+
{label}
diff --git a/ui/src/lib.rs b/ui/src/lib.rs
index aa58eab..c342ade 100644
--- a/ui/src/lib.rs
+++ b/ui/src/lib.rs
@@ -6,9 +6,11 @@ pub mod ws;
pub use app::App;
+#[cfg(not(test))]
use wasm_bindgen::prelude::*;
+#[cfg(not(test))]
#[wasm_bindgen(start)]
-pub fn main() {
+pub fn start() {
leptos::mount::mount_to_body(App);
}
diff --git a/ui/src/ws.rs b/ui/src/ws.rs
index c0e204d..f1cdd85 100644
--- a/ui/src/ws.rs
+++ b/ui/src/ws.rs
@@ -1,8 +1,9 @@
-use futures::{SinkExt, StreamExt};
+use futures::{FutureExt, SinkExt, StreamExt};
use gloo_net::websocket::{Message, futures::WebSocket};
+use gloo_timers::future::TimeoutFuture;
use serde_json::{Value, json};
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq)]
pub enum StreamEvent {
Text(String),
ToolUse { name: String, input: String },
@@ -21,6 +22,18 @@ fn ws_url() -> Result
{
pub fn parse_event(msg: &str) -> Option {
let v: Value = serde_json::from_str(msg).ok()?;
+
+ // Handle JSON-RPC error responses (no "event" field, has "error" field)
+ if let Some(err) = v.get("error") {
+ if let Some(msg) = err.as_str() {
+ return Some(StreamEvent::Error(msg.to_string()));
+ }
+ if let Some(msg) = err.get("message").and_then(|m| m.as_str()) {
+ return Some(StreamEvent::Error(msg.to_string()));
+ }
+ return Some(StreamEvent::Error(err.to_string()));
+ }
+
let event = v.get("event")?.as_str()?;
match event {
"text" => {
@@ -81,6 +94,45 @@ pub async fn connect(token: Option) -> Result {
if v.get("ok").and_then(|v| v.as_bool()) != Some(true) {
return Err("authentication failed".to_string());
}
+ } else {
+ // In no-token mode, loopback gateway sends {"ok":true,...} immediately.
+ // Token-protected gateway waits for an auth frame and sends nothing.
+ // Use a short timeout to detect that auth is required.
+ let read_next = read.next().fuse();
+ let timeout = TimeoutFuture::new(800).fuse();
+ futures::pin_mut!(read_next, timeout);
+
+ match futures::select! {
+ msg = read_next => Some(msg),
+ _ = timeout => None,
+ } {
+ Some(Some(Ok(resp))) => {
+ let resp_text = match resp {
+ Message::Text(t) => t,
+ Message::Bytes(b) => {
+ String::from_utf8(b).map_err(|_| "invalid utf8 in auth response")?
+ }
+ };
+
+ let v: Value =
+ serde_json::from_str(&resp_text).map_err(|_| "invalid JSON in response")?;
+ if v.get("ok").and_then(|v| v.as_bool()) != Some(true) {
+ if let Some(err) = v.get("error") {
+ if let Some(msg) = err.as_str() {
+ return Err(msg.to_string());
+ }
+ if let Some(msg) = err.get("message").and_then(|m| m.as_str()) {
+ return Err(msg.to_string());
+ }
+ return Err(err.to_string());
+ }
+ return Err("authentication failed".to_string());
+ }
+ }
+ Some(Some(Err(e))) => return Err(format!("read response failed: {}", e)),
+ Some(None) => return Err("connection closed during handshake".to_string()),
+ None => return Err("authentication required".to_string()),
+ }
}
Ok(WsConnection { write, read })
@@ -95,7 +147,11 @@ pub async fn send_chat(
"jsonrpc": "2.0",
"id": id,
"method": "chat.send",
- "params": {"content": content}
+ "params": {
+ "channel": "web",
+ "account": "browser",
+ "content": content,
+ }
});
write
.send(Message::Text(msg.to_string()))
diff --git a/ui/tests/wasm.rs b/ui/tests/wasm.rs
new file mode 100644
index 0000000..275246d
--- /dev/null
+++ b/ui/tests/wasm.rs
@@ -0,0 +1,49 @@
+use exoclaw_ui::markdown;
+use exoclaw_ui::ws::{StreamEvent, parse_event};
+use wasm_bindgen_test::wasm_bindgen_test;
+
+#[wasm_bindgen_test]
+fn parse_event_accepts_jsonrpc_string_error() {
+ let msg = r#"{"error":"auth_failed","code":4001}"#;
+ assert_eq!(
+ parse_event(msg),
+ Some(StreamEvent::Error("auth_failed".to_string()))
+ );
+}
+
+#[wasm_bindgen_test]
+fn parse_event_accepts_jsonrpc_object_error() {
+ let msg = r#"{"error":{"code":-32601,"message":"method not found"}}"#;
+ assert_eq!(
+ parse_event(msg),
+ Some(StreamEvent::Error("method not found".to_string()))
+ );
+}
+
+#[wasm_bindgen_test]
+fn parse_event_parses_text() {
+ let msg = r#"{"id":"chat1","event":"text","data":"hello"}"#;
+ assert_eq!(
+ parse_event(msg),
+ Some(StreamEvent::Text("hello".to_string()))
+ );
+}
+
+#[wasm_bindgen_test]
+fn parse_event_parses_tool_use() {
+ let msg = r#"{"id":"chat1","event":"tool_use","data":{"name":"search","input":{"q":"rust"}}}"#;
+ assert_eq!(
+ parse_event(msg),
+ Some(StreamEvent::ToolUse {
+ name: "search".to_string(),
+ input: r#"{"q":"rust"}"#.to_string(),
+ })
+ );
+}
+
+#[wasm_bindgen_test]
+fn markdown_escapes_inline_html() {
+ let rendered = markdown::render(r#""#);
+ assert!(rendered.contains("<script>alert(\"xss\")</script>"));
+ assert!(!rendered.contains("