@inventec/dsh-onetree-log 0.1.2 → 0.1.4

package/lib/client.js

@@ -231,7 +231,7 @@ window.__ModuleLoader__.load({
           },
         }, data.content),
         data && data.truncated && h('div', { style: { fontSize: '11px', opacity: 0.6, marginTop: '4px' } },
-          `（仅显示前 ${humanBytes(data.content ? data.content.length : 0)}，完整内容请到服务器查看解压目录）`),
+          `（仅显示前 ${humanBytes(data.previewBytes ?? (data.content ? data.content.length : 0))}，完整内容请到服务器查看解压目录）`),
       )
     }
 

package/lib/index.js

@@ -20,11 +20,10 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { pipeline } from 'node:stream/promises'
-import { Readable } from 'node:stream'
 import { DumpStore } from './store.js'
 
 export const name = '@inventec/dsh-onetree-log'
-export const inject = ['webServer', 'webRuntime']
+export const inject = ['webServer'] /* LOCAL-PATCH 2026-10-18 (know-how 035): 0.2.1 host removed webRuntime (→webStartup); trusted-hosts now resolved per-request via non-throwing dual-service fallback */
 
 const MAX_UPLOAD_BYTES = 512 * 1024 * 1024
 const PREVIEW_BYTES = 256 * 1024
@@ -62,7 +61,6 @@ function readJsonBody(req) {
 /** 上传字节流 → 临时文件（限额流式落盘，不进内存）。 */
 async function saveUpload(req, destPath) {
   let received = 0
-  const counter = new Readable().wrap(req) // 仅用于错误传播；直接流 req
   const out = fs.createWriteStream(destPath)
   await new Promise((resolve, reject) => {
     req.on('data', chunk => {
@@ -82,7 +80,6 @@ async function saveUpload(req, destPath) {
     req.on('error', reject)
     out.on('error', reject)
   })
-  void counter
 }
 
 function sanitizeUploadName(raw) {
@@ -151,11 +148,14 @@ function previewFile(absPath) {
     if (looksBinary(buf)) {
       return { binary: true, size: stat.size, truncated: stat.size > len }
     }
+    const content = buf.toString('utf8')
     return {
       binary: false,
       size: stat.size,
       truncated: stat.size > len,
-      content: buf.toString('utf8'),
+      content,
+      // UTF-8 实际字节数（content.length 是 UTF-16 字符数，中文日志会偏小）
+      previewBytes: Buffer.byteLength(content, 'utf8'),
     }
   } finally {
     fs.closeSync(handle)
@@ -188,7 +188,8 @@ async function dispatch(req, res, log) {
       return writeJson(res, 200, detail)
     }
     if (method === 'DELETE') {
-      return writeJson(res, store.remove(id) ? 200 : 404, { ok: true })
+      const removed = store.remove(id)
+      return writeJson(res, removed ? 200 : 404, removed ? { ok: true } : { ok: false, error: 'dump 不存在' })
     }
     return writeJson(res, 405, { error: 'method not allowed' })
   }
@@ -246,7 +247,14 @@ export function apply(ctx) {
   store = new DumpStore()
   ctx.logger?.info?.(`[dsh-onetree-log] store at ${store.dumpsDir}，已登记 ${store.list().length} 个 dump`)
 
-  const trustedHostsOf = () => (Array.isArray(ctx.webRuntime?.trustedHosts) ? ctx.webRuntime.trustedHosts : [])
+  /* LOCAL-PATCH 2026-10-18 (know-how 035): was `ctx.webRuntime?.trustedHosts` (0.2.1 host removed webRuntime; cordis Local throws on un-injected property access, `?.` cannot protect). 034 pattern: non-throwing ctx.get lookup, webStartup (0.2.1+) → webRuntime (≤0.2.0) → []. */
+  const resolveTrustedHosts = () => {
+    let startup, runtime
+    try { startup = ctx?.get?.('webStartup') } catch {}
+    try { runtime = ctx?.get?.('webRuntime') } catch {}
+    return startup?.trustedHosts ?? runtime?.trustedHosts ?? []
+  }
+  const trustedHostsOf = () => resolveTrustedHosts()
   try {
     ctx.effect(() => ctx.webServer.register({
       kind: 'prefix',

package/lib/store.js

@@ -77,7 +77,7 @@ export class DumpStore {
     return this.cache.get(key)
   }
 
-  /** ingest 完成后的完整详情：meta + 现算的文件清单（带内存缓存）。 */
+  /** ingest 完成后的完整详情：meta + 现算的文件清单（每次调用全量重建）。 */
   detail(id) {
     const meta = this.get(id)
     if (!meta) return undefined
@@ -167,13 +167,10 @@ export class DumpStore {
   remove(id) {
     const meta = this.get(id)
     if (!meta) return false
-    // path-dir：rootDir 是用户目录，绝不能删；只清登记目录（里面只有 meta.json）
+    // path-dir：rootDir 是用户目录，绝不能删；登记目录里只有 meta.json，
+    // 与其他类型一样整体清掉即可
     const home = path.join(this.dumpsDir, id)
-    if (meta.sourceKind === 'path-dir') {
-      fs.rmSync(home, { recursive: true, force: true })
-    } else {
-      fs.rmSync(home, { recursive: true, force: true })
-    }
+    fs.rmSync(home, { recursive: true, force: true })
     this.cache.delete(id)
     return true
   }
@@ -183,7 +180,9 @@ export class DumpStore {
     const meta = this.get(id)
     if (!meta) throw new Error('dump 不存在')
     const rel = String(relPath ?? '')
-    if (rel.includes('..') || rel.startsWith('/') || rel.includes('\0')) {
+    // 只按路径段拒绝 '..'（'a..b.log' 这类合法文件名不误伤）；越界仍由下方
+    // 前缀包含检查兜底，fail-safe 方向不变
+    if (rel.split(/[\\/]+/).includes('..') || rel.startsWith('/') || rel.includes('\0')) {
       throw new Error('非法的文件路径')
     }
     const target = path.resolve(meta.rootDir, ...rel.split('/').filter(s => s !== '' && s !== '.'))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inventec/dsh-onetree-log",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "AMI MegaRAC OneTree 一键日志（OpenBMC dreport dump）上传与分析框架：设置面板「OneTree 日志」上传压缩包或登记服务器本地路径，安全解包、自动探测 dump 根、文件清单分类，为第二阶段逐域解析提供内核。",
   "type": "module",
   "main": "./lib/index.js",