dsh-monaco

Readme

# dsh-monaco

Serves the [Monaco Editor](https://github.com/microsoft/monaco-editor) distribution to the browser over a host HTTP route, for [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness) plugins that need a real code editor in the page.

## Why a route instead of a bundle

The harness browser plugin channel delivers exactly one file per plugin (`/plugins/<id>/client.js`), and the dynamic bundler emits no extra chunks or assets. Monaco is a multi-file distribution — a loader, per-language modules, and a stylesheet — so it cannot arrive that way.

This plugin mounts those files under a route of its own, reading them from the installed `monaco-editor` package. The editor therefore stays local: no CDN at runtime, and no third-party origin inside a tool that reads the operator's source tree.

## Install

```bash
dsh plugin --profile web add github:DevViking-Persike/dsh-monaco
```

Restart `dsh`. The distribution is then available under `/monaco`.

## Use it from a client plugin

Monaco publishes itself through its own AMD loader:

```js
await loadScript('/monaco/loader.js')
window.require.config({ paths: { vs: '/monaco' } })
window.require(['vs/editor/editor.main'], () => {
  window.monaco.editor.create(host, { value: '', language: 'typescript' })
})
```

## Configuration

| Field | Default | Meaning |
|---|---|---|
| `route` | `/monaco` | Absolute URL prefix, no trailing slash. |

```yaml
- id: dsh-monaco
  name: 'dsh-monaco'
  config:
    route: /vendor/monaco
```

## Model Experience

None. This plugin serves static bytes to the browser and registers no tool, prompt section, or session event, so nothing it does reaches a model request or consumes context.

## Safety

- Every request path is resolved against the distribution root and then proved to be inside it. `resolve` collapses `..` first, so an escape is caught by the containment test rather than by pattern-matching request text — including percent-encoded attempts, which reach the server intact.
- A read failure under the root answers `404`, the same as an unknown path, so the browser cannot learn which files exist from a distinguishable error.
- Only `GET` and `HEAD` are served; anything else answers `405`.
- An extension absent from the content-type table is served as `application/octet-stream` rather than guessed, so a wrong type never makes the browser execute something as script.

## Known Limitations and Deferred Work

- The route serves the whole distribution, including language modules a given page never loads. Serving a subset would need to know each consumer's languages up front, which the route cannot see.
- Responses carry a one-week immutable `cache-control`. That is safe because the distribution is version-pinned by the installed package, but a Monaco upgrade needs a cache-busting route change or a hard reload to take effect in an open tab.
- Files are read per request with no in-process cache; the OS page cache absorbs this, and holding a 24 MB distribution in heap to avoid it has no current consumer.
- Monaco's web workers are not configured here. A consumer that wants them must serve its own worker entry and set `MonacoEnvironment`; without one Monaco runs its language services on the main thread.

## License

MIT — see [LICENSE](LICENSE). [NOTICE.md](NOTICE.md) carries attribution for Monaco Editor (© Microsoft, MIT) and the DeepSeek Harness project whose plugin conventions this follows.