dsh-monaco

dsh-monaco

Serves the Monaco Editor distribution to the browser over a host HTTP route, for DeepSeek Harness plugins that need a real code editor in the page.

Why a route instead of a bundle

The harness browser plugin channel delivers exactly one file per plugin (/plugins/<id>/client.js), and the dynamic bundler emits no extra chunks or assets. Monaco is a multi-file distribution — a loader, per-language modules, and a stylesheet — so it cannot arrive that way.

This plugin mounts those files under a route of its own, reading them from the installed monaco-editor package. The editor therefore stays local: no CDN at runtime, and no third-party origin inside a tool that reads the operator's source tree.

Install

dsh plugin --profile web add github:DevViking-Persike/dsh-monaco

Restart dsh. The distribution is then available under /monaco.

Use it from a client plugin

Monaco publishes itself through its own AMD loader:

await loadScript('/monaco/loader.js')
window.require.config({ paths: { vs: '/monaco' } })
window.require(['vs/editor/editor.main'], () => {
  window.monaco.editor.create(host, { value: '', language: 'typescript' })
})

Configuration

- id: dsh-monaco
  name: 'dsh-monaco'
  config:
    route: /vendor/monaco

Model Experience

None. This plugin serves static bytes to the browser and registers no tool, prompt section, or session event, so nothing it does reaches a model request or consumes context.

Safety

• Every request path is resolved against the distribution root and then proved to be inside it. resolve collapses .. first, so an escape is caught by the containment test rather than by pattern-matching request text — including percent-encoded attempts, which reach the server intact.
• A read failure under the root answers 404, the same as an unknown path, so the browser cannot learn which files exist from a distinguishable error.
• Only GET and HEAD are served; anything else answers 405.
• An extension absent from the content-type table is served as application/octet-stream rather than guessed, so a wrong type never makes the browser execute something as script.

Known Limitations and Deferred Work

• The route serves the whole distribution, including language modules a given page never loads. Serving a subset would need to know each consumer's languages up front, which the route cannot see.
• Responses carry a one-week immutable cache-control. That is safe because the distribution is version-pinned by the installed package, but a Monaco upgrade needs a cache-busting route change or a hard reload to take effect in an open tab.
• Files are read per request with no in-process cache; the OS page cache absorbs this, and holding a 24 MB distribution in heap to avoid it has no current consumer.
• Monaco's web workers are not configured here. A consumer that wants them must serve its own worker entry and set MonacoEnvironment; without one Monaco runs its language services on the main thread.

License

MIT — see LICENSE. NOTICE.md carries attribution for Monaco Editor (© Microsoft, MIT) and the DeepSeek Harness project whose plugin conventions this follows.