@rashidee/co2 1.3.15 → 1.3.16

package/dist/index.js

@@ -6809,7 +6809,7 @@ var {
 // package.json
 var package_default = {
   name: "@rashidee/co2",
-  version: "1.3.15",
+  version: "1.3.16",
   description: "Compound Context Studio \u2014 self-hosted team context authoring for CO2 projects",
   type: "module",
   license: "MIT",
@@ -22015,6 +22015,46 @@ function stopCicdApp(projectId) {
 }
 
 // ../server/src/features/cicd/app-proxy.ts
+var PROXY_BASE_SHIM = `<script data-co2-proxy-base-shim>(function () {
+  var m = location.pathname.match(/^(.*?\\/app-proxy)(?:\\/|$)/)
+  if (!m) return
+  var prefix = m[1]
+  function reroot(p) {
+    return p.charAt(0) === '/' && p.charAt(1) !== '/' && p.indexOf(prefix + '/') !== 0 && p !== prefix ? prefix + p : p
+  }
+  var origFetch = window.fetch.bind(window)
+  window.fetch = function (input, init) {
+    if (typeof input === 'string') input = reroot(input)
+    else if (input instanceof URL && input.host === location.host)
+      input = new URL(reroot(input.pathname) + input.search + input.hash, location.origin)
+    return origFetch(input, init)
+  }
+  var OrigWS = window.WebSocket
+  function PatchedWS(url, protocols) {
+    try {
+      var u = new URL(url, location.href)
+      if (u.host === location.host) {
+        u.pathname = reroot(u.pathname)
+        u.protocol = location.protocol === 'https:' ? 'wss:' : 'ws:'
+        url = u.toString()
+      }
+    } catch (e) { /* malformed URL \u2014 let the real constructor throw */ }
+    return protocols === undefined ? new OrigWS(url) : new OrigWS(url, protocols)
+  }
+  PatchedWS.prototype = OrigWS.prototype
+  PatchedWS.CONNECTING = OrigWS.CONNECTING
+  PatchedWS.OPEN = OrigWS.OPEN
+  PatchedWS.CLOSING = OrigWS.CLOSING
+  PatchedWS.CLOSED = OrigWS.CLOSED
+  window.WebSocket = PatchedWS
+  document.addEventListener('click', function (e) {
+    var t = e.target
+    var a = t && t.closest ? t.closest('a[href]') : null
+    if (!a) return
+    var href = a.getAttribute('href')
+    if (href) a.setAttribute('href', reroot(href))
+  }, true)
+})()</script>`;
 async function proxyCicdAppRequest(db, workspacePath, projectId, prefix, subPath, req) {
   const location = resolveCicdApp(db, workspacePath, projectId);
   if (!location.present) throw svcError6("CICD_APP_MISSING", 404);
@@ -22047,6 +22087,13 @@ async function proxyCicdAppRequest(db, workspacePath, projectId, prefix, subPath
   if (redirectTo?.startsWith("/") && redirectTo !== prefix && !redirectTo.startsWith(`${prefix}/`)) {
     responseHeaders.set("location", `${prefix}${redirectTo}`);
   }
+  const contentType = upstream.headers.get("content-type") ?? "";
+  if (contentType.includes("text/html")) {
+    const html = await upstream.text();
+    const headTag = html.match(/<head[^>]*>/i);
+    const patched = headTag ? html.replace(headTag[0], `${headTag[0]}${PROXY_BASE_SHIM}`) : `${PROXY_BASE_SHIM}${html}`;
+    return new Response(patched, { status: upstream.status, headers: responseHeaders });
+  }
   return new Response(upstream.body, { status: upstream.status, headers: responseHeaders });
 }
 var CICD_PROXY_UPGRADE_RE = /^\/api\/cicd\/(\d+)\/app-proxy(\/.*)$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rashidee/co2",
-  "version": "1.3.15",
+  "version": "1.3.16",
   "description": "Compound Context Studio — self-hosted team context authoring for CO2 projects",
   "type": "module",
   "license": "MIT",

package/plugin/skills/util-gencicdscript/SKILL.md

@@ -111,18 +111,49 @@ port, application count) and STOP — the studio starts/embeds the app.
   once at boot). Never cache the parsed config in a top-level `const`.
 - The page is bare: no header, sidebar or footer (it is iframed by the studio). Light theme,
   one nav tab per application; the tab body is that application's live log.
-- **Path-prefix proxy awareness (MANDATORY)**: the studio embeds the page through its
-  same-origin reverse proxy at `/api/cicd/<projectId>/app-proxy/` — root-absolute client URLs
-  (`fetch('/api/state')`, `href="/infra"`, `ws://host/ws`) escape the prefix, hit the studio
-  instead of this app and render an empty page. The client script MUST derive a base path once —
-  `const BASE = location.pathname.endsWith('/') ? location.pathname.slice(0,-1) : location.pathname`
-  (on the `/infra` page additionally strip the trailing `/infra`) — and prefix EVERY fetch
-  (`fetch(BASE+'/api/state')`), the Infrastructure link (`BASE+'/infra'`) and the log WebSocket.
-  The WebSocket URL must also follow the page scheme:
-  `(location.protocol==='https:'?'wss://':'ws://')+location.host+BASE+'/ws?app=...'` — a
-  hardcoded `ws://` is blocked as mixed content when the studio is served over HTTPS.
+- **Path-prefix proxy awareness (MANDATORY — copy the template below verbatim)**: the studio
+  embeds the page through its same-origin reverse proxy at `/api/cicd/<projectId>/app-proxy/` —
+  root-absolute client URLs (`fetch('/api/state')`, `href="/infra"`, `ws://host/ws`) escape the
+  prefix, hit the studio instead of this app and render an EMPTY BLACK PAGE in the studio.
+  Every generated page's client `<script>` MUST begin with this exact bootstrap block:
+
+  ```js
+  // Proxy-aware base path — the studio serves this page at /api/cicd/<id>/app-proxy/ (main)
+  // and .../app-proxy/infra; direct access serves / and /infra. All client URLs derive from it.
+  // Regex-free ON PURPOSE — see the template-literal escaping rule below.
+  var _p = location.pathname
+  if (_p.endsWith('/infra')) _p = _p.slice(0, -6)
+  if (_p.endsWith('/')) _p = _p.slice(0, -1)
+  var BASE = _p
+  function apiUrl(path) { return BASE + path }                 // apiUrl('/api/state')
+  function wsUrl(path) {                                       // wsUrl('/ws?app=x')
+    return (location.protocol === 'https:' ? 'wss://' : 'ws://') + location.host + BASE + path
+  }
+  ```
+
+  and then NEVER write a root-absolute URL anywhere in client code:
+  - every fetch goes through `apiUrl(...)` — `fetch(apiUrl('/api/state'))`, never `fetch('/api/state')`;
+  - the log stream socket is `new WebSocket(wsUrl('/ws?app='+encodeURIComponent(name)))` —
+    never a hardcoded `ws://` (mixed-content-blocked when the studio is served over HTTPS);
+  - the Infrastructure link is set from script (`infralink.href = BASE + '/infra'`), never a
+    literal `href="/infra"`.
   Server-side routes stay unprefixed (`/api/state`, `/ws`, `/infra`) — the studio proxy strips
   the prefix before forwarding.
+- **Template-literal escaping in client code (MANDATORY)**: the page HTML/JS is emitted from a
+  template literal inside `server.js`, where every backslash is consumed once when the template
+  cooks — a client-side regex like `.replace(/\/$/, '')` reaches the browser as
+  `.replace(//$/, '')`, the `//` starts a comment, and the WHOLE client script dies with a
+  SyntaxError (blank page both direct AND embedded; this exact regression has shipped before).
+  Client code inside the template must therefore contain NO backslashes at all: use string
+  methods (`endsWith`, `slice`, `split`, `indexOf`) instead of regex literals, and avoid `\n`
+  in client strings (concatenate with real newlines or use `String.fromCharCode(10)`).
+- **Syntax self-check gate (MANDATORY before flipping the generation COMPLETED)**:
+  1. `node --check server.js` (validates the server code);
+  2. start the server briefly, fetch `/` and `/infra`, extract every `<script>…</script>` block
+     and run `new Function(script)` on each — any SyntaxError means the page renders blank;
+  3. grep the client sections — any remaining `fetch('/`, `href="/`, `'ws://'` or backslash
+     inside the page template is a defect; fix via `apiUrl`/`wsUrl`/`BASE` and the escaping
+     rule first. Only then flip `CICD_GENERATION.md` to COMPLETED.
 - Infrastructure page: when `infra` is non-empty the main page shows an "Infrastructure" link
   that opens the separate `/infra` page in a new tab — a status-only list of supporting
   3rd-party services, each with a live TCP-reachability dot (polled) and a console link when a