@cjhyy/code-shell-server 0.9.30 → 0.9.32

package/dist/links/http.js

@@ -113,6 +113,7 @@ export function createLinkHttp(options) {
                             "connectionId",
                             "expectedRevision",
                             "authModeId",
+                            "resourceUrl",
                         ]);
                         result = await service.startAuthorization(owner, input, input.authModeId);
                     }
@@ -170,6 +171,7 @@ export function createLinkHttp(options) {
                             "connectionId",
                             "expectedRevision",
                             ...(token ? ["token"] : []),
+                            ...(url.pathname.endsWith("/remote") ? ["resourceUrl"] : []),
                         ]);
                         result = token
                             ? await service.connectToken(owner, input)

package/dist/links/service.js

@@ -186,6 +186,14 @@ export function createLinkService(options = {}) {
                 id: meta.linkAccountId,
                 label: meta.linkAccountLabel,
                 resources: meta.linkResourceLabels?.slice(0, 100) ?? [],
+                ...(remote && meta.linkResourceGroups
+                    ? {
+                        resourceGroups: meta.linkResourceGroups.map((group) => ({
+                            id: group.id,
+                            items: group.items.map((item) => ({ id: item.id, label: item.label })),
+                        })),
+                    }
+                    : {}),
             },
             capabilityIds: meta.linkCapabilityIds ?? [],
             verifiedAt: meta.linkLastVerifiedAt,
@@ -664,6 +672,8 @@ export function createLinkService(options = {}) {
     async function startAuthorization(context, input, rawAuthModeId) {
         await authorize(context);
         const authModeId = string(rawAuthModeId, 80);
+        if (input?.resourceUrl !== undefined && authModeId !== "remote-link")
+            throw new LinkServiceError(400, "invalid_request");
         if (authModeId === "remote-link")
             await refreshRemoteCatalog(context);
         const provider = snapshot().providers.find((candidate) => candidate.id === input?.providerId);
@@ -1029,7 +1039,12 @@ export function createLinkService(options = {}) {
         checkCapacity();
         if (!input ||
             input.methodId !== "remote-link" ||
-            !REMOTE_LINK_ADAPTERS.some((adapter) => adapter.id === input.providerId))
+            !REMOTE_LINK_ADAPTERS.some((adapter) => adapter.id === input.providerId) ||
+            (input.resourceUrl !== undefined &&
+                (input.providerId !== "figma" ||
+                    !input.connectionId ||
+                    typeof input.resourceUrl !== "string" ||
+                    !input.resourceUrl)))
             throw new LinkServiceError(400, "invalid_request");
         const config = options.remoteLink?.();
         if (!config)
@@ -1055,11 +1070,24 @@ export function createLinkService(options = {}) {
                 throw new LinkServiceError(409, "conflict");
         }
         const prepared = { id, expected, input: { ...input, label: string(input.label) } };
+        if (input.resourceUrl !== undefined && !expected)
+            throw new LinkServiceError(400, "invalid_request");
         let attempt;
         try {
+            let resourceFiles;
+            if (input.providerId === "figma") {
+                // Recover the old whitelist from Host custody. Browser input can only suggest one new file.
+                const groups = expected?.meta?.linkResourceGroups;
+                if (expected && (!groups || groups.length !== 1 || groups[0]?.id !== "files"))
+                    throw new Error("Invalid saved Figma resources");
+                resourceFiles = groups?.[0]?.items.map((item) => item.id) ?? [];
+                if (input.resourceUrl !== undefined)
+                    resourceFiles.push(input.resourceUrl);
+            }
             attempt = beginRemoteLinkAuthorization(config, now(), {
                 providerId: input.providerId,
                 actions: capabilities.actions,
+                ...(resourceFiles !== undefined ? { resourceFiles } : {}),
             });
         }
         catch {
@@ -1123,6 +1151,10 @@ export function createLinkService(options = {}) {
                 },
             });
             await check();
+            if (job.attempt.providerId === "figma" &&
+                job.prepared.expected &&
+                credential.meta?.linkAccountId !== job.prepared.expected.meta?.linkAccountId)
+                throw new LinkServiceError(409, "conflict");
             const guarded = {
                 ownerId: context.ownerId,
                 authorize: async () => {

package/dist/panels/directory-bookmarks.d.ts

@@ -1,5 +1,10 @@
 import type { InstalledPanelApp } from "@cjhyy/code-shell-core";
 export type PanelDirectoryAuthorizer = (app: InstalledPanelApp, projectPath: string, workspacePath: string) => Promise<void>;
+/** Host-only proof that a workspace still belongs to the expected main project. */
+export declare function createPanelDirectoryProjectScope(workspacePath: string, expectedProjectPath: string): {
+    projectPath: string;
+    assertCurrent(): void;
+};
 export declare function desktopPanelDirectoryBookmarks(dataDir: string): PanelAppDirectoryBookmarks;
 /** The file mutex uses a sibling of its parent; keep both inside the data volume. */
 export declare function hubPanelDirectoryBookmarks(dataDir: string): PanelAppDirectoryBookmarks;
@@ -9,6 +14,8 @@ export declare class PanelAppDirectoryBookmarks {
     private readonly options;
     constructor(file: string, options?: {
         legacyFiles?: readonly string[];
+        /** Supplied only by a trusted Host, never by Panel or browser input. */
+        isLegacyProjectScope?: (expectedProjectPath: string, legacyProjectPath: string) => boolean;
     });
     remember(appId: string, projectPath: string, path: string): string;
     restore(appId: string, projectPath: string, id: unknown): string;

package/dist/panels/directory-bookmarks.js

@@ -2,9 +2,58 @@ import { randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
 import { dirname, isAbsolute, join } from "node:path";
 import { acquireFileLock } from "@cjhyy/code-shell-core/internal";
+import { createHubPanelBinding } from "./hub-binding.js";
+/** Host-only proof that a workspace still belongs to the expected main project. */
+export function createPanelDirectoryProjectScope(workspacePath, expectedProjectPath) {
+    for (const path of [workspacePath, expectedProjectPath]) {
+        if (!isAbsolute(path) || path.length > 32_768 || path.includes("\0"))
+            throw new Error("Invalid Panel directory project scope");
+    }
+    const binding = createHubPanelBinding(workspacePath);
+    binding.assertBinding();
+    const projectPath = realpathSync(expectedProjectPath);
+    const identity = lstatSync(projectPath);
+    if (!identity.isDirectory() ||
+        identity.isSymbolicLink() ||
+        realpathSync(binding.bindingCwd) !== projectPath)
+        throw new Error("Panel directory project scope is unavailable");
+    const assertCurrent = () => {
+        binding.assertBinding();
+        const current = lstatSync(projectPath);
+        if (!current.isDirectory() ||
+            current.isSymbolicLink() ||
+            current.dev !== identity.dev ||
+            current.ino !== identity.ino ||
+            realpathSync(expectedProjectPath) !== projectPath ||
+            realpathSync(binding.bindingCwd) !== projectPath)
+            throw new Error("Panel directory project scope changed");
+    };
+    assertCurrent();
+    return { projectPath, assertCurrent };
+}
 export function desktopPanelDirectoryBookmarks(dataDir) {
+    const scopes = new Map();
     return new PanelAppDirectoryBookmarks(join(dataDir, "panel-app-directory-bookmarks.json"), {
         legacyFiles: [join(dataDir, "panel-web-directory-bookmarks.json")],
+        isLegacyProjectScope(expectedProjectPath, legacyProjectPath) {
+            const key = JSON.stringify([expectedProjectPath, legacyProjectPath]);
+            try {
+                let scope = scopes.get(key);
+                if (!scope) {
+                    scope = createPanelDirectoryProjectScope(legacyProjectPath, expectedProjectPath);
+                    if (scopes.size >= 64)
+                        scopes.delete(scopes.keys().next().value);
+                    scopes.set(key, scope);
+                }
+                // Keep a failed proof frozen: replacing Git metadata must not silently
+                // reauthorize this instance's previously verified worktree association.
+                scope.assertCurrent();
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
     });
 }
 /** The file mutex uses a sibling of its parent; keep both inside the data volume. */
@@ -156,8 +205,22 @@ export class PanelAppDirectoryBookmarks {
                 }
             }
         }
-        if (!bookmark || bookmark.appId !== appId || bookmark.projectPath !== projectPath)
+        if (!bookmark || bookmark.appId !== appId)
             throw new Error("Saved directory is unavailable; choose it again");
+        const savedProjectPath = bookmark.projectPath;
+        const assertProjectScope = () => {
+            if (savedProjectPath === projectPath)
+                return;
+            try {
+                if (this.options.isLegacyProjectScope?.(projectPath, savedProjectPath) === true)
+                    return;
+            }
+            catch {
+                // The Host proof is optional; a failed proof never relaxes exact scope.
+            }
+            throw new Error("Saved directory is unavailable; choose it again");
+        };
+        assertProjectScope();
         try {
             const info = lstatSync(bookmark.path);
             if (!info.isDirectory() ||
@@ -195,6 +258,7 @@ export class PanelAppDirectoryBookmarks {
                 release();
             }
         }
+        assertProjectScope();
         return bookmark.path;
     }
 }

package/dist/panels/management.d.ts

@@ -1,5 +1,4 @@
 import { type PanelAppPreview, type PanelAppSourceInput } from "@cjhyy/code-shell-core";
-import { getRefCommit } from "@cjhyy/code-shell-core/internal/skills";
 import type { PanelCompatibility, PanelDiscovery, PanelOperationContext, PanelReview, PanelProjectReview, PanelSnapshot, PanelPackageHistory, PanelPackageRestoreReview } from "./types.js";
 export declare class PanelManagementError extends Error {
     readonly status: number;
@@ -23,7 +22,10 @@ export interface PanelManagementOptions {
     compatibility?: (app: Pick<PanelAppPreview, "permissions" | "agent">) => PanelCompatibility;
     now?: () => number;
     /** Network seam only; production still uses the reviewed Core installer. */
-    resolveCommit?: typeof getRefCommit;
+    resolveCommit?: (info: {
+        owner: string;
+        repo: string;
+    }, ref: string) => Promise<string>;
 }
 export declare function createPanelManagement(options: PanelManagementOptions): {
     snapshot: (appId?: string) => Promise<PanelSnapshot>;

package/dist/panels/management.js

@@ -3,9 +3,9 @@ import { panelPackageMutationMatches } from "./package-mutation.js";
 import { createHash, randomBytes } from "node:crypto";
 import { lstatSync, mkdirSync, statSync } from "node:fs";
 import { basename, extname, isAbsolute, join, resolve } from "node:path";
-import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
+import { SettingsManager, PanelAppAlreadyInstalledError, PanelAppInstallError, PanelAppReviewChangedError, assertSafePanelAppId, discoverGitPanelApps, installReviewedLocalPanelApp, invalidateSkillCache, listInstalledPanelApps, inspectProjectPanelApps, listRetainedPanelAppPackages, resolvePanelAppPackage, parsePanelAppPackagePins, retainInstalledPanelApp, userHome, panelAppsRoot, previewLocalPanelApp, resolveGitHubPanelAppCommit, resolvePanelAppBindingPolicy, uninstallPanelApp, } from "@cjhyy/code-shell-core";
 import { mutateJsonFile } from "@cjhyy/code-shell-core/internal";
-import { getRefCommit, parseGithubUrl } from "@cjhyy/code-shell-core/internal/skills";
+import { parseGithubUrl } from "@cjhyy/code-shell-core/internal/skills";
 const REVIEW_TTL = 8 * 60_000;
 const MAX_REVIEWS = 8;
 const MAX_NETWORK = 2;
@@ -47,7 +47,7 @@ export function publicPanelError(error) {
         return new PanelManagementError(503, "github_unavailable", "GitHub 暂时不可用，请稍后重试。");
     if (/(?:ENOTFOUND|EAI_AGAIN|ECONNRESET|ECONNREFUSED|UND_ERR_SOCKET)/.test(code) ||
         /^(?:fetch failed|Failed to fetch)$/i.test(message) ||
-        /GitHub source download failed/i.test(message))
+        /GitHub source (?:download|ref lookup) failed/i.test(message))
         return new PanelManagementError(502, "github_network", "服务端无法连接 GitHub，请检查网络、DNS 或代理设置后重试。");
     if (error instanceof PanelAppInstallError)
         return new PanelManagementError(400, "invalid_source", error.message);
@@ -352,7 +352,9 @@ export function createPanelManagement(options) {
         const ref = parsed.source.ref ?? "HEAD";
         const commit = SHA.test(ref)
             ? ref.toLowerCase()
-            : await (options.resolveCommit ?? getRefCommit)({ owner: parsed.owner, repo: parsed.repo }, ref);
+            : options.resolveCommit
+                ? await options.resolveCommit({ owner: parsed.owner, repo: parsed.repo }, ref)
+                : await resolveGitHubPanelAppCommit(parsed.source);
         await guard();
         if (!SHA.test(commit))
             throw new PanelManagementError(502, "invalid_source", "GitHub 没有返回有效的提交版本。");

package/dist/panels/process-service.d.ts

@@ -84,7 +84,9 @@ export declare class PanelAppProcessService {
         name: string;
         handle?: string;
     }>;
-    grantDirectory(owner: PanelProcessOwner, path: string): Promise<{
+    grantDirectory(owner: PanelProcessOwner, path: string, options?: {
+        assertCurrent?: () => void;
+    }): Promise<{
         handle: string;
         path: string;
         name: string;

package/dist/panels/process-service.js

@@ -221,14 +221,20 @@ export class PanelAppProcessService {
         });
         return { available: true, name, handle };
     }
-    async grantDirectory(owner, path) {
+    async grantDirectory(owner, path, options = {}) {
         owner = { ...owner };
         const epoch = this.epoch(owner);
+        options.assertCurrent?.();
         await this.authorize(owner, epoch);
+        options.assertCurrent?.();
         const resolved = await realpath(path);
+        options.assertCurrent?.();
         await this.authorize(owner, epoch);
+        options.assertCurrent?.();
         const info = await stat(resolved);
+        options.assertCurrent?.();
         await this.authorize(owner, epoch);
+        options.assertCurrent?.();
         this.assertLive(owner, epoch);
         if (!info.isDirectory())
             throw new Error("selected process directory is not a directory");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cjhyy/code-shell-server",
-  "version": "0.9.30",
+  "version": "0.9.32",
   "description": "CodeShell server transport layer — mobile remote HTTP/WS host, pairing, passcode gate, tunnel, rooms, uploads, and session/attachment services. Electron-free; precursor of the auth gateway.",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,13 +60,13 @@
     "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
   },
   "dependencies": {
-    "@cjhyy/code-shell-capability-coding": "0.9.30",
-    "@cjhyy/code-shell-core": "0.9.30",
-    "@cjhyy/code-shell-web": "0.9.30",
+    "@cjhyy/code-shell-capability-coding": "0.9.32",
+    "@cjhyy/code-shell-core": "0.9.32",
+    "@cjhyy/code-shell-web": "0.9.32",
     "@modelcontextprotocol/sdk": "^1.31.0",
     "@types/ws": "^8.18.1",
     "ws": "^8.21.0",
-    "@cjhyy/code-shell-link": "0.9.30"
+    "@cjhyy/code-shell-link": "0.9.32"
   },
   "engines": {
     "node": ">=20.10"