@yeaft/webchat-agent 1.0.545 → 1.0.547

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/local-runtime/version.json +1 -1
  2. package/local-runtime/web/app.bundle.js +96 -96
  3. package/local-runtime/web/app.bundle.js.gz +0 -0
  4. package/local-runtime/web/index.html +1 -1
  5. package/package.json +1 -1
  6. package/workbench/file-ops.js +16 -3
package/local-runtime/web/app.bundle.js.gz CHANGED
Binary file
package/local-runtime/web/index.html CHANGED
@@ -17,6 +17,6 @@
17
17
  </head>
18
18
  <body>
19
19
  <div id="app"></div>
20
- <script type="module" src="app.bundle.js?v=a73be11c"></script>
20
+ <script type="module" src="app.bundle.js?v=3683bc0c"></script>
21
21
  </body>
22
22
  </html>
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@yeaft/webchat-agent",
3
- "version": "1.0.545",
3
+ "version": "1.0.547",
4
4
  "description": "Remote worker agent for Yeaft Web Code Agent — connects the native Yeaft engine, CLI providers, and workbench tools",
5
5
  "main": "index.js",
6
6
  "type": "module",
package/workbench/file-ops.js CHANGED
@@ -10,14 +10,27 @@ export const MAX_WORKBENCH_PREVIEW_BYTES = 20 * 1024 * 1024;
10
10
  export const WORKBENCH_FILE_CHUNK_BYTES = 1024 * 1024;
11
11
  export const WORKBENCH_VIDEO_CHUNK_BYTES = 1024 * 1024;
12
12
 
13
- async function validateResponseImagePath(filePath, workDir) {
13
+ async function canonicalWorkspaceReadPath(filePath, workDir, errorMessage = 'File is outside the active workspace.') {
14
14
  const canonicalRoot = await realpath(resolve(workDir));
15
15
  const canonicalFile = await realpath(resolveAndValidatePath(filePath, canonicalRoot));
16
16
  const relativePath = relative(canonicalRoot, canonicalFile);
17
17
  const outside = relativePath === '..'
18
18
  || relativePath.startsWith(`..${platform() === 'win32' ? '\\' : '/'}`)
19
19
  || isAbsolute(relativePath);
20
- if (outside) throw new Error('Response image is outside the active workspace.');
20
+ if (outside) {
21
+ const error = new Error(errorMessage);
22
+ error.code = 'FILE_OUTSIDE_WORKSPACE';
23
+ throw error;
24
+ }
25
+ return canonicalFile;
26
+ }
27
+
28
+ async function validateResponseImagePath(filePath, workDir) {
29
+ const canonicalFile = await canonicalWorkspaceReadPath(
30
+ filePath,
31
+ workDir,
32
+ 'Response image is outside the active workspace.',
33
+ );
21
34
  const mimeType = BINARY_EXTENSIONS[extname(canonicalFile).toLowerCase()];
22
35
  if (!mimeType?.startsWith('image/')) throw new Error('Response preview only supports image files.');
23
36
  return canonicalFile;
@@ -169,7 +182,7 @@ export async function handleReadFile(msg) {
169
182
  try {
170
183
  const resolved = msg.responseImagePreview
171
184
  ? await validateResponseImagePath(filePath, workDir)
172
- : resolveAndValidatePath(filePath, workDir);
185
+ : await canonicalWorkspaceReadPath(filePath, workDir);
173
186
  const ext = extname(resolved).toLowerCase();
174
187
  if (VIDEO_EXTENSIONS[ext]) {
175
188
  const error = new Error('Video files require the Workbench streaming protocol.');