@co0ontty/wand 4.89.5 → 4.90.0

package/dist/web-ui/markdown.d.ts

@@ -1,2 +1,3 @@
-/** Shared parser with only Wand's presentation and local-link adaptations. */
-export declare function renderChatMarkdown(text: string): string;
+import { type MessageFileContext } from "./message-file-target.js";
+/** Shared parser with source-session-bound local-file adaptations. */
+export declare function renderChatMarkdown(text: string, context?: MessageFileContext): string;

package/dist/web-ui/markdown.js

@@ -1,5 +1,6 @@
 import { Marked, Renderer } from "marked";
 import { localFilePreviewHref, localHttpPreviewHref } from "./react/local-preview/controller.js";
+import { messageFileTarget } from "./message-file-target.js";
 function escapeHtml(value) {
     return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;")
         .replace(/"/g, "&quot;").replace(/'/g, "&#39;");
@@ -37,18 +38,19 @@ function previewAttributes(value, href) {
         ["onclick", "if(window.__openLocalPreview){event.preventDefault();window.__openLocalPreview(this.getAttribute('data-local-preview-url'));}"],
     ];
 }
-function linkAttributes(target) {
-    const path = serverFilePath(target);
+function linkAttributes(target, context) {
+    const file = messageFileTarget(target, context);
+    const path = file?.path || serverFilePath(target);
     if (path) {
         const preview = /(?:\/$|\.(?:html?|)$)/i.test(path) ? localFilePreviewHref(path) : null;
         if (preview)
             return previewAttributes(path, preview);
         return [
-            ["href", "/api/file-raw?download=1&path=" + encodeURIComponent(path)],
+            ["href", file?.downloadUrl || "/api/file-raw?download=1&path=" + encodeURIComponent(path)],
             ["class", "server-file-link"],
             ["data-server-file-path", path],
             ["title", "打开或下载服务端文件"],
-            ["onclick", "if(window.__openFilePreview){event.preventDefault();window.__openFilePreview(this.getAttribute('data-server-file-path'));}"],
+            ...(path.startsWith("/") ? [["onclick", "if(window.__openFilePreview){event.preventDefault();window.__openFilePreview(this.getAttribute('data-server-file-path'));}"]] : []),
         ];
     }
     const preview = localHttpPreviewHref(target);
@@ -64,50 +66,61 @@ function linkAttributes(target) {
 // Marked parses Markdown; this renderer owns only Wand's output contracts.
 // Raw HTML is text, and links/images use explicit protocol allowlists. Never
 // enable raw HTML or accept renderer extensions from message content.
-const renderer = new Renderer();
-renderer.html = ({ text }) => escapeHtml(text);
-renderer.link = function ({ href, tokens }) {
-    const label = this.parser.parseInline(tokens);
-    const attributes = linkAttributes(href);
-    if (!attributes)
-        return "<span>" + label + "</span>";
-    return "<a" + attributes.map(([name, value]) => " " + name + '="' + escapeHtml(value) + '"').join("") + ">" + label + "</a>";
-};
-renderer.image = ({ href, text, title }) => {
-    if (!/^https?:\/\//i.test(href) && (!href.startsWith("/") || href.startsWith("//")))
-        return escapeHtml(text);
-    return '<img src="' + escapeHtml(href) + '" alt="' + escapeHtml(text) + '"' +
-        (title ? ' title="' + escapeHtml(title) + '"' : "") + ' loading="lazy" decoding="async" role="button" tabindex="0"' +
-        ' aria-label="查看' + escapeHtml(text || "图片") + '" onclick="event.stopPropagation();window.__openImageViewer?.(this);"' +
-        ' onkeydown="if(event.key===\'Enter\'||event.key===\' \'){event.preventDefault();this.click();}">';
-};
-renderer.heading = function ({ depth, tokens }) {
-    const tag = "h" + Math.min(depth + 1, 6);
-    return "<" + tag + ">" + this.parser.parseInline(tokens) + "</" + tag + ">\n";
-};
-renderer.codespan = ({ text }) => '<code class="code-inline">' + escapeHtml(text) + "</code>";
-renderer.code = ({ text, lang }) => {
-    const language = (lang || "").trim().split(/\s+/)[0];
-    const content = text.endsWith("\n") ? text : text + "\n";
-    return '<div class="code-block"><div class="code-block-header">' +
-        '<span class="code-lang">' + escapeHtml(language) + "</span>" +
-        '<button type="button" data-antd-control class="code-copy">复制</button></div>' +
-        "<pre><code>" + escapeHtml(content) + "</code></pre></div>\n";
-};
-renderer.tablecell = function ({ header, align, tokens }) {
-    const tag = header ? "th" : "td";
-    const alignment = align ? ' style="text-align:' + align + '"' : "";
-    return "<" + tag + alignment + ">" + this.parser.parseInline(tokens) + "</" + tag + ">\n";
-};
-const renderTable = renderer.table;
-renderer.table = function (token) {
-    return '<div class="md-table-wrap">' + renderTable.call(this, token)
-        .replace("<table>", '<table class="md-table">') + "</div>\n";
-};
-const markdown = new Marked({ renderer, breaks: true, gfm: true, async: false });
-/** Shared parser with only Wand's presentation and local-link adaptations. */
-export function renderChatMarkdown(text) {
+function createMarkdown(context) {
+    const renderer = new Renderer();
+    renderer.html = ({ text }) => escapeHtml(text);
+    renderer.link = function ({ href, tokens }) {
+        const label = this.parser.parseInline(tokens);
+        const file = messageFileTarget(href, context);
+        const attributes = linkAttributes(href, context);
+        if (file?.previewUrl)
+            return '<span class="chat-html-preview" data-html-preview-url="' + escapeHtml(file.previewUrl) +
+                '" data-html-download-url="' + escapeHtml(file.downloadUrl) + '" data-html-label="' + escapeHtml(tokens.map(token => "text" in token ? String(token.text) : "").join("")) + '">' +
+                '<a href="' + escapeHtml(file.previewUrl) + '" class="local-preview-link" data-local-preview-url="' + escapeHtml(file.path) +
+                '" onclick="if(window.__openLocalPreview){event.preventDefault();window.__openLocalPreview(this.getAttribute(\'href\'));}">' + label + '</a></span>';
+        if (!attributes)
+            return "<span>" + label + "</span>";
+        return "<a" + attributes.map(([name, value]) => " " + name + '="' + escapeHtml(value) + '"').join("") + ">" + label + "</a>";
+    };
+    renderer.image = ({ href, text, title }) => {
+        const file = messageFileTarget(href, context);
+        const src = file?.rawUrl || href;
+        if (!file && !/^https?:\/\//i.test(href) && (!href.startsWith("/") || href.startsWith("//")))
+            return escapeHtml(text);
+        return '<img src="' + escapeHtml(src) + '" alt="' + escapeHtml(text) + '"' +
+            (title ? ' title="' + escapeHtml(title) + '"' : "") + ' loading="lazy" decoding="async" role="button" tabindex="0"' +
+            ' aria-label="查看' + escapeHtml(text || "图片") + '" onclick="event.stopPropagation();window.__openImageViewer?.(this);"' +
+            ' onkeydown="if(event.key===\'Enter\'||event.key===\' \'){event.preventDefault();this.click();}">';
+    };
+    renderer.heading = function ({ depth, tokens }) {
+        const tag = "h" + Math.min(depth + 1, 6);
+        return "<" + tag + ">" + this.parser.parseInline(tokens) + "</" + tag + ">\n";
+    };
+    renderer.codespan = ({ text }) => '<code class="code-inline">' + escapeHtml(text) + "</code>";
+    renderer.code = ({ text, lang }) => {
+        const language = (lang || "").trim().split(/\s+/)[0];
+        const content = text.endsWith("\n") ? text : text + "\n";
+        return '<div class="code-block"><div class="code-block-header">' +
+            '<span class="code-lang">' + escapeHtml(language) + "</span>" +
+            '<button type="button" data-antd-control class="code-copy">复制</button></div>' +
+            "<pre><code>" + escapeHtml(content) + "</code></pre></div>\n";
+    };
+    renderer.tablecell = function ({ header, align, tokens }) {
+        const tag = header ? "th" : "td";
+        const alignment = align ? ' style="text-align:' + align + '"' : "";
+        return "<" + tag + alignment + ">" + this.parser.parseInline(tokens) + "</" + tag + ">\n";
+    };
+    const renderTable = renderer.table;
+    renderer.table = function (token) {
+        return '<div class="md-table-wrap">' + renderTable.call(this, token)
+            .replace("<table>", '<table class="md-table">') + "</div>\n";
+    };
+    return new Marked({ renderer, breaks: true, gfm: true, async: false });
+}
+const markdown = createMarkdown({});
+/** Shared parser with source-session-bound local-file adaptations. */
+export function renderChatMarkdown(text, context = {}) {
     if (!text)
         return "";
-    return '<div class="markdown-content">' + markdown.parse(text, { async: false }) + "</div>";
+    return '<div class="markdown-content">' + (context.cwd || context.sessionId ? createMarkdown(context) : markdown).parse(text, { async: false }) + "</div>";
 }

package/dist/web-ui/message-file-target.d.ts

@@ -0,0 +1,13 @@
+export interface MessageFileContext {
+    cwd?: string;
+    sessionId?: string;
+}
+export interface MessageFileTarget {
+    path: string;
+    rawUrl: string;
+    downloadUrl: string;
+    previewUrl: string | null;
+}
+/** Only explicit file references are resolved, never prose or arbitrary web URLs.
+ * Relative references belong to their source session, not the active page URL. */
+export declare function messageFileTarget(input: string, context?: MessageFileContext): MessageFileTarget | null;

package/dist/web-ui/message-file-target.js

@@ -0,0 +1,85 @@
+import { localFilePreviewHref } from "./react/local-preview/controller.js";
+/** Only explicit file references are resolved, never prose or arbitrary web URLs.
+ * Relative references belong to their source session, not the active page URL. */
+export function messageFileTarget(input, context = {}) {
+    let path = input.trim();
+    if (/^file:/i.test(path)) {
+        try {
+            const url = new URL(path);
+            if (url.hostname && url.hostname !== "localhost")
+                return null;
+            path = decodeURIComponent(url.pathname);
+        }
+        catch {
+            return null;
+        }
+    }
+    else if (/^\/api\/local-file\/[A-Za-z0-9_-]+\/$/.test(path)) {
+        try {
+            const encoded = path.split("/")[3].replace(/-/g, "+").replace(/_/g, "/");
+            const bytes = Uint8Array.from(atob(encoded), char => char.charCodeAt(0));
+            path = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+            if (!path.startsWith("/"))
+                return null;
+        }
+        catch {
+            return null;
+        }
+    }
+    else if (/^\/api\/session-file\/[^/?#]+\?/.test(path)) {
+        try {
+            const url = new URL(path, "http://wand.invalid");
+            const relative = url.searchParams.get("path") || "";
+            if (relative.startsWith("/"))
+                return null;
+            return messageFileTarget(relative, { sessionId: decodeURIComponent(url.pathname.split("/")[3]) });
+        }
+        catch {
+            return null;
+        }
+    }
+    else if (path.startsWith("/api/file-raw?")) {
+        try {
+            path = new URL(path, "http://wand.invalid").searchParams.get("path") || "";
+        }
+        catch {
+            return null;
+        }
+    }
+    else {
+        if (/^(?:[a-z][a-z\d+.-]*:|\/\/|#)/i.test(path))
+            return null;
+        try {
+            path = decodeURIComponent(path);
+        }
+        catch { /* literal percent */ }
+    }
+    path = path.replace(/#L\d+(?:C\d+)?$/i, "").replace(/:\d+(?::\d+)?$/, "");
+    if (!path || /[\u0000-\u001f]/.test(path) || /^\/(?:api|android|macos)(?:\/|$)/.test(path))
+        return null;
+    const html = /\.html?$/i.test(path);
+    if (!path.startsWith("/")) {
+        // No trusted context: keep the label rather than guessing the server cwd.
+        if (!context.sessionId && !context.cwd?.startsWith("/"))
+            return null;
+        if (context.sessionId) {
+            const route = "/api/session-file/" + encodeURIComponent(context.sessionId) + "?path=" + encodeURIComponent(path);
+            return { path, rawUrl: route, downloadUrl: route + "&mode=download", previewUrl: html ? route + "&mode=preview" : null };
+        }
+        const parts = [];
+        for (const part of path.split("/")) {
+            if (!part || part === ".")
+                continue;
+            if (part === "..") {
+                if (!parts.length)
+                    return null;
+                parts.pop();
+            }
+            else
+                parts.push(part);
+        }
+        path = context.cwd.replace(/\/$/, "") + "/" + parts.join("/");
+    }
+    const rawUrl = "/api/file-raw?path=" + encodeURIComponent(path);
+    return { path, rawUrl, downloadUrl: rawUrl + "&download=1", previewUrl: html ? localFilePreviewHref(path) : null };
+}

package/dist/web-ui/provider-identity.d.ts

@@ -37,7 +37,7 @@ export declare function agentToolDisplayName(provider: unknown, engine?: AgentTo
 export declare function isProviderId(value: unknown): value is ProviderId;
 export declare const CLAUDE_BRAND_COLOR = "#D97757";
 export declare const CLAUDE_LOGO_PATH = "m4.7144 15.9555 4.7174-2.6471.079-.2307-.079-.1275h-.2307l-.7893-.0486-2.6956-.0729-2.3375-.0971-2.2646-.1214-.5707-.1215-.5343-.7042.0546-.3522.4797-.3218.686.0608 1.5179.1032 2.2767.1578 1.6514.0972 2.4468.255h.3886l.0546-.1579-.1336-.0971-.1032-.0972L6.973 9.8356l-2.55-1.6879-1.3356-.9714-.7225-.4918-.3643-.4614-.1578-1.0078.6557-.7225.8803.0607.2246.0607.8925.686 1.9064 1.4754 2.4893 1.8336.3643.3035.1457-.1032.0182-.0728-.164-.2733-1.3539-2.4467-1.445-2.4893-.6435-1.032-.17-.6194c-.0607-.255-.1032-.4674-.1032-.7285L6.287.1335 6.6997 0l.9957.1336.419.3642.6192 1.4147 1.0018 2.2282 1.5543 3.0296.4553.8985.2429.8318.091.255h.1579v-.1457l.1275-1.706.2368-2.0947.2307-2.6957.0789-.7589.3764-.9107.7468-.4918.5828.2793.4797.686-.0668.4433-.2853 1.8517-.5586 2.9021-.3643 1.9429h.2125l.2429-.2429.9835-1.3053 1.6514-2.0643.7286-.8196.85-.9046.5464-.4311h1.0321l.759 1.1293-.34 1.1657-1.0625 1.3478-.8804 1.1414-1.2628 1.7-.7893 1.36.0729.1093.1882-.0183 2.8535-.607 1.5421-.2794 1.8396-.3157.8318.3886.091.3946-.3278.8075-1.967.4857-2.3072.4614-3.4364.8136-.0425.0304.0486.0607 1.5482.1457.6618.0364h1.621l3.0175.2247.7892.522.4736.6376-.079.4857-1.2142.6193-1.6393-.3886-3.825-.9107-1.3113-.3279h-.1822v.1093l1.0929 1.0686 2.0035 1.8092 2.5075 2.3314.1275.5768-.3218.4554-.34-.0486-2.2039-1.6575-.85-.7468-1.9246-1.621h-.1275v.17l.4432.6496 2.3436 3.5214.1214 1.0807-.17.3521-.6071.2125-.6679-.1214-1.3721-1.9246L14.38 17.959l-1.1414-1.9428-.1397.079-.674 7.2552-.3156.3703-.7286.2793-.6071-.4614-.3218-.7468.3218-1.4753.3886-1.9246.3157-1.53.2853-1.9004.17-.6314-.0121-.0425-.1397.0182-1.4328 1.9672-2.1796 2.9446-1.7243 1.8456-.4128.164-.7164-.3704.0667-.6618.4008-.5889 2.386-3.0357 1.4389-1.882.929-1.0868-.0062-.1579h-.0546l-6.3385 4.1164-1.1293.1457-.4857-.4554.0608-.7467.2307-.2429 1.9064-1.3114Z";
-export declare const CODEX_LOGO_PATH = "M8.086.457a6.105 6.105 0 013.046-.415c1.333.153 2.521.72 3.564 1.7a.117.117 0 00.107.029c1.408-.346 2.762-.224 4.061.366l.063.03.154.076c1.357.703 2.33 1.77 2.918 3.198.278.679.418 1.388.421 2.126a5.655 5.655 0 01-.18 1.631.167.167 0 00.04.155 5.982 5.982 0 011.578 2.891c.385 1.901-.01 3.615-1.183 5.14l-.182.22a6.063 6.063 0 01-2.934 1.851.162.162 0 00-.108.102c-.255.736-.511 1.364-.987 1.992-1.199 1.582-2.962 2.462-4.948 2.451-1.583-.008-2.986-.587-4.21-1.736a.145.145 0 00-.14-.032c-.518.167-1.04.191-1.604.185a5.924 5.924 0 01-2.595-.622 6.058 6.058 0 01-2.146-1.781c-.203-.269-.404-.522-.551-.821a7.74 7.74 0 01-.495-1.283 6.11 6.11 0 01-.017-3.064.166.166 0 00.008-.074.115.115 0 00-.037-.064 5.958 5.958 0 01-1.38-2.202 5.196 5.196 0 01-.333-1.589 6.915 6.915 0 01.188-2.132c.45-1.484 1.309-2.648 2.577-3.493.282-.188.55-.334.802-.438.286-.12.573-.22.861-.304a.129.129 0 00.087-.087A6.016 6.016 0 015.635 2.31C6.315 1.464 7.132.846 8.086.457zm-.804 7.85a.848.848 0 00-1.473.842l1.694 2.965-1.688 2.848a.849.849 0 001.46.864l1.94-3.272a.849.849 0 00.007-.854l-1.94-3.393zm5.446 6.24a.849.849 0 000 1.695h4.848a.849.849 0 000-1.696h-4.848z";
+export declare const CODEX_LOGO_PATH = "M22.2819 9.8211a5.9847 5.9847 0 0 0-.5157-4.9108 6.0462 6.0462 0 0 0-6.5098-2.9A6.0651 6.0651 0 0 0 4.9807 4.1818a5.9847 5.9847 0 0 0-3.9977 2.9 6.0462 6.0462 0 0 0 .7427 7.0966 5.98 5.98 0 0 0 .511 4.9107 6.051 6.051 0 0 0 6.5146 2.9001A5.9847 5.9847 0 0 0 13.2599 24a6.0557 6.0557 0 0 0 5.7718-4.2058 5.9894 5.9894 0 0 0 3.9977-2.9001 6.0557 6.0557 0 0 0-.7475-7.0729zm-9.022 12.6081a4.4755 4.4755 0 0 1-2.8764-1.0408l.1419-.0804 4.7783-2.7582a.7948.7948 0 0 0 .3927-.6813v-6.7369l2.02 1.1686a.071.071 0 0 1 .038.052v5.5826a4.504 4.504 0 0 1-4.4945 4.4944zm-9.6607-4.1254a4.4708 4.4708 0 0 1-.5346-3.0137l.142.0852 4.783 2.7582a.7712.7712 0 0 0 .7806 0l5.8428-3.3685v2.3324a.0804.0804 0 0 1-.0332.0615L9.74 19.9502a4.4992 4.4992 0 0 1-6.1408-1.6464zM2.3408 7.8956a4.485 4.485 0 0 1 2.3655-1.9728V11.6a.7664.7664 0 0 0 .3879.6765l5.8144 3.3543-2.0201 1.1685a.0757.0757 0 0 1-.071 0l-4.8303-2.7865A4.504 4.504 0 0 1 2.3408 7.872zm16.5963 3.8558L13.1038 8.364 15.1192 7.2a.0757.0757 0 0 1 .071 0l4.8303 2.7913a4.4944 4.4944 0 0 1-.6765 8.1042v-5.6772a.79.79 0 0 0-.407-.667zm2.0107-3.0231l-.142-.0852-4.7735-2.7818a.7759.7759 0 0 0-.7854 0L9.409 9.2297V6.8974a.0662.0662 0 0 1 .0284-.0615l4.8303-2.7866a4.4992 4.4992 0 0 1 6.6802 4.66zM8.3065 12.863l-2.02-1.1638a.0804.0804 0 0 1-.038-.0567V6.0742a4.4992 4.4992 0 0 1 7.3757-3.4537l-.142.0805L8.704 5.459a.7948.7948 0 0 0-.3927.6813zm1.0976-2.3654l2.602-1.4998 2.6069 1.4998v2.9994l-2.5974 1.4997-2.6067-1.4997Z";
 export declare const PI_LOGO_PATH = "M165.29 165.29H517.36V400H400V517.36H282.65V634.72H165.29ZM282.65 282.65V400H400V282.65Z";
 export declare const PI_LOGO_DOT_PATH = "M517.36 400H634.72V634.72H517.36Z";
 export declare const GEMINI_LOGO_PATH = "M11.04 19.32Q12 21.51 12 24q0-2.49.93-4.68.96-2.19 2.58-3.81t3.81-2.55Q21.51 12 24 12q-2.49 0-4.68-.93a12.3 12.3 0 0 1-3.81-2.58 12.3 12.3 0 0 1-2.58-3.81Q12 2.49 12 0q0 2.49-.96 4.68-.93 2.19-2.55 3.81a12.3 12.3 0 0 1-3.81 2.58Q2.49 12 0 12q2.49 0 4.68.96 2.19.93 3.81 2.55t2.55 3.81";

package/dist/web-ui/provider-identity.js

@@ -45,13 +45,12 @@ const PROVIDER_ID_SET = new Set(PROVIDER_IDS);
 export function isProviderId(value) {
     return typeof value === "string" && PROVIDER_ID_SET.has(value);
 }
-// Claude paths match the existing Android BrandLogos source (simple-icons,
+// Claude/Codex paths match the existing Android BrandLogos source (simple-icons,
 // CC0). Grok uses xAI's mark path already shipped by the Web new-session view.
 // Claude keeps the official Anthropic orange instead of inheriting Wand accent.
 export const CLAUDE_BRAND_COLOR = "#D97757";
 export const CLAUDE_LOGO_PATH = "m4.7144 15.9555 4.7174-2.6471.079-.2307-.079-.1275h-.2307l-.7893-.0486-2.6956-.0729-2.3375-.0971-2.2646-.1214-.5707-.1215-.5343-.7042.0546-.3522.4797-.3218.686.0608 1.5179.1032 2.2767.1578 1.6514.0972 2.4468.255h.3886l.0546-.1579-.1336-.0971-.1032-.0972L6.973 9.8356l-2.55-1.6879-1.3356-.9714-.7225-.4918-.3643-.4614-.1578-1.0078.6557-.7225.8803.0607.2246.0607.8925.686 1.9064 1.4754 2.4893 1.8336.3643.3035.1457-.1032.0182-.0728-.164-.2733-1.3539-2.4467-1.445-2.4893-.6435-1.032-.17-.6194c-.0607-.255-.1032-.4674-.1032-.7285L6.287.1335 6.6997 0l.9957.1336.419.3642.6192 1.4147 1.0018 2.2282 1.5543 3.0296.4553.8985.2429.8318.091.255h.1579v-.1457l.1275-1.706.2368-2.0947.2307-2.6957.0789-.7589.3764-.9107.7468-.4918.5828.2793.4797.686-.0668.4433-.2853 1.8517-.5586 2.9021-.3643 1.9429h.2125l.2429-.2429.9835-1.3053 1.6514-2.0643.7286-.8196.85-.9046.5464-.4311h1.0321l.759 1.1293-.34 1.1657-1.0625 1.3478-.8804 1.1414-1.2628 1.7-.7893 1.36.0729.1093.1882-.0183 2.8535-.607 1.5421-.2794 1.8396-.3157.8318.3886.091.3946-.3278.8075-1.967.4857-2.3072.4614-3.4364.8136-.0425.0304.0486.0607 1.5482.1457.6618.0364h1.621l3.0175.2247.7892.522.4736.6376-.079.4857-1.2142.6193-1.6393-.3886-3.825-.9107-1.3113-.3279h-.1822v.1093l1.0929 1.0686 2.0035 1.8092 2.5075 2.3314.1275.5768-.3218.4554-.34-.0486-2.2039-1.6575-.85-.7468-1.9246-1.621h-.1275v.17l.4432.6496 2.3436 3.5214.1214 1.0807-.17.3521-.6071.2125-.6679-.1214-1.3721-1.9246L14.38 17.959l-1.1414-1.9428-.1397.079-.674 7.2552-.3156.3703-.7286.2793-.6071-.4614-.3218-.7468.3218-1.4753.3886-1.9246.3157-1.53.2853-1.9004.17-.6314-.0121-.0425-.1397.0182-1.4328 1.9672-2.1796 2.9446-1.7243 1.8456-.4128.164-.7164-.3704.0667-.6618.4008-.5889 2.386-3.0357 1.4389-1.882.929-1.0868-.0062-.1579h-.0546l-6.3385 4.1164-1.1293.1457-.4857-.4554.0608-.7467.2307-.2429 1.9064-1.3114Z";
-// Codex cloud/prompt mark, LobeHub icons (MIT); license: content/licenses/codex-LICENSE.txt.
-export const CODEX_LOGO_PATH = "M8.086.457a6.105 6.105 0 013.046-.415c1.333.153 2.521.72 3.564 1.7a.117.117 0 00.107.029c1.408-.346 2.762-.224 4.061.366l.063.03.154.076c1.357.703 2.33 1.77 2.918 3.198.278.679.418 1.388.421 2.126a5.655 5.655 0 01-.18 1.631.167.167 0 00.04.155 5.982 5.982 0 011.578 2.891c.385 1.901-.01 3.615-1.183 5.14l-.182.22a6.063 6.063 0 01-2.934 1.851.162.162 0 00-.108.102c-.255.736-.511 1.364-.987 1.992-1.199 1.582-2.962 2.462-4.948 2.451-1.583-.008-2.986-.587-4.21-1.736a.145.145 0 00-.14-.032c-.518.167-1.04.191-1.604.185a5.924 5.924 0 01-2.595-.622 6.058 6.058 0 01-2.146-1.781c-.203-.269-.404-.522-.551-.821a7.74 7.74 0 01-.495-1.283 6.11 6.11 0 01-.017-3.064.166.166 0 00.008-.074.115.115 0 00-.037-.064 5.958 5.958 0 01-1.38-2.202 5.196 5.196 0 01-.333-1.589 6.915 6.915 0 01.188-2.132c.45-1.484 1.309-2.648 2.577-3.493.282-.188.55-.334.802-.438.286-.12.573-.22.861-.304a.129.129 0 00.087-.087A6.016 6.016 0 015.635 2.31C6.315 1.464 7.132.846 8.086.457zm-.804 7.85a.848.848 0 00-1.473.842l1.694 2.965-1.688 2.848a.849.849 0 001.46.864l1.94-3.272a.849.849 0 00.007-.854l-1.94-3.393zm5.446 6.24a.849.849 0 000 1.695h4.848a.849.849 0 000-1.696h-4.848z";
+export const CODEX_LOGO_PATH = "M22.2819 9.8211a5.9847 5.9847 0 0 0-.5157-4.9108 6.0462 6.0462 0 0 0-6.5098-2.9A6.0651 6.0651 0 0 0 4.9807 4.1818a5.9847 5.9847 0 0 0-3.9977 2.9 6.0462 6.0462 0 0 0 .7427 7.0966 5.98 5.98 0 0 0 .511 4.9107 6.051 6.051 0 0 0 6.5146 2.9001A5.9847 5.9847 0 0 0 13.2599 24a6.0557 6.0557 0 0 0 5.7718-4.2058 5.9894 5.9894 0 0 0 3.9977-2.9001 6.0557 6.0557 0 0 0-.7475-7.0729zm-9.022 12.6081a4.4755 4.4755 0 0 1-2.8764-1.0408l.1419-.0804 4.7783-2.7582a.7948.7948 0 0 0 .3927-.6813v-6.7369l2.02 1.1686a.071.071 0 0 1 .038.052v5.5826a4.504 4.504 0 0 1-4.4945 4.4944zm-9.6607-4.1254a4.4708 4.4708 0 0 1-.5346-3.0137l.142.0852 4.783 2.7582a.7712.7712 0 0 0 .7806 0l5.8428-3.3685v2.3324a.0804.0804 0 0 1-.0332.0615L9.74 19.9502a4.4992 4.4992 0 0 1-6.1408-1.6464zM2.3408 7.8956a4.485 4.485 0 0 1 2.3655-1.9728V11.6a.7664.7664 0 0 0 .3879.6765l5.8144 3.3543-2.0201 1.1685a.0757.0757 0 0 1-.071 0l-4.8303-2.7865A4.504 4.504 0 0 1 2.3408 7.872zm16.5963 3.8558L13.1038 8.364 15.1192 7.2a.0757.0757 0 0 1 .071 0l4.8303 2.7913a4.4944 4.4944 0 0 1-.6765 8.1042v-5.6772a.79.79 0 0 0-.407-.667zm2.0107-3.0231l-.142-.0852-4.7735-2.7818a.7759.7759 0 0 0-.7854 0L9.409 9.2297V6.8974a.0662.0662 0 0 1 .0284-.0615l4.8303-2.7866a4.4992 4.4992 0 0 1 6.6802 4.66zM8.3065 12.863l-2.02-1.1638a.0804.0804 0 0 1-.038-.0567V6.0742a4.4992 4.4992 0 0 1 7.3757-3.4537l-.142.0805L8.704 5.459a.7948.7948 0 0 0-.3927.6813zm1.0976-2.3654l2.602-1.4998 2.6069 1.4998v2.9994l-2.5974 1.4997-2.6067-1.4997Z";
 // Official Pi mark from https://pi.dev/logo-auto.svg. Keep it local so provider
 // logos remain available when Wand is offline.
 export const PI_LOGO_PATH = "M165.29 165.29H517.36V400H400V517.36H282.65V634.72H165.29ZM282.65 282.65V400H400V282.65Z";
@@ -86,7 +85,7 @@ export function renderProviderLogoMarkup(value) {
         return `<svg ${common} viewBox="0 0 24 24" fill="${CLAUDE_BRAND_COLOR}"><path d="${CLAUDE_LOGO_PATH}"/></svg>`;
     }
     if (provider === "codex") {
-        return `<svg ${common} viewBox="0 0 24 24" fill="currentColor"><path d="${CODEX_LOGO_PATH}" fill-rule="evenodd"/></svg>`;
+        return `<svg ${common} viewBox="0 0 24 24" fill="currentColor"><path d="${CODEX_LOGO_PATH}"/></svg>`;
     }
     return `<svg ${common} viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"><path d="M12 3v3M12 18v3M3 12h3M18 12h3M5.6 5.6l2.1 2.1M16.3 16.3l2.1 2.1M5.6 18.4l2.1-2.1M16.3 7.7l2.1-2.1"/><circle cx="12" cy="12" r="3"/></svg>`;
 }

package/dist/web-ui/react/local-preview/controller.d.ts

@@ -14,7 +14,9 @@ export declare function localHttpPreviewHref(input: string): string | null;
 export declare function localFilePreviewHref(input: string): string | null;
 declare function openFile(value: string): boolean;
 declare function openUrl(value: string): boolean;
+export declare function isArtifactPreviewUrl(value: string): boolean;
 export declare const localPreviewController: {
+    openPreview(previewUrl: string, label?: string): boolean;
     subscribe(listener: Listener): () => void;
     getSnapshot(): LocalPreviewSnapshot;
     isOpen(): boolean;

package/dist/web-ui/react/local-preview/controller.js

@@ -60,6 +60,8 @@ export function localFilePreviewHref(input) {
 }
 function normalizeLocalFile(input) {
     const trimmed = input.trim();
+    if (isArtifactPreviewUrl(trimmed))
+        return trimmed;
     if (!trimmed)
         throw new Error("请输入文件或目录路径。");
     return localFilePreviewHref(trimmed) ?? (() => { throw new Error("请输入服务端文件路径。"); })();
@@ -108,7 +110,17 @@ function openUrl(value) {
         return false;
     }
 }
+export function isArtifactPreviewUrl(value) {
+    return /^\/api\/local-file\/[A-Za-z0-9_-]+\/$/.test(value) ||
+        /^\/api\/session-file\/[^/?#]+\?path=[^&#]+&mode=preview$/.test(value);
+}
 export const localPreviewController = {
+    openPreview(previewUrl, label = "HTML 预览") {
+        if (!isArtifactPreviewUrl(previewUrl))
+            return false;
+        publish({ open: true, mode: "file", value: previewUrl, previewUrl, sourceLabel: label, error: null });
+        return true;
+    },
     subscribe(listener) {
         listeners.add(listener);
         return () => listeners.delete(listener);

package/dist/web-ui/scripts.d.ts

@@ -16,3 +16,13 @@ export declare function getPlushAvatarChunk(requestedHash?: string): {
 };
 /** Blocking, content-versioned device preference bootstrap. */
 export declare function getThemePreloadAsset(): VersionedWebAsset;
+export interface BrowserModuleManifest {
+    entry: string;
+    eager: readonly string[];
+    files: readonly string[];
+    features?: Record<string, string>;
+}
+/** Snapshot a complete build before serving its bootstrap. Old processes keep
+ * its lazy bytes even if npm removes/replaces content during self-update. */
+export declare function getBrowserModuleManifest(): BrowserModuleManifest;
+export declare function getBrowserModule(file: string): string | undefined;

package/dist/web-ui/scripts.js

@@ -24,30 +24,32 @@ function readScriptCache() {
         // Retain the last disk read, or fall back to the embedded copy.
     }
 }
-function injectRuntimeValues(source, configPath, chunkHash, plushHash) {
+function injectRuntimeValues(source, configPath, chunkHash, plushHash, entry) {
     return source
         // This is a JS string literal, not HTML text. JSON escaping also handles
         // quotes, backslashes and newlines in nonstandard configuration paths.
         .replace('"${wandConfigPath}"', JSON.stringify(configPath))
         .replace("${aiTeamsChunkSrc}", `/assets/ai-teams.js?v=${chunkHash}`)
-        .replace("${plushAvatarChunkSrc}", `/assets/plush-avatar.js?v=${plushHash}`);
+        .replace("${plushAvatarChunkSrc}", `/assets/plush-avatar.js?v=${plushHash}`)
+        .replace("${browserModuleSrc}", `/assets/${entry}`);
 }
 export function getScriptAsset(configPath, requestedHash) {
     readScriptCache();
     const teamHash = getAiTeamsChunk().hash;
     const plushHash = getPlushAvatarChunk().hash;
-    const chunkHash = `${teamHash}:${plushHash}`;
+    const entry = getBrowserModuleManifest().entry;
+    const chunkHash = `${teamHash}:${plushHash}:${entry}`;
     if (!_scriptAsset || _scriptAsset.source !== _scriptCache
         || _scriptAsset.configPath !== configPath || _scriptAsset.chunkHash !== chunkHash) {
         _scriptAsset = {
-            ...versionWebAsset(injectRuntimeValues(_scriptCache, configPath, teamHash, plushHash)),
+            ...versionWebAsset(injectRuntimeValues(_scriptCache, configPath, teamHash, plushHash, entry)),
             source: _scriptCache, configPath, chunkHash,
         };
     }
     if (requestedHash && requestedHash !== _scriptAsset.hash) {
         if (!_embeddedScriptAsset || _embeddedScriptAsset.configPath !== configPath) {
             _embeddedScriptAsset = {
-                ...versionWebAsset(injectRuntimeValues(EMBEDDED_WEB_ASSETS.scriptsJs, configPath, embeddedAiTeamsChunk.hash, embeddedPlushAvatarChunk.hash)),
+                ...versionWebAsset(injectRuntimeValues(EMBEDDED_WEB_ASSETS.scriptsJs, configPath, embeddedAiTeamsChunk.hash, embeddedPlushAvatarChunk.hash, EMBEDDED_WEB_ASSETS.browserModuleManifest.entry)),
                 configPath,
             };
         }
@@ -108,3 +110,38 @@ export function getThemePreloadAsset() {
     return themePreloadAsset;
 }
 const themePreloadAsset = versionWebAsset(EMBEDDED_WEB_ASSETS.themePreloadJs);
+let browserManifest = EMBEDDED_WEB_ASSETS.browserModuleManifest;
+let browserManifestKey = "";
+const browserBuilds = [];
+/** Snapshot a complete build before serving its bootstrap. Old processes keep
+ * its lazy bytes even if npm removes/replaces content during self-update. */
+export function getBrowserModuleManifest() {
+    try {
+        const manifestPath = path.join(__dirname, "content/module-manifest.json");
+        const stat = fs.statSync(manifestPath);
+        const key = `${stat.mtimeMs}:${stat.size}`;
+        if (key !== browserManifestKey) {
+            const next = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+            if (!next.files.every(file => /^modules\/[a-f0-9]{16}\/[A-Za-z0-9_-]+\.js$/.test(file))
+                || !next.files.includes(next.entry) || !next.eager.every(file => next.files.includes(file))) {
+                throw new Error("Invalid browser module manifest");
+            }
+            const files = new Map(next.files.map(file => [file, fs.readFileSync(path.join(__dirname, "content", file), "utf8")]));
+            browserBuilds.unshift(files);
+            browserBuilds.splice(2);
+            browserManifest = next;
+            browserManifestKey = key;
+        }
+    }
+    catch { /* Retain the last complete graph (or embedded build), never mix versions. */ }
+    return browserManifest;
+}
+export function getBrowserModule(file) {
+    getBrowserModuleManifest();
+    for (const build of browserBuilds) {
+        const content = build.get(file);
+        if (content !== undefined)
+            return content;
+    }
+    return Object.hasOwn(EMBEDDED_WEB_ASSETS.browserModules, file) ? EMBEDDED_WEB_ASSETS.browserModules[file] : undefined;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@co0ontty/wand",
-  "version": "4.89.5",
+  "version": "4.90.0",
   "description": "A web console for Claude Code, Codex, OpenCode, and other local CLI tools.",
   "type": "module",
   "bin": {
@@ -23,7 +23,8 @@
   "preferGlobal": true,
   "scripts": {
     "generate:web-assets": "node scripts/generate-web-assets.js",
-    "build": "node scripts/check-node-version.js && rm -rf dist && node scripts/bundle-tailwind.js && node scripts/bundle-xterm.js && node scripts/bundle-qrcode.js && node scripts/bundle-browser.js && npm run generate:web-assets && tsc -p tsconfig.json && npm run build:copy-content && node scripts/check-bundle-budget.js && (npm run build:render-bin || echo '[wand] WARNING: build:render-bin failed; dist/native/ has no wand-render (run: npm run build:render-bin)' >&2) && node scripts/stamp-build-info.js && node scripts/fix-dist-permissions.js",
+    "build": "node src/deployment-lock.ts --run-project -- npm run build:body",
+    "build:body": "node scripts/check-node-version.js && rm -rf dist && node scripts/bundle-tailwind.js && node scripts/bundle-xterm.js && node scripts/bundle-qrcode.js && node scripts/bundle-browser.js && npm run generate:web-assets && tsc -p tsconfig.json && npm run build:copy-content && node scripts/check-bundle-budget.js && (npm run build:render-bin || echo '[wand] WARNING: build:render-bin failed; dist/native/ has no wand-render (run: npm run build:render-bin)' >&2) && node scripts/stamp-build-info.js && node scripts/fix-dist-permissions.js",
     "build:copy-content": "cp -r src/web-ui/content dist/web-ui/ && cp src/decision-worker.py dist/decision-worker.py && node scripts/minify-dist-content.js",
     "build:render-bin": "node scripts/stage-render-binaries.js --all",
     "speech:install": "node scripts/install-speech-runtime.js",
@@ -31,7 +32,8 @@
     "build:render-native": "cargo build --release --manifest-path render/Cargo.toml -p wand-renderd",
     "build:structured-render-native": "cargo build --release --manifest-path render/Cargo.toml -p wand-structured-renderd",
     "dev": "node scripts/check-node-version.js && node scripts/bundle-tailwind.js && node scripts/bundle-xterm.js && node scripts/bundle-qrcode.js && node scripts/bundle-browser.js --development && npm run generate:web-assets && tsx src/cli.ts web",
-    "check": "node scripts/check-node-version.js && node scripts/bundle-tailwind.js && node scripts/bundle-xterm.js && node scripts/bundle-qrcode.js && node scripts/bundle-browser.js && npm run generate:web-assets && tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.browser.json && tsc --noEmit -p tsconfig.react.json",
+    "check": "node src/deployment-lock.ts --run-project -- npm run check:body",
+    "check:body": "node scripts/check-node-version.js && node scripts/bundle-tailwind.js && node scripts/bundle-xterm.js && node scripts/bundle-qrcode.js && node scripts/bundle-browser.js && npm run generate:web-assets && tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.browser.json && tsc --noEmit -p tsconfig.react.json",
     "test": "node scripts/check-node-version.js && node --test --import tsx tests/*.test.ts",
     "check:bundle-budget": "node scripts/check-node-version.js && node scripts/check-bundle-budget.js",
     "sync:brand-assets": "node scripts/sync-brand-assets.js",
@@ -82,6 +84,7 @@
     "@xterm/xterm": "^6.0.0",
     "antd": "6.6.5",
     "esbuild": "^0.28.0",
+    "fast-sha256": "1.3.0",
     "qrcode": "^1.5.4",
     "react": "^19.2.7",
     "react-dom": "^19.2.7",

package/dist/web-ui/content/licenses/codex-LICENSE.txt

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2023 LobeHub
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.