Function makeHandler

extensions/java-modernization-studio/server.mjs:220–298

(rec, { instanceId, initialTab, sendPrompt, runTurn, log })

 * exercised without binding a socket.
 */
export function makeHandler(rec, { instanceId, initialTab, sendPrompt, runTurn, log }) {
    return async function handler(req, res) {
        const url = new URL(req.url, "http://127.0.0.1");
        try {
            // Per-instance secret: real instances (createInstanceServer) mint a token
            // that the host embeds in the iframe URL. Reject any loopback request that
            // doesn't present it, so other local processes can't read repo state or
            // dispatch agent actions just by guessing the random port. When no token is
            // set (direct makeHandler unit tests) the guard is a no-op.
            if (rec.token) {
                const provided = url.searchParams.get("token");
                if (provided !== rec.token) {
                    res.statusCode = 403;
                    res.setHeader("Content-Type", "application/json");
                    res.end(JSON.stringify({ ok: false, error: "forbidden" }));
                    return;
                }
            }
            if (req.method === "GET" && url.pathname === "/") {
                res.setHeader("Content-Type", "text/html; charset=utf-8");
                res.end(renderHtml({ instanceId, initialTab, token: rec.token }));
                return;
            }
            if (req.method === "GET" && url.pathname === "/state") {
                const state = await buildState(rec);
                res.setHeader("Content-Type", "application/json");
                res.end(JSON.stringify(state));
                return;
            }
            if (req.method === "GET" && url.pathname === "/events") {
                res.writeHead(200, {
                    "Content-Type": "text/event-stream",
                    "Cache-Control": "no-cache",
                    Connection: "keep-alive",
                });
                res.write("retry: 3000\n\n");
                rec.sseClients.add(res);
                req.on("close", () => rec.sseClients.delete(res));
                return;
            }
            if (req.method === "POST" && url.pathname === "/action") {
                const { body, tooLarge } = await readBody(req);
                if (tooLarge) {
                    res.statusCode = 413;
                    res.setHeader("Content-Type", "application/json");
                    res.end(JSON.stringify({ ok: false, error: "request body too large" }));
                    return;
                }
                let parsed;
                try {
                    parsed = JSON.parse(body || "{}");
                } catch {
                    res.statusCode = 400;
                    res.setHeader("Content-Type", "application/json");
                    res.end(JSON.stringify({ ok: false, error: "invalid JSON body" }));
                    return;
                }
                if (!parsed || typeof parsed.kind !== "string" || !parsed.kind) {