@deepseek-harness-tui/dsh-tui 0.14.1 → 0.16.0

package/lib/types/utils/imageResize.js

@@ -9,12 +9,15 @@
  * (bytes + media type) through sharp — an optionalDependency, absent on
  * minimal installs, which must degrade with a clear error, not a crash.
  *
- * Sizing probe is pure byte inspection (PNG/JPEG/WebP/GIF). Formats the
- * probe cannot identify return null and MUST be forced through an actual
- * decode for measurement — the #432 review gap was letting an
- * "unrecognized but under the byte cap" image through, where a
- * large-resolution small-byte WebP/GIF would sail past the probe and be
- * rejected by upstream afterwards.
+ * The sizing probe is pure byte inspection (PNG/JPEG/WebP/GIF) and lives in
+ * `src/backends/shared/image-size.ts` (D15), because backends admit pasted
+ * images with the same measurement and must not reach into `src/utils/`
+ * (B-3); it is re-exported here so this module stays one import for the
+ * host's composer gate. Formats the probe cannot identify return null and
+ * MUST be forced through an actual decode for measurement — the #432 review
+ * gap was letting an "unrecognized but under the byte cap" image through,
+ * where a large-resolution small-byte WebP/GIF would sail past the probe and
+ * be rejected by upstream afterwards.
  *
  * The single entry point is {@link adaptImageForAdmission}: it decides
  * whether anything has to change (resample, re-encode, or both) and reports
@@ -22,129 +25,9 @@
  * rewriting their image.
  */
 import { loadSharp } from '../dsh-adapter/sharp.js';
-const PNG_SIGNATURE = [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a];
-function probePng(b) {
-    // IHDR is required to be the first chunk: width/height are big-endian
-    // u32 at fixed offsets 16/20.
-    if (b.length < 24)
-        return null;
-    const width = (b[16] << 24) | (b[17] << 16) | (b[18] << 8) | b[19];
-    const height = (b[20] << 24) | (b[21] << 16) | (b[22] << 8) | b[23];
-    return width > 0 && height > 0 ? { width, height } : null;
-}
-function probeJpeg(b) {
-    // Walk the segment chain to the first SOF marker (C0–CF except C4 DHT,
-    // C8 JPG, CC DAC); height/width are big-endian u16 at +5/+7 inside it.
-    if (b.length < 4 || b[0] !== 0xff || b[1] !== 0xd8)
-        return null;
-    let i = 2;
-    while (i + 9 < b.length) {
-        if (b[i] !== 0xff)
-            return null;
-        const marker = b[i + 1];
-        if (marker === 0xd8 || (marker >= 0xd0 && marker <= 0xd9)) {
-            i += 2; // standalone markers carry no length
-            continue;
-        }
-        const segLen = (b[i + 2] << 8) | b[i + 3];
-        if (segLen < 2)
-            return null;
-        const isSof = marker >= 0xc0 && marker <= 0xcf
-            && marker !== 0xc4 && marker !== 0xc8 && marker !== 0xcc;
-        if (isSof) {
-            const height = (b[i + 5] << 8) | b[i + 6];
-            const width = (b[i + 7] << 8) | b[i + 8];
-            return width > 0 && height > 0 ? { width, height } : null;
-        }
-        i += 2 + segLen;
-    }
-    return null;
-}
-function probeWebp(b) {
-    // RIFF....WEBP followed by VP8X (extended) or VP8 (lossy) or VP8L
-    // (lossless). VP8X carries the canvas size as 1-subtracted 24-bit LE;
-    // VP8 carries u16 LE after the frame tag; VP8L packs 14-bit
-    // 1-subtracted fields after the signature byte.
-    if (b.length < 30)
-        return null;
-    if (b[0] !== 0x52 || b[1] !== 0x49 || b[2] !== 0x46 || b[3] !== 0x46)
-        return null;
-    if (b[8] !== 0x57 || b[9] !== 0x45 || b[10] !== 0x42 || b[11] !== 0x50)
-        return null;
-    const fourcc = String.fromCharCode(b[12], b[13], b[14], b[15]);
-    if (fourcc === 'VP8X') {
-        const width = 1 + ((b[24] | (b[25] << 8) | (b[26] << 16)) & 0xffffff);
-        const height = 1 + ((b[27] | (b[28] << 8) | (b[29] << 16)) & 0xffffff);
-        return { width, height };
-    }
-    if (fourcc === 'VP8 ') {
-        // Uncompressed chunk header (10 bytes) then keyframe tag (3) then the
-        // dimensions: 14-bit width/height in the low bits of each u16, with a
-        // 2-bit horizontal/vertical scale in the top bits (RFC 6386 §9.1). Mask
-        // them off, or an encoder that sets the scale bits is measured up to
-        // 49152px too wide and gets shrunk far past the caps.
-        const width = (b[26] | (b[27] << 8)) & 0x3fff;
-        const height = (b[28] | (b[29] << 8)) & 0x3fff;
-        return width > 0 && height > 0 ? { width, height } : null;
-    }
-    if (fourcc === 'VP8L') {
-        const bits = (b[21] | (b[22] << 8) | (b[23] << 16) | (b[24] << 24)) >>> 0;
-        const width = (bits & 0x3fff) + 1;
-        const height = ((bits >> 14) & 0x3fff) + 1;
-        return { width, height };
-    }
-    return null;
-}
-function probeGif(b) {
-    // Logical screen descriptor: u16 LE at fixed offsets 6/8. A truncated header
-    // reads as 0×0 and would then look "inside the caps", so the zero check is
-    // what keeps an unmeasurable file on the decode path.
-    const width = b[6] | (b[7] << 8);
-    const height = b[8] | (b[9] << 8);
-    return width > 0 && height > 0 ? { width, height } : null;
-}
-/**
- * The image media type the encoded bytes actually are, from the magic
- * bytes alone (the same signatures {@link probeImageSize} dispatches on):
- * PNG, JPEG, WebP (RIFF/WEBP) or GIF; anything else is undefined and the
- * caller keeps its own label (those bytes take the decode-or-refuse path
- * anyway). Used to keep a renamed file from travelling under a label its
- * content contradicts.
- */
-export function sniffImageMediaType(bytes) {
-    if (bytes.length >= 8 && PNG_SIGNATURE.every((v, i) => bytes[i] === v))
-        return 'image/png';
-    if (bytes.length >= 2 && bytes[0] === 0xff && bytes[1] === 0xd8)
-        return 'image/jpeg';
-    if (bytes.length >= 12 && bytes[0] === 0x52 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x46
-        && bytes[8] === 0x57 && bytes[9] === 0x45 && bytes[10] === 0x42 && bytes[11] === 0x50)
-        return 'image/webp';
-    if (bytes.length >= 4 && bytes[0] === 0x47 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x38)
-        return 'image/gif';
-    return undefined;
-}
-/**
- * Measure intrinsic pixel dimensions from the encoded bytes alone — no
- * decode, no dependencies. Recognizes PNG / JPEG / WebP (VP8X, VP8,
- * VP8L) / GIF; anything else returns null, which callers MUST treat as
- * "unknown, force a real decode" — never as "small enough".
- */
-export function probeImageSize(bytes) {
-    if (bytes.length >= 8 && PNG_SIGNATURE.every((v, i) => bytes[i] === v)) {
-        return probePng(bytes);
-    }
-    if (bytes.length >= 2 && bytes[0] === 0xff && bytes[1] === 0xd8) {
-        return probeJpeg(bytes);
-    }
-    if (bytes.length >= 30 && bytes[0] === 0x52 && bytes[8] === 0x57) {
-        return probeWebp(bytes);
-    }
-    if (bytes.length >= 10
-        && bytes[0] === 0x47 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x38) {
-        return probeGif(bytes);
-    }
-    return null;
-}
+import { probeImageSize, sniffImageMediaType } from '../backends/shared/image-size.js';
+import { bmpToPng, looksLikeBitmap } from './bmp.js';
+export { probeImageSize, sniffImageMediaType };
 /** Whether a measured image already satisfies the dimension/pixel caps. */
 export function withinDimensionLimits(size, limits) {
     return size.width <= limits.maxImageDimension
@@ -207,6 +90,12 @@ function chooseTargetMediaType(input) {
  * short-circuits the common case — bytes it proves to be inside the caps in an
  * accepted format are returned untouched, with no encoder loaded.
  *
+ * A bitmap paste is converted before any of that: BMP is a format the byte
+ * probe cannot measure and libvips cannot decode at all, so a WeChat or X11
+ * clipboard copy used to be refused as "unsupported image format" however
+ * valid it was. {@link bmpToPng} is dependency-free, so the conversion also
+ * covers deployments without sharp.
+ *
  * Aspect ratio is preserved by {@link downscaleTarget}. An animated source is
  * REFUSED whenever this gate would have to touch its bytes: re-encoding a
  * multi-page image here cannot promise frames, delays and loop survive, and
@@ -215,18 +104,43 @@ function chooseTargetMediaType(input) {
  * change pass through untouched.
  */
 export async function adaptImageForAdmission(bytes, sourceMediaType, limits, acceptedMediaTypes) {
-    const probe = probeImageSize(bytes);
+    let sourceBytes = bytes;
+    let sourceType = sourceMediaType;
+    let converted = false;
+    if (looksLikeBitmap(sourceBytes)) {
+        const png = await bmpToPng(Buffer.from(sourceBytes));
+        if (png !== null) {
+            sourceBytes = png;
+            sourceType = 'image/png';
+            converted = true;
+        }
+    }
+    const probe = probeImageSize(sourceBytes);
     // Share the host-first decoder with previews; a bare import here can load
     // a second libvips and write native warnings straight into the live TUI.
     const sharp = await loadSharp();
     if (sharp === undefined) {
+        // The bitmap conversion needed no libvips, and neither does an in-cap
+        // result: only a resize would, and there is none to do.
+        if (converted && probe !== null && withinDimensionLimits(probe, limits)
+            && acceptedMediaTypes.includes(sourceType)) {
+            return {
+                kind: 'adapted',
+                data: sourceBytes,
+                mediaType: sourceType,
+                width: probe.width,
+                height: probe.height,
+                resized: false,
+                flattened: false,
+            };
+        }
         return { kind: 'unavailable', reason: 'sharp-missing', detail: 'sharp is not installed in this environment' };
     }
     try {
         // One header read drives every decision below: dimensions for a format
         // the byte probe cannot measure (the #432 gap), alpha support, and the
         // frame count that decides whether this gate may touch the bytes at all.
-        const image = sharp(bytes);
+        const image = sharp(sourceBytes);
         const meta = await image.metadata();
         const measured = probe ?? (meta.width !== undefined && meta.height !== undefined
             ? { width: meta.width, height: meta.height }
@@ -236,8 +150,21 @@ export async function adaptImageForAdmission(bytes, sourceMediaType, limits, acc
         }
         const hasAlpha = meta.hasAlpha === true;
         const resized = !withinDimensionLimits(measured, limits);
-        if (!resized && acceptedMediaTypes.includes(sourceMediaType))
-            return { kind: 'unchanged' };
+        if (!resized && acceptedMediaTypes.includes(sourceType)) {
+            // 'unchanged' promises the store the source bytes; a converted bitmap is
+            // different bytes and has to travel as an adaptation.
+            return converted
+                ? {
+                    kind: 'adapted',
+                    data: sourceBytes,
+                    mediaType: sourceType,
+                    width: measured.width,
+                    height: measured.height,
+                    resized: false,
+                    flattened: false,
+                }
+                : { kind: 'unchanged' };
+        }
         if ((meta.pages ?? 1) > 1) {
             return {
                 kind: 'unavailable',
@@ -245,7 +172,7 @@ export async function adaptImageForAdmission(bytes, sourceMediaType, limits, acc
                 detail: `${meta.pages} frames`,
             };
         }
-        const mediaType = chooseTargetMediaType({ hasAlpha, sourceMediaType, acceptedMediaTypes });
+        const mediaType = chooseTargetMediaType({ hasAlpha, sourceMediaType: sourceType, acceptedMediaTypes });
         const target = downscaleTarget(measured, limits);
         const flattened = hasAlpha && mediaType === 'image/jpeg';
         let pipeline = image;

package/lib/types/utils/inputPaste.d.ts

@@ -8,13 +8,13 @@
  *    谁都不许再硬编码 `ctrl+v` 字符串。
  *
  * 明确**不**统一的语义（边界见 Launchpad/PromptInput 各自注释）：
- * - 多行/附件/图片暂存/历史/chip 折叠是聊天页编辑器的能力，落地页是单行
+ * - 多行/历史/chip 折叠是聊天页编辑器的能力，落地页是单行
  *   首屏输入——多行内容在落地页折叠成一行（{@link collapseToSingleLine}），
  *   PromptInput 保留换行；
  * - 异步落点守则**同一条**（读回时必须用当下最新的文本/光标，闭包旧值一律
  *   不许用），实现各自落地：PromptInput 用 revision lease（与会话代次、图片
  *   租约耦合，搬动会改变聊天页行为），Launchpad 用每次渲染刷新的 current-ref
- *   （受控组件，props 即最新值）。
+ *   （受控组件，props 即最新值）与粘贴租约。
  */
 import { type ComboKeyFlags } from './keymap.js';
 /**

package/lib/types/utils/inputPaste.js

@@ -8,13 +8,13 @@
  *    谁都不许再硬编码 `ctrl+v` 字符串。
  *
  * 明确**不**统一的语义（边界见 Launchpad/PromptInput 各自注释）：
- * - 多行/附件/图片暂存/历史/chip 折叠是聊天页编辑器的能力，落地页是单行
+ * - 多行/历史/chip 折叠是聊天页编辑器的能力，落地页是单行
  *   首屏输入——多行内容在落地页折叠成一行（{@link collapseToSingleLine}），
  *   PromptInput 保留换行；
  * - 异步落点守则**同一条**（读回时必须用当下最新的文本/光标，闭包旧值一律
  *   不许用），实现各自落地：PromptInput 用 revision lease（与会话代次、图片
  *   租约耦合，搬动会改变聊天页行为），Launchpad 用每次渲染刷新的 current-ref
- *   （受控组件，props 即最新值）。
+ *   （受控组件，props 即最新值）与粘贴租约。
  */
 import stripAnsi from 'strip-ansi';
 import { actionMatches } from './keymap.js';

package/lib/types/utils/pastedImagePath.d.ts

@@ -56,4 +56,9 @@ export declare function stageClipboardFilePaths<T>(paths: readonly string[], sta
     readonly failure: string;
     readonly failureCode?: 'image-limit';
 }>;
+/** Read one regular file through one descriptor, bounded to `maxBytes + 1`.
+ * The extra byte detects a file that grows after fstat; a short read detects
+ * shrinkage. This avoids stat(path) → readFile(path)'s path-swap TOCTOU and
+ * never allocates from an untrusted size before the profile limit is checked. */
+export declare function readBoundedRegularFile(path: string, maxBytes: number): Promise<Uint8Array>;
 //# sourceMappingURL=pastedImagePath.d.ts.map

package/lib/types/utils/pastedImagePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pastedImagePath.d.ts","sourceRoot":"","sources":["../../../src/utils/pastedImagePath.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,GACX,WAAW,GAAG,YAAY,GAAG,YAAY,GAAG,WAAW,GAAG,SAAS,CAMrE;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiChE;AA8FD;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,CAAC,CAAC,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAErD,wBAAsB,uBAAuB,CAAC,CAAC,EAC7C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EACnC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EACpC,SAAS,SAA2B,GACnC,OAAO,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAA;CACrC,CAAC,CA2BD"}
+{"version":3,"file":"pastedImagePath.d.ts","sourceRoot":"","sources":["../../../src/utils/pastedImagePath.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,GACX,WAAW,GAAG,YAAY,GAAG,YAAY,GAAG,WAAW,GAAG,SAAS,CAMrE;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiChE;AA8FD;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,CAAC,CAAC,IACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAErD,wBAAsB,uBAAuB,CAAC,CAAC,EAC7C,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EACnC,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,EACpC,SAAS,SAA2B,GACnC,OAAO,CAAC;IACT,QAAQ,CAAC,KAAK,EAAE,SAAS,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAA;IACrD,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,aAAa,CAAA;CACrC,CAAC,CA2BD;AAED;;;iFAGiF;AACjF,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAoBhG"}

package/lib/types/utils/pastedImagePath.js

@@ -7,6 +7,9 @@
  * WHOLE paste is a single, syntactically unambiguous local image path.
  * Existence is the caller's async check; parse success alone stages nothing.
  */
+import { constants as fsConstants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { basename } from 'node:path';
 import { homedir } from 'node:os';
 import { fileURLToPath } from 'node:url';
 /** Image media type per file extension, or undefined for non-image paths.
@@ -216,3 +219,33 @@ export async function stageClipboardFilePaths(paths, stage, formatPath, maxStage
     }
     return { parts, staged, failure, ...(failureCode ? { failureCode } : {}) };
 }
+/** Read one regular file through one descriptor, bounded to `maxBytes + 1`.
+ * The extra byte detects a file that grows after fstat; a short read detects
+ * shrinkage. This avoids stat(path) → readFile(path)'s path-swap TOCTOU and
+ * never allocates from an untrusted size before the profile limit is checked. */
+export async function readBoundedRegularFile(path, maxBytes) {
+    // O_NONBLOCK keeps a pasted FIFO/device path from parking the UI before
+    // fstat can reject it; regular-file reads are unchanged.
+    const file = await open(path, fsConstants.O_RDONLY | fsConstants.O_NONBLOCK);
+    try {
+        const info = await file.stat();
+        if (!info.isFile())
+            throw new Error(`${basename(path)} is not a regular file`);
+        if (info.size > maxBytes)
+            throw new Error(`image exceeds this profile's per-image size limit`);
+        const data = Buffer.allocUnsafe(info.size + 1);
+        let offset = 0;
+        while (offset < data.byteLength) {
+            const { bytesRead } = await file.read(data, offset, data.byteLength - offset, offset);
+            if (bytesRead === 0)
+                break;
+            offset += bytesRead;
+        }
+        if (offset !== info.size)
+            throw new Error(`${basename(path)} changed while it was being read`);
+        return data.subarray(0, offset);
+    }
+    finally {
+        await file.close();
+    }
+}

package/lib/types/utils/paths.d.ts

@@ -13,4 +13,15 @@
 export declare function homeDir(): string;
 /** Data directory all preferences/history live in (`~/.dsh-tui`). */
 export declare const DATA_DIR: string;
+/**
+ * Where one backend keeps its own files: `<dataRoot>/backends/<id>`, keyed by
+ * the backend's declared id (the `x-dsh-tui` Backend entry's `spec.id` field).
+ * The single construction point, so a check for what a removal
+ * left behind reads the same path the backend wrote to (C-5).
+ *
+ * `dataRoot` defaults to this profile's own `~/.dsh-tui`. It is a parameter so
+ * that a regression can point the whole check at a temporary tree, exactly like
+ * the diagnostics' own `dataDir` override.
+ */
+export declare function backendDataDir(backendId: string, dataRoot?: string): string;
 //# sourceMappingURL=paths.d.ts.map

package/lib/types/utils/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/utils/paths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;GAIG;AACH,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,qEAAqE;AACrE,eAAO,MAAM,QAAQ,QAA8B,CAAA"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/utils/paths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;GAIG;AACH,wBAAgB,OAAO,IAAI,MAAM,CAEhC;AAED,qEAAqE;AACrE,eAAO,MAAM,QAAQ,QAA8B,CAAA;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAiB,GAAG,MAAM,CAErF"}

package/lib/types/utils/paths.js

@@ -17,3 +17,16 @@ export function homeDir() {
 }
 /** Data directory all preferences/history live in (`~/.dsh-tui`). */
 export const DATA_DIR = join(homeDir(), '.dsh-tui');
+/**
+ * Where one backend keeps its own files: `<dataRoot>/backends/<id>`, keyed by
+ * the backend's declared id (the `x-dsh-tui` Backend entry's `spec.id` field).
+ * The single construction point, so a check for what a removal
+ * left behind reads the same path the backend wrote to (C-5).
+ *
+ * `dataRoot` defaults to this profile's own `~/.dsh-tui`. It is a parameter so
+ * that a regression can point the whole check at a temporary tree, exactly like
+ * the diagnostics' own `dataDir` override.
+ */
+export function backendDataDir(backendId, dataRoot = DATA_DIR) {
+    return join(dataRoot, 'backends', backendId);
+}