@openclaw/diffs 2026.8.33 → 2026.8.35

package/dist/index.js

@@ -5,7 +5,6 @@ import { buildPluginConfigSchema } from "openclaw/plugin-sdk/plugin-entry";
 import { mapPluginConfigIssues } from "openclaw/plugin-sdk/extension-shared";
 import { z } from "zod";
 import { resolveGatewayPublicOrigin } from "openclaw/plugin-sdk/config-contracts";
-import { resolveGatewayPort } from "openclaw/plugin-sdk/gateway-config-runtime";
 import fs from "node:fs";
 import path from "node:path";
 import { resolveLivePluginConfigObject } from "openclaw/plugin-sdk/plugin-config-runtime";
@@ -25,6 +24,32 @@ import { Type } from "typebox";
 import { parsePatchFiles, resolveLanguage } from "@pierre/diffs";
 import { preloadDiffHTML } from "@pierre/diffs/ssr";
 import { escapeHtml } from "openclaw/plugin-sdk/text-utility-runtime";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+//#endregion
 //#region extensions/diffs/src/types.ts
 const DIFF_LAYOUTS = ["unified", "split"];
 const DIFF_MODES = [
@@ -48,6 +73,152 @@ const DIFF_OUTPUT_FORMATS = ["png", "pdf"];
 const DIFF_ARTIFACT_ID_PATTERN = /^[0-9a-f]{20}$/;
 const DIFF_ARTIFACT_TOKEN_PATTERN = /^[0-9a-f]{48}$/;
 //#endregion
+//#region src/gateway/gateway-http-route-contracts.ts
+const GATEWAY_PROBE_ROUTES = /* @__PURE__ */ new Map([
+	["/health", "live"],
+	["/healthz", "live"],
+	["/ready", "ready"],
+	["/readyz", "ready"],
+	["/startup", "startup"],
+	["/startupz", "startup"]
+]);
+function classifyGatewayProbePath(pathname) {
+	for (const [root, status] of GATEWAY_PROBE_ROUTES) {
+		if (pathname === root) return status;
+		if (pathname.startsWith(`${root}/`)) return "namespace";
+	}
+	return "outside";
+}
+//#endregion
+//#region packages/normalization-core/src/string-coerce.ts
+/** Trims string input and returns null for non-strings or empty strings. */
+function normalizeNullableString(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed ? trimmed : null;
+}
+/** Trims string input and returns undefined for non-strings or empty strings. */
+function normalizeOptionalString$1(value) {
+	return normalizeNullableString(value) ?? void 0;
+}
+/** Lowercases a normalized optional string. */
+function normalizeOptionalLowercaseString(value) {
+	return normalizeOptionalString$1(value)?.toLowerCase();
+}
+/** Lowercases a normalized string or returns an empty string when absent. */
+function normalizeLowercaseStringOrEmpty$1(value) {
+	return normalizeOptionalLowercaseString(value) ?? "";
+}
+//#endregion
+//#region src/gateway/security-path.ts
+const MAX_PATH_DECODE_PASSES = 32;
+function normalizePathSeparators(pathname) {
+	const collapsed = pathname.replace(/\/{2,}/g, "/");
+	if (collapsed.length <= 1) return collapsed;
+	return collapsed.replace(/\/+$/, "");
+}
+function resolveDotSegments(pathname) {
+	try {
+		return new URL(pathname, "http://localhost").pathname;
+	} catch {
+		return pathname;
+	}
+}
+function normalizePathForSecurity(pathname) {
+	return normalizePathSeparators(normalizeLowercaseStringOrEmpty$1(resolveDotSegments(pathname))) || "/";
+}
+function pushNormalizedCandidate(candidates, seen, value) {
+	const normalized = normalizePathForSecurity(value);
+	if (seen.has(normalized)) return;
+	seen.add(normalized);
+	candidates.push(normalized);
+}
+function buildCanonicalPathCandidates(pathname, maxDecodePasses = MAX_PATH_DECODE_PASSES) {
+	const candidates = [];
+	const seen = /* @__PURE__ */ new Set();
+	pushNormalizedCandidate(candidates, seen, pathname);
+	let decoded = pathname;
+	let malformedEncoding = false;
+	let decodePasses = 0;
+	for (let pass = 0; pass < maxDecodePasses; pass++) {
+		let nextDecoded;
+		try {
+			nextDecoded = decodeURIComponent(decoded);
+		} catch {
+			malformedEncoding = true;
+			break;
+		}
+		if (nextDecoded === decoded) break;
+		decodePasses += 1;
+		decoded = nextDecoded;
+		pushNormalizedCandidate(candidates, seen, decoded);
+	}
+	let decodePassLimitReached = false;
+	if (!malformedEncoding) try {
+		decodePassLimitReached = decodeURIComponent(decoded) !== decoded;
+	} catch {
+		malformedEncoding = true;
+	}
+	return {
+		candidates,
+		decodePasses,
+		decodePassLimitReached,
+		malformedEncoding
+	};
+}
+function canonicalizePathForSecurity(pathname) {
+	const { candidates, decodePasses, decodePassLimitReached, malformedEncoding } = buildCanonicalPathCandidates(pathname);
+	return {
+		canonicalPath: candidates[candidates.length - 1] ?? "/",
+		candidates,
+		decodePasses,
+		decodePassLimitReached,
+		malformedEncoding,
+		rawNormalizedPath: normalizePathSeparators(normalizeLowercaseStringOrEmpty$1(pathname)) || "/"
+	};
+}
+const PROTECTED_PLUGIN_ROUTE_PREFIXES = ["/api/channels"];
+//#endregion
+//#region src/gateway/server/plugins-http/path-context.ts
+function normalizeProtectedPrefix(prefix) {
+	const collapsed = normalizeLowercaseStringOrEmpty$1(prefix).replace(/\/{2,}/g, "/");
+	if (collapsed.length <= 1) return collapsed || "/";
+	return collapsed.replace(/\/+$/, "");
+}
+/** Matches a normalized path against an exact protected prefix boundary. */
+function prefixMatchPath(pathname, prefix) {
+	return pathname === prefix || pathname.startsWith(`${prefix}/`) || pathname.startsWith(`${prefix}%`);
+}
+const NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES = PROTECTED_PLUGIN_ROUTE_PREFIXES.map(normalizeProtectedPrefix);
+/** Returns true when any decoded path candidate targets a protected route. */
+function isProtectedPluginRoutePathFromContext(context) {
+	if (context.candidates.some((candidate) => NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES.some((prefix) => prefixMatchPath(candidate, prefix)))) return true;
+	if (context.decodePassLimitReached) return true;
+	if (!context.malformedEncoding) return false;
+	return NORMALIZED_PROTECTED_PLUGIN_ROUTE_PREFIXES.some((prefix) => prefixMatchPath(context.rawNormalizedPath, prefix));
+}
+/** Builds all security-relevant decoded path candidates for a request path. */
+function resolvePluginRoutePathContext(pathname) {
+	const canonical = canonicalizePathForSecurity(pathname);
+	return {
+		pathname,
+		canonicalPath: canonical.canonicalPath,
+		candidates: canonical.candidates,
+		malformedEncoding: canonical.malformedEncoding,
+		decodePassLimitReached: canonical.decodePassLimitReached,
+		rawNormalizedPath: canonical.rawNormalizedPath
+	};
+}
+//#endregion
+//#region \0openclaw:bundled-sdk:openclaw/plugin-sdk/gateway-config-runtime
+var gateway_config_runtime_exports = /* @__PURE__ */ __exportAll({
+	classifyGatewayProbePath: () => classifyGatewayProbePath,
+	isProtectedPluginRoutePathFromContext: () => isProtectedPluginRoutePathFromContext,
+	resolvePluginRoutePathContext: () => resolvePluginRoutePathContext
+});
+import * as import_openclaw_plugin_sdk_gateway_config_runtime from "openclaw/plugin-sdk/gateway-config-runtime";
+__reExport(gateway_config_runtime_exports, import_openclaw_plugin_sdk_gateway_config_runtime);
+//#endregion
 //#region extensions/diffs/src/url.ts
 function buildViewerUrl(params) {
 	const normalizedBase = normalizeViewerBaseUrl(params.baseUrl?.trim() || params.viewerBaseUrl?.trim() || resolveGatewayPublicOrigin(params.config) || resolveGatewayBaseUrl(params.config));
@@ -74,7 +245,7 @@ function normalizeViewerBaseUrl(raw, fieldName = "baseUrl") {
 }
 function resolveGatewayBaseUrl(config) {
 	const scheme = config.gateway?.tls?.enabled ? "https" : "http";
-	const port = resolveGatewayPort(config);
+	const port = (0, gateway_config_runtime_exports.resolveGatewayPort)(config);
 	const customHost = config.gateway?.customBindHost?.trim();
 	if (config.gateway?.bind === "custom" && customHost) return `${scheme}://${customHost}:${port}`;
 	return `${scheme}://127.0.0.1:${port}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/diffs",
-  "version": "2026.8.33",
+  "version": "2026.8.35",
   "description": "OpenClaw read-only diff viewer plugin and file renderer for agents.",
   "repository": {
     "type": "git",
@@ -25,14 +25,14 @@
       "minHostVersion": ">=2026.4.30"
     },
     "compat": {
-      "pluginApi": ">=2026.8.33"
+      "pluginApi": ">=2026.8.35"
     },
     "assetScripts": {
       "build": "node --import tsx ../../scripts/build-diffs-viewer-runtime.mts curated"
     },
     "build": {
       "bundledDist": false,
-      "openclawVersion": "2026.8.33",
+      "openclawVersion": "2026.8.35",
       "staticAssets": [
         {
           "source": "./assets/viewer-runtime.js",
@@ -55,7 +55,7 @@
     "skills/**"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.8.33"
+    "openclaw": ">=2026.8.35"
   },
   "peerDependenciesMeta": {
     "openclaw": {