@yeaft/webchat-agent 1.0.542 → 1.0.544

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yeaft/webchat-agent",
-  "version": "1.0.542",
+  "version": "1.0.544",
   "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
   "main": "index.js",
   "type": "module",

package/workbench/file-reference-resolver.js

@@ -6,10 +6,19 @@ import { resolveAndValidatePath } from './utils.js';
 import { sendWorkbenchResult } from './request-routing.js';
 
 const MAX_REFERENCES = 32;
+const MAX_REFERENCE_LENGTH = 4096;
 const MAX_SCANNED_ENTRIES = 5000;
 const MAX_DEPTH = 10;
+const URI_SCHEME = /^[A-Za-z][A-Za-z\d+.-]*:/;
+const WINDOWS_ABSOLUTE_PATH = /^[A-Za-z]:[\\/]/;
 const SKIP_DIRS = new Set(['.git', 'node_modules', '__pycache__', '.next', '.nuxt', 'dist', 'build', '.cache', 'bin', 'obj']);
 
+function isFilesystemReference(value) {
+  return value.length <= MAX_REFERENCE_LENGTH
+    && !value.includes('\0')
+    && (!URI_SCHEME.test(value) || WINDOWS_ABSOLUTE_PATH.test(value));
+}
+
 function comparable(value) {
   const normalized = String(value || '').replaceAll('\\', '/');
   return platform() === 'win32' ? normalized.toLowerCase() : normalized;
@@ -79,21 +88,22 @@ async function findUniqueBasenames(workDir, requestedPaths, {
 export async function resolveFileReferences(references, workDir, scanOptions) {
   const unique = [...new Set((Array.isArray(references) ? references : [])
     .map(value => typeof value === 'string' ? value.trim() : '')
-    .filter(Boolean))].slice(0, MAX_REFERENCES);
+    .filter(value => value && isFilesystemReference(value)))].slice(0, MAX_REFERENCES);
   const root = resolve(workDir);
   const canonicalRoot = await realpath(root);
   const exactCandidates = unique.map(requestedPath => resolveAndValidatePath(requestedPath, root));
   const exactMatches = await Promise.all(exactCandidates.map(exactPath => (
     canonicalWorkspaceFile(exactPath, canonicalRoot)
   )));
-  const unresolved = unique.filter((_path, index) => (
-    !exactMatches[index] && isInsideWorkspace(root, exactCandidates[index])
+  const fallbackEligible = exactCandidates.map((exactPath, index) => (
+    !exactMatches[index] && isInsideWorkspace(root, exactPath)
   ));
+  const unresolved = unique.filter((_path, index) => fallbackEligible[index]);
   const basenameScan = await findUniqueBasenames(root, unresolved, scanOptions);
 
   const resolvedEntries = await Promise.all(unique.map(async (requestedPath, index) => {
     const matches = basenameScan.matches.get(comparable(basename(requestedPath))) || [];
-    const fallbackPath = basenameScan.complete && matches.length === 1
+    const fallbackPath = fallbackEligible[index] && basenameScan.complete && matches.length === 1
       ? await canonicalWorkspaceFile(matches[0], canonicalRoot)
       : null;
     const matchedPath = exactMatches[index] || fallbackPath;