@sparkelf/dsh-patch-better-sidebar-html-preview-path 0.2.0-rc.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DeepSeek
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/package.json

@@ -0,0 +1,37 @@
+{
+  "description": "Data-only patch bounding a workspace-root-relative HTML preview path to the session cwd in dsh-better-sidebar",
+  "dshPatch": {
+    "formatVersion": 1,
+    "variants": [
+      {
+        "dsh": ">=0.1.6-alpha.1",
+        "file": "./patches/better-sidebar-html-preview-path.patch",
+        "id": "better-sidebar-html-preview-path",
+        "target": {
+          "kind": "npm",
+          "name": "dsh-better-sidebar",
+          "range": "0.19.1"
+        }
+      }
+    ]
+  },
+  "exports": {
+    "./package.json": "./package.json",
+    "./patches/better-sidebar-html-preview-path.patch": "./patches/better-sidebar-html-preview-path.patch"
+  },
+  "files": [
+    "patches/*.patch"
+  ],
+  "license": "MIT",
+  "name": "@sparkelf/dsh-patch-better-sidebar-html-preview-path",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "directory": "patches/npm/better-sidebar-html-preview-path",
+    "type": "git",
+    "url": "git+https://github.com/SparkElf/deepseek-harness-plus.git"
+  },
+  "type": "module",
+  "version": "0.2.0-rc.4"
+}

package/patches/better-sidebar-html-preview-path.patch

@@ -0,0 +1,21 @@
+diff --git a/lib/index.js b/lib/index.js
+index 278ca90..82d457d 100644
+--- a/lib/index.js
++++ b/lib/index.js
+@@ -5080,8 +5080,14 @@ function apply(ctx, config) {
+ 					writeError(res, new SidebarError("bad-request", decoded.message, decoded.status));
+ 					return;
+ 				}
+-				const { sessionId, path } = decoded.ref;
+-				const absolute = await ensureWorkspacePath(await sessionCwdOf(ctx, sessionId), path, fenceEnabledOf(() => settingsFace));
++				const { sessionId, path: decodedPath } = decoded.ref;
++				// A produced-file path arrives workspace-root-relative ("/x.html"): the host
++				// reads it as a POSIX root and realpaths it outside the workspace. Bound it to
++				// the session cwd first, the way the media route already bounds its own path.
++				const htmlCwd = await sessionCwdOf(ctx, sessionId);
++				const path = isAbsolute(decodedPath) && !isWithin(htmlCwd, decodedPath)
++					? join(htmlCwd, decodedPath) : decodedPath;
++				const absolute = await ensureWorkspacePath(htmlCwd, path, fenceEnabledOf(() => settingsFace));
+ 				const info = await stat(absolute);
+ 				if (!info.isFile() || info.size > resolved.mediaLimit) throw new SidebarError("fs-error", "not a file or too large", 400);
+ 				const type = mediaTypeForPath(absolute);