From 5ca918a0d340cbaa20e7adba655dac6eca479d0b Mon Sep 17 00:00:00 2001 From: seekskyworld Date: Fri, 4 Sep 2026 11:15:52 +0800 Subject: [PATCH 1/3] feat(web): expose bounded capability snapshot endpoint Signed-off-by: seekskyworld --- web/host/web-host.ts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/web/host/web-host.ts b/web/host/web-host.ts index 6203e647..1f95280e 100644 --- a/web/host/web-host.ts +++ b/web/host/web-host.ts @@ -9,7 +9,10 @@ import { } from "node:http"; import { URL } from "node:url"; import { promisify } from "node:util"; -import { subscribeWebCapabilities } from "../../extensions/shared/web-observer-registry.ts"; +import { + subscribeWebCapabilities, + webCapabilitySnapshot, +} from "../../extensions/shared/web-observer-registry.ts"; import { PiWebAdapter } from "../adapter/pi-adapter.ts"; import { jsonByteLength, @@ -557,6 +560,11 @@ export class WebHost { } if (url.pathname === "/api/models") return this.json(response, 200, { models: this.runtime.listModels() }); + if (url.pathname === "/api/capabilities") + return this.json(response, 200, { + sessionId: this.runtime.sessionManager.getSessionId(), + capabilities: webCapabilitySnapshot(this.runtime.sessionManager), + }); if (url.pathname === "/api/snapshot") { const cursor = this.sequence; const projection = await this.adapter.getSnapshot( From 13a0270bc1ac7f662943cb52c0313b973bc541a9 Mon Sep 17 00:00:00 2001 From: seekskyworld Date: Fri, 4 Sep 2026 11:17:25 +0800 Subject: [PATCH 2/3] feat(web): expose bounded runtime diagnostics Signed-off-by: seekskyworld --- web/host/web-host.ts | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/web/host/web-host.ts b/web/host/web-host.ts index 1f95280e..779d502a 100644 --- a/web/host/web-host.ts +++ b/web/host/web-host.ts @@ -565,6 +565,14 @@ export class WebHost { sessionId: this.runtime.sessionManager.getSessionId(), capabilities: webCapabilitySnapshot(this.runtime.sessionManager), }); + if (url.pathname === "/api/diagnostics") + return this.json(response, 200, { + node: process.version, + cwd: this.runtime.cwd, + sessionId: this.runtime.sessionManager.getSessionId(), + workspaceSelected: this.runtime.workspaceSelected, + models: this.runtime.listModels().filter((model) => model.current), + }); if (url.pathname === "/api/snapshot") { const cursor = this.sequence; const projection = await this.adapter.getSnapshot( From 3bd6dfc9ecf2604c42c59c8f78356d8a48e7eeb1 Mon Sep 17 00:00:00 2001 From: tt-a1i Date: Sat, 5 Sep 2026 09:16:01 +0800 Subject: [PATCH 3/3] test(web): cover capability and diagnostics route contracts Prove unauthenticated rejection, read-only projection, and bounded fields so GET /api/capabilities and /api/diagnostics cannot silently grow secrets or transcript evidence. --- tests/web/web-host.test.ts | 88 +++++++++++++++++++++++++++++++++++++- 1 file changed, 87 insertions(+), 1 deletion(-) diff --git a/tests/web/web-host.test.ts b/tests/web/web-host.test.ts index d80df4fa..d02d2e36 100644 --- a/tests/web/web-host.test.ts +++ b/tests/web/web-host.test.ts @@ -64,7 +64,22 @@ test("serves workspaces through a runtime isolated from terminal sessions", asyn }; }, switchSession: async () => ({ cancelled: false }), - listModels: () => [], + listModels: () => [ + { + provider: "fixture", + id: "current-model", + name: "Current", + label: "Current", + current: true, + }, + { + provider: "fixture", + id: "other-model", + name: "Other", + label: "Other", + current: false, + }, + ], setModel: async () => { throw new WebRuntimeRequestError( "Model is not available", @@ -243,6 +258,14 @@ test("serves workspaces through a runtime isolated from terminal sessions", asyn const unauthorized = await fetch(`${launched.origin}/api/snapshot`); assert.equal(unauthorized.status, 401); + const unauthorizedCapabilities = await fetch( + `${launched.origin}/api/capabilities`, + ); + assert.equal(unauthorizedCapabilities.status, 401); + const unauthorizedDiagnostics = await fetch( + `${launched.origin}/api/diagnostics`, + ); + assert.equal(unauthorizedDiagnostics.status, 401); const response = await fetch(`${launched.origin}/api/snapshot`, { headers: authorized, @@ -294,6 +317,69 @@ test("serves workspaces through a runtime isolated from terminal sessions", asyn omitted: 0, truncated: false, }); + const capabilitiesResponse = await fetch( + `${launched.origin}/api/capabilities`, + { headers: authorized }, + ); + assert.equal(capabilitiesResponse.status, 200); + const capabilitiesBody = (await capabilitiesResponse.json()) as { + sessionId: string; + capabilities: Record; + }; + assert.deepEqual(Object.keys(capabilitiesBody).sort(), [ + "capabilities", + "sessionId", + ]); + assert.equal(capabilitiesBody.sessionId, sessionManager.getSessionId()); + assert.deepEqual( + capabilitiesBody.capabilities, + snapshot.runtime.capabilities, + ); + assert.doesNotMatch( + JSON.stringify(capabilitiesBody), + /token|Authorization|Bearer|transcript|entries|messages|apiKey|secret/i, + ); + const writeCapabilities = await fetch( + `${launched.origin}/api/capabilities`, + { + method: "POST", + headers: authorized, + body: "{}", + }, + ); + assert.equal(writeCapabilities.status, 405); + + const diagnosticsResponse = await fetch( + `${launched.origin}/api/diagnostics`, + { headers: authorized }, + ); + assert.equal(diagnosticsResponse.status, 200); + const diagnosticsBody = await diagnosticsResponse.json(); + assert.deepEqual(diagnosticsBody, { + node: process.version, + cwd, + sessionId: sessionManager.getSessionId(), + workspaceSelected: true, + models: [ + { + provider: "fixture", + id: "current-model", + name: "Current", + label: "Current", + current: true, + }, + ], + }); + assert.doesNotMatch( + JSON.stringify(diagnosticsBody), + /token|Authorization|Bearer|transcript|entries|messages|apiKey|secret/i, + ); + const writeDiagnostics = await fetch(`${launched.origin}/api/diagnostics`, { + method: "POST", + headers: authorized, + body: "{}", + }); + assert.equal(writeDiagnostics.status, 405); const sessionsResponse = await fetch(`${launched.origin}/api/sessions`, { headers: authorized,