mirror of
https://github.com/Ark0N/Codeman.git
synced 2026-09-30 20:49:41 +02:00
Codeman maintainer
c30dfaf0e7
Clicking "DeepSeek web UI..." opened two tabs: the web tab asked for, and a shell tab running the server next to it. The shell was deliberate - the server lived in an ordinary session so it was visible, scrollable, killable and died with its tab, and nothing new had to supervise a long-lived HTTP server. That reasoning was sound and the result was still wrong in use: opening a dashboard should open one tab, and after the first launch the terminal is pure noise. The server moves to a background child process owned by a new `src/deepseek-web-server.ts`, behind `POST /api/deepseek/web`. What the session gave away for free is now explicit, which is most of the module: - Exactly one server. A second click reuses the running one instead of racing it for a port; the session flow could not do this at all, because two clicks were simply two sessions. - Restarted when the requested authority changes. `--trusted-host` fences dsh's own /api against the browser authority, and a Codeman reachable at both loopback and a tailnet name has two. Reusing a server fenced for the other origin renders a page whose every call 403s, which reads as a broken dashboard rather than a misconfigured one, so a mismatch restarts instead. - Killed on shutdown. The child is detached so its whole plugin tree can be signalled at once, which also means it would outlive Codeman and hold its port against the next start - the exact EADDRINUSE this feature already got wrong once. - Boot output captured and returned. With no shell tab there is nowhere else for a stack trace to land, so a failed spawn reports its own tail. The endpoint is fenced at the same bar as the profile installer and for the same reason: booting a dsh profile executes the plugin code in it, so this is a privileged action even though it reads as "open a page". `authority` comes from the client (`location.host`) because only the browser knows which origin is in play, and it is regex-confined at the schema boundary - defence in depth behind the argv-array spawn, admitting host:port in the shapes a browser authority can take and nothing readable as a second argument. `GET /api/deepseek/web-port` is gone; port selection moved into the supervisor, which is the thing that knows whether a server is already running. The two client-side probe helpers went with it, since the server now owns the wait. Verified over the tailnet authority end to end: no session is created (session count unchanged, one tab), the server runs on 3081 beside the user's own dsh web on 3080, status reports the tailnet authority, and the proxied dashboard renders with zero 4xx. Full gate green (6148 passed, +6).
74 lines
2.9 KiB
TypeScript
74 lines
2.9 KiB
TypeScript
/**
|
|
* The background `dsh web` supervisor and the authority boundary in front of it.
|
|
*
|
|
* Two things here are worth pinning and neither is obvious from reading the
|
|
* module:
|
|
*
|
|
* 1. `authority` becomes an argv element of a spawned process (`--trusted-host
|
|
* <authority>`). The spawn is an argv ARRAY so a shell can never see it, but
|
|
* the schema is the layer that stops a value which is not a browser
|
|
* authority at all from reaching the command line, and a regex is easy to
|
|
* widen by accident.
|
|
* 2. The supervisor tracks at most ONE server. The status accessor is what every
|
|
* caller reads to decide whether to start another, so "no server" must report
|
|
* as absent rather than as a half-populated record.
|
|
*/
|
|
import { describe, expect, it, beforeEach } from 'vitest';
|
|
import { DeepSeekWebStartSchema } from '../src/web/schemas.js';
|
|
import { getDeepSeekWebStatus, resetDeepSeekWebForTest, stopDeepSeekWeb } from '../src/deepseek-web-server.js';
|
|
|
|
describe('DeepSeekWebStartSchema: the authority reaching --trusted-host', () => {
|
|
it('accepts the authority shapes a browser can actually report', () => {
|
|
for (const authority of [
|
|
'localhost:3000',
|
|
'127.0.0.1:5013',
|
|
'tnode.tailf80371.ts.net:8444',
|
|
'codeman.example.com',
|
|
'[::1]:3000',
|
|
'host-with-dashes.local:80',
|
|
]) {
|
|
expect(DeepSeekWebStartSchema.safeParse({ authority }).success, authority).toBe(true);
|
|
}
|
|
});
|
|
|
|
it('rejects values that are not an authority at all', () => {
|
|
for (const authority of [
|
|
'',
|
|
'http://localhost:3000', // a URL, not an authority
|
|
'localhost:3000 --trusted-host evil', // an embedded second argument
|
|
'-oProxyCommand=evil', // leading dash, readable as a flag
|
|
'localhost:3000/../path',
|
|
'local host:3000',
|
|
'user:pass@localhost:3000',
|
|
'a'.repeat(256),
|
|
]) {
|
|
expect(DeepSeekWebStartSchema.safeParse({ authority }).success, authority).toBe(false);
|
|
}
|
|
});
|
|
|
|
it('is strict, so an unexpected field cannot ride along', () => {
|
|
expect(DeepSeekWebStartSchema.safeParse({ authority: 'localhost:3000', port: 1 }).success).toBe(false);
|
|
});
|
|
|
|
it('requires the field rather than defaulting it', () => {
|
|
// A guessed default would silently fence dsh's /api against the wrong
|
|
// origin, which presents as a dashboard whose every call 403s.
|
|
expect(DeepSeekWebStartSchema.safeParse({}).success).toBe(false);
|
|
});
|
|
});
|
|
|
|
describe('DeepSeek web supervisor: status', () => {
|
|
beforeEach(() => {
|
|
resetDeepSeekWebForTest();
|
|
});
|
|
|
|
it('reports absent as fully null, not a half-filled record', () => {
|
|
expect(getDeepSeekWebStatus()).toEqual({ running: false, port: null, url: null, authority: null });
|
|
});
|
|
|
|
it('stopping when nothing runs resolves rather than throwing', async () => {
|
|
await expect(stopDeepSeekWeb()).resolves.toBeUndefined();
|
|
expect(getDeepSeekWebStatus().running).toBe(false);
|
|
});
|
|
});
|