dsh-openwrite 0.2.21 → 0.2.22

package/vendor/dsh-dog/lib/index.d.ts

@@ -7,6 +7,16 @@ import { ConnectionRpcHandler } from "@deepseek-ai/dsh-client-connection";
 import { SessionId } from "@deepseek-ai/dsh-session";
 import { JobRegistry } from "@deepseek-ai/dsh-jobs";
 //#region src/debug-contract.d.ts
+/**
+ * Dedicated debugger channel. It is served by this plugin directly on the Web
+ * carrier (see serveDogDebugRpc): Connection's generic channel registry mounts
+ * its HTTP route through the Connection plugin's own context, which only sees
+ * `webServer` when a bundle patch injects it into the shared connection row —
+ * and per-key patch semantics make any such patch clobber other bundles
+ * (OpenWrite issue #81), while the shared `/api` channel already belongs to
+ * the host's Typert gateway. The wire envelope mirrors Connection's, so the
+ * browser side keeps using its stock `connection.rpc.call`.
+ */
 declare const DOG_DEBUG_RPC_CHANNEL = "/dog-rpc";
 declare const DOG_DEBUG_SNAPSHOT_ENDPOINT = "snapshot";
 declare const DOG_RUNTIME_TRACE_ENDPOINT = "goal-runtime";

package/vendor/dsh-dog/lib/index.js

@@ -278,6 +278,16 @@ function defineTool(options) {
 }
 //#endregion
 //#region src/debug-contract.ts
+/**
+* Dedicated debugger channel. It is served by this plugin directly on the Web
+* carrier (see serveDogDebugRpc): Connection's generic channel registry mounts
+* its HTTP route through the Connection plugin's own context, which only sees
+* `webServer` when a bundle patch injects it into the shared connection row —
+* and per-key patch semantics make any such patch clobber other bundles
+* (OpenWrite issue #81), while the shared `/api` channel already belongs to
+* the host's Typert gateway. The wire envelope mirrors Connection's, so the
+* browser side keeps using its stock `connection.rpc.call`.
+*/
 const DOG_DEBUG_RPC_CHANNEL = "/dog-rpc";
 const DOG_DEBUG_SNAPSHOT_ENDPOINT = "snapshot";
 const DOG_RUNTIME_TRACE_ENDPOINT = "goal-runtime";
@@ -357,6 +367,86 @@ function createDogDebugRpcHandler(repository) {
 		}
 	};
 }
+const DOG_DEBUG_BODY_LIMIT = 8388608;
+const ENDPOINT_SEGMENT = /^[A-Za-z0-9_$.-]+$/;
+/**
+* Serve the debugger RPC channel directly on the Web carrier. Connection's
+* generic channel registry (`rpc.handle`) mounts its HTTP route through the
+* Connection plugin's own context, which only sees `webServer` when a bundle
+* patch injects it into the shared connection row — and per-key patch
+* semantics make any such patch clobber other bundles (OpenWrite issue #81);
+* the shared `/api` channel is already claimed by the host's Typert gateway.
+* The wire envelope mirrors Connection's (`client-request`/`server-response`)
+* so the browser side keeps using its stock `connection.rpc.call`; admission
+* at the route reuses Connection's trusted-host fence and browser
+* authentication, so the channel stays exactly as protected as a native one.
+*/
+async function serveDogDebugRpc(req, res, handler) {
+	const respond = (status, body) => {
+		res.writeHead(status, { "content-type": "application/json" });
+		res.end(typeof body === "string" ? body : JSON.stringify(body));
+	};
+	const endpoint = dogDebugEndpointOf(req.url ?? "");
+	if (endpoint === void 0 || req.method !== "POST") {
+		respond(404, "not found");
+		return;
+	}
+	if (((req.headers["content-type"] ?? "").split(";", 1)[0] ?? "").trim().toLowerCase() !== "application/json") {
+		respond(415, "content type must be application/json");
+		return;
+	}
+	let raw = "";
+	let size = 0;
+	for await (const chunk of req) {
+		size += chunk.length;
+		if (size > DOG_DEBUG_BODY_LIMIT) {
+			respond(413, "request too large");
+			return;
+		}
+		raw += chunk;
+	}
+	let body;
+	try {
+		body = JSON.parse(raw);
+	} catch {
+		respond(400, "body is not JSON");
+		return;
+	}
+	const rpcId = typeof body?.rpcId === "string" ? body.rpcId : "invalid-request";
+	if (body?.type !== "client-request" || body.method !== endpoint) {
+		respond(200, {
+			type: "server-response",
+			rpcId,
+			result: {
+				ok: false,
+				error: {
+					code: "gateway/bad-request",
+					message: "invalid client-request message",
+					details: {}
+				}
+			}
+		});
+		return;
+	}
+	const controller = new AbortController();
+	req.on("close", () => controller.abort());
+	try {
+		respond(200, {
+			type: "server-response",
+			rpcId,
+			result: await handler(endpoint, body.payload, controller.signal)
+		});
+	} catch (error) {
+		respond(500, `handler failure: ${String(error)}`);
+	}
+}
+function dogDebugEndpointOf(url) {
+	const pathname = url.split("?", 1)[0] ?? "";
+	if (!pathname.startsWith(`/dog-rpc/`)) return void 0;
+	const endpoint = pathname.slice(9);
+	if (endpoint.split("/").some((segment) => segment === "" || segment === "." || segment === ".." || !ENDPOINT_SEGMENT.test(segment))) return void 0;
+	return endpoint;
+}
 function compareRevisions(left, right) {
 	if (left.current !== right.current) return left.current ? -1 : 1;
 	const leftUpdated = left.runs[0]?.updatedAt ?? "";
@@ -1094,8 +1184,20 @@ async function apply(ctx, config) {
 		if (event.data.reason?.kind !== "interrupted") return;
 		captureInterruptedTurn(repository, session, event).catch(() => void 0);
 	});
-	ctx.inject(["connection", "webServer"], (connectionCtx) => {
-		connectionCtx.effect(() => connectionCtx.connection.rpc.handle(DOG_DEBUG_RPC_CHANNEL, debugHandler), "dog: trusted debugger RPC");
+	ctx.inject(["connection", "webServer"], (c) => {
+		c.effect(() => c.webServer.register({
+			kind: "prefix",
+			path: DOG_DEBUG_RPC_CHANNEL,
+			handler: async (req, res) => {
+				const rejection = c.connection.requestRejection({ headers: req.headers });
+				if (rejection !== void 0) {
+					res.writeHead(rejection);
+					res.end(rejection === 401 ? "unauthorized" : "forbidden");
+					return;
+				}
+				await serveDogDebugRpc(req, res, debugHandler);
+			}
+		}), "dog: trusted debugger RPC");
 	});
 }
 async function captureInterruptedTurn(repository, session, event) {