@oharness/server 0.1.0

package/dist/markdown.js

@@ -0,0 +1,253 @@
+/**
+ * The client-side script, kept as a template so the page stays one file.
+ *
+ * **Everything here builds DOM nodes and sets `textContent`; nothing assigns
+ * `innerHTML` with content from the model, a tool result or a file.** That is
+ * not stylistic. This page holds a token that drives an agent which can run
+ * shell commands, so a `<script>` in a file the agent happened to read would,
+ * with an innerHTML renderer, execute in exactly the context that can act on
+ * this machine. Building nodes makes the injection impossible rather than
+ * filtered.
+ */
+const RAW = String.raw `
+const el = (tag, cls, text) => {
+  const node = document.createElement(tag);
+  if (cls) node.className = cls;
+  if (text !== undefined) node.textContent = text;
+  return node;
+};
+
+// --- markdown -------------------------------------------------------------
+// A small subset: fences, headings, lists, quotes, and inline code/bold/italic
+// /links. Anything unrecognised stays literal text, which is the safe default
+// for a renderer fed by a language model.
+
+function renderMarkdown(source) {
+  const root = el("div", "md");
+  const lines = source.split("\n");
+  let i = 0;
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    if (/^@@FENCE@@/.test(line)) {
+      const lang = line.slice(3).trim();
+      const body = [];
+      i++;
+      while (i < lines.length && !/^@@FENCE@@/.test(lines[i])) body.push(lines[i++]);
+      i++;
+      root.appendChild(codeBlock(body.join("\n"), lang));
+      continue;
+    }
+
+    const heading = /^(#{1,4})\s+(.*)$/.exec(line);
+    if (heading) {
+      root.appendChild(inline(el("h" + (heading[1].length + 2), "md-h"), heading[2]));
+      i++;
+      continue;
+    }
+
+    if (/^\s*>/.test(line)) {
+      const body = [];
+      while (i < lines.length && /^\s*>/.test(lines[i])) body.push(lines[i++].replace(/^\s*>\s?/, ""));
+      const quote = el("blockquote", "md-quote");
+      quote.appendChild(renderMarkdown(body.join("\n")));
+      root.appendChild(quote);
+      continue;
+    }
+
+    if (/^\s*([-*+]|\d+\.)\s+/.test(line)) {
+      const ordered = /^\s*\d+\./.test(line);
+      const list = el(ordered ? "ol" : "ul", "md-list");
+      while (i < lines.length && /^\s*([-*+]|\d+\.)\s+/.test(lines[i])) {
+        const item = lines[i++].replace(/^\s*([-*+]|\d+\.)\s+/, "");
+        list.appendChild(inline(el("li"), item));
+      }
+      root.appendChild(list);
+      continue;
+    }
+
+    if (line.trim() === "") {
+      i++;
+      continue;
+    }
+
+    const paragraph = [];
+    while (
+      i < lines.length &&
+      lines[i].trim() !== "" &&
+      !/^@@FENCE@@|^\s*>|^#{1,4}\s|^\s*([-*+]|\d+\.)\s+/.test(lines[i])
+    ) {
+      paragraph.push(lines[i++]);
+    }
+    root.appendChild(inline(el("p", "md-p"), paragraph.join("\n")));
+  }
+
+  return root;
+}
+
+/** Inline spans, appended as nodes so no markup can come from the text. */
+function inline(parent, text) {
+  const pattern = /(@@BT@@[^@@BT@@]+@@BT@@)|(\*\*[^*]+\*\*)|(\*[^*]+\*)|(\[[^\]]+\]\([^)]+\))/g;
+  let last = 0;
+  let match;
+
+  while ((match = pattern.exec(text)) !== null) {
+    if (match.index > last) parent.appendChild(document.createTextNode(text.slice(last, match.index)));
+    const token = match[0];
+
+    if (token.startsWith("@@BT@@")) {
+      parent.appendChild(el("code", "md-code", token.slice(1, -1)));
+    } else if (token.startsWith("**")) {
+      parent.appendChild(el("strong", null, token.slice(2, -2)));
+    } else if (token.startsWith("*")) {
+      parent.appendChild(el("em", null, token.slice(1, -1)));
+    } else {
+      const label = token.slice(1, token.indexOf("]"));
+      const href = token.slice(token.indexOf("(") + 1, -1);
+      // Only http(s): a javascript: or data: URL from model output would run
+      // script in a page that can drive the agent.
+      if (/^https?:\/\//i.test(href)) {
+        const link = el("a", "md-link", label);
+        link.href = href;
+        link.target = "_blank";
+        link.rel = "noopener noreferrer";
+        parent.appendChild(link);
+      } else {
+        parent.appendChild(document.createTextNode(token));
+      }
+    }
+    last = match.index + token.length;
+  }
+
+  if (last < text.length) parent.appendChild(document.createTextNode(text.slice(last)));
+  return parent;
+}
+
+function codeBlock(source, lang) {
+  const wrap = el("div", "code-wrap");
+  const bar = el("div", "code-bar");
+  bar.appendChild(el("span", "code-lang", lang || "text"));
+
+  const copy = el("button", "code-copy", "copy");
+  copy.type = "button";
+  copy.addEventListener("click", () => {
+    navigator.clipboard?.writeText(source);
+    copy.textContent = "copied";
+    setTimeout(() => (copy.textContent = "copy"), 1200);
+  });
+  bar.appendChild(copy);
+
+  const pre = el("pre", "code");
+  pre.appendChild(highlight(source, lang));
+  wrap.appendChild(bar);
+  wrap.appendChild(pre);
+  return wrap;
+}
+
+// --- highlighting ---------------------------------------------------------
+// Deliberately generic: one tokenizer for strings, comments, numbers and a
+// shared keyword set. A per-language grammar would be more accurate and far
+// more code to be wrong in; this reads well for the languages people paste.
+
+const KEYWORDS = new Set((
+  "const let var function return if else for while class extends new await async " +
+  "import export from default try catch finally throw typeof instanceof interface " +
+  "type enum public private static void null undefined true false this super " +
+  "def lambda pass raise with as elif not and or in is None True False print " +
+  "fn impl struct trait mut pub use crate match Some None Ok Err " +
+  "package func range map chan go defer select case switch break continue"
+).split(" "));
+
+function highlight(source, lang) {
+  const code = el("code", "hl");
+  const pattern =
+    /("(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|@@BT@@(?:[^@@BT@@\\]|\\.)*@@BT@@)|(\/\/[^\n]*|#[^\n]*|\/\*[\s\S]*?\*\/)|(\b\d[\d_.eE+-]*\b)|([A-Za-z_$][\w$]*)/g;
+  let last = 0;
+  let match;
+
+  while ((match = pattern.exec(source)) !== null) {
+    if (match.index > last) code.appendChild(document.createTextNode(source.slice(last, match.index)));
+    const [token, str, comment, num, word] = match;
+
+    if (str) code.appendChild(el("span", "t-str", token));
+    else if (comment) code.appendChild(el("span", "t-com", token));
+    else if (num) code.appendChild(el("span", "t-num", token));
+    else if (word && KEYWORDS.has(word)) code.appendChild(el("span", "t-kw", token));
+    else code.appendChild(document.createTextNode(token));
+
+    last = match.index + token.length;
+  }
+  if (last < source.length) code.appendChild(document.createTextNode(source.slice(last)));
+  return code;
+}
+
+// --- search ---------------------------------------------------------------
+
+/**
+ * Whether an option matches a query.
+ *
+ * Every whitespace-separated word must appear somewhere in the label, the
+ * group or the trailing detail — so "qwen flash" finds qwen/qwen3.7-flash
+ * regardless of the order typed, and "anthropic opus" narrows by vendor and
+ * model at once. A substring match on the whole query would fail both.
+ */
+function matchesQuery(option, query) {
+  if (!query) return true;
+  const words = String(query).toLowerCase().split(/\s+/).filter(Boolean);
+  const hay = (
+    (option.label || "") + " " + (option.group || "") + " " + (option.sub || "")
+  ).toLowerCase();
+  return words.every((word) => hay.includes(word));
+}
+
+// --- diffs ----------------------------------------------------------------
+
+/**
+ * A line diff for edit tool calls.
+ *
+ * Longest common subsequence rather than a naive line-by-line compare: without
+ * it, inserting one line at the top marks every following line as changed, and
+ * the reader cannot see what actually happened.
+ */
+function renderDiff(before, after) {
+  const a = before.split("\n");
+  const b = after.split("\n");
+  const table = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+
+  for (let i = a.length - 1; i >= 0; i--) {
+    for (let j = b.length - 1; j >= 0; j--) {
+      table[i][j] = a[i] === b[j] ? table[i + 1][j + 1] + 1 : Math.max(table[i + 1][j], table[i][j + 1]);
+    }
+  }
+
+  const out = el("pre", "diff");
+  let i = 0;
+  let j = 0;
+  while (i < a.length && j < b.length) {
+    if (a[i] === b[j]) {
+      out.appendChild(el("div", "d-same", "  " + a[i]));
+      i++;
+      j++;
+    } else if (table[i + 1][j] >= table[i][j + 1]) {
+      out.appendChild(el("div", "d-del", "- " + a[i++]));
+    } else {
+      out.appendChild(el("div", "d-add", "+ " + b[j++]));
+    }
+  }
+  while (i < a.length) out.appendChild(el("div", "d-del", "- " + a[i++]));
+  while (j < b.length) out.appendChild(el("div", "d-add", "+ " + b[j++]));
+  return out;
+}
+`;
+/**
+ * Backticks are written as placeholders and substituted here.
+ *
+ * The first version concatenated `String.raw` fragments around quoted
+ * backticks — which ends the raw template at the first `+`, so everything
+ * after it was an ordinary template literal and every `\n` in the client code
+ * became a real newline inside a string. The page parsed as far as that line
+ * and then died. One template, no concatenation, avoids the whole class.
+ */
+export const CLIENT_SCRIPT = RAW.replaceAll("@@FENCE@@", "```").replaceAll("@@BT@@", "`");
+//# sourceMappingURL=markdown.js.map

package/dist/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../src/markdown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsOrB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC"}

package/dist/page.d.ts

@@ -0,0 +1 @@
+export declare const PAGE: string;