId, revision, signal);
+		},
+		async close({ sessionId, bindingId }) {
+			bridge.close(sessionId, bindingId);
+			return { state: "closed" };
+		},
+		async open({ sessionId, bindingId, address, line = 1 }, signal) {
+			let path;
+			try {
+				path = await filePath(services, sessionId, address, signal);
+			} catch (error) {
+				bridge.report(sessionId, bindingId, asCodeServerError(error));
+				throw error;
+			}
+			return bridge.open(sessionId, bindingId, {
+				path,
+				line
+			});
+		}
+	};
+	async function dispatch(method, payload, signal) {
+		const request = requestSchemas[method].safeParse(payload);
+		if (!request.success) throw new CodeServerError("invalid_request", z.prettifyError(request.error));
+		return handlers[method](request.data, signal);
+	}
+	async function answer(method, payload, signal) {
+		try {
+			return {
+				ok: true,
+				value: await dispatch(method, payload, signal)
+			};
+		} catch (error) {
+			const { code, message } = asCodeServerError(error);
+			return {
+				ok: false,
+				error: {
+					code,
+					message,
+					details: {}
+				}
+			};
+		}
+	}
+	return METHODS.map((method) => ({
+		path: `${RPC_CHANNEL}/${RPC_PREFIX}${method}`,
+		methods: ["POST"],
+		requestBody: "buffered",
+		async fetch(request) {
+			if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return new Response("JSON required", { status: 415 });
+			const body = await request.json().catch(() => void 0);
+			const envelope = clientRequestSchema.safeParse(body);
+			if (!envelope.success || envelope.data.method !== `langify-code-server/${method}`) return new Response("Invalid RPC envelope", { status: 400 });
+			const response = {
+				type: "server-response",
+				rpcId: envelope.data.rpcId,
+				result: await answer(method, envelope.data.payload, request.signal)
+			};
+			return Response.json(response);
+		}
+	}));
+}
+/** The iframe URL, relative to the DSH page; its fragment tells the window's extension its binding. */
+function editorUrl(bindingId, cwd) {
+	const query = new URLSearchParams({ folder: cwd });
+	return `${RELAY_PREFIX.slice(1)}/?${query.toString()}#${BINDING_FRAGMENT}=${bindingId}`;
+}
+function asCodeServerError(error) {
+	if (error instanceof CodeServerError) return error;
+	return new CodeServerError("internal_error", error instanceof Error ? error.message : String(error), { cause: error });
+}
+/** The local file a `dsh-resource://file/...` address names. */
+async function filePath(services, sessionId, address, signal) {
+	const file = parseFileAddress(address);
+	if (file === void 0) throw new CodeServerError("not_a_local_file", "Not a local file link");
+	const { original } = await sessionFolders(services, file.scope === "session" ? file.sessionId : sessionId, signal);
+	return localPath(services, file.path, original, "file", signal);
+}
+async function sessionFolders(services, id, signal) {
+	const sessionId = SessionId(id);
+	const fallback = services.workingDirectory.defaultDirectory;
+	const live = services.sessions.get(sessionId);
+	if (live !== void 0) return {
+		cwd: services.workingDirectory.get(live),
+		original: live.header.cwd ?? fallback
+	};
+	const projection = await services.sessionController.projections({ sessionId }, signal);
+	if (projection === null) throw new CodeServerError("session_not_found", "No such session");
+	if (projection.kind !== "sequenced") throw new CodeServerError("session_migration_required", "Open the conversation once to migrate it");
+	const saved = await services.sessionPersistence.stat(sessionId, { signal });
+	if (saved === void 0) throw new CodeServerError("session_not_found", "No such session");
+	const original = saved.header.cwd ?? fallback;
+	return {
+		cwd: projection.values.workingDirectory ?? original,
+		original
+	};
+}
+/** Resolve a path through DSH's file system and require it on this host, canonicalized. */
+async function localPath(services, path, base, type, signal) {
+	const target = await services.fs.resolve(path, {
+		cwd: base,
+		signal
+	});
+	if ((await services.fs.stat(target, signal))?.type !== type) throw new CodeServerError(type === "file" ? "not_a_file" : "not_a_directory", `${path} is not a ${type}`);
+	const processPath = services.fs.processPath(target);
+	if (services.fs.processPathFromHostPath(processPath) !== processPath) throw new CodeServerError("different_host", "The session runs on another file system");
+	return realpath(processPath);
+}
+// src/host/services.ts
+const inject = [
+	"connection",
+	"webServer",
+	"subprocess",
+	"fs",
+	"sessions",
+	"workingDirectory",
+	"sessionController",
+	"sessionPersistence"
+];
+// src/host/index.ts
+const name = "langify-code-server";
+const Config = Schema.object({
+	command: Schema.string().default("code-server").description("code-server executable name or path."),
+	userDataDir: Schema.string().default("").description("code-server's --user-data-dir. Empty uses its default."),
+	extensionsDir: Schema.string().default("").description("code-server's --extensions-dir. Empty uses its default.")
+});
+async function apply(ctx, config) {
+	const runtimeDir = await mkdtemp(join(process.env.XDG_RUNTIME_DIR ?? tmpdir(), "dsh-code-server-"));
+	ctx.effect(() => () => rm(runtimeDir, {
+		recursive: true,
+		force: true
+	}), "code-server: runtime directory");
+	const bridge = await Bridge.listen(join(runtimeDir, "bridge.sock"));
+	ctx.effect(() => () => bridge.dispose(), "code-server: bridge");
+	const admission = (request) => ctx.connection.requestRejection(request);
+	const codeServer = new CodeServer(ctx.subprocess, {
+		command: config.command,
+		userDataDir: config.userDataDir || void 0,
+		extensionsDir: config.extensionsDir || void 0,
+		env: { [SOCKET_ENV]: bridge.socketPath }
+	}, join(runtimeDir, "code-server.sock"), fileURLToPath(new URL("../extension/dsh-code-bridge.vsix", import.meta.url)), ({ socketPath, commit }) => ctx.effect(() => ctx.webServer.registerUpgrade({
+		path: `${RELAY_PREFIX}/stable-${commit}`,
+		handler: relayUpgrades(admission, socketPath)
+	}), "code-server: WebSocket relay"));
+	ctx.effect(() => () => codeServer.dispose(), "code-server: process");
+	ctx.effect(() => ctx.webServer.register({
+		kind: "prefix",
+		path: RELAY_PREFIX,
+		handler: relayRequests(admission, () => codeServer.ensure())
+	}), "code-server: HTTP relay");
+	for (const route of rpcRoutes(ctx, bridge, codeServer)) ctx.effect(() => ctx.connection.fetch.register(route), `code-server: ${route.path}`);
+}
+export { Config, apply, inject, name };