soraacode 0.2.0 → 0.2.1

package/src/server/routes/instance/httpapi/handlers/workspace.ts

@@ -1,102 +0,0 @@
-import { listAdapters } from "@/control-plane/adapters"
-import { Workspace } from "@/control-plane/workspace"
-import * as InstanceState from "@/effect/instance-state"
-import { Vcs } from "@/project/vcs"
-import { Cause, Effect } from "effect"
-import { HttpApiBuilder } from "effect/unstable/httpapi"
-import { InstanceHttpApi } from "../api"
-import { notFound } from "../errors"
-import { ApiVcsApplyError } from "../groups/instance"
-import { ApiWorkspaceCreateError, ApiWorkspaceWarpError, CreatePayload, WarpPayload } from "../groups/workspace"
-
-export const workspaceHandlers = HttpApiBuilder.group(InstanceHttpApi, "workspace", (handlers) =>
-  Effect.gen(function* () {
-    const workspace = yield* Workspace.Service
-
-    const adapters = Effect.fn("WorkspaceHttpApi.adapters")(function* () {
-      const instance = yield* InstanceState.context
-      return yield* Effect.sync(() => listAdapters(instance.project.id))
-    })
-
-    const list = Effect.fn("WorkspaceHttpApi.list")(function* () {
-      return yield* workspace.list((yield* InstanceState.context).project)
-    })
-
-    const create = Effect.fn("WorkspaceHttpApi.create")(function* (ctx: { payload: typeof CreatePayload.Type }) {
-      const instance = yield* InstanceState.context
-      return yield* workspace
-        .create({
-          ...ctx.payload,
-          extra: ctx.payload.extra ?? null,
-          projectID: instance.project.id,
-        })
-        .pipe(
-          Effect.catchCause((cause) => {
-            // Plugin throws surface as defects (because EffectBridge.fromPromise uses Effect.promise),
-            // bypassing Effect.mapError. Walk the cause to surface the real error to the client.
-            const die = cause.reasons.find(Cause.isDieReason)
-            const fail = cause.reasons.find(Cause.isFailReason)
-            const reason: unknown = die?.defect ?? fail?.error
-            const message = reason instanceof Error ? reason.message : "Workspace creation failed"
-            return Effect.fail(
-              new ApiWorkspaceCreateError({
-                name: "WorkspaceCreateError",
-                data: { message },
-              }),
-            )
-          }),
-        )
-    })
-
-    const syncList = Effect.fn("WorkspaceHttpApi.syncList")(function* () {
-      yield* workspace.syncList((yield* InstanceState.context).project)
-    })
-
-    const status = Effect.fn("WorkspaceHttpApi.status")(function* () {
-      const ids = new Set((yield* workspace.list((yield* InstanceState.context).project)).map((item) => item.id))
-      return (yield* workspace.status()).filter((item) => ids.has(item.workspaceID))
-    })
-
-    const remove = Effect.fn("WorkspaceHttpApi.remove")(function* (ctx: { params: { id: Workspace.Info["id"] } }) {
-      return yield* workspace.remove(ctx.params.id)
-    })
-
-    const warp = Effect.fn("WorkspaceHttpApi.warp")(function* (ctx: { payload: typeof WarpPayload.Type }) {
-      yield* workspace
-        .sessionWarp({
-          workspaceID: ctx.payload.id,
-          sessionID: ctx.payload.sessionID,
-          copyChanges: ctx.payload.copyChanges,
-        })
-        .pipe(
-          Effect.mapError((error) => {
-            if (error instanceof Workspace.WorkspaceNotFoundError) return notFound(error.message)
-            if (error instanceof Vcs.PatchApplyError) {
-              return new ApiVcsApplyError({
-                name: "VcsApplyError",
-                data: {
-                  message: error.message,
-                  reason: error.reason,
-                },
-              })
-            }
-            return new ApiWorkspaceWarpError({
-              name: "WorkspaceWarpError",
-              data: {
-                message: error.message,
-              },
-            })
-          }),
-        )
-    })
-
-    return handlers
-      .handle("adapters", adapters)
-      .handle("list", list)
-      .handle("create", create)
-      .handle("syncList", syncList)
-      .handle("status", status)
-      .handle("remove", remove)
-      .handle("warp", warp)
-  }),
-)

package/src/server/routes/instance/httpapi/lifecycle.ts

@@ -1,54 +0,0 @@
-import { EffectBridge } from "@/effect/bridge"
-import type { InstanceContext } from "@/project/instance-context"
-import { InstanceStore } from "@/project/instance-store"
-import { Effect } from "effect"
-import { HttpEffect, HttpMiddleware, HttpServerRequest } from "effect/unstable/http"
-
-type MarkedInstance = {
-  ctx: InstanceContext
-  store: InstanceStore.Interface
-  bridge: EffectBridge.Shape
-}
-
-// Disposal is requested by an endpoint handler, but must run from the outer
-// server middleware after the response has been produced. The original Request
-// object is the stable handoff key between those two phases.
-const disposeAfterResponse = new WeakMap<object, MarkedInstance>()
-
-const mark = (ctx: InstanceContext) =>
-  Effect.gen(function* () {
-    return { ctx, store: yield* InstanceStore.Service, bridge: yield* EffectBridge.make() }
-  })
-
-export const markInstanceForDisposal = (ctx: InstanceContext) =>
-  Effect.gen(function* () {
-    const marked = yield* mark(ctx)
-    return yield* HttpEffect.appendPreResponseHandler((request, response) =>
-      Effect.sync(() => {
-        // The response is sent before disposeMiddleware performs the teardown.
-        disposeAfterResponse.set(request.source, marked)
-        return response
-      }),
-    )
-  })
-
-export const markInstanceForReload = (ctx: InstanceContext, next: InstanceStore.LoadInput) =>
-  Effect.gen(function* () {
-    const marked = yield* mark(ctx)
-    return yield* HttpEffect.appendPreResponseHandler((_request, response) =>
-      Effect.as(Effect.uninterruptible(marked.bridge.run(marked.store.reload(next))), response),
-    )
-  })
-
-export const disposeMiddleware: HttpMiddleware.HttpMiddleware = (effect) =>
-  Effect.gen(function* () {
-    const response = yield* effect
-    const request = yield* HttpServerRequest.HttpServerRequest
-    const marked = disposeAfterResponse.get(request.source)
-    if (!marked) return response
-    disposeAfterResponse.delete(request.source)
-    yield* Effect.uninterruptible(marked.bridge.run(marked.store.dispose(marked.ctx))).pipe(
-      Effect.catchCause((cause) => Effect.logWarning("instance disposal failed", { cause })),
-    )
-    return response
-  })

package/src/server/routes/instance/httpapi/middleware/authorization.ts

@@ -1,150 +0,0 @@
-import { ServerAuth } from "@/server/auth"
-import { Effect, Encoding, Layer, Redacted } from "effect"
-import { HttpEffect, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
-import { HttpApiError, HttpApiMiddleware } from "effect/unstable/httpapi"
-import { hasPtyConnectTicketURL } from "@/server/shared/pty-ticket"
-import { isPublicUIPath } from "@/server/shared/public-ui"
-export {
-  Authorization as ServerAuthorization,
-  authorizationLayer as serverAuthorizationLayer,
-} from "@soraacode/server/middleware/authorization"
-
-const AUTH_TOKEN_QUERY = "auth_token"
-const UNAUTHORIZED = 401
-const WWW_AUTHENTICATE = 'Basic realm="Secure Area"'
-
-// Avoid HttpApiSecurity alternatives here: Effect security middleware wraps the
-// full handler, so a downstream failure can make the next auth alternative run
-// and remap an authorized NotFound into Unauthorized.
-export class Authorization extends HttpApiMiddleware.Service<Authorization>()(
-  "@opencode/ExperimentalHttpApiAuthorization",
-  {
-    error: HttpApiError.UnauthorizedNoContent,
-  },
-) {}
-
-export class PtyConnectAuthorization extends HttpApiMiddleware.Service<PtyConnectAuthorization>()(
-  "@opencode/ExperimentalHttpApiPtyConnectAuthorization",
-  {
-    error: HttpApiError.UnauthorizedNoContent,
-  },
-) {}
-
-function emptyCredential() {
-  return {
-    username: "",
-    password: Redacted.make(""),
-  }
-}
-
-function validateCredential<A, E, R>(
-  effect: Effect.Effect<A, E, R>,
-  credential: ServerAuth.DecodedCredentials,
-  config: ServerAuth.Info,
-) {
-  return Effect.gen(function* () {
-    if (!ServerAuth.required(config)) return yield* effect
-    if (!ServerAuth.authorized(credential, config)) {
-      yield* HttpEffect.appendPreResponseHandler((_request, response) =>
-        Effect.succeed(HttpServerResponse.setHeader(response, "www-authenticate", WWW_AUTHENTICATE)),
-      )
-      return yield* new HttpApiError.Unauthorized({})
-    }
-    return yield* effect
-  })
-}
-
-function decodeCredential(input: string) {
-  return Effect.fromResult(Encoding.decodeBase64String(input)).pipe(
-    Effect.match({
-      onFailure: emptyCredential,
-      onSuccess: (header) => {
-        const separator = header.indexOf(":")
-        if (separator === -1) return emptyCredential()
-        return {
-          username: header.slice(0, separator),
-          password: Redacted.make(header.slice(separator + 1)),
-        }
-      },
-    }),
-  )
-}
-
-function credentialFromRequest(request: HttpServerRequest.HttpServerRequest) {
-  return credentialFromURL(new URL(request.url, "http://localhost"), request)
-}
-
-function credentialFromURL(url: URL, request: HttpServerRequest.HttpServerRequest) {
-  const token = url.searchParams.get(AUTH_TOKEN_QUERY)
-  if (token) return decodeCredential(token)
-  const match = /^Basic\s+(.+)$/i.exec(request.headers.authorization ?? "")
-  if (match) return decodeCredential(match[1])
-  return Effect.succeed(emptyCredential())
-}
-
-function validateRawCredential<A, E, R>(
-  effect: Effect.Effect<A, E, R>,
-  credential: ServerAuth.DecodedCredentials,
-  config: ServerAuth.Info,
-) {
-  if (!ServerAuth.required(config)) return effect
-  if (!ServerAuth.authorized(credential, config))
-    return Effect.succeed(
-      HttpServerResponse.empty({
-        status: UNAUTHORIZED,
-        headers: { "www-authenticate": WWW_AUTHENTICATE },
-      }),
-    )
-  return effect
-}
-
-export const authorizationRouterMiddleware = HttpRouter.middleware()(
-  Effect.gen(function* () {
-    const config = yield* ServerAuth.Config
-    if (!ServerAuth.required(config)) return (effect) => effect
-
-    return (effect) =>
-      Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest
-        const url = new URL(request.url, "http://localhost")
-        if (isPublicUIPath(request.method, url.pathname)) return yield* effect
-        return yield* credentialFromURL(url, request).pipe(
-          Effect.flatMap((credential) => validateRawCredential(effect, credential, config)),
-        )
-      })
-  }),
-)
-
-export const authorizationLayer = Layer.effect(
-  Authorization,
-  Effect.gen(function* () {
-    const config = yield* ServerAuth.Config
-    if (!ServerAuth.required(config)) return Authorization.of((effect) => effect)
-    return Authorization.of((effect) =>
-      Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest
-        return yield* credentialFromRequest(request).pipe(
-          Effect.flatMap((credential) => validateCredential(effect, credential, config)),
-        )
-      }),
-    )
-  }),
-)
-
-export const ptyConnectAuthorizationLayer = Layer.effect(
-  PtyConnectAuthorization,
-  Effect.gen(function* () {
-    const config = yield* ServerAuth.Config
-    if (!ServerAuth.required(config)) return PtyConnectAuthorization.of((effect) => effect)
-    return PtyConnectAuthorization.of((effect) =>
-      Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest
-        const url = new URL(request.url, "http://localhost")
-        if (hasPtyConnectTicketURL(url)) return yield* effect
-        return yield* credentialFromURL(url, request).pipe(
-          Effect.flatMap((credential) => validateCredential(effect, credential, config)),
-        )
-      }),
-    )
-  }),
-)

package/src/server/routes/instance/httpapi/middleware/compression.ts

@@ -1,64 +0,0 @@
-import { deflateSync, gzipSync } from "node:zlib"
-import { Effect } from "effect"
-import { HttpBody, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
-
-// Keep the server's compressible content-type set stable across HTTP backend changes.
-const COMPRESSIBLE_CONTENT_TYPE_REGEX =
-  /^\s*(?:text\/(?!event-stream(?:[;\s]|$))[^;\s]+|application\/(?:javascript|json|xml|xml-dtd|ecmascript|dart|postscript|rtf|tar|toml|vnd\.dart|vnd\.ms-fontobject|vnd\.ms-opentype|wasm|x-httpd-php|x-javascript|x-ns-proxy-autoconfig|x-sh|x-tar|x-www-form-urlencoded)|font\/(?:otf|ttf)|image\/(?:bmp|vnd\.adobe\.photoshop|vnd\.microsoft\.icon|vnd\.ms-dds|x-icon|x-ms-bmp)|message\/rfc822|model\/gltf-binary|x-shader\/x-fragment|x-shader\/x-vertex|[^;\s]+?\+(?:json|text|xml|yaml))(?:[;\s]|$)/i
-
-const NO_TRANSFORM_REGEX = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i
-
-const STREAMING_PATHS = new Set(["/event", "/global/event"])
-const STREAMING_POST_REGEX = /^\/session\/[^/]+\/(?:message|prompt_async)$/
-
-const THRESHOLD_BYTES = 1024
-
-type Encoding = "gzip" | "deflate"
-
-function pickEncoding(acceptEncoding: string | undefined): Encoding | undefined {
-  if (!acceptEncoding) return undefined
-  const lower = acceptEncoding.toLowerCase()
-  if (lower.includes("gzip")) return "gzip"
-  if (lower.includes("deflate")) return "deflate"
-  return undefined
-}
-
-function pathOf(url: string): string {
-  const queryIndex = url.indexOf("?")
-  return queryIndex === -1 ? url : url.slice(0, queryIndex)
-}
-
-export const compressionLayer = HttpRouter.middleware<{ handles: unknown }>()((effect) =>
-  Effect.gen(function* () {
-    const response = yield* effect
-    const request = yield* HttpServerRequest.HttpServerRequest
-
-    if (request.method === "HEAD") return response
-    if (response.headers["content-encoding"]) return response
-    if (response.headers["transfer-encoding"]) return response
-
-    const body = response.body
-    if (body._tag !== "Uint8Array") return response
-    if (body.body.byteLength < THRESHOLD_BYTES) return response
-
-    const cacheControl = response.headers["cache-control"]
-    if (cacheControl && NO_TRANSFORM_REGEX.test(cacheControl)) return response
-
-    const path = pathOf(request.url)
-    if (STREAMING_PATHS.has(path)) return response
-    if (request.method === "POST" && STREAMING_POST_REGEX.test(path)) return response
-
-    const contentType = body.contentType
-    if (!COMPRESSIBLE_CONTENT_TYPE_REGEX.test(contentType)) return response
-
-    const encoding = pickEncoding(request.headers["accept-encoding"])
-    if (!encoding) return response
-
-    const compressed = encoding === "gzip" ? gzipSync(body.body) : deflateSync(body.body)
-    return HttpServerResponse.setHeader(
-      HttpServerResponse.setBody(response, HttpBody.uint8Array(compressed, contentType)),
-      "content-encoding",
-      encoding,
-    )
-  }),
-).layer

package/src/server/routes/instance/httpapi/middleware/cors-vary.ts

@@ -1,29 +0,0 @@
-import { Effect } from "effect"
-import { HttpRouter, HttpServerResponse } from "effect/unstable/http"
-
-// effect-smol's HttpMiddleware.cors builds OPTIONS preflight responses by
-// spreading allowOrigin() and allowHeaders() into the same record. Both set
-// the `vary` key, so allowHeaders' `Vary: Access-Control-Request-Headers`
-// overwrites allowOrigin's `Vary: Origin`. With dynamic origin echoing, the
-// missing `Vary: Origin` lets shared caches reuse a preflight cached for one
-// origin against a different origin.
-//
-// TODO: upstream a fix that merges Vary values in headersFromRequestOptions
-// (packages/effect/src/unstable/http/HttpMiddleware.ts ~line 332).
-export const corsVaryFix = HttpRouter.middleware(
-  (effect) =>
-    Effect.gen(function* () {
-      const response = yield* effect
-      const allowOrigin = response.headers["access-control-allow-origin"]
-      if (!allowOrigin || allowOrigin === "*") return response
-
-      const vary = response.headers["vary"]
-      if (!vary) return HttpServerResponse.setHeader(response, "vary", "Origin")
-
-      const tokens = vary.split(",").map((s) => s.trim().toLowerCase())
-      if (tokens.includes("origin") || tokens.includes("*")) return response
-
-      return HttpServerResponse.setHeader(response, "vary", `${vary}, Origin`)
-    }),
-  { global: true },
-)

package/src/server/routes/instance/httpapi/middleware/error.ts

@@ -1,44 +0,0 @@
-import { NamedError } from "@soraacode/core/util/error"
-import { ConfigErrorV1 } from "@soraacode/core/v1/config/error"
-import { Cause, Effect } from "effect"
-import { HttpRouter, HttpServerError, HttpServerRespondable, HttpServerResponse } from "effect/unstable/http"
-
-// Keep typed HttpApi failures on their declared error path; this boundary only replaces defect-only empty 500s.
-export const errorLayer = HttpRouter.middleware<{ handles: unknown }>()((effect) =>
-  effect.pipe(
-    Effect.catchCause((cause) => {
-      const defect = cause.reasons.filter(Cause.isDieReason).find((reason) => {
-        if (HttpServerResponse.isHttpServerResponse(reason.defect)) return false
-        if (HttpServerError.isHttpServerError(reason.defect)) return false
-        if (HttpServerRespondable.isRespondable(reason.defect)) return false
-        return true
-      })
-      if (!defect) return Effect.failCause(cause)
-
-      const error = defect.defect
-      if (
-        ConfigErrorV1.JsonError.isInstance(error) ||
-        ConfigErrorV1.InvalidError.isInstance(error) ||
-        ConfigErrorV1.FrontmatterError.isInstance(error) ||
-        ConfigErrorV1.DirectoryTypoError.isInstance(error) ||
-        ConfigErrorV1.RemoteAuthError.isInstance(error)
-      ) {
-        return Effect.succeed(HttpServerResponse.jsonUnsafe(error.toObject(), { status: 400 }))
-      }
-
-      const ref = `err_${crypto.randomUUID().slice(0, 8)}`
-
-      return Effect.logError("failed", { ref, error, cause: Cause.pretty(cause) }).pipe(
-        Effect.as(
-          HttpServerResponse.jsonUnsafe(
-            new NamedError.Unknown({
-              message: "Unexpected server error. Check server logs for details.",
-              ref,
-            }).toObject(),
-            { status: 500 },
-          ),
-        ),
-      )
-    }),
-  ),
-).layer

package/src/server/routes/instance/httpapi/middleware/fence.ts

@@ -1,25 +0,0 @@
-import { Flag } from "@soraacode/core/flag/flag"
-import { Database } from "@soraacode/core/database/database"
-import { Effect } from "effect"
-import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
-import * as Fence from "@/server/shared/fence"
-
-const ignoredMethods = new Set(["GET", "HEAD", "OPTIONS"])
-
-export const fenceLayer = HttpRouter.middleware<{ requires: Database.Service; handles: unknown }>()(
-  Effect.gen(function* () {
-    const { db } = yield* Database.Service
-    return (effect) =>
-      Effect.gen(function* () {
-        const request = yield* HttpServerRequest.HttpServerRequest
-        if (!Flag.OPENCODE_WORKSPACE_ID || ignoredMethods.has(request.method)) return yield* effect
-
-        const previous = yield* Fence.load(db)
-        const response = yield* effect
-        const current = Fence.diff(previous, yield* Fence.load(db))
-        if (Object.keys(current).length === 0) return response
-
-        return HttpServerResponse.setHeader(response, Fence.HEADER, JSON.stringify(current))
-      })
-  }),
-).layer

package/src/server/routes/instance/httpapi/middleware/instance-context.ts

@@ -1,43 +0,0 @@
-import { InstanceRef, WorkspaceRef } from "@/effect/instance-ref"
-import { InstanceStore } from "@/project/instance-store"
-import { Effect, Layer } from "effect"
-import { HttpServerResponse } from "effect/unstable/http"
-import { HttpApiMiddleware } from "effect/unstable/httpapi"
-import { WorkspaceRouteContext } from "./workspace-routing"
-
-export class InstanceContextMiddleware extends HttpApiMiddleware.Service<
-  InstanceContextMiddleware,
-  {
-    requires: WorkspaceRouteContext
-  }
->()("@opencode/ExperimentalHttpApiInstanceContext") {}
-
-function decode(input: string): string {
-  try {
-    return decodeURIComponent(input)
-  } catch {
-    return input
-  }
-}
-
-function provideInstanceContext<E>(
-  effect: Effect.Effect<HttpServerResponse.HttpServerResponse, E>,
-  store: InstanceStore.Interface,
-): Effect.Effect<HttpServerResponse.HttpServerResponse, E, WorkspaceRouteContext> {
-  return Effect.gen(function* () {
-    const route = yield* WorkspaceRouteContext
-    const ctx = yield* store.load({ directory: decode(route.directory) })
-    return yield* effect.pipe(
-      Effect.provideService(InstanceRef, ctx),
-      Effect.provideService(WorkspaceRef, route.workspaceID),
-    )
-  })
-}
-
-export const instanceContextLayer = Layer.effect(
-  InstanceContextMiddleware,
-  Effect.gen(function* () {
-    const store = yield* InstanceStore.Service
-    return InstanceContextMiddleware.of((effect) => provideInstanceContext(effect, store))
-  }),
-)

package/src/server/routes/instance/httpapi/middleware/proxy.ts

@@ -1,131 +0,0 @@
-import { ProxyUtil } from "@/server/proxy-util"
-import { Effect, Stream } from "effect"
-import { HttpBody, HttpClient, HttpClientRequest, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
-import * as Socket from "effect/unstable/socket/Socket"
-import { WebSocketTracker } from "../websocket-tracker"
-
-function requestBody(request: HttpServerRequest.HttpServerRequest) {
-  if (request.method === "GET" || request.method === "HEAD") return HttpBody.empty
-  if (request.source instanceof Request && request.source.body === null) return HttpBody.empty
-  const len = request.headers["content-length"]
-  return HttpBody.stream(request.stream, request.headers["content-type"], len ? Number(len) : undefined)
-}
-
-export function websocket(
-  request: HttpServerRequest.HttpServerRequest,
-  target: string | URL,
-): Effect.Effect<HttpServerResponse.HttpServerResponse, never, Socket.WebSocketConstructor> {
-  return Effect.scoped(
-    Effect.gen(function* () {
-      const inbound = yield* Effect.orDie(request.upgrade)
-      const outbound = yield* Socket.makeWebSocket(ProxyUtil.websocketTargetURL(target), {
-        protocols: ProxyUtil.websocketProtocols(request.headers),
-      })
-      const writeInbound = yield* inbound.writer
-      const writeOutbound = yield* outbound.writer
-      const closeSocket = (socket: Socket.Socket, write: (event: Socket.CloseEvent) => Effect.Effect<void, unknown>) =>
-        socket
-          .runRaw(() => Effect.void, {
-            onOpen: write(WebSocketTracker.SERVER_CLOSING_EVENT()).pipe(Effect.catch(() => Effect.void)),
-          })
-          .pipe(
-            Effect.timeout("1 second"),
-            Effect.catchReason("SocketError", "SocketCloseError", () => Effect.void),
-            Effect.catch(() => Effect.void),
-          )
-      const closeAccepted = Effect.all([closeSocket(inbound, writeInbound), closeSocket(outbound, writeOutbound)], {
-        concurrency: "unbounded",
-        discard: true,
-      })
-      const registered = yield* WebSocketTracker.register(
-        Effect.all(
-          [
-            writeInbound(WebSocketTracker.SERVER_CLOSING_EVENT()),
-            writeOutbound(WebSocketTracker.SERVER_CLOSING_EVENT()),
-          ],
-          { concurrency: "unbounded", discard: true },
-        ),
-      )
-      if (!registered) {
-        yield* closeAccepted
-        return HttpServerResponse.empty()
-      }
-
-      yield* outbound
-        .runRaw((message) => writeInbound(message))
-        .pipe(
-          Effect.catchReason("SocketError", "SocketCloseError", (reason) =>
-            writeInbound(new Socket.CloseEvent(reason.code, reason.closeReason)).pipe(Effect.catch(() => Effect.void)),
-          ),
-          Effect.catch(() =>
-            writeInbound(new Socket.CloseEvent(1011, "proxy error")).pipe(Effect.catch(() => Effect.void)),
-          ),
-          Effect.forkScoped,
-        )
-
-      yield* inbound
-        .runRaw((message) => {
-          return writeOutbound(typeof message === "string" ? message : message.slice())
-        })
-        .pipe(
-          Effect.catch(() => Effect.void),
-          Effect.ensuring(writeOutbound(new Socket.CloseEvent()).pipe(Effect.catch(() => Effect.void))),
-        )
-      return HttpServerResponse.empty()
-    }).pipe(Effect.orDie),
-  )
-}
-
-function statusText(response: unknown) {
-  return (response as { source?: Response }).source?.statusText
-}
-
-export function http(
-  client: HttpClient.HttpClient,
-  url: string | URL,
-  extra: HeadersInit | undefined,
-  request: HttpServerRequest.HttpServerRequest,
-): Effect.Effect<HttpServerResponse.HttpServerResponse> {
-  return Effect.gen(function* () {
-    const response = yield* client.execute(
-      HttpClientRequest.make(request.method as never)(url, {
-        headers: ProxyUtil.headers(request.headers as HeadersInit, extra),
-        body: requestBody(request),
-      }),
-    )
-    const headers = new Headers(response.headers as HeadersInit)
-    headers.delete("content-encoding")
-    headers.delete("content-length")
-
-    // An upstream 5xx from a remote workspace sandbox arrives here as an opaque
-    // status — its real cause (and log line) live only inside the sandbox. Buffer
-    // the small error body, log it locally so it shows up in the host's log, and
-    // forward it unchanged (preserving content-type so the client can still parse
-    // the structured error, e.g. its `ref`).
-    if (response.status >= 500) {
-      const body = yield* response.text.pipe(Effect.catch(() => Effect.succeed("")))
-      const contentType = response.headers["content-type"] ?? "application/json"
-      headers.delete("content-type")
-      yield* Effect.logError("workspace proxy upstream error", {
-        url: url.toString(),
-        method: request.method,
-        status: response.status,
-        body: body.slice(0, 2000),
-      })
-      return HttpServerResponse.text(body, {
-        status: response.status,
-        statusText: statusText(response),
-        headers,
-        contentType,
-      })
-    }
-
-    return HttpServerResponse.stream(response.stream.pipe(Stream.catchCause(() => Stream.empty)), {
-      status: response.status,
-      statusText: statusText(response),
-      headers,
-    })
-  }).pipe(Effect.catch(() => Effect.succeed(HttpServerResponse.empty({ status: 500 }))))
-}
-
-export * as HttpApiProxy from "./proxy"