@michengai/dsh-codex-ui 0.2.49 → 0.2.53

package/dist/index.d.mts

@@ -1,7 +1,19 @@
 import { Context } from "@deepseek-ai/cordis";
 //#region src/index.d.ts
+type HostRequest = {
+  method?: string;
+  url?: string;
+  headers?: Record<string, string | string[] | undefined>;
+};
+/**
+ * 判断浏览器请求是否跨站。依赖安装会改写用户配置并拉起子进程，
+ * 恶意网页只需一个表单就能跨站触发，必须先按 Sec-Fetch-Site（优先，
+ * 且无法被页面伪造）再按 Origin 与 Host 的比对阻断；无这些头的
+ * 非浏览器客户端（curl、CLI）仍然放行。
+ */
+declare function crossSiteRequest(request: HostRequest): boolean;
 declare const inject: string[];
 /** 提供不泄露地址、命令和凭证的连接器目录。 */
 declare function apply(ctx: Context): void;
 //#endregion
-export { apply, inject };
+export { apply, crossSiteRequest, inject };

package/dist/index.mjs

@@ -20,6 +20,18 @@ const MANAGED_DEPENDENCIES = [
 	{
 		id: "archive",
 		packageName: "@michengai/dsh-archive-manager"
+	},
+	{
+		id: "im",
+		packageName: "@michengai/dsh-im-connect"
+	},
+	{
+		id: "schedule",
+		packageName: "@michengai/dsh-automation"
+	},
+	{
+		id: "market",
+		packageName: "dshmarket"
 	}
 ];
 function managedDependency(id) {
@@ -48,12 +60,22 @@ async function installedPackageVersion(packageName) {
 		throw error;
 	}
 }
+/** npm latest 查询缓存有效期：避免每次打开“关于”页都打 7 个 registry 请求。 */
+const LATEST_CACHE_TTL_MS = 3e5;
+const latestCache = /* @__PURE__ */ new Map();
 async function npmLatestVersion(packageName) {
+	const hit = latestCache.get(packageName);
+	if (hit !== void 0 && Date.now() - hit.at < LATEST_CACHE_TTL_MS) return hit.version;
 	try {
 		const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`, { signal: AbortSignal.timeout(5e3) });
 		if (!response.ok) return void 0;
 		const manifest = await response.json();
-		return typeof manifest.version === "string" ? manifest.version : void 0;
+		if (typeof manifest.version !== "string") return void 0;
+		latestCache.set(packageName, {
+			version: manifest.version,
+			at: Date.now()
+		});
+		return manifest.version;
 	} catch {
 		return;
 	}
@@ -61,8 +83,13 @@ async function npmLatestVersion(packageName) {
 function escapeRegExp(value) {
 	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+/** 允许写入 YAML 单引号白名单的版本：semver 及常见预发布后缀，禁止引号与空白。 */
+function isSafeReleaseVersion(version) {
+	return /^v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/.test(version);
+}
 /** 将用户确认的精确版本合并进 Profile 的 pnpm 发布时间保护例外。 */
 function applyReleaseExclude(source, packageName, version) {
+	if (!isSafeReleaseVersion(version)) throw new Error("npm 返回了无法识别的最新版本。");
 	const eol = source.includes("\r\n") ? "\r\n" : "\n";
 	const existing = new RegExp(`^  - '${escapeRegExp(packageName)}@([^']*)'\\s*$`, "m").exec(source);
 	if (existing !== null) {
@@ -183,8 +210,19 @@ function runDshPlugin(args) {
 		});
 	});
 }
+/** 并发安装互斥：pnpm 锁文件竞争会触发 EPERM/EBUSY，同一时间只允许一个安装进程。 */
+let installing = false;
 /** 仅允许安装固定依赖，避免把浏览器输入转成任意命令。 */
 async function installDependency(id) {
+	if (installing) throw new Error("已有依赖安装正在进行，请等待完成后再试。");
+	installing = true;
+	try {
+		return await installDependencyLocked(id);
+	} finally {
+		installing = false;
+	}
+}
+async function installDependencyLocked(id) {
 	const dependency = managedDependency(id);
 	if (dependency === void 0) throw new Error("不支持安装该依赖。");
 	const latestVersion = await npmLatestVersion(dependency.packageName);
@@ -206,7 +244,6 @@ function requireService(ctx, key, method) {
 function hostServices(ctx) {
 	return {
 		webServer: requireService(ctx, "webServer", "register"),
-		sessions: requireService(ctx, "sessions", "get"),
 		agents: requireService(ctx, "agents", "get"),
 		tools: requireService(ctx, "tools", "schemas")
 	};
@@ -215,9 +252,30 @@ function hostServices(ctx) {
 //#region src/index.ts
 const connectorsEndpoint = "/api/michengai/codex-ui/connectors";
 const dependenciesEndpoint = "/api/michengai/codex-ui/dependencies";
+function headerValue(headers, name) {
+	const value = headers[name];
+	if (typeof value === "string") return value;
+	if (Array.isArray(value)) return value[0];
+}
+/**
+* 判断浏览器请求是否跨站。依赖安装会改写用户配置并拉起子进程，
+* 恶意网页只需一个表单就能跨站触发，必须先按 Sec-Fetch-Site（优先，
+* 且无法被页面伪造）再按 Origin 与 Host 的比对阻断；无这些头的
+* 非浏览器客户端（curl、CLI）仍然放行。
+*/
+function crossSiteRequest(request) {
+	const headers = request.headers;
+	if (headers === void 0) return false;
+	const site = headerValue(headers, "sec-fetch-site");
+	if (site === "same-origin" || site === "none") return false;
+	if (site !== void 0) return true;
+	const origin = headerValue(headers, "origin");
+	if (origin === void 0) return false;
+	const host = headerValue(headers, "host");
+	return origin !== new URL(request.url ?? "/", `http://${host ?? "localhost"}`).origin;
+}
 const inject = [
 	"webServer",
-	"sessions",
 	"agents",
 	"tools"
 ];
@@ -283,6 +341,14 @@ function apply(ctx) {
 						return;
 					}
 					if (request.method === "POST") {
+						if (crossSiteRequest(request)) {
+							response.writeHead(403, {
+								"content-type": "application/json; charset=utf-8",
+								"cache-control": "no-store"
+							});
+							response.end(JSON.stringify({ error: "已拒绝跨站请求。" }));
+							return;
+						}
 						const dependencies = await installDependency(url.searchParams.get("dependency"));
 						response.writeHead(200, {
 							"content-type": "application/json; charset=utf-8",
@@ -297,12 +363,12 @@ function apply(ctx) {
 					response.writeHead(405);
 					response.end();
 				} catch (error) {
-					const message = error instanceof Error ? error.message : "依赖管理暂不可用。";
+					ctx.logger.warn("dependencies endpoint failed: %s", error);
 					response.writeHead(503, {
 						"content-type": "application/json; charset=utf-8",
 						"cache-control": "no-store"
 					});
-					response.end(JSON.stringify({ error: message }));
+					response.end(JSON.stringify({ error: "依赖管理暂不可用，请查看服务端日志。" }));
 				}
 			}
 		});
@@ -313,4 +379,4 @@ function apply(ctx) {
 	}, "michengai-codex-ui: catalogs");
 }
 //#endregion
-export { apply, inject };
+export { apply, crossSiteRequest, inject };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@michengai/dsh-codex-ui",
-  "version": "0.2.49",
+  "version": "0.2.53",
   "description": "以 Codex 风格重构 DSH Web 侧栏的独立客户端插件",
   "license": "Apache-2.0",
   "publishConfig": {
@@ -53,7 +53,7 @@
   },
   "scripts": {
     "build": "tsc --noEmit && tsdown",
-    "test": "tsx tests/pinned-sessions.assert.ts && tsx tests/session-manager.assert.ts && tsx tests/workspace-browser.assert.ts && tsx tests/sidebar-search.assert.ts && vitest run tests/client-runtime.integration.spec.ts && tsx tests/settings-integration.assert.ts && tsx tests/about-dependencies.assert.ts && tsx tests/dependency-manager.assert.ts && tsx tests/conversation-visuals.assert.ts && tsx tests/client-bundle.assert.ts && tsx tests/codex-suite.assert.ts"
+    "test": "tsx tests/permission-i18n.assert.ts && tsx tests/hover-tip.assert.ts && tsx tests/companion-slots.assert.ts && tsx tests/channel-api.assert.ts && tsx tests/schedule-sessions.assert.ts && tsx tests/session-tree.assert.ts && tsx tests/pinned-sessions.assert.ts && tsx tests/session-manager.assert.ts && tsx tests/workspace-browser.assert.ts && tsx tests/sidebar-search.assert.ts && tsx tests/settings-navigation.assert.ts && tsx tests/settings-nav-icons.assert.ts && tsx tests/locales.assert.ts && vitest run tests/client-runtime.integration.spec.ts && tsx tests/settings-integration.assert.ts && tsx tests/about-dependencies.assert.ts && tsx tests/dependency-manager.assert.ts && tsx tests/conversation-bubbles.assert.ts && tsx tests/conversation-header.assert.ts && tsx tests/conversation-visuals.assert.ts && tsdown && tsx tests/client-bundle.assert.ts && tsx tests/codex-suite.assert.ts"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": ">=4.0.1 <5.0.0",
@@ -71,8 +71,12 @@
     "react": "^18.2.0"
   },
   "peerDependenciesMeta": {
-    "@michengai/dsh-agency-agents": { "optional": true },
-    "@michengai/dsh-skills-manager": { "optional": true }
+    "@michengai/dsh-agency-agents": {
+      "optional": true
+    },
+    "@michengai/dsh-skills-manager": {
+      "optional": true
+    }
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
@@ -86,17 +90,15 @@
     "@deepseek-ai/dsh-client-ui-settings-general": "0.1.0-rc.6",
     "@deepseek-ai/dsh-client-ui-sidebar": "0.1.0-rc.6",
     "@deepseek-ai/dsh-client-ui-slots": "0.1.0-rc.6",
+    "@types/jsdom": "^30.0.0",
     "@types/node": "^26.0.0",
     "@types/react": "~18.3.1",
+    "jsdom": "^29.1.1",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "tsdown": "^0.22.2",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.8",
-    "jsdom": "^29.1.1"
+    "vitest": "^4.1.8"
   }
 }
-
-
-