@michengai/dsh-codex-ui 0.2.111 → 0.2.113

package/lib/index.mjs

@@ -5,6 +5,16 @@ import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomBytes, randomUUID } from "node:crypto";
+//#region src/business-api.ts
+const CODEX_UI_API_BASE = "/api/dsh-codex-ui";
+const CODEX_UI_API_ENDPOINTS = Object.freeze({
+	connectors: `${CODEX_UI_API_BASE}/connectors`,
+	dependencies: `${CODEX_UI_API_BASE}/dependencies`,
+	openInExplorer: `${CODEX_UI_API_BASE}/open-in-explorer`,
+	preferences: `${CODEX_UI_API_BASE}/preferences`,
+	sessionMove: `${CODEX_UI_API_BASE}/session-move`
+});
+//#endregion
 //#region src/dependencies.ts
 const SUITE_PACKAGE = "@michengai/dsh-codex-suite";
 const SUITE_MEMBER_PACKAGES = [
@@ -1558,41 +1568,17 @@ function writeWorkspacePreferences(pinnedWorkspaceIds, workspaceGroups = [], pat
 }
 //#endregion
 //#region src/index.ts
-const connectorsEndpoint = "/api/michengai/codex-ui/connectors";
-const dependenciesEndpoint = "/api/michengai/codex-ui/dependencies";
-const explorerEndpoint = "/api/michengai/codex-ui/open-in-explorer";
-const preferencesEndpoint = "/api/michengai/codex-ui/preferences";
-const sessionMoveEndpoint = "/api/michengai/codex-ui/session-move";
+const connectorsEndpoint = CODEX_UI_API_ENDPOINTS.connectors;
+const dependenciesEndpoint = CODEX_UI_API_ENDPOINTS.dependencies;
+const explorerEndpoint = CODEX_UI_API_ENDPOINTS.openInExplorer;
+const preferencesEndpoint = CODEX_UI_API_ENDPOINTS.preferences;
+const sessionMoveEndpoint = CODEX_UI_API_ENDPOINTS.sessionMove;
 const maxPreferencesBodyBytes = 32768;
-function isLoopbackAddress(value) {
-	const address = value?.toLowerCase().replace(/^\[|\]$/g, "");
-	return address === "localhost" || address === "localhost." || address === "::1" || address?.startsWith("127.") === true || address?.startsWith("::ffff:127.") === true;
-}
 function headerValue(headers, name) {
 	const value = headers[name];
 	if (typeof value === "string") return value;
 	if (Array.isArray(value)) return value[0];
 }
-/**
-* 依赖安装会改写用户配置并拉起子进程，只允许回环地址上的同源浏览器请求。
-* Origin、Host 和 Sec-Fetch-Site 都可被非浏览器客户端伪造，不能单独作为授权依据。
-*/
-function crossSiteRequest(request) {
-	if (!isLoopbackAddress(request.socket?.remoteAddress)) return true;
-	const headers = request.headers;
-	if (headers === void 0) return true;
-	const site = headerValue(headers, "sec-fetch-site");
-	if (site !== void 0 && site !== "same-origin") return true;
-	const origin = headerValue(headers, "origin");
-	const host = headerValue(headers, "host");
-	if (origin === void 0 || host === void 0) return true;
-	try {
-		const url = new URL(origin);
-		return url.protocol !== "http:" && url.protocol !== "https:" || !isLoopbackAddress(url.hostname) || url.host !== host;
-	} catch {
-		return true;
-	}
-}
 /** 把安装错误收成可给浏览器看的文案：我们自己的中文说明保留，带本地路径的底层错误脱敏。 */
 function publicDependencyError(error) {
 	const message = error instanceof Error ? error.message : "依赖管理暂不可用。";
@@ -1615,6 +1601,35 @@ async function readRequestBody(request, maxBytes = maxPreferencesBodyBytes) {
 	}
 	return Buffer.concat(chunks).toString("utf8");
 }
+/**
+* 所有业务 REST 依赖 connection >=0.1.2-rc.1 的 Host/Origin/Fetch Metadata 与登录检查。
+* 必须在读取请求体及执行副作用前调用；不得将 undefined 以外的拒绝结果当作放行。
+* 发布包信任边界由 tests/business-rest-auth.assert.ts 的真实宿主契约用例验证。
+*/
+function authenticateBusinessRequest(ctx, request, response, errorBody = (_status, message) => ({ error: message })) {
+	const reject = (status, message) => {
+		response.writeHead(status, {
+			"content-type": "application/json; charset=utf-8",
+			"cache-control": "no-store"
+		});
+		response.end(JSON.stringify(errorBody(status, message)));
+		return false;
+	};
+	try {
+		const connection = ctx.get("connection");
+		if (typeof connection?.requestRejection !== "function") {
+			ctx.logger.warn("Codex UI 业务 REST 认证不可用：缺少 connection.requestRejection。");
+			return reject(503, "宿主认证服务暂不可用。");
+		}
+		const rejection = connection.requestRejection(request);
+		if (rejection !== void 0) return reject(rejection, rejection === 401 ? "请先登录 DSH。" : "已拒绝不可信或跨站请求。");
+		return true;
+	} catch (error) {
+		const reason = error instanceof Error ? `${error.name}: ${error.message}` : typeof error;
+		ctx.logger.warn("Codex UI 业务 REST 认证调用失败：%s", reason);
+		return reject(503, "宿主认证服务暂不可用。");
+	}
+}
 const inject = [
 	"webServer",
 	"agents",
@@ -1650,6 +1665,13 @@ function publicSessionMoveError(error) {
 		}[code] ?? "暂时无法移动该会话，请稍后重试。"
 	};
 }
+function sessionMoveAuthenticationError(status, error) {
+	return {
+		ok: false,
+		code: status === 401 ? "session-move/unauthorized" : status === 403 ? "session-move/forbidden" : "session-move/service-unavailable",
+		error
+	};
+}
 /** 提供不泄露地址、命令和凭证的连接器目录。 */
 function apply(ctx) {
 	const host = hostServices(ctx);
@@ -1660,6 +1682,7 @@ function apply(ctx) {
 			kind: "exact",
 			path: connectorsEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response)) return;
 				if (request.method !== "GET" && request.method !== "HEAD") {
 					response.writeHead(405);
 					response.end();
@@ -1702,6 +1725,7 @@ function apply(ctx) {
 			kind: "exact",
 			path: dependenciesEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response)) return;
 				const url = new URL(request.url ?? "/", "http://localhost");
 				try {
 					if (request.method === "GET") {
@@ -1731,14 +1755,6 @@ function apply(ctx) {
 						return;
 					}
 					if (request.method === "POST") {
-						if (crossSiteRequest(request)) {
-							response.writeHead(403, {
-								"content-type": "application/json; charset=utf-8",
-								"cache-control": "no-store"
-							});
-							response.end(JSON.stringify({ error: "已拒绝非本机同源请求。" }));
-							return;
-						}
 						if (url.searchParams.get("action") === "update-all") {
 							const runtime = resolveDependencyRuntime(ctx);
 							const notifyParent = canRequestParentReload(runtime);
@@ -1800,6 +1816,7 @@ function apply(ctx) {
 			kind: "exact",
 			path: preferencesEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response)) return;
 				try {
 					if (request.method === "GET" || request.method === "HEAD") {
 						const preferences = await readWorkspacePreferences();
@@ -1811,14 +1828,6 @@ function apply(ctx) {
 						return;
 					}
 					if (request.method === "PUT") {
-						if (crossSiteRequest(request)) {
-							response.writeHead(403, {
-								"content-type": "application/json; charset=utf-8",
-								"cache-control": "no-store"
-							});
-							response.end(JSON.stringify({ error: "已拒绝跨站请求。" }));
-							return;
-						}
 						const body = JSON.parse(await readRequestBody(request));
 						const record = body !== null && typeof body === "object" ? body : void 0;
 						const pinnedWorkspaceIds = record === void 0 ? void 0 : parsePinnedWorkspaceIds(record.pinnedWorkspaceIds);
@@ -1878,23 +1887,12 @@ function apply(ctx) {
 			kind: "exact",
 			path: sessionMoveEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response, sessionMoveAuthenticationError)) return;
 				if (request.method !== "POST") {
 					response.writeHead(405, { allow: "POST" });
 					response.end();
 					return;
 				}
-				if (crossSiteRequest(request)) {
-					response.writeHead(403, {
-						"content-type": "application/json; charset=utf-8",
-						"cache-control": "no-store"
-					});
-					response.end(JSON.stringify({
-						ok: false,
-						code: "session-move/cross-site",
-						error: "已拒绝跨站请求。"
-					}));
-					return;
-				}
 				try {
 					const body = JSON.parse(await readRequestBody(request));
 					const record = body !== null && typeof body === "object" ? body : void 0;
@@ -1951,19 +1949,12 @@ function apply(ctx) {
 			kind: "exact",
 			path: explorerEndpoint,
 			handler: async (request, response) => {
+				if (!authenticateBusinessRequest(ctx, request, response)) return;
 				if (request.method !== "POST") {
 					response.writeHead(405, { allow: "POST" });
 					response.end();
 					return;
 				}
-				if (crossSiteRequest(request)) {
-					response.writeHead(403, {
-						"content-type": "application/json; charset=utf-8",
-						"cache-control": "no-store"
-					});
-					response.end(JSON.stringify({ error: "已拒绝跨站请求。" }));
-					return;
-				}
 				if (process.platform !== "win32") {
 					response.writeHead(501, {
 						"content-type": "application/json; charset=utf-8",
@@ -2022,4 +2013,4 @@ function apply(ctx) {
 	}, "michengai-codex-ui: catalogs");
 }
 //#endregion
-export { RequestBodyTooLargeError, apply, crossSiteRequest, inject, publicDependencyError, readRequestBody };
+export { RequestBodyTooLargeError, apply, inject, publicDependencyError, readRequestBody };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-codex-ui",
-  "version": "0.2.111",
+  "version": "0.2.113",
   "description": "以 Codex 风格重构 DSH Web 侧栏的独立客户端插件",
   "license": "Apache-2.0",
   "publishConfig": {
@@ -62,10 +62,12 @@
   "scripts": {
     "build": "tsc --noEmit && tsdown",
     "typecheck": "tsc --noEmit",
-    "test": "pnpm run typecheck && vitest run && tsdown && node tests/run-assertions.mjs"
+    "test": "pnpm run typecheck && vitest run && tsdown && node tests/run-assertions.mjs && pnpm run test:layout",
+    "test:layout": "node scripts/verify-workspace-drop-layout.mjs --run && node scripts/verify-sidebar-transition.mjs"
   },
   "peerDependencies": {
-    "@deepseek-ai/cordis": ">=4.0.1 <5.0.0",
+    "@deepseek-ai/cordis": ">=4.0.2 <5.0.0",
+    "@deepseek-ai/dsh-client-connection": ">=0.1.2-rc.1 <0.2.0",
     "@deepseek-ai/dsh-client-locale": ">=0.1.0-rc.5 <0.2.0",
     "@deepseek-ai/dsh-client-runtime": ">=0.1.0-rc.5 <0.2.0",
     "@deepseek-ai/dsh-client-ui-conversation": ">=0.1.0-rc.5 <0.2.0",
@@ -119,12 +121,14 @@
     "@types/node": "^26.0.0",
     "@types/react": "~18.3.1",
     "jsdom": "^29.1.1",
+    "playwright": "1.63.0",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tsdown": "^0.22.2",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.8",
+    "workflow-yaml": "npm:yaml@2.9.0"
   },
   "dependencies": {
     "lucide-react": "^1.39.0"