anymous 1.0.0

package/src/server/routes/instance/httpapi/middleware/proxy.ts

@@ -0,0 +1,108 @@
+import { ProxyUtil } from "@/server/proxy-util"
+import { Effect, Stream } from "effect"
+import { HttpBody, HttpClient, HttpClientRequest, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+import * as Socket from "effect/unstable/socket/Socket"
+import { WebSocketTracker } from "../websocket-tracker"
+
+function requestBody(request: HttpServerRequest.HttpServerRequest) {
+  if (request.method === "GET" || request.method === "HEAD") return HttpBody.empty
+  if (request.source instanceof Request && request.source.body === null) return HttpBody.empty
+  const len = request.headers["content-length"]
+  return HttpBody.stream(request.stream, request.headers["content-type"], len ? Number(len) : undefined)
+}
+
+export function websocket(
+  request: HttpServerRequest.HttpServerRequest,
+  target: string | URL,
+): Effect.Effect<HttpServerResponse.HttpServerResponse, never, Socket.WebSocketConstructor> {
+  return Effect.scoped(
+    Effect.gen(function* () {
+      const inbound = yield* Effect.orDie(request.upgrade)
+      const outbound = yield* Socket.makeWebSocket(ProxyUtil.websocketTargetURL(target), {
+        protocols: ProxyUtil.websocketProtocols(request.headers),
+      })
+      const writeInbound = yield* inbound.writer
+      const writeOutbound = yield* outbound.writer
+      const closeSocket = (socket: Socket.Socket, write: (event: Socket.CloseEvent) => Effect.Effect<void, unknown>) =>
+        socket
+          .runRaw(() => Effect.void, {
+            onOpen: write(WebSocketTracker.SERVER_CLOSING_EVENT()).pipe(Effect.catch(() => Effect.void)),
+          })
+          .pipe(
+            Effect.timeout("1 second"),
+            Effect.catchReason("SocketError", "SocketCloseError", () => Effect.void),
+            Effect.catch(() => Effect.void),
+          )
+      const closeAccepted = Effect.all([closeSocket(inbound, writeInbound), closeSocket(outbound, writeOutbound)], {
+        concurrency: "unbounded",
+        discard: true,
+      })
+      const registered = yield* WebSocketTracker.register(
+        Effect.all(
+          [
+            writeInbound(WebSocketTracker.SERVER_CLOSING_EVENT()),
+            writeOutbound(WebSocketTracker.SERVER_CLOSING_EVENT()),
+          ],
+          { concurrency: "unbounded", discard: true },
+        ),
+      )
+      if (!registered) {
+        yield* closeAccepted
+        return HttpServerResponse.empty()
+      }
+
+      yield* outbound
+        .runRaw((message) => writeInbound(message))
+        .pipe(
+          Effect.catchReason("SocketError", "SocketCloseError", (reason) =>
+            writeInbound(new Socket.CloseEvent(reason.code, reason.closeReason)).pipe(Effect.catch(() => Effect.void)),
+          ),
+          Effect.catch(() =>
+            writeInbound(new Socket.CloseEvent(1011, "proxy error")).pipe(Effect.catch(() => Effect.void)),
+          ),
+          Effect.forkScoped,
+        )
+
+      yield* inbound
+        .runRaw((message) => {
+          return writeOutbound(typeof message === "string" ? message : message.slice())
+        })
+        .pipe(
+          Effect.catch(() => Effect.void),
+          Effect.ensuring(writeOutbound(new Socket.CloseEvent()).pipe(Effect.catch(() => Effect.void))),
+        )
+      return HttpServerResponse.empty()
+    }).pipe(Effect.orDie),
+  )
+}
+
+function statusText(response: unknown) {
+  return (response as { source?: Response }).source?.statusText
+}
+
+export function http(
+  client: HttpClient.HttpClient,
+  url: string | URL,
+  extra: HeadersInit | undefined,
+  request: HttpServerRequest.HttpServerRequest,
+): Effect.Effect<HttpServerResponse.HttpServerResponse> {
+  return Effect.gen(function* () {
+    const response = yield* client.execute(
+      HttpClientRequest.make(request.method as never)(url, {
+        headers: ProxyUtil.headers(request.headers as HeadersInit, extra),
+        body: requestBody(request),
+      }),
+    )
+    const headers = new Headers(response.headers as HeadersInit)
+    headers.delete("content-encoding")
+    headers.delete("content-length")
+
+    return HttpServerResponse.stream(response.stream.pipe(Stream.catchCause(() => Stream.empty)), {
+      status: response.status,
+      statusText: statusText(response),
+      headers,
+    })
+  }).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.empty({ status: 500 }))))
+}
+
+export * as HttpApiProxy from "./proxy"

package/src/server/routes/instance/httpapi/middleware/schema-error.ts

@@ -0,0 +1,41 @@
+import { Effect } from "effect"
+import { HttpServerResponse } from "effect/unstable/http"
+import { HttpApiMiddleware } from "effect/unstable/httpapi"
+import { InvalidRequestError } from "../errors"
+
+// Effect's Issue formatter recursively dumps the rejected `actual` value with
+// no truncation, so a 5KB invalid array produces a ~360KB string. Cap to keep
+// 4xx responses small and avoid mirroring entire request payloads (which may
+// contain secrets) into the response body and log file.
+const REASON_LIMIT = 1024
+function truncateReason(reason: string) {
+  if (reason.length <= REASON_LIMIT) return reason
+  return reason.slice(0, REASON_LIMIT) + `… (${reason.length - REASON_LIMIT} more chars)`
+}
+
+// Default Respondable returns an empty 400 body. Match the NamedError shape
+// used by other 4xx/5xx so the SDK's `wrapClientError` extracts `.data.message`.
+export class SchemaErrorMiddleware extends HttpApiMiddleware.Service<SchemaErrorMiddleware>()(
+  "@opencode/HttpApiSchemaError",
+  {
+    error: InvalidRequestError,
+  },
+) {}
+
+export const schemaErrorLayer = HttpApiMiddleware.layerSchemaErrorTransform(SchemaErrorMiddleware, (error, context) => {
+  const reason = truncateReason(error.cause.message)
+  const response = context.endpoint.path.startsWith("/api/")
+    ? Effect.fail(
+        new InvalidRequestError({
+          message: reason,
+          kind: error.kind,
+        }),
+      )
+    : Effect.succeed(
+        HttpServerResponse.jsonUnsafe(
+          { name: "BadRequest", data: { message: reason, kind: error.kind } },
+          { status: 400 },
+        ),
+      )
+  return Effect.logWarning("schema rejection", { kind: error.kind, reason }).pipe(Effect.andThen(response))
+})

package/src/server/routes/instance/httpapi/middleware/workspace-routing.ts

@@ -0,0 +1,250 @@
+import { WorkspaceV2 } from "@opencode-ai/core/workspace"
+import type { Target } from "@/control-plane/types"
+import { Workspace } from "@/control-plane/workspace"
+import { WorkspaceAdapterRuntime } from "@/control-plane/workspace-adapter-runtime"
+import { Session } from "@/session/session"
+import { HttpApiProxy } from "./proxy"
+import * as Fence from "@/server/shared/fence"
+import { getWorkspaceRouteSessionID, isLocalWorkspaceRoute, workspaceProxyURL } from "@/server/shared/workspace-routing"
+import { NotFoundError } from "@/storage/storage"
+import { Flag } from "@opencode-ai/core/flag/flag"
+import { Context, Data, Effect, Layer, Option, Schema } from "effect"
+import { HttpClient, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+import { HttpApiMiddleware } from "effect/unstable/httpapi"
+import * as Socket from "effect/unstable/socket/Socket"
+import { InvalidRequestError } from "../errors"
+
+// Query fields this middleware reads from the URL. Spread into every
+// endpoint query schema in groups that apply WorkspaceRoutingMiddleware,
+// otherwise HttpApi rejects requests carrying these params with 400.
+// HttpApiMiddleware in effect-smol cannot declare query params today —
+// remove this once upstream supports middleware-declared query schemas.
+export const WorkspaceRoutingQueryFields = {
+  directory: Schema.optional(Schema.String),
+  workspace: Schema.optional(Schema.String),
+}
+
+export const WorkspaceRoutingQuery = Schema.Struct(WorkspaceRoutingQueryFields)
+
+type RemoteTarget = Extract<Target, { type: "remote" }>
+
+type RequestPlan = Data.TaggedEnum<{
+  InvalidWorkspace: {}
+  MissingWorkspace: { readonly workspaceID: WorkspaceV2.ID }
+  Local: { readonly directory: string; readonly workspaceID?: WorkspaceV2.ID }
+  Remote: {
+    readonly request: HttpServerRequest.HttpServerRequest
+    readonly workspace: Workspace.Info
+    readonly target: RemoteTarget
+    readonly url: URL
+  }
+}>
+const RequestPlan = Data.taggedEnum<RequestPlan>()
+const InvalidWorkspaceID = Symbol("InvalidWorkspaceID")
+
+export class WorkspaceRouteContext extends Context.Service<
+  WorkspaceRouteContext,
+  {
+    readonly directory: string
+    readonly workspaceID?: WorkspaceV2.ID
+  }
+>()("@opencode/ExperimentalHttpApiWorkspaceRouteContext") {}
+
+export class WorkspaceRoutingMiddleware extends HttpApiMiddleware.Service<
+  WorkspaceRoutingMiddleware,
+  {
+    provides: WorkspaceRouteContext
+    requires: Session.Service
+  }
+>()("@opencode/ExperimentalHttpApiWorkspaceRouting") {}
+
+function requestURL(request: HttpServerRequest.HttpServerRequest): URL {
+  return new URL(request.url, "http://localhost")
+}
+
+function configuredWorkspaceID(): WorkspaceV2.ID | undefined {
+  return Flag.OPENCODE_WORKSPACE_ID ? WorkspaceV2.ID.make(Flag.OPENCODE_WORKSPACE_ID) : undefined
+}
+
+function selectedWorkspaceID(url: URL, sessionWorkspaceID?: WorkspaceV2.ID): WorkspaceV2.ID | undefined {
+  const workspaceParam = url.searchParams.get("workspace")
+  return sessionWorkspaceID ?? (workspaceParam ? WorkspaceV2.ID.make(workspaceParam) : undefined)
+}
+
+function selectedV2WorkspaceID(
+  url: URL,
+  sessionWorkspaceID?: WorkspaceV2.ID,
+): WorkspaceV2.ID | typeof InvalidWorkspaceID | undefined {
+  if (sessionWorkspaceID) return sessionWorkspaceID
+  const workspaceParam = url.searchParams.get("workspace")
+  if (!workspaceParam) return undefined
+  const workspaceID = Schema.decodeUnknownOption(WorkspaceV2.ID)(workspaceParam)
+  if (Option.isNone(workspaceID)) return InvalidWorkspaceID
+  return workspaceID.value
+}
+
+function defaultDirectory(request: HttpServerRequest.HttpServerRequest, url: URL): string {
+  return url.searchParams.get("directory") || request.headers["x-opencode-directory"] || process.cwd()
+}
+
+function shouldStayOnControlPlane(request: HttpServerRequest.HttpServerRequest, url: URL): boolean {
+  return isLocalWorkspaceRoute(request.method, url.pathname) || url.pathname.startsWith("/console")
+}
+
+function resolveWorkspace(
+  id: WorkspaceV2.ID | undefined,
+  envWorkspaceID: WorkspaceV2.ID | undefined,
+): Effect.Effect<Workspace.Info | void, never, Workspace.Service> {
+  if (!id || envWorkspaceID) return Effect.void
+  return Workspace.Service.use((workspace) => workspace.get(id))
+}
+
+function missingWorkspaceResponse(id: WorkspaceV2.ID): HttpServerResponse.HttpServerResponse {
+  return HttpServerResponse.text(`Workspace not found: ${id}`, {
+    status: 500,
+    contentType: "text/plain; charset=utf-8",
+  })
+}
+
+function resolveTarget(workspace: Workspace.Info): Effect.Effect<Target> {
+  return WorkspaceAdapterRuntime.target(workspace)
+}
+
+function proxyRemote(
+  client: HttpClient.HttpClient,
+  request: HttpServerRequest.HttpServerRequest,
+  workspace: Workspace.Info,
+  target: RemoteTarget,
+  url: URL,
+): Effect.Effect<HttpServerResponse.HttpServerResponse, never, Socket.WebSocketConstructor | Workspace.Service> {
+  return Effect.gen(function* () {
+    const syncing = yield* Workspace.Service.use((svc) => svc.isSyncing(workspace.id))
+    if (!syncing) {
+      return HttpServerResponse.text(`broken sync connection for workspace: ${workspace.id}`, {
+        status: 503,
+        contentType: "text/plain; charset=utf-8",
+      })
+    }
+    const proxyURL = workspaceProxyURL(target.url, url)
+    const headers = request.headers as Record<string, string>
+    if (headers["upgrade"]?.toLowerCase() === "websocket") return yield* HttpApiProxy.websocket(request, proxyURL)
+    const response = yield* HttpApiProxy.http(client, proxyURL, target.headers, request)
+    const sync = Fence.parse(new Headers(response.headers))
+    if (sync) {
+      const syncFailure = yield* Fence.wait(
+        workspace.id,
+        sync,
+        request.source instanceof Request ? request.source.signal : undefined,
+      ).pipe(
+        Effect.as(undefined),
+        Effect.catch((error) => Effect.succeed(HttpServerResponse.text(error.message, { status: 503 }))),
+      )
+      if (syncFailure) return syncFailure
+    }
+    return response
+  })
+}
+
+function planWorkspaceRequest(
+  request: HttpServerRequest.HttpServerRequest,
+  url: URL,
+  workspace: Workspace.Info,
+): Effect.Effect<RequestPlan, never, Workspace.Service> {
+  return Effect.gen(function* () {
+    const target = yield* resolveTarget(workspace)
+    if (target.type === "remote") return RequestPlan.Remote({ request, workspace, target, url })
+    return RequestPlan.Local({ directory: target.directory, workspaceID: workspace.id })
+  })
+}
+
+function planRequest(
+  request: HttpServerRequest.HttpServerRequest,
+  session?: Session.Info,
+): Effect.Effect<RequestPlan, never, Workspace.Service> {
+  return Effect.gen(function* () {
+    const url = requestURL(request)
+    const envWorkspaceID = configuredWorkspaceID()
+    const workspaceID = url.pathname.startsWith("/api/")
+      ? selectedV2WorkspaceID(url, session?.workspaceID)
+      : selectedWorkspaceID(url, session?.workspaceID)
+    if (workspaceID === InvalidWorkspaceID) return RequestPlan.InvalidWorkspace()
+    const workspace = yield* resolveWorkspace(workspaceID, envWorkspaceID)
+
+    if (workspaceID && workspace === undefined && !envWorkspaceID) {
+      return RequestPlan.MissingWorkspace({ workspaceID })
+    }
+
+    if (workspace !== undefined && !envWorkspaceID && !shouldStayOnControlPlane(request, url)) {
+      return yield* planWorkspaceRequest(request, url, workspace)
+    }
+
+    return RequestPlan.Local({
+      directory: session?.directory || defaultDirectory(request, url),
+      workspaceID: envWorkspaceID ?? workspaceID,
+    })
+  })
+}
+
+function routeWorkspace<E>(
+  client: HttpClient.HttpClient,
+  effect: Effect.Effect<HttpServerResponse.HttpServerResponse, E, WorkspaceRouteContext>,
+  plan: RequestPlan,
+): Effect.Effect<HttpServerResponse.HttpServerResponse, E, Socket.WebSocketConstructor | Workspace.Service> {
+  return RequestPlan.$match(plan, {
+    InvalidWorkspace: () =>
+      Effect.succeed(
+        HttpServerResponse.jsonUnsafe(
+          new InvalidRequestError({
+            message: "Invalid workspace query parameter",
+            kind: "Query",
+            field: "workspace",
+          }),
+          { status: 400 },
+        ),
+      ),
+    MissingWorkspace: ({ workspaceID }) => Effect.succeed(missingWorkspaceResponse(workspaceID)),
+    Remote: ({ request, workspace, target, url }) => proxyRemote(client, request, workspace, target, url),
+    Local: ({ directory, workspaceID }) =>
+      effect.pipe(Effect.provideService(WorkspaceRouteContext, WorkspaceRouteContext.of({ directory, workspaceID }))),
+  })
+}
+
+function routeHttpApiWorkspace<E>(
+  client: HttpClient.HttpClient,
+  effect: Effect.Effect<HttpServerResponse.HttpServerResponse, E, WorkspaceRouteContext>,
+): Effect.Effect<
+  HttpServerResponse.HttpServerResponse,
+  E,
+  Session.Service | Workspace.Service | HttpServerRequest.HttpServerRequest | Socket.WebSocketConstructor
+> {
+  return Effect.gen(function* () {
+    const request = yield* HttpServerRequest.HttpServerRequest
+    const sessionID = getWorkspaceRouteSessionID(requestURL(request))
+    const session = sessionID
+      ? yield* Session.Service.use((svc) => svc.get(sessionID)).pipe(
+          Effect.catchIf(
+            (error): error is NotFoundError => NotFoundError.isInstance(error),
+            () => Effect.succeed(undefined),
+          ),
+          Effect.catchDefect(() => Effect.succeed(undefined)),
+        )
+      : undefined
+    const plan = yield* planRequest(request, session)
+    return yield* routeWorkspace(client, effect, plan)
+  })
+}
+
+export const workspaceRoutingLayer = Layer.effect(
+  WorkspaceRoutingMiddleware,
+  Effect.gen(function* () {
+    const makeWebSocket = yield* Socket.WebSocketConstructor
+    const workspace = yield* Workspace.Service
+    const client = yield* HttpClient.HttpClient
+    return WorkspaceRoutingMiddleware.of((effect) =>
+      routeHttpApiWorkspace(client, effect).pipe(
+        Effect.provideService(Socket.WebSocketConstructor, makeWebSocket),
+        Effect.provideService(Workspace.Service, workspace),
+      ),
+    )
+  }),
+)