dsh-builtin-browser 0.1.22 → 0.2.0

package/lib/browser-electron/virtual-cursor.js

@@ -0,0 +1,71 @@
+/**
+ * Synthetic pointer feedback for a human watching the tab: an overlay drawn
+ * INSIDE the page, never the real system pointer. Its presence is the "the agent
+ * has taken over this tab" signal, so it also covers DOM-level operations that
+ * move no pointer at all.
+ *
+ * Implementation notes that matter:
+ * - The overlay is `position: fixed` and positioned from viewport coordinates,
+ *   which is exactly what the element locator already computes and what
+ *   `Input.dispatchMouseEvent` consumes.
+ * - All styling is inline and the ripple uses the Web Animations API: a
+ *   `<style>` element would be subject to the page's `style-src` CSP, an
+ *   injected script is not. Injected page feedback must never be silently
+ *   dropped by a strict CSP.
+ * - Every call is best-effort: feedback is never allowed to fail an operation.
+ * @module dsh-browser/browser-electron/virtual-cursor
+ */
+/** Element id of the overlay root, stable so repeat calls update one node. */
+const CURSOR_ID = '__dsh_agent_cursor__';
+/**
+ * The in-page expression that materializes or moves the overlay. Idempotent: the
+ * first call creates the nodes, later calls only move them (and pulse).
+ * @param x - viewport x in CSS pixels.
+ * @param y - viewport y in CSS pixels.
+ * @param action - whether to pulse a click ripple at the point.
+ * @returns a self-contained expression that evaluates to `true`.
+ */
+export function cursorScript(x, y, action) {
+    return `(() => {
+  const id = ${JSON.stringify(CURSOR_ID)}
+  let root = document.getElementById(id)
+  if (!root) {
+    root = document.createElement('div')
+    root.id = id
+    root.setAttribute('aria-hidden', 'true')
+    root.style.cssText = 'position:fixed;left:0;top:0;width:0;height:0;z-index:2147483647;pointer-events:none;transition:transform 120ms ease-out;will-change:transform'
+    const svg = '<svg width="22" height="22" viewBox="0 0 22 22" style="position:absolute;left:-2px;top:-2px;filter:drop-shadow(0 1px 2px rgba(0,0,0,.45))">'
+      + '<path d="M4 2 L4 18 L8.4 13.8 L11.2 19.6 L13.8 18.4 L11 12.8 L17 12.6 Z" fill="#ffffff" stroke="#111111" stroke-width="1.4" stroke-linejoin="round"/></svg>'
+    const ripple = '<span style="position:absolute;left:0;top:0;width:34px;height:34px;margin:-17px 0 0 -17px;border-radius:50%;border:2px solid rgba(64,160,255,.9);opacity:0"></span>'
+    root.innerHTML = svg + ripple
+    ;(document.body || document.documentElement).appendChild(root)
+  }
+  root.style.transform = 'translate(${x}px, ${y}px)'
+  ${action === 'click' ? `const ripple = root.lastElementChild
+  if (ripple && typeof ripple.animate === 'function') {
+    ripple.animate(
+      [{ transform: 'scale(.25)', opacity: 0.95 }, { transform: 'scale(1.6)', opacity: 0 }],
+      { duration: 550, easing: 'ease-out' },
+    )
+  }` : ''}
+  return true
+})()`;
+}
+/**
+ * Draw (or move) the pointer overlay on one view's page.
+ *
+ * Fire-and-forget: a page that is mid-navigation, cross-origin-blocked, or
+ * otherwise unable to answer must not turn a successful operation into a
+ * failure, and the navigation that just committed may still be replacing the
+ * document this call would have painted into.
+ * @param handle - the view to paint into.
+ * @param x - viewport x in CSS pixels.
+ * @param y - viewport y in CSS pixels.
+ * @param action - whether to pulse a click ripple.
+ * @param evaluate - the provider's evaluate bridge (keeps the CDP coupling in one place).
+ */
+export function paintCursor(handle, x, y, action, evaluate) {
+    if (!Number.isFinite(x) || !Number.isFinite(y))
+        return;
+    void evaluate(handle, cursorScript(Math.round(x), Math.round(y), action)).catch(() => { });
+}

package/lib/index.d.ts

@@ -4,10 +4,24 @@
  *   - `dsh-builtin-browser/browser`          -> the ctx.browser seam (Service)
  *   - `dsh-builtin-browser/browser-electron` -> the Electron CDP provider
  *   - `dsh-builtin-browser/tool-browser`     -> the model-facing browser_* tools
- * This root entry only re-exports for programmatic use; the loader rows are
- * the composition surface.
+ * The capability itself is composed by those rows; this root entry exists for
+ * programmatic imports AND because the host's client-module scan identifies a
+ * package's browser half through a loader row whose specifier resolves to the
+ * PACKAGE ROOT. A row named after a subpath (`dsh-builtin-browser/browser`) is
+ * not a package specifier and is skipped by design, which is why the patch also
+ * registers a row under the bare package name — see cordis.patch.yml.
  * @module dsh-builtin-browser
  */
+/** Plugin identity for the root row (the composition surface is the subpath rows). */
+export declare const name = "dsh-builtin-browser";
+/**
+ * Inert application for the root row: the browser seam, the Electron provider and
+ * the tools are mounted by the subpath rows, so this one only exists to give the
+ * package a loader row named after the package itself. Without it the host's
+ * client scan finds no row to resolve `dsh.client` from, and the settings panel
+ * never reaches the browser (the plugin works, its client half is invisible).
+ */
+export declare function apply(): void;
 export { BrowserError } from './browser/types.js';
 export type { BrowserA11yNode, BrowserA11yRequest, BrowserA11yResult, BrowserChallenge, BrowserCheckRequest, BrowserClearRequest, BrowserClickRequest, BrowserContentFormat, BrowserContentRequest, BrowserContentResult, BrowserElementTarget, BrowserExecuteRequest, BrowserExecuteResult, BrowserFillField, BrowserFillRequest, BrowserFillResult, BrowserGetValueRequest, BrowserGetValueResult, BrowserNavigateRequest, BrowserOpenRequest, BrowserProvider, BrowserScrapeField, BrowserScrapeRequest, BrowserScrapeResult, BrowserScreenshotRequest, BrowserScreenshotResult, BrowserSelectRequest, BrowserSelectResult, BrowserSessionId, BrowserSetValueRequest, BrowserSetValueResult, BrowserSnapshotElement, BrowserSnapshotResult, BrowserTab, BrowserTypeRequest, ExportedCookie, } from './browser/types.js';
 export { BrowserRuntime } from './browser/runtime.js';

package/lib/index.js

@@ -4,10 +4,26 @@
  *   - `dsh-builtin-browser/browser`          -> the ctx.browser seam (Service)
  *   - `dsh-builtin-browser/browser-electron` -> the Electron CDP provider
  *   - `dsh-builtin-browser/tool-browser`     -> the model-facing browser_* tools
- * This root entry only re-exports for programmatic use; the loader rows are
- * the composition surface.
+ * The capability itself is composed by those rows; this root entry exists for
+ * programmatic imports AND because the host's client-module scan identifies a
+ * package's browser half through a loader row whose specifier resolves to the
+ * PACKAGE ROOT. A row named after a subpath (`dsh-builtin-browser/browser`) is
+ * not a package specifier and is skipped by design, which is why the patch also
+ * registers a row under the bare package name — see cordis.patch.yml.
  * @module dsh-builtin-browser
  */
+/** Plugin identity for the root row (the composition surface is the subpath rows). */
+export const name = 'dsh-builtin-browser';
+/**
+ * Inert application for the root row: the browser seam, the Electron provider and
+ * the tools are mounted by the subpath rows, so this one only exists to give the
+ * package a loader row named after the package itself. Without it the host's
+ * client scan finds no row to resolve `dsh.client` from, and the settings panel
+ * never reaches the browser (the plugin works, its client half is invisible).
+ */
+export function apply() {
+    // Intentionally empty: see the module comment above.
+}
 export { BrowserError } from './browser/types.js';
 export { BrowserRuntime } from './browser/runtime.js';
 export { ElectronBrowserProvider } from './browser-electron/provider.js';

package/lib/tool-browser/index.js

@@ -63,8 +63,13 @@ function taskKey(exec) {
  */
 async function ensureSession(browser, state, key, agent) {
     const existing = state.sessionsByTask.get(key);
-    if (existing !== undefined)
-        return existing;
+    if (existing !== undefined) {
+        // The human closing a browser window ends that session, so a cached id can
+        // be stale: never hand a dead session back to a tool call.
+        if (browser.exists(existing))
+            return existing;
+        state.sessionsByTask.delete(key);
+    }
     const pending = state.pendingOpens.get(key);
     if (pending !== undefined)
         return pending;
@@ -1285,6 +1290,71 @@ export function apply(ctx, config = {}) {
             return { entries: rendered };
         },
     }));
+    ctx.tools.register(defineTool({
+        name: 'browser_visited',
+        description: 'List pages the shared browser has visited, newest first, from the PERSISTENT browsing history: it survives closing the browser and restarting DSH, so it is how you (or the human) find a page again afterwards. Reopen one by passing its url to browser_open. Not to be confused with browser_history, which is only the current session\'s operation log (navigate/click/type) and disappears with the session.',
+        parameters: {
+            limit: { type: 'number', description: 'Maximum entries to return (default 30, capped at 200).' },
+            domain: { type: 'string', description: 'Only visits whose hostname contains this text (case-insensitive).' },
+        },
+        output: {
+            schema: {
+                type: 'object',
+                additionalProperties: false,
+                properties: {
+                    count: { type: 'number', required: true },
+                    entries: {
+                        type: 'array',
+                        required: true,
+                        items: {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                at: { type: 'number', required: true },
+                                url: { type: 'string', required: true },
+                                title: { type: 'string' },
+                                session: { type: 'string' },
+                            },
+                        },
+                    },
+                },
+            },
+            render: (_args, value) => {
+                const entries = value.entries;
+                if (entries.length === 0) {
+                    return [{ type: 'text', text: '(no recorded visits — nothing has been browsed yet, or history recording is turned off in settings)' }];
+                }
+                return [{
+                        type: 'text',
+                        text: entries.map(entry => {
+                            const when = new Date(entry.at).toISOString().replace('T', ' ').slice(0, 19);
+                            const title = entry.title !== undefined ? `${entry.title} — ` : '';
+                            return `${when}  ${title}${entry.url}${entry.session !== undefined ? `  [${entry.session}]` : ''}`;
+                        }).join('\n'),
+                    }];
+            },
+        },
+        timeoutMs,
+        isConcurrencySafe: () => true,
+        async execute(args, _exec) {
+            const browser = ctx.get('browser');
+            if (browser === undefined)
+                throw new Error('tool-browser: browser service unavailable');
+            const rawLimit = typeof args.limit === 'number' && Number.isFinite(args.limit) ? args.limit : 30;
+            const limit = Math.max(1, Math.min(200, Math.floor(rawLimit)));
+            const domain = typeof args.domain === 'string' && args.domain.trim() !== '' ? args.domain.trim() : undefined;
+            const entries = browser.visited({ limit, ...domain !== undefined ? { domain } : {} });
+            return {
+                count: entries.length,
+                entries: entries.map(entry => ({
+                    at: entry.at,
+                    url: entry.url,
+                    ...entry.title !== undefined ? { title: entry.title } : {},
+                    ...entry.session !== undefined ? { session: entry.session } : {},
+                })),
+            };
+        },
+    }));
     ctx.tools.register(defineTool({
         name: 'browser_replay',
         description: 'Replay one recorded browser operation by its history sequence number (from browser_history). Navigate/click/type are re-issued against the current page; execute re-runs its script. The replayed step is appended to history as a new entry.',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-builtin-browser",
-  "version": "0.1.22",
+  "version": "0.2.0",
   "description": "Shared real browser plugin for DeepSeek Harness: install-and-use — a visible native browser the human can take over, driven by the agent over CDP. DOM-level interaction (React/Vue safe), per-task session isolation, cookie persistence (browser_auth), CAPTCHA detection, batch form fill (browser_fill), authenticated download, history/replay, action restriction",
   "type": "module",
   "main": "lib/index.js",
@@ -25,6 +25,9 @@
     "./host-main": {
       "default": "./lib/browser-electron/host-main.js"
     },
+    "./client": {
+      "default": "./client.js"
+    },
     "./cordis.patch.yml": "./cordis.patch.yml",
     "./package.json": "./package.json"
   },
@@ -32,6 +35,7 @@
     "lib",
     "src",
     "docs",
+    "client.js",
     "cordis.patch.yml",
     "README.md",
     "README.en.md",
@@ -65,9 +69,9 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
-    "@deepseek-ai/dsh-llm": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-tools": "^0.1.1-rc.2",
-    "@deepseek-ai/dsh-system-prompt": "^0.1.1-rc.2",
+    "@deepseek-ai/dsh-llm": ">=0.1.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-tools": ">=0.1.1-rc.2 <0.3.0",
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.1-rc.2 <0.3.0",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "devDependencies": {
@@ -78,8 +82,16 @@
     "bundle": {
       "patch": "./cordis.patch.yml"
     },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-slots",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ]
+    },
     "compatibility": {
-      "dsh": ">=0.1.1-rc.1 <0.2.0",
+      "dsh": ">=0.1.1-rc.1 <0.3.0",
       "profiles": [
         "web",
         "desktop"
@@ -87,7 +99,9 @@
       "dshReleases": {
         "0.1.0-rc.8": "unknown",
         "0.1.1-rc.1": "compatible",
-        "0.1.1-rc.2": "compatible"
+        "0.1.1-rc.2": "compatible",
+        "0.2.0-rc.1": "compatible",
+        "0.2.0-rc.2": "compatible"
       }
     }
   }

package/src/browser/runtime.ts

@@ -47,6 +47,7 @@ import type {
   BrowserKeyRequest,
   BrowserChallenge,
   ExportedCookie,
+  VisitedPage,
 } from './types.js'
 import { BrowserError } from './types.js'
 
@@ -177,7 +178,21 @@ export class BrowserRuntime extends Service {
     const usable = [...providers.values()].filter(provider => provider.available())
     const [single] = usable
     if (single === undefined) {
-      throw new BrowserError('no usable browser provider is registered', 'BROWSER_PROVIDER_UNAVAILABLE')
+      // Two very different causes used to read identically here — nothing is
+      // registered, or something is registered but cannot run — and only the
+      // second one has a fix the user can apply without reinstalling.
+      const registered = [...providers.values()].map(provider => provider.id)
+      if (registered.length === 0) {
+        throw new BrowserError(
+          'no browser provider is registered — install a browser plugin (e.g. dsh-builtin-browser) and enable it in this profile',
+          'BROWSER_PROVIDER_UNAVAILABLE',
+        )
+      }
+      throw new BrowserError(
+        `browser provider(s) ${registered.join(', ')} are registered but report themselves unavailable — `
+        + 'for dsh-builtin-browser this means no spawnable Electron binary was found; run `npx install-electron` in the active profile or set ELECTRON_PATH',
+        'BROWSER_PROVIDER_UNAVAILABLE',
+      )
     }
     if (usable.length > 1) {
       const ids = usable.map(provider => provider.id).join(', ')
@@ -331,6 +346,27 @@ export class BrowserRuntime extends Service {
     return this.resolveProvider().history(session)
   }
 
+  /**
+   * Persisted visits, newest first — the record that outlives the browser
+   * process, as opposed to {@link history}'s session-scoped operation log.
+   * @param options - result cap and an optional hostname filter.
+   * @returns the retained visits (empty when history recording is disabled).
+   */
+  visited(options?: { readonly limit?: number; readonly domain?: string }): readonly VisitedPage[] {
+    return this.resolveProvider().visited(options)
+  }
+
+  /**
+   * Whether a session is still live. Sessions can end outside the tool layer
+   * (the human closed its window), so a cached id must be re-checked before
+   * reuse; a provider that does not implement the check counts as live.
+   * @param session - the session id to test.
+   */
+  exists(session: BrowserSessionId): boolean {
+    const provider = this.resolveProvider()
+    return provider.exists === undefined ? true : provider.exists(session)
+  }
+
   /** Replay one recorded operation by sequence number through the provider. */
   async replay(session: BrowserSessionId, seq: number): Promise<void> {
     return this.resolveProvider().replay(session, seq)

package/src/browser/types.ts

@@ -573,12 +573,43 @@ export interface BrowserProvider {
   restoreAuth(session: BrowserSessionId, cookies: readonly ExportedCookie[]): Promise<number>
   /** Return the session's chronological operation log. */
   history(session: BrowserSessionId): Promise<readonly BrowserHistoryEntry[]>
+  /**
+   * Persisted visits, newest first: what survives the browser process, so a
+   * human or an Agent can find a page again after the interface was closed.
+   * @param options - result cap and an optional hostname filter.
+   * @returns the retained visits (empty when history is disabled).
+   */
+  visited(options?: { readonly limit?: number; readonly domain?: string }): readonly VisitedPage[]
+  /**
+   * Optional: whether a session is still live. A session can end outside the
+   * tool layer — the human closed the browser window — so a cached id must be
+   * checked before it is reused. Providers that never end a session on their own
+   * can omit this, and callers treat absence as "still live".
+   * @param session - the session id to test.
+   */
+  exists?(session: BrowserSessionId): boolean
   /** Replay one recorded operation by sequence number. */
   replay(session: BrowserSessionId, seq: number): Promise<void>
   /** Close the session and destroy its backing surface. Idempotent. */
   close(session: BrowserSessionId): Promise<void>
 }
 
+/**
+ * One visited page in the persistent browsing history — the durable record that
+ * outlives sessions, unlike {@link BrowserHistoryEntry}, which is a
+ * session-scoped operation log (navigate/click/type/…).
+ */
+export interface VisitedPage {
+  /** Epoch milliseconds when the visit was recorded. */
+  readonly at: number
+  /** Absolute URL of the visited document. */
+  readonly url: string
+  /** Document title at visit time, when the page exposed one. */
+  readonly title?: string
+  /** Session/task label that drove the visit, when the provider knows it. */
+  readonly session?: string
+}
+
 /** One recorded browser operation, in chronological order (seq 1, 2, 3…). */
 export interface BrowserHistoryEntry {
   /** Monotonic sequence number within the session. */

package/src/browser-electron/entry.ts

@@ -11,11 +11,13 @@
  */
 
 import type { Context } from '@deepseek-ai/cordis'
+import type { IncomingMessage, ServerResponse } from 'node:http'
 import z from '@deepseek-ai/schemastery'
 import type { BrowserRuntime } from '../browser/runtime.js'
 import { ElectronBrowserProvider } from './provider.js'
 import type { ElectronBrowserViewHost } from './provider.js'
 import { defaultHostMainPath, RemoteElectronViewHost } from './remote-host.js'
+import { SettingsStore } from './settings-store.js'
 
 export {
   ELECTRON_BROWSER_PROVIDER_ID,
@@ -62,6 +64,9 @@ export function apply(ctx: Context & { browser: BrowserRuntime }, config: Config
   // External host (desktop shell) wins; otherwise self-host. The self-hosted
   // child is disposed with the fiber, mirroring the shell's lifetime.
   const host: ElectronBrowserViewHost = config.viewHost ?? new RemoteElectronViewHost(defaultHostMainPath())
+  // One settings document per plugin instance: the settings panel writes it, the
+  // provider reads it live, and both ends agree on the same file.
+  const settings = new SettingsStore()
   // Own the disposer on THIS plugin's fiber: registerBrowserProvider's effect
   // is bound to the seam's own fiber (the browser row), so a reload of this
   // row would otherwise collide with the still-registered provider
@@ -71,6 +76,7 @@ export function apply(ctx: Context & { browser: BrowserRuntime }, config: Config
     downloadDir: config.downloadDir,
     snapshotMaxElements: config.snapshotMaxElements,
     contentMaxChars: config.contentMaxChars,
+    settings: () => settings.get(),
   }))
   ctx.effect(() => () => {
     unregister()
@@ -78,4 +84,133 @@ export function apply(ctx: Context & { browser: BrowserRuntime }, config: Config
       host.dispose()
     }
   })
+  installSettingsRoute(ctx, settings)
+}
+
+/** Route the settings panel reads and writes. */
+const SETTINGS_ROUTE = '/dsh-builtin-browser/settings'
+
+/** The host web-server surface this plugin uses, described structurally. */
+interface WebServerHost {
+  readonly webServer: {
+    register(
+      spec: {
+        readonly kind: 'exact'
+        readonly path: string
+        readonly handler: (request: IncomingMessage, response: ServerResponse) => void | Promise<void>
+      },
+      label?: string,
+    ): () => void
+  }
+  effect(callback: () => (() => void) | void): void
+}
+
+/**
+ * Expose the settings document over the host's web server, which is how the
+ * settings panel reads and writes it. A host without that service (headless /
+ * CLI surfaces) simply skips this: the panel is then unreachable and the file
+ * stays hand-editable — never a plugin-startup failure.
+ * @param ctx - the plugin context.
+ * @param settings - the settings document to expose.
+ */
+function installSettingsRoute(ctx: Context, settings: SettingsStore): void {
+  const inject = (ctx as unknown as {
+    inject?: (deps: readonly string[], callback: (host: WebServerHost) => void) => void
+  }).inject
+  if (typeof inject !== 'function') return
+  try {
+    inject(['webServer'], (host) => {
+      host.effect(() => host.webServer.register({
+        kind: 'exact',
+        path: SETTINGS_ROUTE,
+        handler: (request, response) => handleSettingsRequest(request, response, settings),
+      }, 'dsh-builtin-browser: settings'))
+    })
+  } catch {
+    // No web server on this surface: the settings file remains the interface.
+  }
+}
+
+/**
+ * Same-origin guard. Settings are machine-local configuration, so a page loaded
+ * elsewhere must not be able to read or rewrite them.
+ * @param request - the incoming request.
+ * @returns whether the request may touch the settings document.
+ */
+function sameOrigin(request: IncomingMessage): boolean {
+  const site = String(request.headers['sec-fetch-site'] ?? '').toLowerCase()
+  if (site === 'cross-site') return false
+  const origin = String(request.headers.origin ?? '').trim()
+  if (origin === 'null') return false
+  if (origin === '') return true
+  try {
+    return new URL(origin).host.toLowerCase() === String(request.headers.host ?? '').trim().toLowerCase()
+  } catch {
+    return false
+  }
+}
+
+/**
+ * One settings round-trip: `GET` reads the document, `PUT`/`POST` merges a
+ * partial patch into it.
+ * @param request - the incoming request.
+ * @param response - the response to write.
+ * @param settings - the settings document.
+ */
+async function handleSettingsRequest(
+  request: IncomingMessage,
+  response: ServerResponse,
+  settings: SettingsStore,
+): Promise<void> {
+  const json = (status: number, body: unknown): void => {
+    response.writeHead(status, {
+      'content-type': 'application/json; charset=utf-8',
+      'cache-control': 'no-store',
+    })
+    response.end(JSON.stringify(body))
+  }
+  if (!sameOrigin(request)) {
+    json(403, { ok: false, error: 'cross-origin request refused' })
+    return
+  }
+  const method = request.method ?? 'GET'
+  if (method === 'GET') {
+    json(200, { ok: true, settings: settings.get(), path: settings.path() })
+    return
+  }
+  if (method !== 'PUT' && method !== 'POST') {
+    response.writeHead(405, { allow: 'GET, PUT' })
+    response.end()
+    return
+  }
+  try {
+    const body = await readBody(request)
+    const patch: unknown = body.trim() === '' ? {} : JSON.parse(body)
+    json(200, { ok: true, settings: settings.update(patch) })
+  } catch (error) {
+    json(400, { ok: false, error: `invalid settings patch: ${String(error)}` })
+  }
+}
+
+/**
+ * Read a request body with a hard cap (the settings patch is tiny, and an
+ * unbounded read would let any same-origin caller exhaust memory).
+ * @param request - the incoming request.
+ * @param limit - maximum accepted characters.
+ * @returns the body text.
+ */
+function readBody(request: IncomingMessage, limit = 64 * 1024): Promise<string> {
+  return new Promise<string>((resolve, reject) => {
+    let text = ''
+    request.setEncoding('utf8')
+    request.on('data', chunk => {
+      text += String(chunk)
+      if (text.length > limit) {
+        request.destroy()
+        reject(new Error('settings patch too large'))
+      }
+    })
+    request.on('end', () => resolve(text))
+    request.on('error', reject)
+  })
 }