agent-canvas 0.2.0 → 0.6.0

package/daemon/src/server.ts

@@ -1,95 +1,136 @@
-import { writeFileSync, mkdirSync, readFileSync, chmodSync } from "fs";
-import { join, dirname } from "path";
-import { tmpdir } from "os";
-import { randomBytes } from "crypto";
-import {
-  createWebSocketManager,
-  SessionManager,
-  type WSData,
-} from "@fabrika/canvas-kernel/server";
-import { corsHeaders, dispatch, jsonResponse } from "@fabrika/daemon-kit";
-import { createApiHandlers } from "./handlers/api";
-import { createFileHandlers } from "./handlers/files";
-import { createStaticHandlers } from "./handlers/static";
-import { createUploadHandlers } from "./handlers/uploads";
-import { startRemoteFeedbackPoller } from "./remote-feedback";
-import { CLI_AUTH_FILE, PID_FILE, SESSIONS_DIR, TEMP_DIR } from "./paths";
-
-const PORT = parseInt(process.env.CANVAS_PORT || "19400", 10);
-const VERSION = JSON.parse(readFileSync(join(dirname(import.meta.dir), "..", "package.json"), "utf-8")).version as string;
+import { createWebSocketManager, SessionManager, type WSData } from '@fabrika/canvas-kernel/server'
+import { corsHeaders, dispatch, jsonResponse } from '@fabrika/daemon-kit'
+import { randomBytes } from 'crypto'
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from 'fs'
+import { dirname, join } from 'path'
+import { createApiHandlers } from './handlers/api'
+import { createFileHandlers } from './handlers/files'
+import { createStaticHandlers } from './handlers/static'
+import { createUploadHandlers } from './handlers/uploads'
+import { CLI_AUTH_FILE, PID_FILE, REVIEWS_DIR, SESSIONS_DIR, TEMP_DIR } from './paths'
+import { startRemoteFeedbackPoller } from './remote-feedback'
+import { ReviewProxies } from './review/proxy'
+import { createReviewServer, type ReviewSocketData } from './review/server'
+import { ReviewStore } from './review/store'
+
+const PORT = parseInt(process.env.CANVAS_PORT || '19400', 10)
+const VERSION = JSON.parse(readFileSync(join(dirname(import.meta.dir), '..', 'package.json'), 'utf-8')).version as string
 
 // Write PID file so CLI can find and stop us
-mkdirSync(TEMP_DIR, { recursive: true, mode: 0o700 });
-chmodSync(TEMP_DIR, 0o700);
-writeFileSync(PID_FILE, String(process.pid));
-const cliAuthToken = randomBytes(32).toString("base64url");
-writeFileSync(CLI_AUTH_FILE, cliAuthToken, { mode: 0o600 });
-chmodSync(CLI_AUTH_FILE, 0o600);
+mkdirSync(TEMP_DIR, { recursive: true, mode: 0o700 })
+chmodSync(TEMP_DIR, 0o700)
+writeFileSync(PID_FILE, String(process.pid))
+const cliAuthToken = randomBytes(32).toString('base64url')
+writeFileSync(CLI_AUTH_FILE, cliAuthToken, { mode: 0o600 })
+chmodSync(CLI_AUTH_FILE, 0o600)
+
+const sessionManager = new SessionManager(SESSIONS_DIR)
+const wsManager = createWebSocketManager(sessionManager)
+const reviewStore = new ReviewStore(REVIEWS_DIR)
+const reviewProxies = new ReviewProxies(reviewStore, `http://localhost:${PORT}/assets/review.js`)
+const review = createReviewServer(reviewStore, reviewProxies)
+
+type SocketData = WSData | ReviewSocketData
+type Socket = Bun.ServerWebSocket<SocketData>
+
+function isReviewSocket(socket: Socket): socket is Bun.ServerWebSocket<ReviewSocketData> {
+	return socket.data.type === 'review'
+}
 
-const sessionManager = new SessionManager(SESSIONS_DIR);
-const wsManager = createWebSocketManager(sessionManager);
+function isCanvasSocket(socket: Socket): socket is Bun.ServerWebSocket<WSData> {
+	return socket.data.type !== 'review'
+}
 
 const routes = [
-  ...createApiHandlers({ sessionManager, broadcastPlanUpdate: wsManager.broadcastPlanUpdate, broadcastRevisionUpdate: wsManager.broadcastRevisionUpdate, port: PORT, version: VERSION, cliAuthToken }),
-  ...createFileHandlers(sessionManager),
-  ...createUploadHandlers(sessionManager),
-  ...createStaticHandlers(),
-];
-
-const server = Bun.serve<WSData>({
-  port: PORT,
-  hostname: "localhost",
-  fetch(req, server) {
-    const url = new URL(req.url);
-
-    // CORS preflight
-    if (req.method === "OPTIONS") {
-      return new Response(null, { status: 204, headers: corsHeaders(PORT) });
-    }
-
-    // WebSocket upgrade: /ws/session/:id
-    const wsBrowserMatch = url.pathname.match(/^\/ws\/session\/([^/]+)$/);
-    if (wsBrowserMatch) {
-      const upgraded = server.upgrade(req, { data: { type: "browser", sessionId: wsBrowserMatch[1] } });
-      if (!upgraded) return new Response("WebSocket upgrade failed", { status: 400 });
-      return undefined as any;
-    }
-
-    // WebSocket upgrade: /ws/wait/:id
-    const wsWaitMatch = url.pathname.match(/^\/ws\/wait\/([^/]+)$/);
-    if (wsWaitMatch) {
-      const upgraded = server.upgrade(req, { data: { type: "wait", sessionId: wsWaitMatch[1] } });
-      if (!upgraded) return new Response("WebSocket upgrade failed", { status: 400 });
-      return undefined as any;
-    }
-
-    // Route dispatch
-    const response = dispatch(routes, req, url);
-    if (response) return response;
-
-    // Root redirect
-    if (url.pathname === "/" && req.method === "GET") {
-      const sessions = sessionManager.list();
-      if (sessions.length > 0) {
-        const latest = sessions.sort((a, b) =>
-          new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime()
-        )[0];
-        return Response.redirect(`/s/${latest.id}`, 302);
-      }
-      return jsonResponse({ message: "No active sessions", sessions: [] });
-    }
-
-    return jsonResponse({ error: "Not found" }, 404);
-  },
-
-  websocket: wsManager.handlers,
-});
-
-export { sessionManager, server };
-export const broadcastPlanUpdate = wsManager.broadcastPlanUpdate;
+	...createApiHandlers({
+		sessionManager,
+		broadcastPlanUpdate: wsManager.broadcastPlanUpdate,
+		broadcastRevisionUpdate: wsManager.broadcastRevisionUpdate,
+		port: PORT,
+		version: VERSION,
+		cliAuthToken,
+	}),
+	...createFileHandlers(sessionManager),
+	...createUploadHandlers(sessionManager),
+	...createStaticHandlers(),
+]
+
+const server = Bun.serve<SocketData>({
+	port: PORT,
+	hostname: 'localhost',
+	fetch(req, server) {
+		const url = new URL(req.url)
+
+		// Review mode answers its own preflights: the application under review runs on another port.
+		const reviewResponse = review.fetch(req, url, server)
+		if (reviewResponse === 'upgraded') return undefined
+		if (reviewResponse !== null) return reviewResponse
+
+		// CORS preflight
+		if (req.method === 'OPTIONS') {
+			return new Response(null, { status: 204, headers: corsHeaders(PORT) })
+		}
+
+		// WebSocket upgrade: /ws/session/:id
+		const wsBrowserMatch = url.pathname.match(/^\/ws\/session\/([^/]+)$/)
+		if (wsBrowserMatch) {
+			const upgraded = server.upgrade(req, { data: { type: 'browser', sessionId: wsBrowserMatch[1] } })
+			if (!upgraded) return new Response('WebSocket upgrade failed', { status: 400 })
+			return undefined
+		}
+
+		// WebSocket upgrade: /ws/wait/:id
+		const wsWaitMatch = url.pathname.match(/^\/ws\/wait\/([^/]+)$/)
+		if (wsWaitMatch) {
+			const upgraded = server.upgrade(req, { data: { type: 'wait', sessionId: wsWaitMatch[1] } })
+			if (!upgraded) return new Response('WebSocket upgrade failed', { status: 400 })
+			return undefined
+		}
+
+		// Route dispatch
+		const response = dispatch(routes, req, url)
+		if (response) return response
+
+		// Root redirect
+		if (url.pathname === '/' && req.method === 'GET') {
+			const sessions = sessionManager.list()
+			if (sessions.length > 0) {
+				const latest = sessions.sort((a, b) => new Date(b.updatedAt).getTime() - new Date(a.updatedAt).getTime())[0]
+				return Response.redirect(`/s/${latest.id}`, 302)
+			}
+			return jsonResponse({ message: 'No active sessions', sessions: [] })
+		}
+
+		return jsonResponse({ error: 'Not found' }, 404)
+	},
+
+	websocket: {
+		open(socket) {
+			if (isReviewSocket(socket)) review.channel.handlers.open(socket)
+			else if (isCanvasSocket(socket)) wsManager.handlers.open(socket)
+		},
+		message(socket, message) {
+			if (isReviewSocket(socket)) review.channel.handlers.message(socket, message)
+			else if (isCanvasSocket(socket)) wsManager.handlers.message(socket, message)
+		},
+		pong(socket) {
+			if (isReviewSocket(socket)) review.channel.handlers.pong(socket)
+			else if (isCanvasSocket(socket)) wsManager.handlers.pong(socket)
+		},
+		close(socket) {
+			if (isReviewSocket(socket)) review.channel.handlers.close(socket)
+			else if (isCanvasSocket(socket)) wsManager.handlers.close(socket)
+		},
+	},
+})
+
+export { server, sessionManager }
+export const broadcastPlanUpdate = wsManager.broadcastPlanUpdate
 
 // Start polling for remote feedback from shared canvases.
 // No-ops if CANVAS_SHARE_ENDPOINT is not set.
-startRemoteFeedbackPoller(sessionManager, wsManager.broadcastRemoteFeedback, VERSION);
+startRemoteFeedbackPoller(sessionManager, wsManager.broadcastRemoteFeedback, VERSION)
+
+reviewProxies.restore()
 
-console.log(`Planner daemon listening on http://localhost:${PORT}`);
+console.log(`Planner daemon listening on http://localhost:${PORT}`)

package/daemon/src/share.ts

@@ -1,11 +1,5 @@
-import type { SessionManager, ShareEntry } from "@fabrika/canvas-kernel/server";
-import {
-  generateShareKey,
-  exportShareKey,
-  encryptString,
-  ENCRYPTION_META,
-  type EncryptionMeta,
-} from "../client/shareCrypto";
+import type { SessionManager, ShareEntry } from '@fabrika/canvas-kernel/server'
+import { ENCRYPTION_META, type EncryptionMeta, encryptString, exportShareKey, generateShareKey } from '../client/shareCrypto'
 
 /**
  * Canvas sharing: packages a specific revision into a self-contained
@@ -33,58 +27,58 @@ import {
  */
 
 export interface SharePayload {
-  version: 1;
-  /** Present iff payload fields below are ciphertext rather than plaintext. */
-  encryption?: EncryptionMeta;
-  origin: {
-    sessionId: string;
-    revision: number;
-    label?: string;
-    createdAt: string;
-  };
-  canvasFiles: Array<{
-    filename: string;
-    compiledJs: string;
-    sourceJsx?: string;
-  }>;
-  runtime: {
-    componentsVersion: string;
-  };
+	version: 1
+	/** Present iff payload fields below are ciphertext rather than plaintext. */
+	encryption?: EncryptionMeta
+	origin: {
+		sessionId: string
+		revision: number
+		label?: string
+		createdAt: string
+	}
+	canvasFiles: Array<{
+		filename: string
+		compiledJs: string
+		sourceJsx?: string
+	}>
+	runtime: {
+		componentsVersion: string
+	}
 }
 
 export interface ShareResponse {
-  shareId: string;
-  url: string;
-  ownerToken?: string;
-  expiresAt?: string;
+	shareId: string
+	url: string
+	ownerToken?: string
+	expiresAt?: string
 }
 
 export interface ShareConfig {
-  /** Base URL of the share worker, e.g. `https://canvas-share.example.workers.dev` */
-  endpoint: string;
-  /** Version of the @agent-canvas runtime bundles — worker uses this to pick matching runtime */
-  componentsVersion: string;
-  /** Optional bearer token. If the worker has SHARE_AUTH_TOKEN set, this
-   *  must match. Loaded from CANVAS_SHARE_AUTH_TOKEN env var on the daemon. */
-  authToken?: string;
-  /** End-to-end encryption setting. Defaults to true. */
-  encryption?: boolean;
+	/** Base URL of the share worker, e.g. `https://canvas-share.example.workers.dev` */
+	endpoint: string
+	/** Version of the @agent-canvas runtime bundles — worker uses this to pick matching runtime */
+	componentsVersion: string
+	/** Optional bearer token. If the worker has SHARE_AUTH_TOKEN set, this
+	 *  must match. Loaded from CANVAS_SHARE_AUTH_TOKEN env var on the daemon. */
+	authToken?: string
+	/** End-to-end encryption setting. Defaults to true. */
+	encryption?: boolean
 }
 
 export function loadShareConfig(version: string): ShareConfig | null {
-  const endpoint = process.env.CANVAS_SHARE_ENDPOINT ?? "https://canvas.contember.com";
-  if (!endpoint) return null;
-  return {
-    endpoint: endpoint.replace(/\/+$/, ""),
-    componentsVersion: version,
-    encryption: !isEncryptionDisabled(),
-    ...(process.env.CANVAS_SHARE_AUTH_TOKEN ? { authToken: process.env.CANVAS_SHARE_AUTH_TOKEN } : {}),
-  };
+	const endpoint = process.env.CANVAS_SHARE_ENDPOINT ?? 'https://canvas.contember.com'
+	if (!endpoint) return null
+	return {
+		endpoint: endpoint.replace(/\/+$/, ''),
+		componentsVersion: version,
+		encryption: !isEncryptionDisabled(),
+		...(process.env.CANVAS_SHARE_AUTH_TOKEN ? { authToken: process.env.CANVAS_SHARE_AUTH_TOKEN } : {}),
+	}
 }
 
 function isEncryptionDisabled(): boolean {
-  const v = (process.env.CANVAS_SHARE_ENCRYPTION ?? "").trim().toLowerCase();
-  return v === "0" || v === "off" || v === "false" || v === "no";
+	const v = (process.env.CANVAS_SHARE_ENCRYPTION ?? '').trim().toLowerCase()
+	return v === '0' || v === 'off' || v === 'false' || v === 'no'
 }
 
 /**
@@ -93,42 +87,42 @@ function isEncryptionDisabled(): boolean {
  * original JSX source for "view source" functionality on the shared canvas.
  */
 export function buildSharePayload(
-  sessionManager: SessionManager,
-  sessionId: string,
-  revision: number,
-  componentsVersion: string,
+	sessionManager: SessionManager,
+	sessionId: string,
+	revision: number,
+	componentsVersion: string,
 ): SharePayload {
-  const session = sessionManager.get(sessionId);
-  if (!session) throw new Error(`Session ${sessionId} not found`);
+	const session = sessionManager.get(sessionId)
+	if (!session) throw new Error(`Session ${sessionId} not found`)
 
-  const revInfo = session.revisions.find((r) => r.revision === revision);
-  if (!revInfo) throw new Error(`Revision ${revision} not found in session ${sessionId}`);
+	const revInfo = session.revisions.find((r) => r.revision === revision)
+	if (!revInfo) throw new Error(`Revision ${revision} not found in session ${sessionId}`)
 
-  const canvasFiles: SharePayload["canvasFiles"] = [];
-  for (const cf of revInfo.canvasFiles) {
-    const compiledJs = sessionManager.getCompiled(sessionId, cf.filename, revision);
-    if (!compiledJs) {
-      throw new Error(`No compiled JS for ${cf.filename} at revision ${revision}`);
-    }
-    const sourceJsx = sessionManager.readRevisionJsx(sessionId, revision, cf.filename) ?? undefined;
-    canvasFiles.push({
-      filename: cf.filename,
-      compiledJs,
-      ...(sourceJsx ? { sourceJsx } : {}),
-    });
-  }
+	const canvasFiles: SharePayload['canvasFiles'] = []
+	for (const cf of revInfo.canvasFiles) {
+		const compiledJs = sessionManager.getCompiled(sessionId, cf.filename, revision)
+		if (!compiledJs) {
+			throw new Error(`No compiled JS for ${cf.filename} at revision ${revision}`)
+		}
+		const sourceJsx = sessionManager.readRevisionJsx(sessionId, revision, cf.filename) ?? undefined
+		canvasFiles.push({
+			filename: cf.filename,
+			compiledJs,
+			...(sourceJsx ? { sourceJsx } : {}),
+		})
+	}
 
-  return {
-    version: 1,
-    origin: {
-      sessionId,
-      revision,
-      ...(revInfo.label ? { label: revInfo.label } : {}),
-      createdAt: revInfo.createdAt,
-    },
-    canvasFiles,
-    runtime: { componentsVersion },
-  };
+	return {
+		version: 1,
+		origin: {
+			sessionId,
+			revision,
+			...(revInfo.label ? { label: revInfo.label } : {}),
+			createdAt: revInfo.createdAt,
+		},
+		canvasFiles,
+		runtime: { componentsVersion },
+	}
 }
 
 /**
@@ -141,30 +135,30 @@ export function buildSharePayload(
  * Everything else (sessionId, label, compiledJs, sourceJsx) is encrypted.
  */
 export async function encryptSharePayload(
-  payload: SharePayload,
-  key: CryptoKey,
+	payload: SharePayload,
+	key: CryptoKey,
 ): Promise<SharePayload> {
-  const canvasFiles = await Promise.all(
-    payload.canvasFiles.map(async (cf) => ({
-      filename: cf.filename,
-      compiledJs: await encryptString(key, cf.compiledJs),
-      ...(cf.sourceJsx ? { sourceJsx: await encryptString(key, cf.sourceJsx) } : {}),
-    })),
-  );
-  return {
-    version: payload.version,
-    encryption: ENCRYPTION_META,
-    origin: {
-      sessionId: await encryptString(key, payload.origin.sessionId),
-      revision: payload.origin.revision,
-      ...(payload.origin.label
-        ? { label: await encryptString(key, payload.origin.label) }
-        : {}),
-      createdAt: payload.origin.createdAt,
-    },
-    canvasFiles,
-    runtime: payload.runtime,
-  };
+	const canvasFiles = await Promise.all(
+		payload.canvasFiles.map(async (cf) => ({
+			filename: cf.filename,
+			compiledJs: await encryptString(key, cf.compiledJs),
+			...(cf.sourceJsx ? { sourceJsx: await encryptString(key, cf.sourceJsx) } : {}),
+		})),
+	)
+	return {
+		version: payload.version,
+		encryption: ENCRYPTION_META,
+		origin: {
+			sessionId: await encryptString(key, payload.origin.sessionId),
+			revision: payload.origin.revision,
+			...(payload.origin.label
+				? { label: await encryptString(key, payload.origin.label) }
+				: {}),
+			createdAt: payload.origin.createdAt,
+		},
+		canvasFiles,
+		runtime: payload.runtime,
+	}
 }
 
 /**
@@ -174,31 +168,31 @@ export async function encryptSharePayload(
  * fix their config.
  */
 export async function pushShareToWorker(
-  payload: SharePayload,
-  config: ShareConfig,
+	payload: SharePayload,
+	config: ShareConfig,
 ): Promise<ShareResponse> {
-  const headers: Record<string, string> = { "Content-Type": "application/json" };
-  if (config.authToken) headers["Authorization"] = `Bearer ${config.authToken}`;
+	const headers: Record<string, string> = { 'Content-Type': 'application/json' }
+	if (config.authToken) headers['Authorization'] = `Bearer ${config.authToken}`
 
-  const res = await fetch(`${config.endpoint}/shares`, {
-    method: "POST",
-    headers,
-    body: JSON.stringify(payload),
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Share endpoint returned ${res.status}: ${text || res.statusText}`);
-  }
-  const data = (await res.json()) as { shareId?: string; url?: string; ownerToken?: string; expiresAt?: string };
-  if (!data.shareId || !data.url) {
-    throw new Error(`Share endpoint returned invalid response: ${JSON.stringify(data)}`);
-  }
-  return {
-    shareId: data.shareId,
-    url: data.url,
-    ...(data.ownerToken ? { ownerToken: data.ownerToken } : {}),
-    ...(data.expiresAt ? { expiresAt: data.expiresAt } : {}),
-  };
+	const res = await fetch(`${config.endpoint}/shares`, {
+		method: 'POST',
+		headers,
+		body: JSON.stringify(payload),
+	})
+	if (!res.ok) {
+		const text = await res.text().catch(() => '')
+		throw new Error(`Share endpoint returned ${res.status}: ${text || res.statusText}`)
+	}
+	const data = (await res.json()) as { shareId?: string; url?: string; ownerToken?: string; expiresAt?: string }
+	if (!data.shareId || !data.url) {
+		throw new Error(`Share endpoint returned invalid response: ${JSON.stringify(data)}`)
+	}
+	return {
+		shareId: data.shareId,
+		url: data.url,
+		...(data.ownerToken ? { ownerToken: data.ownerToken } : {}),
+		...(data.expiresAt ? { expiresAt: data.expiresAt } : {}),
+	}
 }
 
 /**
@@ -208,36 +202,36 @@ export async function pushShareToWorker(
  * paste it to reviewers.
  */
 export async function shareRevision(
-  sessionManager: SessionManager,
-  sessionId: string,
-  revision: number,
-  config: ShareConfig,
+	sessionManager: SessionManager,
+	sessionId: string,
+	revision: number,
+	config: ShareConfig,
 ): Promise<ShareEntry> {
-  const plaintext = buildSharePayload(sessionManager, sessionId, revision, config.componentsVersion);
+	const plaintext = buildSharePayload(sessionManager, sessionId, revision, config.componentsVersion)
 
-  const useEncryption = config.encryption !== false;
-  let payload = plaintext;
-  let encodedKey: string | undefined;
-  if (useEncryption) {
-    const key = await generateShareKey();
-    encodedKey = await exportShareKey(key);
-    payload = await encryptSharePayload(plaintext, key);
-  }
+	const useEncryption = config.encryption !== false
+	let payload = plaintext
+	let encodedKey: string | undefined
+	if (useEncryption) {
+		const key = await generateShareKey()
+		encodedKey = await exportShareKey(key)
+		payload = await encryptSharePayload(plaintext, key)
+	}
 
-  const response = await pushShareToWorker(payload, config);
-  const url = encodedKey ? `${response.url}#k=${encodedKey}` : response.url;
+	const response = await pushShareToWorker(payload, config)
+	const url = encodedKey ? `${response.url}#k=${encodedKey}` : response.url
 
-  const entry: ShareEntry = {
-    shareId: response.shareId,
-    url,
-    revision,
-    createdAt: new Date().toISOString(),
-    ...(response.ownerToken ? { ownerToken: response.ownerToken } : {}),
-    ...(response.expiresAt ? { expiresAt: response.expiresAt } : {}),
-    ...(encodedKey ? { encryptionKey: encodedKey } : {}),
-  };
-  sessionManager.addShare(sessionId, entry);
-  return entry;
+	const entry: ShareEntry = {
+		shareId: response.shareId,
+		url,
+		revision,
+		createdAt: new Date().toISOString(),
+		...(response.ownerToken ? { ownerToken: response.ownerToken } : {}),
+		...(response.expiresAt ? { expiresAt: response.expiresAt } : {}),
+		...(encodedKey ? { encryptionKey: encodedKey } : {}),
+	}
+	sessionManager.addShare(sessionId, entry)
+	return entry
 }
 
 /**
@@ -245,23 +239,23 @@ export async function shareRevision(
  * it from the local session metadata on success.
  */
 export async function revokeShare(
-  sessionManager: SessionManager,
-  sessionId: string,
-  shareId: string,
-  config: ShareConfig,
+	sessionManager: SessionManager,
+	sessionId: string,
+	shareId: string,
+	config: ShareConfig,
 ): Promise<void> {
-  const session = sessionManager.get(sessionId);
-  const entry = session?.shares?.find((s) => s.shareId === shareId);
-  if (!entry) throw new Error(`Share ${shareId} not found`);
-  if (!entry.ownerToken) throw new Error("No owner token recorded for this share");
+	const session = sessionManager.get(sessionId)
+	const entry = session?.shares?.find((s) => s.shareId === shareId)
+	if (!entry) throw new Error(`Share ${shareId} not found`)
+	if (!entry.ownerToken) throw new Error('No owner token recorded for this share')
 
-  const res = await fetch(`${config.endpoint}/shares/${shareId}/revoke`, {
-    method: "POST",
-    headers: { "Authorization": `Bearer ${entry.ownerToken}` },
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => "");
-    throw new Error(`Revoke failed: ${res.status} ${text}`);
-  }
-  sessionManager.removeShare(sessionId, shareId);
+	const res = await fetch(`${config.endpoint}/shares/${shareId}/revoke`, {
+		method: 'POST',
+		headers: { 'Authorization': `Bearer ${entry.ownerToken}` },
+	})
+	if (!res.ok) {
+		const text = await res.text().catch(() => '')
+		throw new Error(`Revoke failed: ${res.status} ${text}`)
+	}
+	sessionManager.removeShare(sessionId, shareId)
 }

package/daemon/src/stubFetch.ts

@@ -0,0 +1,7 @@
+/** Replace `globalThis.fetch` for a test. The caller restores the original. */
+export function stubFetch(handler: (url: string, init: RequestInit | undefined) => Response | Promise<Response>): void {
+	globalThis.fetch = Object.assign(
+		async (input: Parameters<typeof fetch>[0], init?: RequestInit) => handler(String(input), init),
+		{ preconnect: fetch.preconnect },
+	)
+}