codehost 0.1.0

package/src/web/tunnel-client.ts

@@ -0,0 +1,190 @@
+import {
+  type HttpResHead,
+  Op,
+  WsReassembler,
+  chunk,
+  decodeFrame,
+  encodeFrame,
+  encodeJson,
+  payloadJson,
+  payloadText,
+  wsMessageFrames,
+} from "../shared/protocol";
+
+// Browser-side end of the tunnel. Owns the WebRTC data channel and multiplexes
+// HTTP requests (driven by the Service Worker) and WebSocket connections
+// (driven by the in-page TunnelWebSocket shim) over it by streamId.
+
+interface HttpWaiter {
+  onHead: (head: HttpResHead) => void;
+  onBody: (chunk: Uint8Array) => void;
+  onEnd: () => void;
+  onError: (message: string) => void;
+}
+
+export interface TunnelWsHandlers {
+  onOpenAck: (ok: boolean, protocol?: string) => void;
+  onText: (text: string) => void;
+  onBin: (data: Uint8Array) => void;
+  onClose: (code: number, reason: string) => void;
+}
+
+export interface TunnelWsHandle {
+  sendText: (text: string) => void;
+  sendBin: (data: Uint8Array) => void;
+  close: (code?: number, reason?: string) => void;
+}
+
+/** The subset of a tunnel the Service Worker glue and WS shim depend on. Both
+ *  the local {@link TunnelClient} and the cross-tab proxy implement it. */
+export interface TunnelLike {
+  fetch(method: string, path: string, headers: Record<string, string>, body?: Uint8Array): Promise<Response>;
+  openWs(path: string, protocols: string[] | undefined, handlers: TunnelWsHandlers): TunnelWsHandle;
+}
+
+export class TunnelClient {
+  private nextStreamId = 1;
+  private https = new Map<number, HttpWaiter>();
+  private wss = new Map<number, TunnelWsHandlers>();
+  private wsRx = new WsReassembler(); // reassembles daemon -> browser WS messages
+  private textEncoder = new TextEncoder();
+
+  constructor(private channel: RTCDataChannel) {
+    channel.binaryType = "arraybuffer";
+    channel.addEventListener("message", (ev) => this.onFrame(ev.data));
+  }
+
+  private allocId(): number {
+    const id = this.nextStreamId;
+    this.nextStreamId = (this.nextStreamId + 1) >>> 0 || 1;
+    return id;
+  }
+
+  private onFrame(data: ArrayBuffer | string): void {
+    if (typeof data === "string") return;
+    const { op, streamId, payload } = decodeFrame(data);
+    switch (op) {
+      case Op.HttpResHead:
+        this.https.get(streamId)?.onHead(payloadJson<HttpResHead>(payload));
+        break;
+      case Op.HttpResBody:
+        this.https.get(streamId)?.onBody(payload.slice());
+        break;
+      case Op.HttpResEnd:
+        this.https.get(streamId)?.onEnd();
+        this.https.delete(streamId);
+        break;
+      case Op.Error: {
+        const waiter = this.https.get(streamId);
+        if (waiter) {
+          waiter.onError(payloadJson<{ message: string }>(payload).message);
+          this.https.delete(streamId);
+        }
+        break;
+      }
+      case Op.WsOpenAck: {
+        const info = payloadJson<{ ok: boolean; protocol?: string }>(payload);
+        this.wss.get(streamId)?.onOpenAck(info.ok, info.protocol);
+        break;
+      }
+      case Op.WsCont:
+        this.wsRx.cont(streamId, payload);
+        break;
+      case Op.WsText:
+        this.wss.get(streamId)?.onText(payloadText(this.wsRx.finish(streamId, payload)));
+        break;
+      case Op.WsBin:
+        this.wss.get(streamId)?.onBin(this.wsRx.finish(streamId, payload).slice());
+        break;
+      case Op.WsClose: {
+        const info = payloadJson<{ code?: number; reason?: string }>(payload);
+        this.wsRx.drop(streamId);
+        this.wss.get(streamId)?.onClose(info.code ?? 1000, info.reason ?? "");
+        this.wss.delete(streamId);
+        break;
+      }
+    }
+  }
+
+  /** Perform an HTTP request over the tunnel; resolves to a Response. */
+  fetch(method: string, path: string, headers: Record<string, string>, body?: Uint8Array): Promise<Response> {
+    const streamId = this.allocId();
+    return new Promise<Response>((resolve, reject) => {
+      let head: HttpResHead | null = null;
+      let controller: ReadableStreamDefaultController<Uint8Array> | null = null;
+      const stream = new ReadableStream<Uint8Array>({
+        start: (c) => {
+          controller = c;
+        },
+      });
+
+      this.https.set(streamId, {
+        onHead: (h) => {
+          head = h;
+          resolve(
+            new Response(stream, {
+              status: h.status === 204 || h.status === 304 ? h.status : h.status,
+              statusText: h.statusText,
+              headers: h.headers,
+            }),
+          );
+        },
+        onBody: (b) => controller?.enqueue(b),
+        onEnd: () => {
+          try {
+            controller?.close();
+          } catch {
+            // already closed
+          }
+          if (!head) reject(new Error("stream ended before head"));
+        },
+        onError: (msg) => {
+          try {
+            controller?.error(new Error(msg));
+          } catch {
+            // ignore
+          }
+          if (!head) reject(new Error(msg));
+        },
+      });
+
+      this.send(encodeJson(Op.HttpReq, streamId, { method, path, headers }));
+      if (body && body.byteLength) {
+        for (const part of chunk(body)) this.send(encodeFrame(Op.HttpReqBody, streamId, part));
+      }
+      this.send(encodeFrame(Op.HttpReqEnd, streamId));
+    });
+  }
+
+  /** Open a WebSocket stream over the tunnel; returns its streamId + a sender. */
+  openWs(path: string, protocols: string[] | undefined, handlers: TunnelWsHandlers) {
+    const streamId = this.allocId();
+    this.wss.set(streamId, handlers);
+    this.send(encodeJson(Op.WsOpen, streamId, { path, protocols }));
+    return {
+      sendText: (text: string) => {
+        for (const f of wsMessageFrames(Op.WsText, streamId, this.textEncoder.encode(text))) this.send(f);
+      },
+      sendBin: (data: Uint8Array) => {
+        for (const f of wsMessageFrames(Op.WsBin, streamId, data)) this.send(f);
+      },
+      close: (code?: number, reason?: string) => {
+        this.send(encodeJson(Op.WsClose, streamId, { code, reason }));
+        this.wss.delete(streamId);
+      },
+    };
+  }
+
+  private send(frame: Uint8Array): void {
+    if (this.channel.readyState === "open") {
+      // Copy into a fresh ArrayBuffer-backed view to satisfy send()'s typing.
+      const copy = new Uint8Array(frame.byteLength);
+      copy.set(frame);
+      this.channel.send(copy.buffer);
+    }
+  }
+
+  get ready(): boolean {
+    return this.channel.readyState === "open";
+  }
+}

package/src/web/tunnel-host.ts

@@ -0,0 +1,63 @@
+import { connBroker } from "./conn-broker";
+import { makeTunnelWebSocket } from "./tunnel-websocket";
+
+// Page-side glue between the Service Worker and the connection broker.
+// - Registers the SW and starts the broker (SharedWorker coordination).
+// - Answers the SW's `tunnel-fetch` messages by running the request over the
+//   right tunnel for the peer (local channel if this tab owns it, else a proxy
+//   to the owner tab) and streaming the response back through the port.
+// - Exposes window.__codehostMakeWS so the VS Code iframe's injected bootstrap
+//   can install a WebSocket shim bound to the right peer (same-origin access).
+
+declare global {
+  interface Window {
+    __codehostMakeWS?: (peerId: string, basePath: string) => unknown;
+  }
+}
+
+export async function registerTunnelHost(): Promise<void> {
+  connBroker.init();
+
+  if (!("serviceWorker" in navigator)) {
+    console.warn("[codehost] no service worker support; VS Code tunneling unavailable");
+    return;
+  }
+
+  navigator.serviceWorker.addEventListener("message", onSwMessage);
+
+  window.__codehostMakeWS = (peerId: string, basePath: string) =>
+    makeTunnelWebSocket(connBroker.tunnelFor(peerId), basePath);
+
+  // Built to /sw.js at the web root (see vite.sw.config.ts) so its scope is "/".
+  await navigator.serviceWorker.register("/sw.js", { type: "module", scope: "/" });
+  await navigator.serviceWorker.ready;
+}
+
+function onSwMessage(event: MessageEvent): void {
+  const msg = event.data;
+  if (msg?.type !== "tunnel-fetch") return;
+  const port = event.ports[0];
+
+  void connBroker
+    .tunnelFor(msg.peerId)
+    .fetch(msg.method, msg.path, msg.headers, msg.body ? new Uint8Array(msg.body) : undefined)
+    .then(async (res) => {
+      const headers: Record<string, string> = {};
+      res.headers.forEach((v, k) => (headers[k] = v));
+      port.postMessage({ type: "head", status: res.status, statusText: res.statusText, headers });
+      if (res.body) {
+        const reader = res.body.getReader();
+        for (;;) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          // Transfer the underlying buffer to avoid a copy.
+          const buf = value.buffer.slice(value.byteOffset, value.byteOffset + value.byteLength);
+          port.postMessage({ type: "body", chunk: buf }, [buf]);
+        }
+      }
+      port.postMessage({ type: "end" });
+    })
+    .catch((err) => {
+      port.postMessage({ type: "error", message: String(err) });
+    });
+}

package/src/web/tunnel-websocket.ts

@@ -0,0 +1,113 @@
+import type { TunnelLike, TunnelWsHandle } from "./tunnel-client";
+
+// Minimal WebSocket implementation backed by a TunnelClient stream. Installed
+// into the VS Code iframe as `window.WebSocket` so the workbench's socket
+// connections traverse the WebRTC data channel instead of the network.
+//
+// Only the surface VS Code uses is implemented: readyState, binaryType, send,
+// close, and the onopen/onmessage/onclose/onerror + addEventListener events.
+
+type Listener = (ev: any) => void;
+
+export function makeTunnelWebSocket(client: TunnelLike, basePath: string) {
+  return class TunnelWebSocket implements Partial<WebSocket> {
+    static readonly CONNECTING = 0;
+    static readonly OPEN = 1;
+    static readonly CLOSING = 2;
+    static readonly CLOSED = 3;
+    readonly CONNECTING = 0;
+    readonly OPEN = 1;
+    readonly CLOSING = 2;
+    readonly CLOSED = 3;
+
+    url: string;
+    readyState = 0;
+    binaryType: BinaryType = "blob";
+    protocol = "";
+
+    onopen: Listener | null = null;
+    onmessage: Listener | null = null;
+    onclose: Listener | null = null;
+    onerror: Listener | null = null;
+
+    private listeners = new Map<string, Set<Listener>>();
+    private handle: TunnelWsHandle;
+
+    constructor(url: string | URL, protocols?: string | string[]) {
+      this.url = String(url);
+      const u = new URL(this.url, self.location.href);
+      // Forward only the path+query relative to the server base path.
+      let path = u.pathname + u.search;
+      if (basePath && path.startsWith(basePath)) path = path.slice(basePath.length) || "/";
+      const protoList = protocols ? (Array.isArray(protocols) ? protocols : [protocols]) : undefined;
+
+      this.handle = client.openWs(basePath + path, protoList, {
+        onOpenAck: (ok, protocol) => {
+          if (!ok) {
+            this.fail();
+            return;
+          }
+          this.readyState = 1;
+          this.protocol = protocol ?? "";
+          this.dispatch("open", {});
+        },
+        onText: (text) => this.dispatch("message", { data: text }),
+        onBin: (data) => this.dispatch("message", { data: this.wrapBinary(data) }),
+        onClose: (code, reason) => {
+          this.readyState = 3;
+          this.dispatch("close", { code, reason, wasClean: code === 1000 });
+        },
+      });
+    }
+
+    private wrapBinary(data: Uint8Array): ArrayBuffer | Blob {
+      if (this.binaryType === "arraybuffer") {
+        return data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength) as ArrayBuffer;
+      }
+      return new Blob([data as BlobPart]);
+    }
+
+    send(data: string | ArrayBufferLike | ArrayBufferView | Blob): void {
+      if (this.readyState !== 1) return;
+      if (typeof data === "string") {
+        this.handle.sendText(data);
+      } else if (data instanceof Blob) {
+        void data.arrayBuffer().then((b) => this.handle.sendBin(new Uint8Array(b)));
+      } else if (ArrayBuffer.isView(data)) {
+        this.handle.sendBin(new Uint8Array(data.buffer, data.byteOffset, data.byteLength));
+      } else {
+        this.handle.sendBin(new Uint8Array(data as ArrayBuffer));
+      }
+    }
+
+    close(code?: number, reason?: string): void {
+      if (this.readyState === 3) return;
+      this.readyState = 2;
+      this.handle.close(code, reason);
+      this.readyState = 3;
+      this.dispatch("close", { code: code ?? 1000, reason: reason ?? "", wasClean: true });
+    }
+
+    private fail(): void {
+      this.readyState = 3;
+      this.dispatch("error", {});
+      this.dispatch("close", { code: 1006, reason: "tunnel open failed", wasClean: false });
+    }
+
+    addEventListener(type: string, listener: Listener): void {
+      if (!this.listeners.has(type)) this.listeners.set(type, new Set());
+      this.listeners.get(type)!.add(listener);
+    }
+
+    removeEventListener(type: string, listener: Listener): void {
+      this.listeners.get(type)?.delete(listener);
+    }
+
+    private dispatch(type: string, init: Record<string, unknown>): void {
+      const ev = { type, target: this, ...init };
+      const handler = (this as any)[`on${type}`] as Listener | null;
+      handler?.call(this, ev);
+      this.listeners.get(type)?.forEach((l) => l.call(this, ev));
+    }
+  };
+}

package/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "jsx": "react-jsx",
+    "strict": true,
+    "skipLibCheck": true,
+    "types": ["bun-types"],
+    "paths": {}
+  },
+  "include": ["src/**/*", "vite.config.ts"],
+  "exclude": ["src/web/sw.ts"]
+}

package/vite.config.ts

@@ -0,0 +1,17 @@
+import { defineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+
+export default defineConfig({
+  plugins: [react()],
+  server: {
+    port: 5173,
+    proxy: {
+      "/api": "http://localhost:3001",
+      "/ws": { target: "ws://localhost:3001", ws: true },
+    },
+  },
+  build: {
+    outDir: "dist/public",
+    emptyOutDir: true,
+  },
+});

package/vite.sw.config.ts

@@ -0,0 +1,20 @@
+import { defineConfig } from "vite";
+
+// Builds the Service Worker as a single, unhashed file at the web root
+// (dist/public/sw.js) so it registers with scope "/" and can intercept
+// /vs/<peerId>/* across the whole origin. Run after the main `vite build`
+// so it doesn't wipe the app assets (emptyOutDir: false).
+export default defineConfig({
+  build: {
+    outDir: "dist/public",
+    emptyOutDir: false,
+    lib: {
+      entry: "src/web/sw.ts",
+      formats: ["es"],
+      fileName: () => "sw.js",
+    },
+    rollupOptions: {
+      output: { entryFileNames: "sw.js" },
+    },
+  },
+});

package/worker/index.ts

@@ -0,0 +1,47 @@
+import { validateToken } from "../src/shared/token";
+import { Room } from "./room";
+
+export { Room };
+
+interface Env {
+  ROOM: DurableObjectNamespace;
+}
+
+const CORS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET,OPTIONS",
+  "Access-Control-Allow-Headers": "*",
+};
+
+export default {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    const url = new URL(request.url);
+
+    if (request.method === "OPTIONS") {
+      return new Response(null, { headers: CORS });
+    }
+
+    // GET /room/:token  -> WebSocket upgrade routed to the per-token DO.
+    const match = url.pathname.match(/^\/room\/([^/]+)\/?$/);
+    if (match) {
+      const token = decodeURIComponent(match[1]);
+      // Authoritative gate: reject weak tokens here so a patched CLI/browser
+      // can't open a room with a guessable bearer secret.
+      const check = validateToken(token);
+      if (!check.ok) {
+        return new Response(`weak token: ${check.reason}`, { status: 400, headers: CORS });
+      }
+      const id = env.ROOM.idFromName(token);
+      const stub = env.ROOM.get(id);
+      return stub.fetch(request);
+    }
+
+    if (url.pathname === "/" || url.pathname === "/health") {
+      return new Response(JSON.stringify({ ok: true, service: "codehost-signal" }), {
+        headers: { "content-type": "application/json", ...CORS },
+      });
+    }
+
+    return new Response("not found", { status: 404, headers: CORS });
+  },
+};

package/worker/room.ts

@@ -0,0 +1,179 @@
+import type {
+  ClientMessage,
+  PeerInfo,
+  PeerMeta,
+  Role,
+  ServerMessage,
+} from "../src/shared/signaling";
+
+interface Attachment {
+  peerId: string;
+  role: Role;
+  meta: PeerMeta | null;
+  /** Wall-clock ms of the last message from this socket (hello / ping / signal). */
+  lastSeen: number;
+}
+
+/** How often the room scans for dead sockets, and how long a socket may go
+ *  silent before eviction. Clients heartbeat every ~10s; allow ~3 misses, so a
+ *  crashed peer drops out within ~35-50s instead of lingering as a phantom. */
+const SWEEP_MS = 15_000;
+const STALE_MS = 35_000;
+
+/**
+ * One Durable Object instance per token-room. Holds the live WebSocket
+ * connections, keeps a registry of who is present, and relays WebRTC signals
+ * between peers. Uses the WebSocket Hibernation API so idle rooms cost nothing.
+ */
+export class Room implements DurableObject {
+  private state: DurableObjectState;
+
+  constructor(state: DurableObjectState) {
+    this.state = state;
+  }
+
+  async fetch(request: Request): Promise<Response> {
+    if (request.headers.get("Upgrade") !== "websocket") {
+      return new Response("expected websocket", { status: 426 });
+    }
+    const pair = new WebSocketPair();
+    const [client, server] = Object.values(pair);
+    // Hibernatable accept: the DO can be evicted between messages and revived
+    // on the next event, with serializeAttachment surviving across hibernation.
+    this.state.acceptWebSocket(server);
+    return new Response(null, { status: 101, webSocket: client });
+  }
+
+  async webSocketMessage(ws: WebSocket, raw: string | ArrayBuffer): Promise<void> {
+    let msg: ClientMessage;
+    try {
+      msg = JSON.parse(typeof raw === "string" ? raw : new TextDecoder().decode(raw));
+    } catch {
+      return;
+    }
+
+    if (msg.type === "hello") {
+      const att: Attachment = {
+        peerId: msg.peerId,
+        role: msg.role,
+        meta: msg.meta ?? null,
+        lastSeen: Date.now(),
+      };
+      ws.serializeAttachment(att);
+      this.send(ws, { type: "welcome", peerId: msg.peerId });
+      this.broadcastPeers();
+      void this.ensureSweep();
+      return;
+    }
+
+    if (msg.type === "ping") {
+      this.touch(ws);
+      return;
+    }
+
+    if (msg.type === "signal") {
+      const att = this.touch(ws);
+      if (!att) return;
+      const target = this.findByPeerId(msg.to);
+      if (target) {
+        this.send(target, { type: "signal", from: att.peerId, data: msg.data });
+      }
+      return;
+    }
+  }
+
+  /** Periodic sweep: evict sockets that stopped heart-beating. Covers daemons
+   *  killed with `kill -9`, whose WebSocket lingers in the room until the edge
+   *  notices the dead TCP connection — otherwise they show as phantom servers. */
+  async alarm(): Promise<void> {
+    const now = Date.now();
+    let evicted = false;
+    for (const ws of this.state.getWebSockets()) {
+      const att = this.attachment(ws);
+      if (att && now - att.lastSeen > STALE_MS) {
+        try {
+          ws.close(1001, "stale");
+        } catch {
+          // already closing
+        }
+        evicted = true;
+      }
+    }
+    if (evicted) this.broadcastPeers();
+    // Keep sweeping while anyone is connected; let idle rooms go quiet.
+    if (this.state.getWebSockets().length > 0) {
+      await this.state.storage.setAlarm(now + SWEEP_MS);
+    }
+  }
+
+  async webSocketClose(ws: WebSocket): Promise<void> {
+    try {
+      ws.close();
+    } catch {
+      // already closing
+    }
+    this.broadcastPeers();
+  }
+
+  async webSocketError(ws: WebSocket): Promise<void> {
+    this.broadcastPeers();
+  }
+
+  // ---- helpers ----
+
+  private attachment(ws: WebSocket): Attachment | null {
+    return (ws.deserializeAttachment() as Attachment | null) ?? null;
+  }
+
+  /** Refresh a socket's liveness timestamp; returns its attachment if known. */
+  private touch(ws: WebSocket): Attachment | null {
+    const att = this.attachment(ws);
+    if (!att) return null;
+    att.lastSeen = Date.now();
+    ws.serializeAttachment(att);
+    return att;
+  }
+
+  /** Arm the sweep alarm if one isn't already pending. */
+  private async ensureSweep(): Promise<void> {
+    if ((await this.state.storage.getAlarm()) == null) {
+      await this.state.storage.setAlarm(Date.now() + SWEEP_MS);
+    }
+  }
+
+  private findByPeerId(peerId: string): WebSocket | null {
+    for (const ws of this.state.getWebSockets()) {
+      if (this.attachment(ws)?.peerId === peerId) return ws;
+    }
+    return null;
+  }
+
+  private peerList(): PeerInfo[] {
+    const peers: PeerInfo[] = [];
+    for (const ws of this.state.getWebSockets()) {
+      const att = this.attachment(ws);
+      if (att) peers.push({ peerId: att.peerId, role: att.role, meta: att.meta });
+    }
+    return peers;
+  }
+
+  private broadcastPeers(): void {
+    const message: ServerMessage = { type: "peers", peers: this.peerList() };
+    const payload = JSON.stringify(message);
+    for (const ws of this.state.getWebSockets()) {
+      try {
+        ws.send(payload);
+      } catch {
+        // socket gone; will be cleaned up on close
+      }
+    }
+  }
+
+  private send(ws: WebSocket, message: ServerMessage): void {
+    try {
+      ws.send(JSON.stringify(message));
+    } catch {
+      // ignore
+    }
+  }
+}

package/worker/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ESNext",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ESNext"],
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "types": ["@cloudflare/workers-types"]
+  },
+  "include": ["**/*.ts", "../src/shared/signaling.ts", "../src/shared/token.ts"]
+}

package/worker/wrangler.jsonc

@@ -0,0 +1,18 @@
+{
+  "$schema": "node_modules/wrangler/config-schema.json",
+  "name": "codehost-signal",
+  "main": "index.ts",
+  "compatibility_date": "2025-01-01",
+  "account_id": "0beef4cd2d2da6befa47d8d149d6e157",
+  "observability": { "enabled": true },
+  "durable_objects": {
+    "bindings": [{ "name": "ROOM", "class_name": "Room" }]
+  },
+  // SQLite-backed Durable Objects are available on the Workers free plan.
+  "migrations": [{ "tag": "v1", "new_sqlite_classes": ["Room"] }],
+  // The page derives its signaling URL as wss://signal.<page host>, so the
+  // Worker is served on signal.codehost.dev via a custom-domain route. This is
+  // already provisioned in Cloudflare; re-reconciling it needs a Zone-scoped
+  // token, so it's left out of routine deploys (uncomment for first setup).
+  // "routes": [{ "pattern": "signal.codehost.dev", "custom_domain": true }]
+}