gemcode 0.4.25__tar.gz → 0.4.27__tar.gz

{gemcode-0.4.25/src/gemcode.egg-info → gemcode-0.4.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gemcode
-Version: 0.4.25
+Version: 0.4.27
 Summary: Local-first coding agent on Google Gemini + ADK
 Author: GemCode Contributors
 License:                                  Apache License

{gemcode-0.4.25 → gemcode-0.4.27}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gemcode"
-version = "0.4.25"
+version = "0.4.27"
 description = "Local-first coding agent on Google Gemini + ADK"
 readme = "README.md"
 requires-python = ">=3.11"

{gemcode-0.4.25 → gemcode-0.4.27}/src/gemcode/web/hitl_bridge.py

@@ -1,4 +1,10 @@
-"""File-based HITL approval bridge for web chat (subprocess-safe)."""
+"""File-based HITL approval bridge for web chat (subprocess-safe).
+
+Chat SSE runs in a ``gemcode.web.sse_adapter`` subprocess while
+``POST /api/chat/approve`` is handled by the parent ``gemcode serve`` process.
+In-memory waiter sets therefore cannot detect “live” approvals across that
+boundary — use ``*.waiting`` marker files on the shared approval dir instead.
+"""
 
 from __future__ import annotations
 
@@ -17,22 +23,64 @@ def _approval_dir() -> Path:
   return Path.home() / ".gemcode" / "web_approvals"
 _DEFAULT_TIMEOUT_S = float(os.environ.get("GEMCODE_WEB_HITL_TIMEOUT_S", "3600"))
 _POLL_INTERVAL_S = 0.25
-# approval_ids currently blocked in wait_for_web_approval (same process)
+# Same-process hints only (parent server never shares these with sse_adapter).
 _active_waiters: set[str] = set()
-# emitted to the UI but wait_for_web_approval not started yet (preflight)
 _pending_approval_ids: set[str] = set()
 
 
+def _safe_id(approval_id: str) -> str:
+  return "".join(c if c.isalnum() or c in "-_:" else "_" for c in approval_id)
+
+
+def _approval_path(approval_id: str) -> Path:
+  return _approval_dir() / f"{_safe_id(approval_id)}.json"
+
+
+def _waiting_path(approval_id: str) -> Path:
+  """Marker written by the SSE subprocess while an approval is expected/active."""
+  return _approval_dir() / f"{_safe_id(approval_id)}.waiting"
+
+
+def _is_live_approval(approval_id: str) -> bool:
+  """True if a chat turn is still waiting for this approval (cross-process safe)."""
+  aid = (approval_id or "").strip()
+  if not aid:
+    return False
+  if aid in _active_waiters or aid in _pending_approval_ids:
+    return True
+  try:
+    path = _waiting_path(aid)
+    if not path.is_file():
+      return False
+    # Heartbeats refresh mtime; stale markers mean the SSE subprocess died.
+    age_s = time.time() - path.stat().st_mtime
+    return age_s < 90.0
+  except OSError:
+    return False
+
+
 def register_pending_approval(approval_id: str) -> None:
   """Mark an approval as expected so early UI clicks are not reported as late."""
   aid = (approval_id or "").strip()
-  if aid:
-    _pending_approval_ids.add(aid)
+  if not aid:
+    return
+  _pending_approval_ids.add(aid)
+  _touch_waiting(aid)
 
 
-def _approval_path(approval_id: str) -> Path:
-  safe = "".join(c if c.isalnum() or c in "-_:" else "_" for c in approval_id)
-  return _approval_dir() / f"{safe}.json"
+def _touch_waiting(approval_id: str) -> None:
+  try:
+    _approval_dir().mkdir(parents=True, exist_ok=True)
+    _waiting_path(approval_id).write_text(f"{time.time():.3f}\n", encoding="utf-8")
+  except OSError:
+    pass
+
+
+def _clear_waiting_marker(approval_id: str) -> None:
+  try:
+    _waiting_path(approval_id).unlink(missing_ok=True)
+  except OSError:
+    pass
 
 
 def _read_approval_file(path: Path) -> bool | None:
@@ -60,14 +108,16 @@ def resolve_web_approval(approval_id: str, *, confirmed: bool) -> dict[str, Any]
     return {"ok": False, "error": "approval_id is required"}
   _approval_dir().mkdir(parents=True, exist_ok=True)
   path = _approval_path(approval_id)
+  # Detect live wait BEFORE writing; marker is owned by the SSE subprocess.
+  live = _is_live_approval(approval_id)
   payload = {"confirmed": bool(confirmed), "resolved_ms": int(time.time() * 1000)}
   path.write_text(json.dumps(payload), encoding="utf-8")
-  late = approval_id not in _active_waiters and approval_id not in _pending_approval_ids
   return {
     "ok": True,
     "approval_id": approval_id,
     "confirmed": bool(confirmed),
-    "late": late,
+    # late = no waiter — UI may start a recovery turn. Never true while SSE waits.
+    "late": not live,
   }
 
 
@@ -81,14 +131,18 @@ async def wait_for_web_approval(
   """Block until the user approves/denies or timeout (deny on timeout)."""
   _approval_dir().mkdir(parents=True, exist_ok=True)
   path = _approval_path(approval_id)
+  register_pending_approval(approval_id)
 
   # User may have approved before we started waiting (preflight UI is immediate).
   existing = _read_approval_file(path)
   if existing is not None:
+    _pending_approval_ids.discard(approval_id)
+    _clear_waiting_marker(approval_id)
     return existing
 
   _pending_approval_ids.discard(approval_id)
   _active_waiters.add(approval_id)
+  _touch_waiting(approval_id)
   try:
     deadline = time.monotonic() + max(1.0, timeout_s)
     next_hb = time.monotonic()
@@ -98,17 +152,20 @@ async def wait_for_web_approval(
         if result is not None:
           return result
       now = time.monotonic()
-      if heartbeat is not None and now >= next_hb:
-        try:
-          heartbeat()
-        except Exception:
-          pass
+      if now >= next_hb:
+        _touch_waiting(approval_id)
+        if heartbeat is not None:
+          try:
+            heartbeat()
+          except Exception:
+            pass
         next_hb = now + max(5.0, heartbeat_s)
       await asyncio.sleep(_POLL_INTERVAL_S)
     return False
   finally:
     _active_waiters.discard(approval_id)
     _pending_approval_ids.discard(approval_id)
+    _clear_waiting_marker(approval_id)
 
 
 def new_approval_id(session_id: str, fc_id: str | None) -> str:

gemcode-0.4.27/src/gemcode/web/preview_api.py

@@ -0,0 +1,363 @@
+"""Detect local (or tenant-pod) dev servers and reverse-proxy them for the web UI."""
+
+from __future__ import annotations
+
+import atexit
+import socket
+import subprocess
+import sys
+import threading
+import time
+from http.client import HTTPConnection
+from pathlib import Path
+from typing import Any
+from urllib.error import URLError
+from urllib.parse import quote, unquote
+from urllib.request import Request, urlopen
+
+# Common dev-server ports (GemCode web UI uses 3002; API 3001)
+COMMON_DEV_PORTS = (
+  3000,
+  3003,
+  3004,
+  5173,
+  5174,
+  8080,
+  8000,
+  4200,
+  5000,
+  4321,
+  8888,
+  5500,
+)
+
+# When nothing listens, auto-start ``python -m http.server`` for static HTML previews.
+# Skip framework ports (Vite/Next) so we do not mask a missing ``npm run dev``.
+STATIC_AUTOSTART_PORTS = frozenset({8000, 8080, 5500, 8888, 5000, 4321})
+
+_STRIP_RESPONSE_HEADERS = frozenset(
+  {
+    "transfer-encoding",
+    "connection",
+    "content-length",
+    "content-encoding",
+    "x-frame-options",
+    "content-security-policy",
+    "content-security-policy-report-only",
+  }
+)
+
+_server_lock = threading.Lock()
+_managed_servers: dict[int, subprocess.Popen[bytes]] = {}
+
+
+def _port_open(host: str, port: int, *, timeout: float = 0.2) -> bool:
+  try:
+    with socket.create_connection((host, port), timeout=timeout):
+      return True
+  except OSError:
+    return False
+
+
+def _probe_http(url: str, *, timeout: float = 1.5) -> dict[str, Any] | None:
+  try:
+    req = Request(url, headers={"User-Agent": "GemCode-Web-Preview/1.0"})
+    with urlopen(req, timeout=timeout) as resp:
+      ctype = (resp.headers.get("Content-Type") or "").lower()
+      return {
+        "ok": True,
+        "status": resp.status,
+        "content_type": ctype,
+      }
+  except (URLError, OSError, TimeoutError, ValueError):
+    return None
+
+
+def scan_local_preview_ports(
+  *,
+  host: str = "127.0.0.1",
+  extra_ports: list[int] | None = None,
+) -> list[dict[str, Any]]:
+  """Return listening HTTP-ish ports on localhost (tenant pod when hosted)."""
+  ports: list[int] = list(COMMON_DEV_PORTS)
+  if extra_ports:
+    for p in extra_ports:
+      if isinstance(p, int) and 1 < p < 65536 and p not in ports:
+        ports.append(p)
+
+  found: list[dict[str, Any]] = []
+  for port in ports:
+    if not _port_open(host, port):
+      continue
+    url = f"http://{host}:{port}"
+    probe = _probe_http(url)
+    found.append(
+      {
+        "port": port,
+        "url": url,
+        "reachable": probe is not None,
+        "content_type": (probe or {}).get("content_type"),
+      }
+    )
+  return found
+
+
+def handle_preview_get(kind: str) -> tuple[int, dict[str, Any]]:
+  k = (kind or "ports").strip().lower()
+  if k == "ports":
+    ports = scan_local_preview_ports()
+    return 200, {"ok": True, "ports": ports, "host": "127.0.0.1"}
+  return 400, {"ok": False, "error": f"Unknown preview kind: {kind}"}
+
+
+def _inject_base_href(html: str, base_path: str) -> str:
+  base_tag = f'<base href="{base_path}">'
+  if "<base " in html.lower():
+    return html
+  lower = html.lower()
+  idx = lower.find("<head")
+  if idx >= 0:
+    gt = html.find(">", idx)
+    if gt >= 0:
+      return html[: gt + 1] + base_tag + html[gt + 1 :]
+  return base_tag + html
+
+
+def _proxy_base_for_path(port: int, request_path: str) -> str:
+  """``/api/preview/proxy/{port}/…/`` directory for relative assets."""
+  path = request_path.split("?", 1)[0] or "/"
+  if path.endswith("/"):
+    dir_path = path
+  elif "/" in path:
+    dir_path = path.rsplit("/", 1)[0] + "/"
+  else:
+    dir_path = "/"
+  if not dir_path.startswith("/"):
+    dir_path = "/" + dir_path
+  # Encode each segment so spaces in folder names work in <base href>
+  parts = [quote(seg, safe="") for seg in dir_path.split("/") if seg]
+  encoded = "/" + "/".join(parts) + ("/" if parts or dir_path.endswith("/") else "")
+  if encoded == "//" or encoded == "":
+    encoded = "/"
+  elif not encoded.endswith("/"):
+    encoded += "/"
+  return f"/api/preview/proxy/{port}{encoded}"
+
+
+def _cleanup_managed_servers() -> None:
+  with _server_lock:
+    for proc in _managed_servers.values():
+      try:
+        proc.terminate()
+      except Exception:
+        pass
+    _managed_servers.clear()
+
+
+atexit.register(_cleanup_managed_servers)
+
+
+def ensure_workspace_static_server(port: int, root: Path) -> tuple[bool, str | None]:
+  """
+  Ensure something accepts TCP on ``127.0.0.1:port``.
+
+  If the port is free and eligible, start ``python -m http.server`` in ``root``.
+  Returns (ok, note).
+  """
+  if _port_open("127.0.0.1", port, timeout=0.35):
+    return True, None
+  if port not in STATIC_AUTOSTART_PORTS:
+    return False, (
+      f"No server on :{port}. Start your app in the workspace "
+      f"(e.g. npm run dev) or use a static port like 8000."
+    )
+  root = root.expanduser().resolve()
+  if not root.is_dir():
+    return False, f"Workspace root is not a directory: {root}"
+
+  with _server_lock:
+    if _port_open("127.0.0.1", port, timeout=0.35):
+      return True, None
+    existing = _managed_servers.get(port)
+    if existing is not None and existing.poll() is None:
+      for _ in range(25):
+        if _port_open("127.0.0.1", port, timeout=0.2):
+          return True, "managed"
+        if existing.poll() is not None:
+          break
+        time.sleep(0.08)
+    try:
+      proc = subprocess.Popen(
+        [
+          sys.executable,
+          "-m",
+          "http.server",
+          str(port),
+          "--bind",
+          "127.0.0.1",
+        ],
+        cwd=str(root),
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+        start_new_session=True,
+      )
+    except OSError as exc:
+      return False, f"Could not start static preview server: {exc}"
+    _managed_servers[port] = proc
+    for _ in range(30):
+      if _port_open("127.0.0.1", port, timeout=0.2):
+        return True, "started"
+      if proc.poll() is not None:
+        _managed_servers.pop(port, None)
+        return False, "Static preview server exited immediately (port may be busy)."
+      time.sleep(0.08)
+    return False, "Timed out waiting for static preview server."
+
+
+def handle_preview_proxy(
+  port: int,
+  sub_path: str = "/",
+  *,
+  query: str = "",
+  workspace_root: str | Path | None = None,
+) -> tuple[int, bytes, dict[str, str]]:
+  """
+  Reverse-proxy HTTP from 127.0.0.1:{port} (on this process / tenant pod).
+
+  If nothing is listening and ``port`` is a static preview port, auto-start
+  ``python -m http.server`` in the workspace so HTML apps work without a
+  manual ``bash`` step (hosted GKE).
+
+  Returns (status, body, response_headers).
+  """
+  if not isinstance(port, int) or port < 1 or port > 65535:
+    return 400, b'{"error":"Invalid port"}', {"Content-Type": "application/json; charset=utf-8"}
+
+  # Block GemCode's own API/UI ports from being framed as "app preview"
+  if port in (3001, 3002):
+    return (
+      400,
+      b'{"error":"Port reserved for GemCode API/UI"}',
+      {"Content-Type": "application/json; charset=utf-8"},
+    )
+
+  raw = sub_path or "/"
+  if not raw.startswith("/"):
+    raw = "/" + raw
+  # Collapse .. segments
+  parts: list[str] = []
+  for seg in raw.split("/"):
+    if seg in ("", "."):
+      continue
+    if seg == "..":
+      if parts:
+        parts.pop()
+      continue
+    parts.append(seg)
+  path = "/" + "/".join(parts)
+  if raw.endswith("/") and path != "/":
+    path += "/"
+
+  qs = (query or "").lstrip("?")
+  request_path = path if not qs else f"{path}?{qs}"
+
+  # Encode path for the upstream request (spaces in folder names).
+  upstream_path = "/" + "/".join(quote(seg, safe="") for seg in parts)
+  if path.endswith("/") and upstream_path != "/":
+    upstream_path += "/"
+  if not qs:
+    upstream_request = upstream_path
+  else:
+    upstream_request = f"{upstream_path}?{qs}"
+
+  root: Path | None = None
+  if workspace_root:
+    try:
+      root = Path(workspace_root).expanduser().resolve()
+    except OSError:
+      root = None
+
+  def _fetch() -> tuple[int, bytes, str, list[tuple[str, str]]]:
+    conn = HTTPConnection("127.0.0.1", port, timeout=20.0)
+    conn.request(
+      "GET",
+      upstream_request,
+      headers={"User-Agent": "GemCode-Web-Preview/1.0", "Accept": "*/*"},
+    )
+    resp = conn.getresponse()
+    body = resp.read()
+    ctype = (resp.getheader("Content-Type") or "").lower()
+    headers_list = resp.getheaders()
+    status = int(resp.status)
+    conn.close()
+    return status, body, ctype, headers_list
+
+  try:
+    status, body, ctype, headers_list = _fetch()
+  except OSError as first_exc:
+    note: str | None = None
+    if root is not None:
+      ok, note = ensure_workspace_static_server(port, root)
+      if ok:
+        try:
+          time.sleep(0.05)
+          status, body, ctype, headers_list = _fetch()
+        except OSError as second_exc:
+          msg = (
+            f'{{"error":"Preview upstream unreachable after starting static server: '
+            f'{type(second_exc).__name__}: {second_exc}"}}'
+          )
+          return 502, msg.encode(), {"Content-Type": "application/json; charset=utf-8"}
+      else:
+        detail = note or str(first_exc)
+        msg = f'{{"error":"Preview upstream unreachable: {detail}"}}'
+        return 502, msg.encode(), {"Content-Type": "application/json; charset=utf-8"}
+    else:
+      msg = f'{{"error":"Preview upstream unreachable: {type(first_exc).__name__}: {first_exc}"}}'
+      return 502, msg.encode(), {"Content-Type": "application/json; charset=utf-8"}
+
+  headers: dict[str, str] = {}
+  for key, value in headers_list:
+    if key.lower() in _STRIP_RESPONSE_HEADERS:
+      continue
+    headers[key] = value
+
+  proxy_base = _proxy_base_for_path(port, path)
+  if "text/html" in ctype:
+    try:
+      text = body.decode("utf-8", errors="replace")
+      text = _inject_base_href(text, proxy_base)
+      body = text.encode("utf-8")
+      headers["Content-Type"] = "text/html; charset=utf-8"
+    except Exception:
+      pass
+
+  headers["Cache-Control"] = "no-store"
+  headers["X-Frame-Options"] = "SAMEORIGIN"
+  headers["Content-Security-Policy"] = (
+    "default-src * 'unsafe-inline' 'unsafe-eval' data: blob:; "
+    "script-src * 'unsafe-inline' 'unsafe-eval'; style-src * 'unsafe-inline'; "
+    "frame-ancestors 'self';"
+  )
+  return status, body, headers
+
+
+def parse_preview_proxy_path(raw_path: str) -> tuple[int, str] | None:
+  """Parse `/api/preview/proxy/{port}` or `/api/preview/proxy/{port}/...` → (port, sub_path)."""
+  prefix = "/api/preview/proxy/"
+  if not raw_path.startswith(prefix):
+    return None
+  rest = raw_path[len(prefix) :]
+  if not rest:
+    return None
+  parts = rest.split("/", 1)
+  try:
+    port = int(parts[0])
+  except ValueError:
+    return None
+  sub = "/"
+  if len(parts) > 1 and parts[1]:
+    sub = "/" + unquote(parts[1])
+  elif rest.endswith("/") or raw_path.endswith("/"):
+    sub = "/"
+  return port, sub

{gemcode-0.4.25 → gemcode-0.4.27}/src/gemcode/web/server.py

@@ -318,7 +318,7 @@ def _build_handler(project_root: str) -> type[BaseHTTPRequestHandler]:
           else:
             port, sub_path = parsed_proxy
             status, body, hdrs = handle_preview_proxy(
-              port, sub_path, query=parsed.query or ""
+              port, sub_path, query=parsed.query or "", workspace_root=root
             )
         except Exception as exc:
           status = 500

{gemcode-0.4.25 → gemcode-0.4.27}/src/gemcode/web/sse_adapter.py

@@ -512,10 +512,15 @@ def _inject_web_code_context(cfg: GemCodeConfig, prompt: str, req: dict[str, Any
   else:
     lines.append(
       "**Web UI permissions — interactive.** Shell and mutating tools pause for an "
-      "**inline Yes/No card in the chat** (also pinned above the composer). "
+      "**inline Yes/No card in the chat**. "
       "Do **not** invent Approve/Deny dialog text or tell the user to open a popup — "
       "wait silently; after they tap Yes or No the turn continues."
     )
+  lines.append(
+    "**Web preview:** For static HTML/CSS/JS, prefer `http://localhost:8000/...` links. "
+    "GemCode will auto-serve the workspace on common static ports (8000/8080/…) when "
+    "nothing is listening. For Vite/Next (3000/5173), start the real dev server with bash first."
+  )
 
   if mode == "agents":
     lines.extend(

{gemcode-0.4.25 → gemcode-0.4.27/src/gemcode.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gemcode
-Version: 0.4.25
+Version: 0.4.27
 Summary: Local-first coding agent on Google Gemini + ADK
 Author: GemCode Contributors
 License:                                  Apache License

{gemcode-0.4.25 → gemcode-0.4.27}/src/gemcode.egg-info/SOURCES.txt

@@ -174,6 +174,7 @@ tests/test_files_api.py
 tests/test_fleet_reports.py
 tests/test_habit_chains.py
 tests/test_habit_runs.py
+tests/test_hitl_bridge_cross_process.py
 tests/test_hosted_tenant.py
 tests/test_ide_stdio_attachments.py
 tests/test_interactive_permission_ask.py

gemcode-0.4.27/tests/test_hitl_bridge_cross_process.py

@@ -0,0 +1,53 @@
+"""Cross-process HITL late detection (parent approve vs sse_adapter wait)."""
+
+from __future__ import annotations
+
+import asyncio
+from pathlib import Path
+
+from gemcode.web import hitl_bridge
+
+
+def test_resolve_not_late_when_waiting_marker_exists(tmp_path: Path, monkeypatch) -> None:
+  monkeypatch.setenv("GEMCODE_HOSTED_TENANT_ROOT", str(tmp_path))
+  aid = "sess:tool1"
+  hitl_bridge.register_pending_approval(aid)
+  assert (tmp_path / ".gemcode" / "web_approvals" / "sess:tool1.waiting").is_file()
+
+  # Simulate parent process: clear in-memory sets (as if another process).
+  hitl_bridge._pending_approval_ids.clear()
+  hitl_bridge._active_waiters.clear()
+
+  out = hitl_bridge.resolve_web_approval(aid, confirmed=True)
+  assert out["ok"] is True
+  assert out["late"] is False
+
+
+def test_resolve_late_when_no_waiter(tmp_path: Path, monkeypatch) -> None:
+  monkeypatch.setenv("GEMCODE_HOSTED_TENANT_ROOT", str(tmp_path))
+  hitl_bridge._pending_approval_ids.clear()
+  hitl_bridge._active_waiters.clear()
+  out = hitl_bridge.resolve_web_approval("sess:orphan", confirmed=True)
+  assert out["ok"] is True
+  assert out["late"] is True
+
+
+def test_wait_picks_up_parent_resolve(tmp_path: Path, monkeypatch) -> None:
+  monkeypatch.setenv("GEMCODE_HOSTED_TENANT_ROOT", str(tmp_path))
+  aid = "sess:bash1"
+
+  async def _run() -> bool:
+    async def approve_soon() -> None:
+      await asyncio.sleep(0.35)
+      # Parent server process has empty in-memory waiter sets.
+      hitl_bridge._pending_approval_ids.clear()
+      hitl_bridge._active_waiters.clear()
+      out = hitl_bridge.resolve_web_approval(aid, confirmed=True)
+      assert out["late"] is False  # *.waiting marker from waiter process
+
+    task = asyncio.create_task(approve_soon())
+    confirmed = await hitl_bridge.wait_for_web_approval(aid, timeout_s=5.0)
+    await task
+    return confirmed
+
+  assert asyncio.run(_run()) is True

gemcode-0.4.27/tests/test_preview_proxy.py

@@ -0,0 +1,65 @@
+"""Tests for preview proxy path parsing and static autostart."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+from gemcode.web import preview_api
+from gemcode.web.preview_api import parse_preview_proxy_path
+
+
+def test_parse_preview_proxy_root() -> None:
+  assert parse_preview_proxy_path("/api/preview/proxy/8000") == (8000, "/")
+  assert parse_preview_proxy_path("/api/preview/proxy/8000/") == (8000, "/")
+
+
+def test_parse_preview_proxy_subpath() -> None:
+  assert parse_preview_proxy_path("/api/preview/proxy/5173/assets/app.js") == (
+    5173,
+    "/assets/app.js",
+  )
+
+
+def test_parse_preview_proxy_space_path() -> None:
+  assert parse_preview_proxy_path("/api/preview/proxy/8000/final%20todo/index.html") == (
+    8000,
+    "/final todo/index.html",
+  )
+
+
+def test_parse_preview_proxy_invalid() -> None:
+  assert parse_preview_proxy_path("/api/preview") is None
+  assert parse_preview_proxy_path("/api/preview/proxy/") is None
+  assert parse_preview_proxy_path("/api/preview/proxy/abc") is None
+
+
+def test_proxy_base_for_nested_html() -> None:
+  assert preview_api._proxy_base_for_path(8000, "/final todo/index.html") == (
+    "/api/preview/proxy/8000/final%20todo/"
+  )
+
+
+def test_static_autostart_serves_workspace(tmp_path: Path) -> None:
+  (tmp_path / "hello.html").write_text("<html><body>hi</body></html>", encoding="utf-8")
+  port = 18765
+  original = preview_api.STATIC_AUTOSTART_PORTS
+  preview_api.STATIC_AUTOSTART_PORTS = frozenset(set(original) | {port})
+  try:
+    status, body, headers = preview_api.handle_preview_proxy(
+      port,
+      "/hello.html",
+      workspace_root=tmp_path,
+    )
+    assert status == 200
+    assert b"hi" in body
+    assert "text/html" in headers.get("Content-Type", "")
+  finally:
+    preview_api.STATIC_AUTOSTART_PORTS = original
+    with preview_api._server_lock:
+      proc = preview_api._managed_servers.pop(port, None)
+    if proc is not None and proc.poll() is None:
+      proc.terminate()
+      try:
+        proc.wait(timeout=2)
+      except Exception:
+        proc.kill()