@xcanwin/manyoyo 6.2.15 → 6.2.19

package/lib/web/frontend/app.css

@@ -1082,7 +1082,7 @@ body.workspace-switcher-open .workspace-switcher-panel {
     display: flex;
     align-items: center;
     gap: 8px;
-    flex-wrap: wrap;
+    flex-wrap: nowrap;
     padding: 12px 14px;
     border-bottom: 1px solid var(--line);
     background: rgba(255, 251, 244, 0.96);
@@ -2175,6 +2175,20 @@ body.composer-options-open .composer-options-panel {
         border-bottom: 1px solid var(--line);
     }
 
+    .files-toolbar {
+        flex-wrap: wrap;
+    }
+
+    .files-toolbar-path-group {
+        flex-basis: 100%;
+    }
+
+    .files-toolbar-meta {
+        flex-basis: 100%;
+        flex-wrap: wrap;
+        margin-left: 0;
+    }
+
     .files-browser[data-mobile-pane="list"] .files-preview {
         display: none;
     }

package/lib/web/frontend/file-browser.js

@@ -9,6 +9,18 @@
             .replace(/'/g, ''');
     }
 
+    // 双向控制符（RTLO 等）/ 零宽字符可以让文件名视觉上和真实字节完全不一致
+    // （例如 "cod" + U+202E + "exe.txt" 会被浏览器渲染成 "codtxt.exe"），
+    // 展示前统一替换成可见的 \uXXXX 记法，破坏其排版效果并让人一眼看出异常。
+    // 范围：U+200B-U+200F（零宽字符/LRM/RLM）、U+202A-U+202E（嵌入/覆盖方向控制符）、
+    // U+2060-U+2069（零宽连接符/方向隔离符）、U+FEFF（BOM/零宽不换行空格）、U+061C（阿拉伯字母标记）。
+    const SUSPICIOUS_UNICODE_PATTERN = /[\u200B-\u200F\u202A-\u202E\u2060-\u2069\uFEFF\u061C]/g;
+    function sanitizeDisplayText(value) {
+        return String(value == null ? '' : value).replace(SUSPICIOUS_UNICODE_PATTERN, function (ch) {
+            return '\\u' + ch.codePointAt(0).toString(16).toUpperCase().padStart(4, '0');
+        });
+    }
+
     function formatBytes(size) {
         const value = Number(size || 0);
         if (!Number.isFinite(value) || value <= 0) {
@@ -46,6 +58,8 @@
         const parts = [];
         if (entry && entry.kind === 'directory') {
             parts.push('目录');
+        } else if (entry && entry.kind === 'symlink') {
+            parts.push('符号链接');
         } else {
             parts.push(formatBytes(entry && entry.size));
         }
@@ -55,6 +69,16 @@
         return parts.join(' · ');
     }
 
+    function buildEntryTitle(entry) {
+        const basePath = sanitizeDisplayText(entry && (entry.path || entry.name) || '');
+        if (entry && entry.kind === 'symlink') {
+            return entry.symlinkTarget
+                ? `${basePath} → ${sanitizeDisplayText(entry.symlinkTarget)}`
+                : `${basePath}（符号链接目标无法解析，可能已损坏）`;
+        }
+        return basePath;
+    }
+
     function inferLanguageFromPath(filePath) {
         const text = String(filePath || '').toLowerCase();
         if (text.endsWith('.md') || text.endsWith('.markdown')) return 'markdown';
@@ -99,6 +123,7 @@
                     <div class="files-toolbar-meta">
                         <div class="files-toolbar-status" data-role="status">未加载</div>
                         <button type="button" class="secondary" data-action="mkdir">新建目录</button>
+                        <button type="button" class="secondary" data-action="new-file">新建文件</button>
                     </div>
                 </header>
                 <div class="files-layout">
@@ -132,6 +157,7 @@
         const filesBrowserNode = root.querySelector('.files-browser');
         const visitBtn = root.querySelector('[data-action="visit"]');
         const mkdirBtn = root.querySelector('[data-action="mkdir"]');
+        const newFileBtn = root.querySelector('[data-action="new-file"]');
         const saveBtn = root.querySelector('[data-action="save"]');
         const toggleMarkdownViewBtn = root.querySelector('[data-action="toggle-markdown-view"]');
         const backToListBtn = root.querySelector('[data-action="back-to-list"]');
@@ -235,7 +261,7 @@
             state.previewReadOnly = true;
             state.previewDirty = false;
             if (previewTitleNode) {
-                previewTitleNode.textContent = title;
+                previewTitleNode.textContent = sanitizeDisplayText(title);
             }
             if (previewMetaNode) {
                 previewMetaNode.textContent = description;
@@ -260,6 +286,17 @@
             return host;
         }
 
+        function updatePreviewMeta() {
+            const payload = state.selectedFile;
+            if (!previewMetaNode || !payload) {
+                return;
+            }
+            const modeLabel = payload.kind === 'text'
+                ? (payload.editable === true ? '可编辑' : '只读预览')
+                : '只读预览';
+            previewMetaNode.textContent = `${payload.kind === 'text' ? '文本文件' : '文件'} · ${formatBytes(payload.size)} · ${modeLabel}${payload.truncated ? ' · 已截断预览' : ''}`;
+        }
+
         function renderPreviewPayload(payload) {
             state.selectedFile = payload || null;
             state.previewReadOnly = !(payload && payload.editable === true);
@@ -269,14 +306,9 @@
                 return;
             }
             if (previewTitleNode) {
-                previewTitleNode.textContent = payload.path || '未命名文件';
-            }
-            if (previewMetaNode) {
-                const modeLabel = payload.kind === 'text'
-                    ? (payload.editable === true ? '可编辑' : '只读预览')
-                    : '只读预览';
-                previewMetaNode.textContent = `${payload.kind === 'text' ? '文本文件' : '文件'} · ${formatBytes(payload.size)} · ${modeLabel}${payload.truncated ? ' · 已截断预览' : ''}`;
+                previewTitleNode.textContent = sanitizeDisplayText(payload.path) || '未命名文件';
             }
+            updatePreviewMeta();
             if (!previewBodyNode) {
                 syncMarkdownToggleButton();
                 syncSaveButton();
@@ -315,8 +347,12 @@
                                 doc: String(payload.content || ''),
                                 language,
                                 readOnly: state.previewReadOnly,
-                                onChange: function () {
+                                onChange: function (nextValue) {
                                     state.previewDirty = true;
+                                    if (state.selectedFile) {
+                                        state.selectedFile.size = new TextEncoder().encode(nextValue).length;
+                                    }
+                                    updatePreviewMeta();
                                     syncSaveButton();
                                 }
                             });
@@ -354,6 +390,23 @@
             syncSaveButton();
         }
 
+        function openSymlinkEntry(entry) {
+            const safeName = sanitizeDisplayText(entry.name);
+            const message = entry.symlinkTarget
+                ? `"${safeName}" 是符号链接，实际指向：\n${sanitizeDisplayText(entry.symlinkTarget)}\n\n是否继续访问？`
+                : `"${safeName}" 是一个无法解析的符号链接（可能已损坏），是否仍要尝试访问？`;
+            confirmFn(message).then(function (proceed) {
+                if (!proceed) {
+                    return;
+                }
+                if (entry.symlinkTargetKind === 'directory') {
+                    loadDirectory(entry.path);
+                    return;
+                }
+                loadFile(entry.path, entry);
+            });
+        }
+
         function renderList() {
             if (pathNode) {
                 pathNode.value = state.pathDraft || state.currentPath || state.containerPath || '/';
@@ -364,6 +417,9 @@
             if (mkdirBtn) {
                 mkdirBtn.disabled = state.loadingList || state.loadingFile || !state.sessionName || state.historyOnly === true;
             }
+            if (newFileBtn) {
+                newFileBtn.disabled = state.loadingList || state.loadingFile || !state.sessionName || state.historyOnly === true;
+            }
             if (!listNode) {
                 return;
             }
@@ -393,7 +449,7 @@
                 const parentButton = document.createElement('button');
                 parentButton.type = 'button';
                 parentButton.className = 'files-entry files-entry-parent';
-                parentButton.title = state.parentPath;
+                parentButton.title = sanitizeDisplayText(state.parentPath);
                 parentButton.addEventListener('click', function () {
                     loadDirectory(state.parentPath);
                 });
@@ -415,8 +471,12 @@
                 const button = document.createElement('button');
                 button.type = 'button';
                 button.className = 'files-entry' + (state.selectedPath === entry.path ? ' is-active' : '');
-                button.title = String(entry.path || entry.name || '');
+                button.title = buildEntryTitle(entry);
                 button.addEventListener('click', function () {
+                    if (entry.kind === 'symlink') {
+                        openSymlinkEntry(entry);
+                        return;
+                    }
                     if (entry.kind === 'directory') {
                         loadDirectory(entry.path);
                         return;
@@ -425,7 +485,7 @@
                 });
                 button.innerHTML = `
                     <span class="files-entry-name">
-                        <span class="files-entry-title">${escapeHtml(entry.name || entry.path || '未命名')}</span>
+                        <span class="files-entry-title">${escapeHtml(sanitizeDisplayText(entry.name || entry.path || '未命名'))}</span>
                     </span>
                     <span class="files-entry-meta">${escapeHtml(buildEntryMeta(entry))}</span>
                 `;
@@ -596,6 +656,30 @@
             }
         }
 
+        async function createFile() {
+            if (!state.sessionName || state.historyOnly === true || state.loadingList || state.loadingFile) {
+                return;
+            }
+            const input = await promptFn('请输入新文件名称');
+            const name = String(input || '').trim();
+            if (!name) {
+                return;
+            }
+            const targetPath = joinDirectoryPath(state.currentPath || state.containerPath || '/', name);
+            setStatus('创建文件中');
+            try {
+                await api('/api/sessions/' + encodeURIComponent(state.sessionName) + '/fs/create', {
+                    method: 'POST',
+                    body: JSON.stringify({ path: targetPath })
+                });
+                await loadDirectory(state.currentPath || state.containerPath || '/');
+                setStatus('已创建文件');
+            } catch (e) {
+                setStatus('创建文件失败');
+                onError(e && e.message ? e.message : '创建文件失败');
+            }
+        }
+
         function sync(context) {
             const session = context && context.session;
             const detail = context && context.detail;
@@ -669,6 +753,14 @@
             });
         }
 
+        if (newFileBtn) {
+            newFileBtn.addEventListener('click', function () {
+                createFile().catch(function (e) {
+                    onError(e && e.message ? e.message : '创建文件失败');
+                });
+            });
+        }
+
         if (saveBtn) {
             saveBtn.addEventListener('click', function () {
                 saveCurrentFile().catch(function (e) {
@@ -679,6 +771,9 @@
 
         if (toggleMarkdownViewBtn) {
             toggleMarkdownViewBtn.addEventListener('click', function () {
+                if (state.editor && typeof state.editor.getValue === 'function' && state.selectedFile) {
+                    state.selectedFile.content = state.editor.getValue();
+                }
                 state.markdownViewMode = state.markdownViewMode === 'source' ? 'rendered' : 'source';
                 renderPreviewPayload(state.selectedFile);
             });
@@ -699,6 +794,7 @@
     }
 
     window.ManyoyoFileBrowser = {
-        create
+        create,
+        sanitizeDisplayText
     };
 }());

package/lib/web/server.js

@@ -3315,19 +3315,32 @@ try {
                 itemStat = null;
             }
             let kind = 'other';
+            let symlinkTarget = null;
+            let symlinkTargetKind = null;
             if (entry.isDirectory()) {
                 kind = 'directory';
             } else if (entry.isFile()) {
                 kind = 'file';
             } else if (entry.isSymbolicLink()) {
                 kind = 'symlink';
+                try {
+                    const resolvedPath = fs.realpathSync(fullPath);
+                    const resolvedStat = fs.statSync(resolvedPath);
+                    symlinkTarget = resolvedPath;
+                    symlinkTargetKind = resolvedStat.isDirectory() ? 'directory' : 'file';
+                } catch (e) {
+                    symlinkTarget = null;
+                    symlinkTargetKind = null;
+                }
             }
             return {
                 name: entry.name,
                 path: fullPath,
                 kind,
                 size: itemStat && typeof itemStat.size === 'number' ? itemStat.size : 0,
-                mtimeMs: itemStat && typeof itemStat.mtimeMs === 'number' ? Math.floor(itemStat.mtimeMs) : 0
+                mtimeMs: itemStat && typeof itemStat.mtimeMs === 'number' ? Math.floor(itemStat.mtimeMs) : 0,
+                symlinkTarget,
+                symlinkTargetKind
             };
         })
         .sort((a, b) => {
@@ -3520,6 +3533,41 @@ try {
 `);
 }
 
+function buildContainerFileCreateCommand(requestedPath) {
+    return buildWebContainerNodeCommand(`
+// __MANYOYO_FS_CREATE__
+const fs = require('fs');
+const path = require('path');
+
+const requestedPath = ${JSON.stringify(String(requestedPath || ''))};
+
+try {
+    const resolvedPath = path.resolve(requestedPath);
+    const parentPath = path.dirname(resolvedPath);
+    const realParentPath = fs.realpathSync(parentPath);
+    const targetPath = path.join(realParentPath, path.basename(resolvedPath));
+    if (fs.existsSync(targetPath)) {
+        throw new Error('文件已存在: ' + targetPath);
+    }
+
+    fs.writeFileSync(targetPath, '', 'utf8');
+    const stat = fs.statSync(targetPath);
+    process.stdout.write(JSON.stringify({
+        path: targetPath,
+        name: path.basename(targetPath),
+        kind: 'file',
+        size: stat.size,
+        mtimeMs: stat.mtimeMs,
+        created: true
+    }));
+} catch (e) {
+    process.stdout.write(JSON.stringify({
+        error: e && e.message ? e.message : '创建文件失败'
+    }));
+}
+`);
+}
+
 async function execAgentInWebContainerStream(ctx, state, sessionRefOrContainerName, command, options = {}) {
     const opts = options && typeof options === 'object' ? options : {};
     const sessionRef = typeof sessionRefOrContainerName === 'string'
@@ -4800,6 +4848,34 @@ async function handleWebApi(req, res, pathname, ctx, state) {
                 sendJson(res, 200, result);
             }
         },
+        {
+            method: 'POST',
+            match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/fs\/create$/),
+            handler: async match => {
+                const sessionRef = getValidSessionRef(ctx, res, match[1]);
+                if (!sessionRef) {
+                    return;
+                }
+                const payload = await readJsonBody(req);
+                const targetPath = String(payload && payload.path ? payload.path : '').trim();
+                if (!targetPath) {
+                    sendJson(res, 400, { error: 'path 不能为空' });
+                    return;
+                }
+
+                await ensureWebContainer(ctx, state, sessionRef.containerName, sessionRef);
+                const result = await execJsonCommandInWebContainer(
+                    ctx,
+                    sessionRef.containerName,
+                    buildContainerFileCreateCommand(targetPath)
+                );
+                if (result && result.error) {
+                    sendJson(res, 400, { error: result.error });
+                    return;
+                }
+                sendJson(res, 200, result);
+            }
+        },
         {
             method: 'GET',
             match: currentPath => currentPath.match(/^\/api\/sessions\/([^/]+)\/detail$/),

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@xcanwin/manyoyo",
-    "version": "6.2.15",
+    "version": "6.2.19",
     "imageVersion": "1.9.1-common",
     "playwrightCliVersion": "0.1.18",
     "description": "AI Agent CLI Security Sandbox for Docker and Podman",