CCodeWhale Botfix(vscode): make the extension's send path work, and close the security holes

6482b58a创建于 12 小时前历史提交

文件	最后提交记录	最后更新时间
.vscode	fix(vscode): make the extension's send path work, and close the security holes The extension had never successfully started a turn. `startTurn` accepted only HTTP 200/202 while the runtime's `start_thread_turn` (crates/tui/src/runtime_api.rs:4613-4632) returns `StatusCode::CREATED` as its ONLY success path, so every send failed. `git log -- src/api.ts` is a single commit: this was never a regression, it shipped that way and was never run end to end. api.ts (send path): - Status handling now tests a RANGE (`isOk`: >= 200 && < 300) through one `ensureOk` helper routed through every call site, rather than enumerating codes at eleven of them. 201 is accepted because it is 2xx, not because it is special-cased — the same shape the embedded web client already used at crates/tui/src/runtime_web/app.mjs:873, which is why that client worked against the same runtime this one choked on. - The runtime's JSON `error.message` is surfaced on every route; previously only startTurn passed it through. - 409 is typed: a second send while a turn is live is "already running", and interrupting when nothing streams is "nothing to stop", not an error. Security (extension.ts, runtime.ts, secrets.ts): - SecretStorage now wins over the settings token, matching what secrets.ts, the manifest and the README all already promised. Previously a repo-local .vscode/settings.json could supply a bearer AND retarget `runtimeHost`, and the token rode every request — opening a repo was enough. - The runtime token is passed to the terminal via environment instead of `--auth-token` in argv, which was visible in shell history and `ps`. - status.ts nonce uses a CSPRNG, matching chat.ts. Chat correctness and accessibility (chat.ts, transcript.ts): - Transcript prefers `detail` over the 280-char `summary`, so reload shows the reply instead of a stub. - `operation_key` is reused on retry, so a timeout and resend no longer creates two turns; the dead SSE stream is cleared so reconnect can fire. - The composer keeps its text until the turn is accepted. - Tool paths are parsed out of `metadata.tool_input` and treated as untrusted. The durable fix is runtime-side and is NOT taken here. - Focus styling and roles/labels added; there were none. Chrome (package.json, extension.ts): - Chat is contributed to the secondary sidebar with an activity-bar fallback, gated on `codewhale.noSecondarySidebar`, which is set at activation from `vscode.version` (>= 1.106). One ChatView instance serves both view ids and `reveal()` focuses whichever resolved. - `engines.vscode` stays `^1.96.2` and the threshold is enforced at runtime, matching the shipping Codex extension; raising the floor would have cut off 1.90-1.105 users and made the fallback unreachable for nothing. CI and dev loop (ci.yml, .gitignore, .vscode/): - CI runs the extension tests. Nothing ran them before, which is how a send path that could not work stayed green. - launch.json/tasks.json give a working F5 host. The root `.gitignore`'s bare `.vscode/` silently swallowed them, so a negation was added — without it these files exist locally and vanish on commit. Gates: cd extensions/vscode && npx tsc --noEmit -> clean cd extensions/vscode && npm test -> tests 42, pass 42, fail 0 (baseline before this was 25) manifest/provider coherence: every declared view id has a provider; no provider lacks a manifest entry; context key set at activation. Not done, deliberately: the Runtime view still exists, so this is not yet a single-view Agents panel. Removing it spans extension.ts, status.ts and two commands; a half-removal is worse than either state. Gate item 5 — a human driving one real turn in an Extension Development Host — remains unproven. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D4rk4NXwyy6wmvii9Lp84P Signed-off-by: CodeWhale Bot <bot@codewhale.net>	12 小时前
media	fix(vscode): make the extension's send path work, and close the security holes The extension had never successfully started a turn. `startTurn` accepted only HTTP 200/202 while the runtime's `start_thread_turn` (crates/tui/src/runtime_api.rs:4613-4632) returns `StatusCode::CREATED` as its ONLY success path, so every send failed. `git log -- src/api.ts` is a single commit: this was never a regression, it shipped that way and was never run end to end. api.ts (send path): - Status handling now tests a RANGE (`isOk`: >= 200 && < 300) through one `ensureOk` helper routed through every call site, rather than enumerating codes at eleven of them. 201 is accepted because it is 2xx, not because it is special-cased — the same shape the embedded web client already used at crates/tui/src/runtime_web/app.mjs:873, which is why that client worked against the same runtime this one choked on. - The runtime's JSON `error.message` is surfaced on every route; previously only startTurn passed it through. - 409 is typed: a second send while a turn is live is "already running", and interrupting when nothing streams is "nothing to stop", not an error. Security (extension.ts, runtime.ts, secrets.ts): - SecretStorage now wins over the settings token, matching what secrets.ts, the manifest and the README all already promised. Previously a repo-local .vscode/settings.json could supply a bearer AND retarget `runtimeHost`, and the token rode every request — opening a repo was enough. - The runtime token is passed to the terminal via environment instead of `--auth-token` in argv, which was visible in shell history and `ps`. - status.ts nonce uses a CSPRNG, matching chat.ts. Chat correctness and accessibility (chat.ts, transcript.ts): - Transcript prefers `detail` over the 280-char `summary`, so reload shows the reply instead of a stub. - `operation_key` is reused on retry, so a timeout and resend no longer creates two turns; the dead SSE stream is cleared so reconnect can fire. - The composer keeps its text until the turn is accepted. - Tool paths are parsed out of `metadata.tool_input` and treated as untrusted. The durable fix is runtime-side and is NOT taken here. - Focus styling and roles/labels added; there were none. Chrome (package.json, extension.ts): - Chat is contributed to the secondary sidebar with an activity-bar fallback, gated on `codewhale.noSecondarySidebar`, which is set at activation from `vscode.version` (>= 1.106). One ChatView instance serves both view ids and `reveal()` focuses whichever resolved. - `engines.vscode` stays `^1.96.2` and the threshold is enforced at runtime, matching the shipping Codex extension; raising the floor would have cut off 1.90-1.105 users and made the fallback unreachable for nothing. CI and dev loop (ci.yml, .gitignore, .vscode/): - CI runs the extension tests. Nothing ran them before, which is how a send path that could not work stayed green. - launch.json/tasks.json give a working F5 host. The root `.gitignore`'s bare `.vscode/` silently swallowed them, so a negation was added — without it these files exist locally and vanish on commit. Gates: cd extensions/vscode && npx tsc --noEmit -> clean cd extensions/vscode && npm test -> tests 42, pass 42, fail 0 (baseline before this was 25) manifest/provider coherence: every declared view id has a provider; no provider lacks a manifest entry; context key set at activation. Not done, deliberately: the Runtime view still exists, so this is not yet a single-view Agents panel. Removing it spans extension.ts, status.ts and two commands; a half-removal is worse than either state. Gate item 5 — a human driving one real turn in an Extension Development Host — remains unproven. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D4rk4NXwyy6wmvii9Lp84P Signed-off-by: CodeWhale Bot <bot@codewhale.net>	12 小时前
src	fix(vscode): make the extension's send path work, and close the security holes The extension had never successfully started a turn. `startTurn` accepted only HTTP 200/202 while the runtime's `start_thread_turn` (crates/tui/src/runtime_api.rs:4613-4632) returns `StatusCode::CREATED` as its ONLY success path, so every send failed. `git log -- src/api.ts` is a single commit: this was never a regression, it shipped that way and was never run end to end. api.ts (send path): - Status handling now tests a RANGE (`isOk`: >= 200 && < 300) through one `ensureOk` helper routed through every call site, rather than enumerating codes at eleven of them. 201 is accepted because it is 2xx, not because it is special-cased — the same shape the embedded web client already used at crates/tui/src/runtime_web/app.mjs:873, which is why that client worked against the same runtime this one choked on. - The runtime's JSON `error.message` is surfaced on every route; previously only startTurn passed it through. - 409 is typed: a second send while a turn is live is "already running", and interrupting when nothing streams is "nothing to stop", not an error. Security (extension.ts, runtime.ts, secrets.ts): - SecretStorage now wins over the settings token, matching what secrets.ts, the manifest and the README all already promised. Previously a repo-local .vscode/settings.json could supply a bearer AND retarget `runtimeHost`, and the token rode every request — opening a repo was enough. - The runtime token is passed to the terminal via environment instead of `--auth-token` in argv, which was visible in shell history and `ps`. - status.ts nonce uses a CSPRNG, matching chat.ts. Chat correctness and accessibility (chat.ts, transcript.ts): - Transcript prefers `detail` over the 280-char `summary`, so reload shows the reply instead of a stub. - `operation_key` is reused on retry, so a timeout and resend no longer creates two turns; the dead SSE stream is cleared so reconnect can fire. - The composer keeps its text until the turn is accepted. - Tool paths are parsed out of `metadata.tool_input` and treated as untrusted. The durable fix is runtime-side and is NOT taken here. - Focus styling and roles/labels added; there were none. Chrome (package.json, extension.ts): - Chat is contributed to the secondary sidebar with an activity-bar fallback, gated on `codewhale.noSecondarySidebar`, which is set at activation from `vscode.version` (>= 1.106). One ChatView instance serves both view ids and `reveal()` focuses whichever resolved. - `engines.vscode` stays `^1.96.2` and the threshold is enforced at runtime, matching the shipping Codex extension; raising the floor would have cut off 1.90-1.105 users and made the fallback unreachable for nothing. CI and dev loop (ci.yml, .gitignore, .vscode/): - CI runs the extension tests. Nothing ran them before, which is how a send path that could not work stayed green. - launch.json/tasks.json give a working F5 host. The root `.gitignore`'s bare `.vscode/` silently swallowed them, so a negation was added — without it these files exist locally and vanish on commit. Gates: cd extensions/vscode && npx tsc --noEmit -> clean cd extensions/vscode && npm test -> tests 42, pass 42, fail 0 (baseline before this was 25) manifest/provider coherence: every declared view id has a provider; no provider lacks a manifest entry; context key set at activation. Not done, deliberately: the Runtime view still exists, so this is not yet a single-view Agents panel. Removing it spans extension.ts, status.ts and two commands; a half-removal is worse than either state. Gate item 5 — a human driving one real turn in an Extension Development Host — remains unproven. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D4rk4NXwyy6wmvii9Lp84P Signed-off-by: CodeWhale Bot <bot@codewhale.net>	12 小时前
.gitignore	feat(vscode): add local runtime extension scaffold Harvests the safe Phase 0 VS Code lane from PR #1022 and the Agent View request in #2580 while keeping chat webviews, inline edits, Agent View, and retry/undo runtime endpoints out of this slice. Credits @lbcheng888 for the earlier extension scaffold and @AiurArtanis plus the v0.9 GUI/VS Code reporters for the request trail.	3 个月前
.vscodeignore		12 小时前
LICENSE	feat(vscode): add local runtime extension scaffold Harvests the safe Phase 0 VS Code lane from PR #1022 and the Agent View request in #2580 while keeping chat webviews, inline edits, Agent View, and retry/undo runtime endpoints out of this slice. Credits @lbcheng888 for the earlier extension scaffold and @AiurArtanis plus the v0.9 GUI/VS Code reporters for the request trail.	3 个月前
README.md		12 小时前
package-lock.json	chore(deps): bump the npm_and_yarn group across 2 directories with 2 updates Bumps the npm_and_yarn group with 1 update in the /integrations/feishu-bridge directory: [qs](https://github.com/ljharb/qs). Bumps the npm_and_yarn group with 2 updates in the /extensions/vscode directory: [qs](https://github.com/ljharb/qs) and [fast-uri](https://github.com/fastify/fast-uri). Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/qs/compare/v6.15.2...v6.16.0) Updates `qs` from 6.15.2 to 6.16.0 - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](https://github.com/ljharb/qs/compare/v6.15.2...v6.16.0) Updates `fast-uri` from 3.1.5 to 3.1.7 - [Release notes](https://github.com/fastify/fast-uri/releases) - [Commits](https://github.com/fastify/fast-uri/compare/v3.1.5...v3.1.7) --- updated-dependencies: - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: qs dependency-version: 6.16.0 dependency-type: indirect dependency-group: npm_and_yarn - dependency-name: fast-uri dependency-version: 3.1.7 dependency-type: indirect dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> (cherry picked from commit a21880b6ac351271def8236621a7550905b85876)	3 天前
package.json	fix(vscode): make the extension's send path work, and close the security holes The extension had never successfully started a turn. `startTurn` accepted only HTTP 200/202 while the runtime's `start_thread_turn` (crates/tui/src/runtime_api.rs:4613-4632) returns `StatusCode::CREATED` as its ONLY success path, so every send failed. `git log -- src/api.ts` is a single commit: this was never a regression, it shipped that way and was never run end to end. api.ts (send path): - Status handling now tests a RANGE (`isOk`: >= 200 && < 300) through one `ensureOk` helper routed through every call site, rather than enumerating codes at eleven of them. 201 is accepted because it is 2xx, not because it is special-cased — the same shape the embedded web client already used at crates/tui/src/runtime_web/app.mjs:873, which is why that client worked against the same runtime this one choked on. - The runtime's JSON `error.message` is surfaced on every route; previously only startTurn passed it through. - 409 is typed: a second send while a turn is live is "already running", and interrupting when nothing streams is "nothing to stop", not an error. Security (extension.ts, runtime.ts, secrets.ts): - SecretStorage now wins over the settings token, matching what secrets.ts, the manifest and the README all already promised. Previously a repo-local .vscode/settings.json could supply a bearer AND retarget `runtimeHost`, and the token rode every request — opening a repo was enough. - The runtime token is passed to the terminal via environment instead of `--auth-token` in argv, which was visible in shell history and `ps`. - status.ts nonce uses a CSPRNG, matching chat.ts. Chat correctness and accessibility (chat.ts, transcript.ts): - Transcript prefers `detail` over the 280-char `summary`, so reload shows the reply instead of a stub. - `operation_key` is reused on retry, so a timeout and resend no longer creates two turns; the dead SSE stream is cleared so reconnect can fire. - The composer keeps its text until the turn is accepted. - Tool paths are parsed out of `metadata.tool_input` and treated as untrusted. The durable fix is runtime-side and is NOT taken here. - Focus styling and roles/labels added; there were none. Chrome (package.json, extension.ts): - Chat is contributed to the secondary sidebar with an activity-bar fallback, gated on `codewhale.noSecondarySidebar`, which is set at activation from `vscode.version` (>= 1.106). One ChatView instance serves both view ids and `reveal()` focuses whichever resolved. - `engines.vscode` stays `^1.96.2` and the threshold is enforced at runtime, matching the shipping Codex extension; raising the floor would have cut off 1.90-1.105 users and made the fallback unreachable for nothing. CI and dev loop (ci.yml, .gitignore, .vscode/): - CI runs the extension tests. Nothing ran them before, which is how a send path that could not work stayed green. - launch.json/tasks.json give a working F5 host. The root `.gitignore`'s bare `.vscode/` silently swallowed them, so a negation was added — without it these files exist locally and vanish on commit. Gates: cd extensions/vscode && npx tsc --noEmit -> clean cd extensions/vscode && npm test -> tests 42, pass 42, fail 0 (baseline before this was 25) manifest/provider coherence: every declared view id has a provider; no provider lacks a manifest entry; context key set at activation. Not done, deliberately: the Runtime view still exists, so this is not yet a single-view Agents panel. Removing it spans extension.ts, status.ts and two commands; a half-removal is worse than either state. Gate item 5 — a human driving one real turn in an Extension Development Host — remains unproven. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D4rk4NXwyy6wmvii9Lp84P Signed-off-by: CodeWhale Bot <bot@codewhale.net>	12 小时前
tsconfig.json	feat(vscode): add local runtime extension scaffold Harvests the safe Phase 0 VS Code lane from PR #1022 and the Agent View request in #2580 while keeping chat webviews, inline edits, Agent View, and retry/undo runtime endpoints out of this slice. Credits @lbcheng888 for the earlier extension scaffold and @AiurArtanis plus the v0.9 GUI/VS Code reporters for the request trail.	3 个月前

CodeWhale for VS Code

Official Codewhale extension: an agentic chat sidebar over the local Engine Runtime API, with editor context, streaming turns, approvals, and terminal parity.

What it does

Chat sidebar (primary view):

create, switch, and resume Codewhale threads; every thread stays available from the terminal and the embedded browser client
stream turns live over the runtime's replayable SSE contract (GET /v1/threads/{id}/events?since_seq=…) with automatic reconnection
attach editor context as chips before sending: current selection, active file, or Problems-panel diagnostics
resolve tool approvals (allow / deny / remember) and clarification questions inline, hydrated from the thread-detail snapshot so a reload never strands pending work
steer a running turn or stop it
render agent replies as a safe Markdown subset; every code block gets Copy and Insert-at-cursor actions
open changed files from file_change items when the runtime includes a path

Runtime view (secondary): connection state, recent thread summaries, restore points, and the original terminal launch helpers.

Connection: the extension attaches to codewhale serve --http on 127.0.0.1:7878 by default, starts it in a visible terminal on request, and never runs its own agent engine — the runtime is the single turn/event owner.

Security posture

Runtime bearer tokens are stored in VS Code SecretStorage via CodeWhale: Set Runtime Token; the legacy codewhale.runtimeToken setting still works and is migrated into secret storage on first use.
The webview renders with a strict CSP (default-src 'none'), and all model output is HTML-escaped before any Markdown transform runs; links must be http(s).
The chat webview script is a static string — no runtime data is interpolated into it.

Local use

npm install
npm test                                # compile + unit tests
npm run package                         # -> codewhale-vscode-<version>.vsix
code --install-extension codewhale-vscode-<version>.vsix

Settings: codewhale.commandPath, codewhale.runtimeHost, codewhale.runtimePort, codewhale.agentViewRefreshIntervalSeconds (0 disables automatic refresh). Commands: CodeWhale: Ask Codewhale (ctrl+alt+c from the editor, also on the editor context menu), CodeWhale: New Chat, CodeWhale: Set Runtime Token, CodeWhale: Start Local Runtime.

Keep the runtime on 127.0.0.1 unless you deliberately front it with trusted local networking controls.

Not yet built

VS Code-native diff/merge review of agent file changes (blocked on the runtime publishing a Files/Changes contract), provider/model switching from the composer, retry/undo/restore buttons, and account sign-in surface. The runtime's embedded browser client (codewhale web) remains the full-feature fallback for those flows.