dsh-skill-hub 0.3.24 → 0.3.25

package/lib/types/client/api.d.ts

@@ -7,6 +7,28 @@ import { type CatalogResponse, type ConfigResponse, type CreateRequest, type Cre
 export declare class SkillHubApiError extends Error {
     constructor(message: string);
 }
+/**
+ * Resolve one route path against the page's base.
+ *
+ * Every route in this family is registered on the server as a root-absolute
+ * path (`/api/skill-hub/...`), which is right there but wrong in a browser
+ * behind a reverse proxy that owns a path prefix: the page loads from
+ * `https://host/app/dsh/` while a root-absolute URL drops the prefix entirely,
+ * so the gateway answers 404 HTML and `readJson` reports "invalid JSON
+ * response" (issue #18). Resolving against `document.baseURI` is the host's own
+ * convention — `dsh-client-connection` opens its browser carrier with
+ * `new URL(path.slice(1), document.baseURI)` — so a root deployment resolves to
+ * exactly the same absolute path while a prefixed one keeps its prefix, and the
+ * gateway strips it before forwarding: the server still receives
+ * `/api/skill-hub/*`.
+ *
+ * `SKILL_HUB_API_ROOT` must stay absolute (the same constant registers the
+ * routes on the server), which is why the prefix is applied here at the single
+ * outbound boundary rather than in the constants.
+ * @param path - one route path, root-absolute unless it is already a full URL.
+ * @returns the URL to fetch.
+ */
+export declare function resolveApiUrl(path: string): string;
 /** The browser half's only data entry point. */
 export declare class SkillHubApi {
     /** One GET round trip (query already encoded by the caller). */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-skill-hub",
-  "version": "0.3.24",
+  "version": "0.3.25",
   "description": "In-GUI skill hub for DeepSeek Harness (dsh): browse the full local skill catalog from the official ctx.skills registry (every root + third-party providers), toggle skills on/off, inspect bodies, surface frontmatter diagnostics, and scaffold new skills — plus a codex-style skill market (built-in catalog, upstream update checks, one-click update-all) with tracked source sync. The full manager beyond the read-only dsh-skill-manager browser.",
   "type": "module",
   "engines": {

package/src/client/api.test.ts

@@ -0,0 +1,51 @@
+/**
+ * Root-absolute route paths must resolve against the page's base, not the site
+ * root: behind a reverse proxy that owns a path prefix (`https://host/app/dsh/`)
+ * a root-absolute URL loses the prefix and the gateway answers 404 HTML — the
+ * `HTTP 404: invalid JSON response` banner in issue #18.
+ */
+
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { SkillHubApi, resolveApiUrl } from './api.ts'
+
+describe('resolveApiUrl (issue #18)', () => {
+  afterEach(() => { vi.unstubAllGlobals() })
+
+  it('resolves to the site root for a plain deployment', () => {
+    vi.stubGlobal('document', { baseURI: 'http://127.0.0.1:3080/' })
+    expect(resolveApiUrl('/api/skill-hub/catalog')).toBe('http://127.0.0.1:3080/api/skill-hub/catalog')
+  })
+
+  it('keeps a reverse proxy path prefix', () => {
+    vi.stubGlobal('document', { baseURI: 'https://host.example.com/app/dsh/' })
+    expect(resolveApiUrl('/api/skill-hub/catalog')).toBe('https://host.example.com/app/dsh/api/skill-hub/catalog')
+  })
+
+  it('passes full URLs through and tolerates a missing document (SSR/tests)', () => {
+    expect(resolveApiUrl('https://cdn.example.com/x.json')).toBe('https://cdn.example.com/x.json')
+    expect(resolveApiUrl('/api/skill-hub/catalog')).toBe('/api/skill-hub/catalog')
+  })
+})
+
+describe('SkillHubApi outbound boundary (issue #18)', () => {
+  afterEach(() => { vi.unstubAllGlobals() })
+
+  it('sends every request through the resolved URL, prefix included', async () => {
+    vi.stubGlobal('document', { baseURI: 'https://host.example.com/app/dsh/' })
+    const seen: string[] = []
+    vi.stubGlobal('fetch', async (url: string) => {
+      seen.push(String(url))
+      return new Response(JSON.stringify({ ok: true, skills: [], disabled: [], diagnostics: [] }), {
+        status: 200,
+        headers: { 'content-type': 'application/json' },
+      })
+    })
+
+    const api = new SkillHubApi()
+    await api.catalog()
+
+    // One outbound path for the whole family: the prefix is applied once, here.
+    expect(seen).toHaveLength(1)
+    expect(seen[0]).toBe('https://host.example.com/app/dsh/api/skill-hub/catalog')
+  })
+})

package/src/client/api.ts

@@ -83,6 +83,37 @@ async function readJson<T>(response: Response): Promise<T> {
   return body as T
 }
 
+/**
+ * Resolve one route path against the page's base.
+ *
+ * Every route in this family is registered on the server as a root-absolute
+ * path (`/api/skill-hub/...`), which is right there but wrong in a browser
+ * behind a reverse proxy that owns a path prefix: the page loads from
+ * `https://host/app/dsh/` while a root-absolute URL drops the prefix entirely,
+ * so the gateway answers 404 HTML and `readJson` reports "invalid JSON
+ * response" (issue #18). Resolving against `document.baseURI` is the host's own
+ * convention — `dsh-client-connection` opens its browser carrier with
+ * `new URL(path.slice(1), document.baseURI)` — so a root deployment resolves to
+ * exactly the same absolute path while a prefixed one keeps its prefix, and the
+ * gateway strips it before forwarding: the server still receives
+ * `/api/skill-hub/*`.
+ *
+ * `SKILL_HUB_API_ROOT` must stay absolute (the same constant registers the
+ * routes on the server), which is why the prefix is applied here at the single
+ * outbound boundary rather than in the constants.
+ * @param path - one route path, root-absolute unless it is already a full URL.
+ * @returns the URL to fetch.
+ */
+export function resolveApiUrl(path: string): string {
+  if (!path.startsWith('/')) return path
+  if (typeof document === 'undefined') return path
+  try {
+    return new URL(path.slice(1), document.baseURI).href
+  } catch {
+    return path
+  }
+}
+
 /**
  * Fetch with a hard timeout: a hung connection (proxy, stalled keep-alive,
  * host wedged) must never leave the panel stuck on "loading" forever — it
@@ -92,7 +123,7 @@ async function fetchWithTimeout(input: RequestInfo | URL, init?: RequestInit, ms
   const controller = new AbortController()
   const timer = setTimeout(() => controller.abort(), ms)
   try {
-    return await fetch(input, { ...init, signal: controller.signal })
+    return await fetch(typeof input === 'string' ? resolveApiUrl(input) : input, { ...init, signal: controller.signal })
   } finally {
     clearTimeout(timer)
   }