dsh-edge 0.1.0

package/package.json

@@ -0,0 +1,97 @@
+{
+  "name": "dsh-edge",
+  "version": "0.1.0",
+  "description": "Install and run DeepSeek Harness on Cloudflare Workers",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "dsh-edge": "scripts/cli.mjs"
+  },
+  "files": [
+    "dist",
+    "src",
+    "scripts/*.d.mts",
+    "scripts/*.mjs",
+    "wrangler.jsonc",
+    "README.md",
+    "README.zh.md",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pawaca/dsh-edge.git",
+    "directory": "apps/dsh-edge"
+  },
+  "homepage": "https://github.com/pawaca/dsh-edge/tree/master/apps/dsh-edge#readme",
+  "bugs": {
+    "url": "https://github.com/pawaca/dsh-edge/issues"
+  },
+  "keywords": [
+    "deepseek",
+    "agent",
+    "cloudflare-workers",
+    "durable-objects"
+  ],
+  "engines": {
+    "node": ">=22.14.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dshEdge": {
+    "upstreamVersion": "0.1.0-rc.7"
+  },
+  "dependencies": {
+    "@clack/prompts": "1.7.0",
+    "@cloudflare/computer": "0.2.0",
+    "just-bash": "3.3.0",
+    "execa": "^10.0.0",
+    "jsonc-parser": "^3.3.1",
+    "wrangler": "4.123.0",
+    "@deepseek-ai/dsh-brand": "0.1.0-rc.7",
+    "@deepseek-ai/cordis": "4.0.1",
+    "@deepseek-ai/dsh-anonymous-user-id": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-host-apiproxy": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-credentials": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-launch-environment": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-agent-loop": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-llm": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-agent": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-llm-deepseek": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-session": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-session-persistence": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-system-prompt": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-session-query": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-tool-call-timeout-policy": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-settings": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-tool-web": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-session-title": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-web": "0.1.0-rc.7",
+    "@deepseek-ai/dsh-web-search-deepseek": "0.1.0-rc.7"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "5.20260812.1",
+    "playwright": "^1.49.0",
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.8",
+    "ws": "^8.21.0"
+  },
+  "scripts": {
+    "bundle:direct": "pnpm run web:build && node scripts/bundle.mjs direct",
+    "bundle:isolated": "pnpm run web:build && node scripts/bundle.mjs isolated",
+    "dev": "pnpm run web:build && wrangler dev --env=\"\"",
+    "dev:isolated": "pnpm run web:build && wrangler dev --env isolated",
+    "dsh-edge": "node scripts/cli.mjs",
+    "example:install": "node examples/install-keyless.mjs",
+    "install:cloudflare": "pnpm run web:build && node scripts/cli.mjs install",
+    "pack:verify": "node scripts/verify-packed.mjs",
+    "web:assemble": "node scripts/assemble-web.mjs",
+    "web:build": "pnpm --workspace-root run build:lib:host && pnpm --workspace-root run build:lib:client && pnpm --workspace-root run build:web && pnpm run web:assemble",
+    "test": "vitest run --root ../.. apps/dsh-edge/tests/agent.spec.ts apps/dsh-edge/tests/auth.spec.ts apps/dsh-edge/tests/cli.spec.ts apps/dsh-edge/tests/deployment-health.spec.ts apps/dsh-edge/tests/deployment.spec.ts apps/dsh-edge/tests/direct-shell.spec.ts apps/dsh-edge/tests/do-session-persistence.spec.ts apps/dsh-edge/tests/edge-api.spec.ts apps/dsh-edge/tests/edge-credentials.spec.ts apps/dsh-edge/tests/edge-remotes.spec.ts apps/dsh-edge/tests/installer.spec.ts apps/dsh-edge/tests/sse.spec.ts apps/dsh-edge/tests/web-search.spec.ts apps/dsh-edge/tests/workspace.spec.ts",
+    "test:integration": "pnpm run web:build && node tests/session.integration.mjs",
+    "test:snapshot": "vitest run --config vitest.snapshot.config.ts",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/scripts/assemble-web.mjs

@@ -0,0 +1,230 @@
+/** Assemble the upstream Web shell and client-plugin graph as Worker assets. */
+
+import { createHash } from 'node:crypto'
+import {
+  cp,
+  mkdir,
+  readFile,
+  readdir,
+  rm,
+  stat,
+  writeFile,
+} from 'node:fs/promises'
+import { dirname, join, relative, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const appRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const repoRoot = resolve(appRoot, '../..')
+const shellDist = join(repoRoot, 'apps/web/dist')
+const outputRoot = join(appRoot, 'dist')
+const deploymentPatches = [
+  join(repoRoot, 'packages/bundle/base/cordis.patch.yml'),
+  join(repoRoot, 'packages/bundle/web-app/cordis.patch.yml'),
+]
+// Deployment-owned browser features use the same client-plugin contract but
+// intentionally stay out of upstream's generic Web composition.
+const edgeClientPackages = ['@deepseek-ai/dsh-client-ui-edge']
+
+// HMR is useful only when the upstream Node host also runs its bundle watcher.
+// Edge deploys immutable, content-addressed static assets instead.
+const edgeExcludedPackages = new Set([
+  // Requires the upstream Node-side bundle watcher.
+  '@deepseek-ai/dsh-client-hmr',
+  // These surfaces depend on generated Host remotes or writable Host settings
+  // that the minimal Edge ApiProxy does not advertise yet. Keeping them out of
+  // the graph is capability negotiation at assembly time; their upstream code
+  // remains unchanged and can be restored with the matching server domain.
+  '@deepseek-ai/dsh-cordis-client-runner',
+  '@deepseek-ai/dsh-client-ui-cordis',
+  '@deepseek-ai/dsh-client-ui-goal',
+  '@deepseek-ai/dsh-client-ui-message-feedback',
+  '@deepseek-ai/dsh-client-ui-plan',
+  '@deepseek-ai/dsh-client-ui-settings-models',
+  '@deepseek-ai/dsh-client-ui-settings-plugin-inventory',
+  '@deepseek-ai/dsh-client-ui-settings-plugins',
+  // Its header action calls the session.export endpoint, which Edge does not
+  // implement. Keep the unavailable action out of the assembled browser.
+  '@deepseek-ai/dsh-session-log-export',
+])
+const shellStaticPackages = new Set(['@deepseek-ai/dsh-client-ui-primitives'])
+const assetSecurityHeaders = `/*
+  Content-Security-Policy: frame-ancestors 'none'
+  X-Frame-Options: DENY
+`
+
+function shortHash(input) {
+  return createHash('sha1').update(input).digest('hex').slice(0, 12)
+}
+
+async function isDirectory(path) {
+  try {
+    return (await stat(path)).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+async function findPackageJsonFiles(root) {
+  const found = []
+  const visit = async (directory) => {
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+      if (entry.name === 'node_modules' || entry.name === 'lib') continue
+      const path = join(directory, entry.name)
+      if (entry.isDirectory()) {
+        await visit(path)
+      } else if (entry.name === 'package.json') {
+        found.push(path)
+      }
+    }
+  }
+  await visit(root)
+  return found
+}
+
+async function removeSourceMaps(root) {
+  for (const entry of await readdir(root, { withFileTypes: true })) {
+    const path = join(root, entry.name)
+    if (entry.isDirectory()) {
+      await removeSourceMaps(path)
+    } else if (entry.name.endsWith('.map')) {
+      await rm(path)
+    }
+  }
+}
+
+function deploymentPackageNames(patch) {
+  const names = []
+  for (const match of patch.matchAll(/^\s+name:\s+'([^']+)'\s*$/gm)) {
+    if (!edgeExcludedPackages.has(match[1])) names.push(match[1])
+  }
+  return names
+}
+
+function clientBundleRelativePath(pkg) {
+  const client = pkg.exports?.['./client']
+  if (typeof client === 'string') return client
+  if (client !== null && typeof client === 'object' && typeof client.default === 'string') {
+    return client.default
+  }
+  throw new Error(`${pkg.name} is in the Web roster but exports no ./client bundle.`)
+}
+
+function injectBootManifest(html, graph) {
+  const json = JSON.stringify(graph).replaceAll('<', '\\u003c')
+  const script = `<script>window.__DSH_BOOT__ = ${json}</script>`
+  const head = html.indexOf('<head>')
+  return head === -1
+    ? `${script}${html}`
+    : `${html.slice(0, head + 6)}${script}${html.slice(head + 6)}`
+}
+
+function injectOwnerSessionGuard(html) {
+  const script = `<script>(() => {
+  const originalFetch = window.fetch.bind(window)
+  let redirecting = false
+  window.fetch = async (...args) => {
+    const input = args[0]
+    const href = input instanceof Request ? input.url : String(input)
+    const target = new URL(href, window.location.href)
+    const response = await originalFetch(...args)
+    if (!redirecting
+      && response.status === 401
+      && response.headers.get('www-authenticate') === 'DshEdgeOwner'
+      && target.origin === window.location.origin
+      && target.pathname.startsWith('/api/')) {
+      redirecting = true
+      window.location.replace('/login')
+    }
+    return response
+  }
+})()</script>`
+  const head = html.indexOf('<head>')
+  return head === -1
+    ? `${script}${html}`
+    : `${html.slice(0, head + 6)}${script}${html.slice(head + 6)}`
+}
+
+async function copyBundle(pkgPath, pkg, entries) {
+  const declaration = pkg.dsh?.client
+  if (declaration?.platform !== 'web') {
+    throw new Error(`${pkg.name} is in the upstream Web roster but has no web dsh.client declaration.`)
+  }
+  const source = resolve(dirname(pkgPath), clientBundleRelativePath(pkg))
+  const contents = await readFile(source)
+  const rev = shortHash(contents)
+  const destination = join(outputRoot, 'plugins', pkg.name, 'client.js')
+  await mkdir(dirname(destination), { recursive: true })
+  await writeFile(destination, contents)
+
+  entries.push({
+    id: pkg.name,
+    url: `/plugins/${pkg.name}/client.js?rev=${rev}`,
+    rev,
+    ...(Array.isArray(declaration.inject) ? { inject: declaration.inject } : {}),
+    ...(declaration.immediately === true ? { immediately: true } : {}),
+  })
+}
+
+async function main() {
+  if (!await isDirectory(shellDist)) {
+    throw new Error('Upstream Web shell is not built. Run `pnpm --workspace-root run build:web` first.')
+  }
+
+  const packagesByName = new Map()
+  for (const pkgPath of await findPackageJsonFiles(join(repoRoot, 'packages'))) {
+    const pkg = JSON.parse(await readFile(pkgPath, 'utf8'))
+    if (typeof pkg.name === 'string') packagesByName.set(pkg.name, { path: pkgPath, pkg })
+  }
+
+  const declared = []
+  for (const patchPath of deploymentPatches) {
+    declared.push(...deploymentPackageNames(await readFile(patchPath, 'utf8')))
+  }
+  declared.push(...edgeClientPackages)
+  const roster = []
+  const seen = new Set()
+  for (const name of declared) {
+    if (seen.has(name)) continue
+    const record = packagesByName.get(name)
+    // Vendor entries and package subpaths have no workspace package root; only
+    // workspace packages can declare the client bundles assembled here.
+    if (record === undefined) continue
+    if (record.pkg.dsh?.client?.platform !== 'web') continue
+    seen.add(name)
+    roster.push(name)
+  }
+  await rm(outputRoot, { recursive: true, force: true })
+  await cp(shellDist, outputRoot, { recursive: true })
+  // Match the published upstream Web package: production assets do not ship
+  // source maps, keeping the Worker upload compact without changing runtime JS.
+  await removeSourceMaps(outputRoot)
+
+  const entries = []
+  for (const name of roster) {
+    const record = packagesByName.get(name)
+    if (record === undefined) throw new Error(`Cannot resolve upstream Web package ${name}.`)
+    await copyBundle(record.path, record.pkg, entries)
+  }
+
+  const selected = new Set(entries.map(entry => entry.id))
+  for (const entry of entries) {
+    for (const dependency of entry.inject ?? []) {
+      if (!selected.has(dependency) && !shellStaticPackages.has(dependency)) {
+        throw new Error(`${entry.id} injects missing Edge Web package ${dependency}.`)
+      }
+    }
+  }
+
+  const graph = { rev: shortHash(JSON.stringify(entries)), entries }
+  const indexPath = join(outputRoot, 'index.html')
+  const index = await readFile(indexPath, 'utf8')
+  await writeFile(indexPath, injectOwnerSessionGuard(injectBootManifest(index, graph)))
+  // Cloudflare may serve index.html and SPA fallbacks without invoking the
+  // Worker. Apply the framing boundary at the asset layer so every alias of
+  // the executable shell receives the same policy while immutable assets can
+  // still bypass Worker execution.
+  await writeFile(join(outputRoot, '_headers'), assetSecurityHeaders)
+  console.log(`Assembled ${entries.length} upstream client plugins in ${relative(repoRoot, outputRoot)} (rev ${graph.rev}).`)
+}
+
+await main()

package/scripts/bundle-size.d.mts

@@ -0,0 +1,2 @@
+export function parseWranglerGzipBytes(output: string): number
+export function requireGzipBudget(output: string, maxBytes: number): number

package/scripts/bundle-size.mjs

@@ -0,0 +1,26 @@
+const SIZE_UNITS = Object.freeze({
+  B: 1,
+  KiB: 1024,
+  MiB: 1024 * 1024,
+})
+
+/** Extract Wrangler's total compressed upload size in bytes. */
+export function parseWranglerGzipBytes(output) {
+  const match = /Total Upload:[^\n/]+\/ gzip:\s*([0-9]+(?:\.[0-9]+)?)\s*(B|KiB|MiB)/u.exec(output)
+  if (match === null) throw new Error('Wrangler did not report a compressed upload size.')
+  return Math.ceil(Number(match[1]) * SIZE_UNITS[match[2]])
+}
+
+/** Reject a compressed Worker artifact above the repository budget. */
+export function requireGzipBudget(output, maxBytes) {
+  if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) {
+    throw new TypeError('maxBytes must be a positive safe integer.')
+  }
+  const actualBytes = parseWranglerGzipBytes(output)
+  if (actualBytes > maxBytes) {
+    throw new Error(
+      `Direct Worker gzip size ${actualBytes} bytes exceeds the ${maxBytes}-byte budget.`,
+    )
+  }
+  return actualBytes
+}

package/scripts/bundle.mjs

@@ -0,0 +1,53 @@
+import { createRequire } from 'node:module'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { execa } from 'execa'
+import { requireGzipBudget } from './bundle-size.mjs'
+import { writeModeWranglerConfig } from './wrangler-config.mjs'
+
+const DIRECT_GZIP_BUDGET_BYTES = 900 * 1024
+const appDirectory = fileURLToPath(new URL('..', import.meta.url))
+const require = createRequire(import.meta.url)
+const wranglerCli = require.resolve('wrangler')
+const mode = process.argv[2]
+
+if (mode !== 'direct' && mode !== 'isolated') {
+  process.stderr.write('Usage: node scripts/bundle.mjs <direct|isolated>\n')
+  process.exitCode = 2
+} else {
+  const directory = await mkdtemp(join(tmpdir(), `dsh-edge-${mode}-bundle-`))
+  try {
+    const configFile = join(directory, 'wrangler.json')
+    const outputDirectory = join(directory, 'worker')
+    await writeModeWranglerConfig(mode, configFile)
+    const result = await execa(process.execPath, [
+      wranglerCli,
+      'deploy',
+      '--config', configFile,
+      '--env', mode === 'direct' ? '' : 'isolated',
+      '--dry-run',
+      '--outdir', outputDirectory,
+    ], {
+      cwd: appDirectory,
+      reject: false,
+      all: true,
+    })
+    const output = result.all ?? `${result.stdout}\n${result.stderr}`
+    process.stdout.write(output.endsWith('\n') ? output : `${output}\n`)
+    if (result.exitCode !== 0) {
+      process.exitCode = result.exitCode
+    } else if (mode === 'direct') {
+      const bytes = requireGzipBudget(output, DIRECT_GZIP_BUDGET_BYTES)
+      process.stdout.write(
+        `Direct Worker gzip budget: ${bytes}/${DIRECT_GZIP_BUDGET_BYTES} bytes.\n`,
+      )
+    }
+  } catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`)
+    process.exitCode = 1
+  } finally {
+    await rm(directory, { recursive: true, force: true })
+  }
+}

package/scripts/cli.d.mts

@@ -0,0 +1,39 @@
+import type { InstallerUi } from './install.mjs'
+
+export type InstallerInterruptSignal = 'SIGHUP' | 'SIGINT' | 'SIGTERM'
+
+export class InstallInterruptedError extends Error {
+  readonly exitCode: number
+  readonly signal: InstallerInterruptSignal
+  outputFailureStream?: 'stderr' | 'stdout'
+}
+
+export type InstallerCommand = 'install' | 'upgrade'
+export function parseCommand(args: string[]): InstallerCommand | 'help' | 'version'
+export function createInstallerUi(
+  clack?: typeof import('@clack/prompts'),
+  signal?: AbortSignal,
+  writeDescriptor?: (fd: number, value: string) => number,
+  output?: import('node:stream').Writable,
+  writeRecovery?: (failedStream: 'stderr' | 'stdout', value: string) => Promise<boolean>,
+  command?: InstallerCommand,
+): InstallerUi
+export function runInstaller(options?: {
+  command?: InstallerCommand
+  install?: (options: { command: InstallerCommand; ui: InstallerUi; signal: AbortSignal }) => Promise<unknown>
+  installEdgeImpl?: typeof import('./install.mjs').installEdge
+  installerUi?: InstallerUi
+  outputDrainTimeoutMs?: number
+  uiFactory?: (
+    signal: AbortSignal,
+    output: import('node:stream').Writable,
+    writeRecovery: (failedStream: 'stderr' | 'stdout', value: string) => Promise<boolean>,
+  ) => InstallerUi
+  runtimeProcess?: {
+    on(signal: InstallerInterruptSignal, handler: () => void): unknown
+    removeListener(signal: InstallerInterruptSignal, handler: () => void): unknown
+  }
+  stderr?: import('node:stream').Writable
+  stdout?: import('node:stream').Writable
+  wranglerRunner?: typeof import('./install.mjs').executeWrangler
+}): Promise<unknown>