create-windy 0.8.3 → 0.10.0

package/template/apps/server/src/system/role-authorization-postgres.integration.test.ts

@@ -0,0 +1,181 @@
+// @windy-module system.agent begin
+import {
+  afterAll,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "bun:test";
+import { resolve } from "node:path";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { migrate } from "drizzle-orm/node-postgres/migrator";
+import { Pool } from "pg";
+import { agentSourceInvalidations } from "@southwind-ai/database";
+import { createFoundationSnapshot } from "../foundation.js";
+import type { RequestActor } from "../guards.js";
+import { createSystemRepositories } from "./seed.js";
+import { UserAccountPolicy } from "./user-account-policy.js";
+import { invalidateActorAuthorization } from "../agent/session-invalidation/authorization-revocation.js";
+import { ModuleAuthoritativeSourceAccessRegistry } from "../agent/context-memory/authoritative-source-registry.js";
+import { DrizzleSessionInvalidationOutbox } from "../agent/session-persistence/drizzle-invalidation-outbox.js";
+
+const databaseUrl = process.env.ORGANIZATION_TEST_DATABASE_URL;
+const describePostgres = databaseUrl ? describe : describe.skip;
+const originalPermissions = ["home.read", "case.read"];
+const nextPermissions = [
+  ...originalPermissions,
+  "intelligence.read",
+  "analysis.overview.read",
+];
+const actor: RequestActor = {
+  id: "role-test-admin",
+  type: "user",
+  name: "测试管理员",
+  roleCodes: ["super-admin"],
+  permissionKeys: ["system.role.manage"],
+};
+
+describePostgres("角色更新与 Agent 失效事件原子提交", () => {
+  let pool: Pool;
+  let repositories: ReturnType<typeof createSystemRepositories>;
+  let policy: UserAccountPolicy;
+  let failAfterPublish = false;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    await migrate(drizzle(pool), {
+      migrationsFolder: resolve(
+        import.meta.dir,
+        "../../../../packages/database/drizzle",
+      ),
+      migrationsSchema: "public",
+      migrationsTable: "__organization_test_migrations",
+    });
+  });
+  beforeEach(async () => {
+    await pool.query(
+      "truncate table users, roles, departments, agent_source_invalidations cascade",
+    );
+    const db = drizzle(pool);
+    repositories = createSystemRepositories(createFoundationSnapshot(), { db });
+    await repositories.departments.all();
+    await repositories.roles.create(
+      {
+        id: "test-role",
+        code: "demo.leader",
+        name: "测试领导",
+        dataScope: "department-and-children",
+        departmentIds: [],
+        permissionKeys: originalPermissions,
+      },
+      actor,
+    );
+    await repositories.users.create(
+      {
+        id: "test-officer",
+        username: "test-officer",
+        displayName: "测试用户",
+        departmentId: "dept_platform",
+        roleIds: ["test-role"],
+      },
+      actor,
+    );
+    const sources = new ModuleAuthoritativeSourceAccessRegistry([
+      {
+        moduleKey: "system.agent",
+        access: {
+          authorizeCurrent: async () => ({
+            outcome: "denied",
+            reason: "authorization-revoked",
+          }),
+        },
+      },
+    ]);
+    const outbox = new DrizzleSessionInvalidationOutbox(db);
+    failAfterPublish = false;
+    policy = new UserAccountPolicy(
+      repositories.users,
+      repositories.roles,
+      undefined,
+      {
+        async publish(event) {
+          const database =
+            repositories.organizationTransaction?.currentDatabase();
+          if (!database) throw new Error("missing organization transaction");
+          // 固定复现日志中的毫秒值；第二次更新也使用该时间，验证 latest + 1。
+          await invalidateActorAuthorization(
+            { ...event, occurredAt: "2026-11-06T15:34:43.424Z", database },
+            sources,
+            outbox,
+          );
+          if (failAfterPublish) throw new Error("forced transaction failure");
+        },
+      },
+    );
+  });
+  afterAll(async () => {
+    await pool?.end();
+  });
+
+  async function updatePermissions(permissionKeys: string[]) {
+    return repositories.organizationMutationRunner.run(async () => {
+      const current = await repositories.roles.get("test-role");
+      if (!current) throw new Error("missing role");
+      const updated = await repositories.roles.update(
+        current.id,
+        { permissionKeys },
+        actor,
+      );
+      if (!updated) throw new Error("missing updated role");
+      await policy.afterRoleUpdate(current, updated);
+      return updated;
+    });
+  }
+
+  test("现实时钟下增加、撤回权限均保存，并按 number 精确读取单调序号", async () => {
+    await updatePermissions(nextPermissions);
+    expect((await repositories.roles.get("test-role"))?.permissionKeys).toEqual(
+      nextPermissions,
+    );
+    await updatePermissions(originalPermissions);
+    const rows = await drizzle(pool)
+      .select()
+      .from(agentSourceInvalidations)
+      .orderBy(agentSourceInvalidations.sequence);
+    expect(rows.map(({ sequence }) => sequence)).toEqual([
+      1793979283424, 1793979283425,
+    ]);
+    expect(rows.every(({ cause }) => cause === "authorization-revoked")).toBe(
+      true,
+    );
+    const deliveries = await pool.query(
+      "select count(*)::int as count from agent_source_invalidation_deliveries",
+    );
+    expect(deliveries.rows[0].count).toBeGreaterThan(0);
+    expect((await repositories.roles.get("test-role"))?.permissionKeys).toEqual(
+      originalPermissions,
+    );
+  });
+
+  test("事件追加后发生错误仍同时回滚角色和 outbox", async () => {
+    failAfterPublish = true;
+    await expect(updatePermissions(nextPermissions)).rejects.toThrow(
+      "forced transaction failure",
+    );
+    expect((await repositories.roles.get("test-role"))?.permissionKeys).toEqual(
+      originalPermissions,
+    );
+    expect(await drizzle(pool).select().from(agentSourceInvalidations)).toEqual(
+      [],
+    );
+    expect(
+      (
+        await pool.query(
+          "select count(*)::int as count from agent_source_invalidation_deliveries",
+        )
+      ).rows[0].count,
+    ).toBe(0);
+  });
+});
+// @windy-module system.agent end

package/template/apps/web/Dockerfile

@@ -1,15 +1,23 @@
 # syntax=docker/dockerfile:1
 
-FROM oven/bun:1.3.14-alpine AS deps
+ARG WINDY_NODE_IMAGE=node:24.7.0-alpine
+ARG WINDY_WEB_BUN_IMAGE=oven/bun:1.3.14-alpine
+
+FROM ${WINDY_NODE_IMAGE} AS node
+
+FROM ${WINDY_WEB_BUN_IMAGE} AS deps
+COPY --from=node /usr/local/bin/node /usr/local/bin/node
 WORKDIR /app
 
 COPY package.json bun.lock ./
 COPY windy.modules.json windy.modules.json
 # windy-copy:deps begin
+COPY apps/agent-server/package.json apps/agent-server/package.json
 COPY apps/license/package.json apps/license/package.json
 COPY apps/server/package.json apps/server/package.json
 COPY apps/signing-service/package.json apps/signing-service/package.json
 COPY apps/web/package.json apps/web/package.json
+COPY apps/windy-gateway/package.json apps/windy-gateway/package.json
 COPY packages/ai-client/package.json packages/ai-client/package.json
 COPY packages/config/package.json packages/config/package.json
 COPY packages/create-windy/package.json packages/create-windy/package.json
@@ -19,12 +27,14 @@ COPY packages/delivery/package.json packages/delivery/package.json
 COPY packages/example-work-order/package.json packages/example-work-order/package.json
 COPY packages/jobs/package.json packages/jobs/package.json
 COPY packages/license-sdk/package.json packages/license-sdk/package.json
+COPY packages/model-gateway/package.json packages/model-gateway/package.json
 COPY packages/modules/package.json packages/modules/package.json
 COPY packages/server-sdk/package.json packages/server-sdk/package.json
 COPY packages/shared/package.json packages/shared/package.json
 COPY packages/storage/package.json packages/storage/package.json
 # windy-copy:deps end
-RUN --mount=type=cache,id=windy-bun-1.3.14,target=/root/.bun/install/cache,sharing=shared bun -e 'const child=Bun.spawn(["bun","install","--frozen-lockfile","--no-progress","--backend=copyfile","--linker=hoisted","--ignore-scripts"],{stdin:"inherit",stdout:"inherit",stderr:"inherit"});const heartbeat=setInterval(()=>console.log("[windy] Bun 依赖安装仍在进行"),15000);const exitCode=await child.exited;clearInterval(heartbeat);process.exit(exitCode)' && bun --cwd apps/server -e 'await import("argon2")'
+ARG WINDY_NPM_REGISTRY=https://registry.npmjs.org
+RUN --mount=type=cache,id=windy-bun-1.3.14,target=/root/.bun/install/cache,sharing=shared bun -e 'const child=Bun.spawn(["bun","install","--frozen-lockfile","--no-progress","--filter","*","--filter","!./apps/agent-server","--registry",process.env.WINDY_NPM_REGISTRY||"https://registry.npmjs.org","--backend=copyfile","--linker=hoisted","--ignore-scripts"],{stdin:"inherit",stdout:"inherit",stderr:"inherit"});const started=Date.now();const heartbeat=setInterval(()=>console.log("[windy] Bun 依赖安装尚未完成，已耗时 "+Math.round((Date.now()-started)/1000)+" 秒"),15000);const deadline=setTimeout(()=>{console.error("[windy] Bun 安装超过 300 秒，请检查 npm 下载网络或通过 WINDY_NPM_REGISTRY 指定可用源");child.kill("SIGKILL")},300000);const exitCode=await child.exited;clearInterval(heartbeat);clearTimeout(deadline);process.exit(exitCode)' && bun --cwd apps/server -e 'await import("argon2")'
 
 FROM deps AS build
 # windy-copy:build begin
@@ -39,12 +49,14 @@ COPY packages/storage packages/storage
 # windy-copy:build end
 # Bun 1.3.14 on Linux resolves Vite's relative imports from the .bin symlink
 # instead of its real package entry. Execute the immutable hoisted entry directly.
-RUN cd apps/web && bun ../../node_modules/vite/bin/vite.js build
+RUN cd apps/web && node ../../node_modules/vite/bin/vite.js build
 
 FROM deps AS runner
 COPY apps/web/package.json apps/web/package.json
 COPY apps/web/server.ts apps/web/server.ts
 COPY apps/web/runtime-server.ts apps/web/runtime-server.ts
+COPY apps/web/dsh-workbench-proxy.ts apps/web/dsh-workbench-proxy.ts
+COPY apps/web/dsh-workbench-location.ts apps/web/dsh-workbench-location.ts
 COPY packages/shared packages/shared
 COPY --from=build /app/apps/web/dist apps/web/dist
 ENV NODE_ENV=production

package/template/apps/web/dev/dev-port.test.ts

@@ -3,26 +3,26 @@ import { selectDevPort, type PortState } from "./dev-port";
 import { windyDevIdentity } from "./dev-identity";
 
 describe("Windy 本地开发端口", () => {
-  test("默认选择 8746", async () => {
+  test("默认选择 28746", async () => {
     const result = await selectDevPort({
       fingerprint: "project-a",
       inspect: async () => ({ kind: "available" }),
     });
 
-    expect(result).toEqual({ kind: "selected", port: 8_746 });
+    expect(result).toEqual({ kind: "selected", port: 28_746 });
   });
 
   test("外部服务或其他 Windy 项目占用时自动递增", async () => {
     const states = new Map<number, PortState>([
-      [8_746, { kind: "occupied" }],
-      [8_747, { kind: "occupied", identity: windyDevIdentity("project-b") }],
+      [28_746, { kind: "occupied" }],
+      [28_747, { kind: "occupied", identity: windyDevIdentity("project-b") }],
     ]);
     const result = await selectDevPort({
       fingerprint: "project-a",
       inspect: async (port) => states.get(port) || { kind: "available" },
     });
 
-    expect(result).toEqual({ kind: "selected", port: 8_748 });
+    expect(result).toEqual({ kind: "selected", port: 28_748 });
   });
 
   test("检测到同一项目时返回已有地址而不启动重复服务", async () => {
@@ -34,7 +34,7 @@ describe("Windy 本地开发端口", () => {
       }),
     });
 
-    expect(result).toEqual({ kind: "existing", port: 8_746 });
+    expect(result).toEqual({ kind: "existing", port: 28_746 });
   });
 
   test("最多扫描 100 个端口", async () => {

package/template/apps/web/dev/dev-port.ts

@@ -1,6 +1,6 @@
 import { isWindyDevIdentity, type WindyDevIdentity } from "./dev-identity";
 
-export const DEFAULT_DEV_PORT = 8_746;
+export const DEFAULT_DEV_PORT = 28_746;
 export const DEV_PORT_SCAN_LIMIT = 100;
 
 export type PortState =

package/template/apps/web/dev/start.ts

@@ -1,8 +1,12 @@
+import { dirname, join } from "node:path";
+import { createRequire } from "node:module";
 import { projectFingerprint } from "./dev-identity";
 import { selectDevPort } from "./dev-port";
 
 const fingerprint = projectFingerprint(process.cwd());
-const configuredPort = parseConfiguredPort(process.env.WINDY_DEV_PORT);
+const configuredPort = parseConfiguredPort(
+  process.env.WINDY_DEV_PORT ?? process.env.WINDY_WEB_PORT,
+);
 const selection = configuredPort
   ? { kind: "selected" as const, port: configuredPort }
   : await selectDevPort({ fingerprint });
@@ -14,17 +18,29 @@ if (selection.kind === "existing") {
 }
 
 console.info(`启动 Windy Web：${url}`);
-const child = Bun.spawn(["bunx", "--bun", "vite"], {
-  cwd: process.cwd(),
-  env: {
-    ...process.env,
-    WINDY_DEV_PORT: String(selection.port),
-    WINDY_DEV_FINGERPRINT: fingerprint,
+const child = Bun.spawn(
+  [
+    "node",
+    join(
+      dirname(createRequire(import.meta.url).resolve("vite/package.json")),
+      "bin/vite.js",
+    ),
+  ],
+  {
+    cwd: process.cwd(),
+    env: {
+      ...process.env,
+      WINDY_DEV_PORT: String(selection.port),
+      API_UPSTREAM:
+        process.env.API_UPSTREAM ??
+        `http://127.0.0.1:${process.env.WINDY_SERVER_PORT ?? "19747"}`,
+      WINDY_DEV_FINGERPRINT: fingerprint,
+    },
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
   },
-  stdin: "inherit",
-  stdout: "inherit",
-  stderr: "inherit",
-});
+);
 process.exit(await child.exited);
 
 function parseConfiguredPort(value: string | undefined): number | undefined {

package/template/apps/web/dsh-workbench-location.ts

@@ -0,0 +1,21 @@
+/** The pairing and one-use handoff pages remain owned by the product SPA. */
+export function isDshWorkbenchPath(path: string): boolean {
+  const url = new URL(path, "http://web.internal");
+  if (url.pathname === "/agent" || url.pathname === "/agent/")
+    return !url.searchParams.has("handoff");
+  return (
+    url.pathname.startsWith("/agent/") &&
+    url.pathname !== "/agent/connect" &&
+    !url.pathname.startsWith("/agent/connect/")
+  );
+}
+
+export function dshWorkbenchProxyPath(path: string): string {
+  return path.replace(/^\/agent(?:\/|(?=\?|$))/, "/api/agent/native/");
+}
+
+export function dshWorkbenchLoginPath(path: string): string | undefined {
+  const url = new URL(path, "http://web.internal");
+  if (url.pathname !== "/agent" && url.pathname !== "/agent/") return;
+  return `/login?returnTo=${encodeURIComponent(`${url.pathname}${url.search}`)}`;
+}

package/template/apps/web/dsh-workbench-proxy.test.ts

@@ -0,0 +1,121 @@
+import { expect, test } from "bun:test";
+import {
+  dshWorkbenchProxyPath,
+  isDshWorkbenchPath,
+} from "./dsh-workbench-location";
+import { createDshWebProxy } from "./dsh-workbench-proxy";
+
+test("native mount accepts the bare entry and preserves pairing and handoff in the SPA", () => {
+  for (const path of [
+    "/agent",
+    "/agent/",
+    "/agent?session=abc",
+    "/agent/assets/a.js",
+  ])
+    expect(isDshWorkbenchPath(path)).toBe(true);
+  for (const path of [
+    "/agent/connect",
+    "/agent/connect?pairing=abc",
+    "/agent/connect/",
+    "/agent?handoff=one-use",
+    "/agent/?handoff=one-use",
+    "/agents",
+  ])
+    expect(isDshWorkbenchPath(path)).toBe(false);
+  expect(dshWorkbenchProxyPath("/agent")).toBe("/api/agent/native/");
+  expect(dshWorkbenchProxyPath("/agent?session=abc")).toBe(
+    "/api/agent/native/?session=abc",
+  );
+  expect(dshWorkbenchProxyPath("/agent/assets/a.js")).toBe(
+    "/api/agent/native/assets/a.js",
+  );
+});
+
+test("production entry serves the native document directly and retains login redirects", async () => {
+  const requests: Request[] = [];
+  const upstream = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    fetch(request) {
+      requests.push(new Request(request.url, { headers: request.headers }));
+      return request.headers.has("cookie")
+        ? new Response("<html>DSH</html>", {
+            headers: { "content-type": "text/html" },
+          })
+        : Response.json({ error: "UNAUTHENTICATED" }, { status: 401 });
+    },
+  });
+  try {
+    const proxy = createDshWebProxy(upstream.url.origin);
+    const server = {} as Parameters<typeof proxy.fetch>[1];
+    const response = await proxy.fetch(
+      new Request("https://windy.test/agent?session=abc", {
+        headers: { cookie: "windy.sid=fixture", "x-windy-actor-id": "forged" },
+      }),
+      server,
+    );
+    expect(response?.status).toBe(200);
+    expect(response?.headers.get("location")).toBeNull();
+    expect(await response?.text()).toBe("<html>DSH</html>");
+    expect(new URL(requests[0]!.url).pathname).toBe("/api/agent/native/");
+    expect(new URL(requests[0]!.url).search).toBe("?session=abc");
+    expect(requests[0]!.headers.get("x-windy-actor-id")).toBeNull();
+    const anonymous = await proxy.fetch(
+      new Request("https://windy.test/agent"),
+      server,
+    );
+    expect(anonymous?.status).toBe(302);
+    expect(anonymous?.headers.get("location")).toBe("/login?returnTo=%2Fagent");
+    const api = await proxy.fetch(
+      new Request("https://windy.test/agent/api/status"),
+      server,
+    );
+    expect(api?.status).toBe(401);
+  } finally {
+    await upstream.stop(true);
+  }
+});
+
+test("production skill generation survives short default idle timeout and strips private browser headers", async () => {
+  let received: Request | undefined;
+  const upstream = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    idleTimeout: 10,
+    async fetch(request) {
+      received = request;
+      const body = await request.json();
+      expect(body).toEqual({ action: "draft", workflow: "整理材料" });
+      await new Promise((resolve) => setTimeout(resolve, 3100));
+      return Response.json({ draft: { name: "synthetic" } });
+    },
+  });
+  const proxy = createDshWebProxy(upstream.url.origin);
+  const web = Bun.serve({
+    hostname: "127.0.0.1",
+    port: 0,
+    idleTimeout: 1,
+    fetch: proxy.fetch,
+    websocket: proxy.websocket,
+  });
+  try {
+    const response = await fetch(new URL("/agent/windy/skills", web.url), {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        "x-windy-skill-draft-complete": "1",
+      },
+      body: JSON.stringify({ action: "draft", workflow: "整理材料" }),
+      signal: AbortSignal.timeout(10_000),
+    });
+    expect(response.status).toBe(200);
+    expect(await response.json()).toEqual({ draft: { name: "synthetic" } });
+    expect(new URL(received!.url).pathname).toBe(
+      "/api/agent/native/windy/skills",
+    );
+    expect(received!.headers.has("x-windy-skill-draft-complete")).toBe(false);
+  } finally {
+    await web.stop(true);
+    await upstream.stop(true);
+  }
+});

package/template/apps/web/dsh-workbench-proxy.ts

@@ -0,0 +1,194 @@
+import WebSocket from "ws";
+import type { Server, ServerWebSocket } from "bun";
+import {
+  dshWorkbenchLoginPath,
+  dshWorkbenchProxyPath,
+} from "./dsh-workbench-location";
+export { isDshWorkbenchPath } from "./dsh-workbench-location";
+
+export interface DshWebSocketState {
+  readonly upstream: WebSocket;
+  readonly pending: (string | Uint8Array)[];
+  client?: ServerWebSocket<DshWebSocketState>;
+  bufferedBytes: number;
+  closed: boolean;
+}
+
+export function createDshWebProxy(apiUpstream?: string) {
+  const target = (request: Request) => {
+    if (!apiUpstream) throw new Error("API_UPSTREAM_NOT_CONFIGURED");
+    const url = new URL(request.url);
+    return new URL(
+      dshWorkbenchProxyPath(`${url.pathname}${url.search}`),
+      apiUpstream,
+    );
+  };
+  return {
+    async fetch(
+      request: Request,
+      server: Server<DshWebSocketState>,
+    ): Promise<Response | undefined> {
+      try {
+        const url = target(request);
+        const headers = new Headers(request.headers);
+        for (const name of [
+          "host",
+          "connection",
+          "content-length",
+          "upgrade",
+          "sec-websocket-key",
+          "sec-websocket-version",
+          "sec-websocket-extensions",
+        ])
+          headers.delete(name);
+        // Bun builds the API request URL from Host. Keep the browser authority
+        // for HTTP LAN deployments without a fixed public base URL, while the
+        // network destination remains the configured API upstream.
+        headers.set("host", new URL(request.url).host);
+        headers.delete("forwarded");
+        headers.delete("x-forwarded-host");
+        headers.delete("x-forwarded-proto");
+        const privateHeaders: string[] = [];
+        headers.forEach((_value, name) => {
+          if (name.startsWith("x-windy-")) privateHeaders.push(name);
+        });
+        for (const name of privateHeaders) headers.delete(name);
+        if (request.headers.get("upgrade")?.toLowerCase() !== "websocket") {
+          const skillRequest =
+            request.method === "POST" &&
+            new URL(request.url).pathname === "/agent/windy/skills";
+          if (skillRequest) server.timeout(request, 120);
+          const response = await fetch(url, {
+            method: request.method,
+            headers,
+            body: ["GET", "HEAD"].includes(request.method)
+              ? undefined
+              : request.body,
+            redirect: "manual",
+            signal: skillRequest
+              ? AbortSignal.any([request.signal, AbortSignal.timeout(115_000)])
+              : request.signal,
+          });
+          const login = dshWorkbenchLoginPath(request.url);
+          if (response.status === 401 && login) {
+            await response.body?.cancel();
+            return new Response(null, {
+              status: 302,
+              headers: { location: login, "cache-control": "no-store" },
+            });
+          }
+          return response;
+        }
+        if (new URL(request.url).pathname !== "/agent/api/remote.mux")
+          return unavailable(404);
+        url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
+        const upstream = new WebSocket(url, { headers: headerRecord(headers) });
+        upstream.binaryType = "arraybuffer";
+        const state: DshWebSocketState = {
+          upstream,
+          pending: [],
+          bufferedBytes: 0,
+          closed: false,
+        };
+        upstream.addEventListener("message", (event) => {
+          const frame =
+            typeof event.data === "string"
+              ? event.data
+              : new Uint8Array(event.data as ArrayBuffer);
+          if (state.client) {
+            if (state.client.send(frame) === 0) close(state, 1013);
+          } else {
+            state.bufferedBytes +=
+              typeof frame === "string"
+                ? Buffer.byteLength(frame)
+                : frame.byteLength;
+            if (state.bufferedBytes > 2_097_152 || state.pending.length >= 128)
+              return close(state, 1013);
+            state.pending.push(frame);
+          }
+        });
+        upstream.addEventListener("close", (event) => {
+          const code = event.code === 1008 ? 1008 : 1011;
+          close(state, code);
+        });
+        const opened = await new Promise<boolean>((resolve) => {
+          const timeout = setTimeout(() => {
+            upstream.close();
+            resolve(false);
+          }, 10_000);
+          const settle = (ok: boolean) => {
+            clearTimeout(timeout);
+            resolve(ok);
+          };
+          upstream.addEventListener("open", () => settle(true), { once: true });
+          upstream.addEventListener("error", () => settle(false), {
+            once: true,
+          });
+          upstream.addEventListener("close", () => settle(false), {
+            once: true,
+          });
+        });
+        if (!opened) {
+          close(state);
+          return unavailable(503);
+        }
+        if (server.upgrade(request, { data: state })) return;
+        close(state);
+        return unavailable(400);
+      } catch {
+        return unavailable(503);
+      }
+    },
+    websocket: {
+      open(client: ServerWebSocket<DshWebSocketState>) {
+        const state = client.data;
+        state.client = client;
+        if (state.upstream.readyState !== WebSocket.OPEN)
+          return close(state, 1011);
+        for (const frame of state.pending)
+          if (client.send(frame) === 0) return close(state, 1013);
+        state.pending.length = 0;
+        state.bufferedBytes = 0;
+      },
+      message(
+        client: ServerWebSocket<DshWebSocketState>,
+        message: string | Buffer,
+      ) {
+        const { upstream } = client.data;
+        if (
+          upstream.readyState !== WebSocket.OPEN ||
+          upstream.bufferedAmount > 8_388_608
+        )
+          return close(client.data, 1013);
+        upstream.send(message);
+      },
+      close(client: ServerWebSocket<DshWebSocketState>) {
+        client.data.closed = true;
+        client.data.pending.length = 0;
+        client.data.upstream.close();
+      },
+    },
+  };
+}
+
+function close(state: DshWebSocketState, code = 1000) {
+  if (state.closed) return;
+  state.closed = true;
+  state.pending.length = 0;
+  state.upstream.close();
+  state.client?.close(code, "Agent disconnected");
+}
+function unavailable(status: number) {
+  return Response.json(
+    { error: "AGENT_UNAVAILABLE" },
+    { status, headers: { "cache-control": "no-store" } },
+  );
+}
+
+function headerRecord(headers: Headers): Record<string, string> {
+  const record: Record<string, string> = {};
+  headers.forEach((value, name) => {
+    record[name] = value;
+  });
+  return record;
+}