codehost 0.1.0

package/src/web/conn-shared-worker.ts

@@ -0,0 +1,132 @@
+// SharedWorker: coordinates a single WebRTC connection per server (peerId)
+// across every codehost.dev tab of this origin. It owns no media itself
+// (RTCPeerConnection is Window-only) — it just elects one tab as the "owner"
+// that holds the data channel, and relays tunnel RPCs between the other tabs
+// and that owner, with failover when the owner tab goes away.
+//
+// This file is intentionally DOM-free (only MessagePort/MessageEvent) so it
+// type-checks under the app's DOM tsconfig and bundles as a module worker.
+
+interface Tab {
+  id: number;
+  port: MessagePort;
+  alive: number; // last heartbeat (ms, from the tab's clock; only compared loosely)
+}
+
+type Msg = Record<string, unknown> & { t: string };
+
+const tabs = new Map<number, Tab>();
+const owners = new Map<string, number>(); // peerId -> owner tabId
+const subs = new Map<string, Set<number>>(); // peerId -> interested tabIds
+const ready = new Set<string>(); // peerIds whose owner has an open channel
+let nextId = 1;
+
+// SharedWorkerGlobalScope isn't in the DOM lib; reach the connect hook via any.
+(self as unknown as { onconnect: (e: MessageEvent) => void }).onconnect = (e) => {
+  const port = e.ports[0];
+  const tab: Tab = { id: nextId++, port, alive: Date.now() };
+  tabs.set(tab.id, tab);
+  port.onmessage = (ev: MessageEvent) => onMessage(tab, ev.data as Msg);
+  port.start?.();
+  send(tab, { t: "welcome", tabId: tab.id });
+};
+
+function send(tab: Tab | undefined, msg: Msg): void {
+  tab?.port.postMessage(msg);
+}
+
+function onMessage(tab: Tab, msg: Msg): void {
+  tab.alive = Date.now();
+  switch (msg.t) {
+    case "ping":
+      return;
+    case "bye":
+      cleanup(tab.id);
+      return;
+    case "acquire": {
+      const peerId = msg.peerId as string;
+      (subs.get(peerId) ?? subs.set(peerId, new Set()).get(peerId)!).add(tab.id);
+      if (!owners.has(peerId)) {
+        owners.set(peerId, tab.id);
+        send(tab, { t: "role", peerId, owner: true });
+      } else {
+        send(tab, { t: "role", peerId, owner: false, ownerTabId: owners.get(peerId) });
+        // If the owner is already up, don't make the latecomer wait for the next
+        // broadcast — tell it the connection is ready right now.
+        if (ready.has(peerId)) send(tab, { t: "ready", peerId });
+      }
+      return;
+    }
+    case "ready": {
+      // Owner finished establishing — wake everyone waiting on this peer.
+      const peerId = msg.peerId as string;
+      ready.add(peerId);
+      for (const id of subs.get(peerId) ?? []) {
+        if (id !== tab.id) send(tabs.get(id), { t: "ready", peerId });
+      }
+      return;
+    }
+    case "release": {
+      const peerId = msg.peerId as string;
+      subs.get(peerId)?.delete(tab.id);
+      if (owners.get(peerId) === tab.id) reassign(peerId, tab.id);
+      return;
+    }
+    case "rpc": {
+      // Route a tunnel call to the current owner of this peer.
+      const peerId = msg.peerId as string;
+      const owner = tabs.get(owners.get(peerId) ?? -1);
+      if (!owner) {
+        send(tab, { t: "rpc-reply", peerId, callId: msg.callId, payload: { op: "error", message: "no owner" } });
+        return;
+      }
+      send(owner, { t: "rpc", peerId, callId: msg.callId, fromTabId: tab.id, payload: msg.payload });
+      return;
+    }
+    case "rpc-reply": {
+      // Owner answering a routed call — deliver to the original requester.
+      send(tabs.get(msg.toTabId as number), {
+        t: "rpc-reply",
+        peerId: msg.peerId,
+        callId: msg.callId,
+        payload: msg.payload,
+      });
+      return;
+    }
+  }
+}
+
+function cleanup(tabId: number): void {
+  tabs.delete(tabId);
+  for (const [peerId, set] of subs) {
+    set.delete(tabId);
+    if (owners.get(peerId) === tabId) reassign(peerId, tabId);
+    if (set.size === 0) {
+      subs.delete(peerId);
+      owners.delete(peerId);
+      ready.delete(peerId);
+    }
+  }
+}
+
+// Promote a remaining subscriber to owner (failover), or drop the peer.
+function reassign(peerId: string, goneTabId: number): void {
+  owners.delete(peerId);
+  ready.delete(peerId); // new owner must re-establish before anyone proxies
+  const candidate = [...(subs.get(peerId) ?? [])].find((id) => id !== goneTabId && tabs.has(id));
+  if (candidate == null) return;
+  owners.set(peerId, candidate);
+  send(tabs.get(candidate), { t: "promoted", peerId });
+  for (const id of subs.get(peerId) ?? []) {
+    if (id !== candidate) send(tabs.get(id), { t: "owner-gone", peerId });
+  }
+}
+
+// Evict tabs that stopped heart-beating (covers crashes / killed tabs where no
+// `bye` arrived). Heartbeats land ~every 4s; allow generous slack.
+setInterval(() => {
+  const now = Date.now();
+  for (const [id, tab] of tabs) {
+    if (now - tab.alive > 15_000) cleanup(id);
+  }
+}, 5_000);

package/src/web/discovery.tsx

@@ -0,0 +1,267 @@
+import { useEffect, useRef, useState } from "react";
+import type { PeerInfo } from "../shared/signaling";
+import { TOKEN_REQUIREMENTS, validateToken } from "../shared/token";
+import { SignalingClient } from "../shared/signaling-client";
+import type { RtcSignal } from "../shared/rtc";
+import { RtcClient } from "./rtc-client";
+import { getSignalUrl } from "./config";
+import { registerTunnelHost } from "./tunnel-host";
+import { connBroker } from "./conn-broker";
+
+const TOKEN_KEY = "codehost.token";
+
+type ConnState = "idle" | "connecting" | "connected" | "failed";
+
+export function Discovery() {
+  const [token, setToken] = useState(() => localStorage.getItem(TOKEN_KEY) ?? "");
+  const [draft, setDraft] = useState(token);
+  const [tokenError, setTokenError] = useState<string | null>(null);
+  const [connected, setConnected] = useState(false);
+  const [servers, setServers] = useState<PeerInfo[]>([]);
+
+  // Active WebRTC connection to one server (Phase 2: echo test).
+  const [activePeerId, setActivePeerId] = useState<string | null>(null);
+  const [connState, setConnState] = useState<ConnState>("idle");
+
+  // Once a server's data channel is open we mount its VS Code in an iframe.
+  const [iframeSrc, setIframeSrc] = useState<string | null>(null);
+
+  const clientRef = useRef<SignalingClient | null>(null);
+  const rtcRef = useRef<RtcClient | null>(null);
+  const activePeerRef = useRef<string | null>(null);
+
+  // Register the Service Worker + connection broker once. The broker shares one
+  // WebRTC connection per server across tabs; on owner failover it asks us to
+  // reload the iframe so it reconnects through the new owner.
+  useEffect(() => {
+    void registerTunnelHost();
+    connBroker.onLost((peerId) => {
+      if (peerId !== activePeerRef.current) return;
+      setIframeSrc(null);
+      setTimeout(() => setIframeSrc(`/vs/${peerId}/`), 400);
+    });
+  }, []);
+
+  useEffect(() => {
+    if (!token) return;
+    const client = new SignalingClient({
+      url: getSignalUrl(),
+      token,
+      role: "viewer",
+      onOpen: () => setConnected(true),
+      onClose: () => setConnected(false),
+      onPeers: (peers) => setServers(peers.filter((p) => p.role === "server")),
+      onSignal: (from, data) => {
+        if (from === activePeerRef.current) void rtcRef.current?.handleSignal(data);
+      },
+    });
+    clientRef.current = client;
+    client.connect();
+    return () => {
+      rtcRef.current?.close();
+      rtcRef.current = null;
+      if (activePeerRef.current) connBroker.disconnect(activePeerRef.current);
+      client.close();
+      clientRef.current = null;
+      setConnected(false);
+      setServers([]);
+      setActivePeerId(null);
+      activePeerRef.current = null;
+      setConnState("idle");
+      setIframeSrc(null);
+    };
+  }, [token]);
+
+  function applyToken(e: React.FormEvent) {
+    e.preventDefault();
+    const t = draft.trim();
+    const check = validateToken(t);
+    if (!check.ok) {
+      setTokenError(check.reason ?? "invalid token");
+      return;
+    }
+    setTokenError(null);
+    localStorage.setItem(TOKEN_KEY, t);
+    setToken(t);
+  }
+
+  async function connectTo(server: PeerInfo) {
+    const client = clientRef.current;
+    if (!client) return;
+
+    rtcRef.current?.close();
+    rtcRef.current = null;
+    setIframeSrc(null);
+    setActivePeerId(server.peerId);
+    activePeerRef.current = server.peerId;
+    setConnState("connecting");
+
+    // The broker decides whether this tab owns the connection. `establish` is
+    // only invoked when we're the owner (or get promoted on failover); other
+    // tabs reuse the owner's channel via a proxy, so they never open WebRTC.
+    const establish = () =>
+      new Promise<RTCDataChannel>((resolve, reject) => {
+        const rtc = new RtcClient({
+          sendSignal: (data: RtcSignal) => client.sendSignal(server.peerId, data),
+          onState: (state) => {
+            if (state === "failed" || state === "disconnected") setConnState("failed");
+          },
+          onOpen: (channel) => {
+            clearTimeout(timer);
+            resolve(channel);
+          },
+          onClose: () => setConnState((s) => (s === "connected" ? "idle" : s)),
+        });
+        rtcRef.current = rtc;
+        // Don't hang forever dialing a peer that never answers (e.g. a stale
+        // server still listed in the room): fail the attempt after 15s.
+        const timer = setTimeout(() => {
+          rtc.close();
+          reject(new Error("connection timed out"));
+        }, 15000);
+        rtc.start().catch((err) => {
+          clearTimeout(timer);
+          reject(err);
+        });
+      });
+
+    try {
+      await connBroker.connect(server.peerId, establish);
+      setConnState("connected");
+      setIframeSrc(`/vs/${server.peerId}/`);
+    } catch {
+      setConnState("failed");
+    }
+  }
+
+  function disconnect() {
+    rtcRef.current?.close();
+    rtcRef.current = null;
+    if (activePeerRef.current) connBroker.disconnect(activePeerRef.current);
+    setIframeSrc(null);
+    setActivePeerId(null);
+    activePeerRef.current = null;
+    setConnState("idle");
+  }
+
+  const activeServer = servers.find((s) => s.peerId === activePeerId);
+
+  // Connected view: VS Code in an iframe, served over the tunnel.
+  if (iframeSrc && connState === "connected") {
+    return (
+      <div style={styles.page}>
+        <header style={styles.header}>
+          <span style={styles.brand}>codehost</span>
+          <span style={styles.dim}>·</span>
+          <span style={styles.dim}>{activeServer?.meta?.name ?? activePeerId?.slice(0, 8)}</span>
+          {activeServer?.meta?.cwd && <span style={styles.cwd}>{activeServer.meta.cwd}</span>}
+          <span style={{ flex: 1 }} />
+          <button style={styles.connectBtn} onClick={disconnect}>
+            Disconnect
+          </button>
+        </header>
+        <iframe title="VS Code" src={iframeSrc} style={{ flex: 1, border: "none", width: "100%", background: "#1e1e1e" }} />
+      </div>
+    );
+  }
+
+  return (
+    <div style={styles.page}>
+      <header style={styles.header}>
+        <span style={styles.brand}>codehost</span>
+        <span style={styles.dim}>·</span>
+        <span style={styles.dim}>{getSignalUrl()}</span>
+        <span style={{ flex: 1 }} />
+        <span style={{ ...styles.status, color: connected ? "#4ec9b0" : "#888" }}>
+          {token ? (connected ? "● connected" : "○ connecting…") : "○ no token"}
+        </span>
+      </header>
+
+      <main style={styles.main}>
+        <form onSubmit={applyToken} style={styles.tokenForm}>
+          <label style={styles.label}>Token</label>
+          <input
+            value={draft}
+            onChange={(e) => {
+              setDraft(e.target.value);
+              if (tokenError) setTokenError(null);
+            }}
+            placeholder="your room token"
+            style={styles.input}
+          />
+          <button type="submit" style={styles.button}>
+            {token === draft.trim() ? "Reconnect" : "Connect"}
+          </button>
+        </form>
+        {tokenError ? (
+          <p style={styles.tokenError}>{tokenError}</p>
+        ) : (
+          <p style={styles.tokenHint}>Token requires {TOKEN_REQUIREMENTS}.</p>
+        )}
+
+        <h2 style={styles.h2}>VS Code servers</h2>
+        {!token && <p style={styles.dim}>Enter a token to see your servers.</p>}
+        {token && servers.length === 0 && (
+          <p style={styles.dim}>
+            No servers online. Run{" "}
+            <code style={styles.code}>bunx codehost serve -t {token || "<token>"}</code> on a machine.
+          </p>
+        )}
+        <ul style={styles.list}>
+          {servers.map((s) => {
+            const isActive = s.peerId === activePeerId;
+            return (
+              <li key={s.peerId} style={styles.card}>
+                <div style={styles.cardMain}>
+                  <div style={styles.cardName}>{s.meta?.name ?? s.peerId.slice(0, 8)}</div>
+                  <div style={styles.cardSub}>
+                    {s.meta?.host && <span>{s.meta.host}</span>}
+                    {s.meta?.cwd && <span style={styles.cwd}>{s.meta.cwd}</span>}
+                  </div>
+                  {isActive && (
+                    <div style={styles.echo}>
+                      {connState === "connecting" && "negotiating WebRTC…"}
+                      {connState === "failed" && "connection failed"}
+                    </div>
+                  )}
+                </div>
+                <button
+                  style={styles.connectBtn}
+                  onClick={() => connectTo(s)}
+                  disabled={isActive && connState === "connecting"}
+                >
+                  {isActive && connState === "connecting" ? "…" : "Connect"}
+                </button>
+              </li>
+            );
+          })}
+        </ul>
+      </main>
+    </div>
+  );
+}
+
+const styles: Record<string, React.CSSProperties> = {
+  page: { display: "flex", flexDirection: "column", height: "100%", background: "#1f1f1f", color: "#ccc", fontFamily: "system-ui, sans-serif" },
+  header: { display: "flex", alignItems: "center", gap: 8, padding: "8px 14px", background: "#2d2d2d", borderBottom: "1px solid #3d3d3d", fontSize: 13 },
+  brand: { fontFamily: "monospace", fontWeight: 700, color: "#fff" },
+  dim: { color: "#888", fontSize: 12 },
+  status: { fontSize: 12 },
+  main: { flex: 1, overflow: "auto", padding: "20px 24px", maxWidth: 760, width: "100%", margin: "0 auto", boxSizing: "border-box" },
+  tokenForm: { display: "flex", alignItems: "center", gap: 8, marginBottom: 8 },
+  tokenHint: { margin: "0 0 20px", fontSize: 12, color: "#888" },
+  tokenError: { margin: "0 0 20px", fontSize: 12, color: "#f48771" },
+  label: { fontSize: 12, color: "#888" },
+  input: { flex: 1, background: "#252525", border: "1px solid #3d3d3d", color: "#eee", padding: "8px 10px", borderRadius: 6, fontSize: 13, outline: "none" },
+  button: { background: "#0e639c", border: "none", color: "#fff", padding: "8px 16px", borderRadius: 6, cursor: "pointer", fontSize: 13 },
+  h2: { fontSize: 14, color: "#aaa", fontWeight: 600, margin: "0 0 12px" },
+  code: { background: "#252525", padding: "2px 6px", borderRadius: 4, fontFamily: "monospace", fontSize: 12 },
+  list: { listStyle: "none", margin: 0, padding: 0, display: "flex", flexDirection: "column", gap: 8 },
+  card: { display: "flex", alignItems: "center", gap: 12, background: "#252525", border: "1px solid #3d3d3d", borderRadius: 8, padding: "12px 14px" },
+  cardMain: { flex: 1, minWidth: 0 },
+  cardName: { fontSize: 14, fontWeight: 600, color: "#fff" },
+  cardSub: { display: "flex", gap: 12, fontSize: 12, color: "#888", marginTop: 2 },
+  cwd: { fontFamily: "monospace" },
+  echo: { marginTop: 6, fontSize: 12, color: "#4ec9b0", fontFamily: "monospace" },
+  connectBtn: { background: "#0e639c", border: "none", color: "#fff", padding: "6px 14px", borderRadius: 6, cursor: "pointer", fontSize: 13 },
+};

package/src/web/rtc-client.ts

@@ -0,0 +1,84 @@
+import { CHANNEL_LABEL, ICE_SERVERS, type RtcSignal } from "../shared/rtc";
+
+export interface RtcClientOptions {
+  /** Relay a signal to the server peer via the signaling channel. */
+  sendSignal: (data: RtcSignal) => void;
+  onOpen?: (channel: RTCDataChannel) => void;
+  onClose?: () => void;
+  onState?: (state: RTCPeerConnectionState) => void;
+}
+
+/**
+ * Browser-side WebRTC client. The viewer is the offerer: it creates the data
+ * channel, makes an offer, and exchanges ICE with the daemon via signaling.
+ */
+export class RtcClient {
+  private pc: RTCPeerConnection;
+  private channel: RTCDataChannel | null = null;
+
+  constructor(private opts: RtcClientOptions) {
+    this.pc = new RTCPeerConnection({
+      iceServers: ICE_SERVERS.map((urls) => ({ urls })),
+    });
+
+    this.pc.onicecandidate = (ev) => {
+      if (ev.candidate) {
+        this.opts.sendSignal({
+          kind: "candidate",
+          candidate: ev.candidate.candidate,
+          mid: ev.candidate.sdpMid ?? "0",
+        });
+      }
+    };
+
+    this.pc.onconnectionstatechange = () => {
+      this.opts.onState?.(this.pc.connectionState);
+    };
+  }
+
+  /** Create the data channel + offer and kick off the handshake. */
+  async start(): Promise<void> {
+    const channel = this.pc.createDataChannel(CHANNEL_LABEL, { ordered: true });
+    channel.binaryType = "arraybuffer";
+    this.channel = channel;
+    channel.onopen = () => this.opts.onOpen?.(channel);
+    channel.onclose = () => this.opts.onClose?.();
+
+    const offer = await this.pc.createOffer();
+    await this.pc.setLocalDescription(offer);
+    this.opts.sendSignal({ kind: "offer", type: "offer", sdp: offer.sdp ?? "" });
+  }
+
+  /** Handle an inbound signal from the daemon. */
+  async handleSignal(data: unknown): Promise<void> {
+    const sig = data as RtcSignal;
+    if (!sig || typeof sig !== "object") return;
+
+    if (sig.kind === "answer") {
+      await this.pc.setRemoteDescription({ type: "answer", sdp: sig.sdp });
+    } else if (sig.kind === "candidate") {
+      try {
+        await this.pc.addIceCandidate({ candidate: sig.candidate, sdpMid: sig.mid });
+      } catch (err) {
+        console.error("[rtc] addIceCandidate failed:", err);
+      }
+    }
+  }
+
+  get dataChannel(): RTCDataChannel | null {
+    return this.channel;
+  }
+
+  close(): void {
+    try {
+      this.channel?.close();
+    } catch {
+      // ignore
+    }
+    try {
+      this.pc.close();
+    } catch {
+      // ignore
+    }
+  }
+}

package/src/web/sw.ts

@@ -0,0 +1,136 @@
+/// <reference lib="webworker" />
+// Service Worker: intercepts HTTP requests to /vs/<peerId>/* and forwards them
+// to the controlling page (which owns the WebRTC data channel) over a
+// MessageChannel, streaming the response back. WebSocket connections can't be
+// intercepted here, so we inject a bootstrap script into VS Code's HTML that
+// overrides window.WebSocket inside the iframe (see tunnel-websocket.ts).
+const sw = self as unknown as ServiceWorkerGlobalScope;
+
+const VS_PREFIX = /^\/vs\/([^/]+)(\/.*)?$/;
+
+sw.addEventListener("install", () => sw.skipWaiting());
+sw.addEventListener("activate", (e) => e.waitUntil(sw.clients.claim()));
+
+sw.addEventListener("fetch", (event: FetchEvent) => {
+  const url = new URL(event.request.url);
+  if (url.origin !== sw.location.origin) return;
+
+  // Serve the iframe bootstrap from the SW itself (same-origin, CSP 'self').
+  if (url.pathname === "/__codehost/bootstrap.js") {
+    event.respondWith(bootstrapResponse());
+    return;
+  }
+
+  const m = url.pathname.match(VS_PREFIX);
+  if (!m) return; // let the network/Pages handle the discovery app itself
+  const peerId = m[1];
+
+  event.respondWith(proxyOverTunnel(event.request, peerId));
+});
+
+async function proxyOverTunnel(request: Request, peerId: string): Promise<Response> {
+  const client = await pickClient();
+  if (!client) return new Response("no codehost page open", { status: 502 });
+
+  const url = new URL(request.url);
+  const headers: Record<string, string> = {};
+  request.headers.forEach((v, k) => (headers[k] = v));
+  const bodyBuf =
+    request.method === "GET" || request.method === "HEAD"
+      ? undefined
+      : new Uint8Array(await request.arrayBuffer());
+
+  const isDocument = request.mode === "navigate" || request.destination === "document";
+
+  return new Promise<Response>((resolve) => {
+    const mc = new MessageChannel();
+    let resolved = false;
+
+    mc.port1.onmessage = (ev) => {
+      const msg = ev.data;
+      if (msg.type === "head") {
+        const stream = new ReadableStream<Uint8Array>({
+          start(controller) {
+            mc.port1.onmessage = (e2) => {
+              const m2 = e2.data;
+              if (m2.type === "body") controller.enqueue(new Uint8Array(m2.chunk));
+              else if (m2.type === "end") controller.close();
+              else if (m2.type === "error") controller.error(new Error(m2.message));
+            };
+          },
+        });
+
+        // Inject the WS-shim bootstrap into VS Code's HTML documents.
+        const headers = new Headers(msg.headers);
+        const ct = headers.get("content-type") ?? "";
+        if (isDocument && ct.includes("text/html")) {
+          resolved = true;
+          resolve(injectBootstrap(stream, msg, peerId, headers));
+          return;
+        }
+        resolved = true;
+        resolve(new Response(stream, { status: msg.status, statusText: msg.statusText, headers }));
+      } else if (msg.type === "error" && !resolved) {
+        resolved = true;
+        resolve(new Response(`tunnel error: ${msg.message}`, { status: 502 }));
+      }
+    };
+
+    client.postMessage(
+      {
+        type: "tunnel-fetch",
+        peerId,
+        method: request.method,
+        path: url.pathname + url.search,
+        headers,
+        body: bodyBuf,
+      },
+      [mc.port2, ...(bodyBuf ? [bodyBuf.buffer] : [])],
+    );
+  });
+}
+
+// Strip CSP so our injected same-origin bootstrap can run, and prepend the
+// bootstrap <script> as the first thing in <head>.
+async function injectBootstrap(
+  stream: ReadableStream<Uint8Array>,
+  head: { status: number; statusText: string },
+  peerId: string,
+  headers: Headers,
+): Promise<Response> {
+  const raw = await new Response(stream).text();
+  const tag = `<script src="/__codehost/bootstrap.js" data-peer="${peerId}" data-base="/vs/${peerId}"></script>`;
+  const html = raw.includes("<head>") ? raw.replace("<head>", `<head>${tag}`) : tag + raw;
+  headers.delete("content-security-policy");
+  headers.delete("content-security-policy-report-only");
+  headers.set("content-length", String(new TextEncoder().encode(html).byteLength));
+  return new Response(html, { status: head.status, statusText: head.statusText, headers });
+}
+
+async function pickClient(): Promise<Client | null> {
+  const all = await sw.clients.matchAll({ type: "window", includeUncontrolled: true });
+  // Prefer the top-level discovery page (not the VS Code iframe).
+  const top = all.find((c) => !new URL(c.url).pathname.startsWith("/vs/"));
+  return top ?? all[0] ?? null;
+}
+
+function bootstrapResponse(): Response {
+  // Runs inside the VS Code iframe. The parent page exposes its TunnelClient
+  // factory at window.parent.__codehostMakeWS (same-origin), which returns a
+  // WebSocket-compatible class bound to the right peer + base path.
+  const js = `(() => {
+    const el = document.currentScript;
+    const base = el && el.getAttribute('data-base');
+    const peer = el && el.getAttribute('data-peer');
+    try {
+      const make = window.parent.__codehostMakeWS;
+      if (make && base && peer) {
+        const Shim = make(peer, base);
+        if (Shim) window.WebSocket = Shim;
+      }
+    } catch (e) { console.error('[codehost] WS shim install failed', e); }
+  })();`;
+  return new Response(js, {
+    headers: { "content-type": "text/javascript", "cache-control": "no-store" },
+  });
+}

package/src/web/tsconfig.sw.json

@@ -0,0 +1,12 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "skipLibCheck": true,
+    "lib": ["ESNext", "WebWorker"],
+    "types": []
+  },
+  "include": ["sw.ts", "../shared/protocol.ts"]
+}